KR20210132545A - Apparatus and method for detecting abnormal behavior and system having the same - Google Patents

Abstract

According to one embodiment of the present invention, an abnormal behavior detection apparatus includes: an information collection part configured to collect information of a current process and information of a parent process of the current process when requested to collect information about the current process; an identification information generation part configured to generate process identification information about the current process based on the information collected by the information collection part; a learning part configured to generate relation information between the current process and the parent process, based on the process identification information generated by the identification information generation part and the information of the parent process collected by the information collection part; a storage part configured to store a plurality of learning results which are pre-learned by the learning part; and a control part configured to request the information collection part to collect the information about the current process when requested to execute the current process, and check whether the plurality of learning results stored in the storage part include the relation information learned by the learning part, and then, stop the execution of the current process based on a result of the checking operation. Therefore, the present invention is capable of preventing access to an abnormal network such as a malicious website or the like.

Description

Abnormal behavior detection device, method, and system including the same

The present invention relates to an apparatus, method, and system for detecting abnormal behavior, and to a system including the same, and to an apparatus, method, and system including the same for blocking execution of an abnormal process or access to an abnormal network.

A malicious program is a generic name for executable code written for malicious purposes, also called malware, malicious software, or malicious code. ), worm virus, and Trojan horse.

In addition, spyware similar to a malicious program is software that infiltrates other people's computers and extracts personal information, and the number of abuse cases is increasing recently.

These malicious programs can cause damage such as network traffic generation, system performance degradation, file deletion, and personal information leakage, and the symptoms and dissemination methods caused by malicious programs are becoming increasingly complex and intelligent.

Patent Document 1 relates to a malicious program detection apparatus and method for detecting such a malicious program. Patent Document 1 discloses a configuration for detecting a malicious program by determining whether the executable file is a malicious program based on the characteristics that the malicious program may have through header analysis of the executable file (PE file).

However, a method of detecting a malicious program using bytes of a specific code section such as a header has a problem in that it is possible to determine whether a malicious program is a malicious program only when code information about the malicious program is known in advance. That is, Patent Document 1 has difficulty in detecting new malicious codes and variant malicious codes.

KR 10-0942795 B1

In order to block the execution of an abnormal process (malicious program), the present invention checks whether a process to be executed has a history generated from a parent process and determines the reputation of the process itself, such as a new malicious program or a variant malicious program. It relates to an abnormal behavior detection device and method capable of blocking the execution itself, and a system including the same.

In addition, in order to block access to an abnormal network, the present invention checks whether there is a history of accessing from a process to a network or a history of accessing a network from a process, and judging the reputation of the network itself. It relates to an abnormal behavior detection apparatus and method capable of blocking access to an abnormal network itself, and a system including the same.

Other objects and advantages of the present invention may be understood by the following description, and will become more clearly understood by the examples of the present invention. In addition, it will be readily apparent that the objects and advantages of the present invention can be realized by means and combinations thereof indicated in the claims.

An apparatus for detecting abnormal behavior according to an aspect of the present invention includes: an information collection unit configured to collect information on the current process and information on a parent process of the current process when a request for collection of information on the current process is received; an identification information generation unit configured to generate process identification information for the current process based on the information collected by the information collection unit; a learning unit configured to generate relationship information about the current process and the parent process based on the process identification information generated by the identification information generating unit and the information of the parent process collected by the information collecting unit; a storage unit configured to store a plurality of learning results previously learned by the learning unit; and when a process execution for the current process is requested, the information collection unit is requested to collect information on the current process, and the plurality of learning results stored in the storage unit includes the relationship information learned by the learning unit. may include a control unit configured to check and block execution of the current process based on a result of the verification.

The information collection unit is configured to collect information of the current process including the ID of the current process, the creation time of the current process, and user terminal information, and collect information of the parent process including the ID of the parent process can be

The identification information generator may be configured to generate process identification information for the current process based on an ID of the current process, a creation time of the current process, and the user terminal information.

The learning unit receives the process identification information and the parent process information generated by the identification information generation unit as input, and uses a combined value of the process identification information and the parent process information based on machine learning as the learned relationship information It may be configured to output as

The learned relationship information may include a hash value in which the process identification information and information of the parent process are combined.

When the learned relationship information is included in the plurality of learning results stored in the storage unit, the controller may determine the current process as a normal process and execute the current process.

When the learned relationship information is not included in the plurality of learning results stored in the storage unit, the controller determines that the current process is an abnormal process and blocks execution of the current process.

The controller may be configured to store, in the storage unit, process identification information for the current process as blocking information, when it is determined that the current process is the abnormal process.

The control unit may be configured to, if it is determined that the current process is the abnormal process, search for a reputation of the current process before blocking the execution of the current process, and block the execution of the current process based on the search result .

When the current process is determined as the normal process, the controller controls the information collection unit to collect log information of the current process, and stores log information of the current process collected by the information collection unit in the storage unit and outputting log information on a process that is a target of the log output request among a plurality of log information stored in the storage unit when a log output request is input.

An anomaly detection apparatus according to another aspect of the present invention includes: an information collection unit configured to collect information on a current process and information on a network when a request for collection of information on a network is received; an identification information generation unit configured to generate process identification information for the current process based on the information collected by the information collection unit; a learning unit configured to generate relationship information between the current process and the information of the network, based on the process identification information generated by the identification information generating unit and the network information collected by the information collecting unit; a storage unit configured to store a plurality of learning results previously learned by the learning unit; and when access to the network from the current process or access to the current process from the network is requested, the information collection unit requests the information collection unit to collect information on the network, and the learning is performed based on a plurality of learning results stored in the storage unit. It may include a control unit configured to check whether the relationship information learned by the unit is included, and to block access to the network based on the verification result.

The learning unit receives the process identification information and the network information generated by the identification information generation unit, and outputs a value obtained by combining the process identification information and the network information based on machine learning as the learned relationship information can be configured to

When the access is requested, the control unit determines whether the current process is a normal process based on information on the current process and a parent process of the current process, and if the current process is determined to be a normal process, sends the information collection unit It may be configured to request collection of information about the network.

An abnormal behavior detection system according to another aspect of the present invention includes a user terminal group including a user terminal equipped with an abnormal behavior detection apparatus according to the present invention; and a central server configured to be wirelessly or wiredly connected to a user terminal included in the user terminal group.

When the central server receives the learning result stored in the storage unit from the user terminal included in the user terminal group, the central server stores the received learning result, and provides the received learning result to all user terminals belonging to the user terminal group. It can be configured to distribute.

The user terminal may be configured to selectively store the learning results not stored in the storage unit among the learning results distributed by the central server.

An abnormal behavior detection method according to another aspect of the present invention comprises: an information collecting step of collecting information on the current process and a parent process of the current process when a process execution for the current process is requested; a relationship information generation step of generating relationship information on the current process and the parent process based on the information on the current process and the information on the parent process collected in the information collection step; a relationship information checking step of checking whether the relationship information generated in the relationship information generation step is included in the pre-stored learning result; and a blocking step of blocking execution of the current process based on a result of the checking of the relationship information checking step.

The blocking step may include a reputation search step of searching for a reputation for the current process when the generated relationship information is not included in the pre-stored learning result; and a process execution blocking step of blocking execution of the current process based on the reputation of the current process found in the reputation search step.

In an abnormal behavior detection method according to another aspect of the present invention, when an access request from a current process to a network or an access request from the network to the current process is requested, the information collecting step of collecting information about the current process and the network ; a relationship information generation step of generating relationship information about the current process and the network based on the information on the current process and the information on the network collected in the information collection step; a relationship information checking step of checking whether the relationship information generated in the relationship information generation step is included in the pre-stored learning result; and a blocking step of blocking access to and from the network based on a result of the checking of the relationship information checking step.

The blocking step may include a reputation search step of searching for a reputation for the network when the generated relationship information is not included in the pre-stored learning result; and a network access blocking step of blocking access to the network based on the reputation of the network discovered in the reputation search step.

According to one aspect of the present invention, since the execution of the abnormal process is blocked based on the relationship information between the abnormal process and the parent process, rather than based on a specific code included in the abnormal process such as a malicious program, a new or variant malicious program, etc. Even if it is an abnormal process, it has the advantage that it can be easily blocked.

In addition, according to an aspect of the present invention, the network does not block network access based only on information of the network, such as an IP address, but also considers information on a process related to the network, such as a process to access the network or a process to access the network. It can be determined whether the network is abnormal. Accordingly, there is an advantage that access to an abnormal network such as a new harmful site can be easily blocked.

In addition, according to one aspect of the present invention, since the reputation of the process and/or network is searched and secondarily whether the process and/or network is abnormal is determined in consideration of this, the execution of the abnormal process and the connection of the abnormal network are blocked. There is an advantage in that the accuracy and reliability of the

The following drawings attached to the present specification illustrate preferred embodiments of the present invention, and serve to further understand the technical spirit of the present invention together with the detailed description of the present invention to be described later, so the present invention is a matter described in such drawings should not be construed as being limited only to
1 is a diagram schematically illustrating an apparatus for detecting an abnormal behavior according to an embodiment of the present invention.
2 is a diagram schematically illustrating an abnormal behavior detection system according to another embodiment of the present invention.
3 is a diagram schematically illustrating an embodiment for blocking execution of an abnormal process in a method for detecting an abnormal behavior according to another embodiment of the present invention.
4 is a diagram schematically illustrating an embodiment for blocking access to an abnormal network in a method for detecting an abnormal behavior according to another embodiment of the present invention.
5 and 6 are diagrams schematically illustrating another embodiment for blocking access to an abnormal network in a method for detecting an anomaly according to another embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, the terms or words used in the present specification and claims should not be construed as being limited to their ordinary or dictionary meanings, and the inventor should properly understand the concept of the term in order to best describe his invention. Based on the principle that can be defined, it should be interpreted as meaning and concept consistent with the technical idea of the present invention.

Therefore, the configuration shown in the embodiments and drawings described in the present specification is only the most preferred embodiment of the present invention and does not represent all of the technical spirit of the present invention, so at the time of the present application, various It should be understood that there may be equivalents and variations.

In addition, in the description of the present invention, if it is determined that a detailed description of a related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

Terms including an ordinal number such as 1st, 2nd, etc. are used for the purpose of distinguishing any one of various components from the others, and are not used to limit the components by such terms.

Throughout the specification, when a part "includes" a certain element, it means that other elements may be further included, rather than excluding other elements, unless otherwise stated. In addition, a term such as a control unit described in the specification means a unit for processing at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software.

In addition, throughout the specification, when a part is "connected" with another part, it is not only "directly connected" but also "indirectly connected" with another element interposed therebetween. include

1 is a diagram schematically illustrating an anomaly detection apparatus 100 according to an embodiment of the present invention.

Referring to FIG. 1 , it may include an information collection unit 110 , an identification information generation unit 120 , a learning unit 130 , a storage unit 140 , and a control unit 150 . Here, the control unit 150 may be connected to the information collection unit 110 , the identification information generation unit 120 , the learning unit 130 , and the storage unit 140 to control each of them.

The information collection unit 110 may be configured to collect information on the current process and information on a parent process of the current process when an information collection request for the current process is input. Here, the information collection unit 110 may have access to computer resource information. Preferably, the information collection unit 110 may have a read right for computer resource information.

The information collection unit 110 may collect information on the current process as well as information on the parent process of the current process, even if information collection on the current process is requested, based on the access right to the computer resource information.

A process means a running program or task, and a child process may be created by a parent process. Accordingly, the current process described in an embodiment of the present invention refers to a process that is a request target for information collection and is currently running. And, the parent process means a process that created the current process. Accordingly, the information collection unit 110 may access log data to collect information on the parent process of the current process as well as information on the current process.

The identification information generating unit 120 may be configured to generate process identification information for the current process based on the information collected by the information collecting unit 110 . Here, the identification information is identification information for specifying the current process, and means identification information for distinguishing the current process from other processes.

Preferably, the identification information generating unit 120 may generate process identification information for the current process that can specify the current process by using the ID of the current process collected by the information collecting unit 110 .

For example, it is assumed that process A is created by process X and process Y, respectively, and process X is a process different from process Y. In this case, process X and process Y are each a parent process of process A. The process identification information generated by the identification information generating unit 120 may be information for identifying whether the process A is a process generated by the X process or the Y process. Accordingly, when generating the process identification information, the identification information generating unit 120 may generate process identification information for the current process based on unique pieces of information that can specify the current process.

Based on the process identification information generated by the identification information generation unit 120 and the parent process information collected by the information collection unit 110, the learning unit 130 is configured to configure the relationship between the current process and the parent process. may be configured to generate information.

Preferably, the learning unit 130 may learn and generate the relationship information by combining information on the current process and the parent process that has executed the current process.

For example, as in the previous example, it is assumed that process A is created by process X and process Y, respectively, process X is a different process from process Y, and only process A created by process X is currently running. The learning unit 130 may learn relationship information between process A and process X based on process identification information on process A and information on process X. That is, the learning unit 130 may specify the current process and the parent process to be learned by learning based on the information of the current process and the information of the parent process, rather than learning based only on the information of the current process.

The storage unit 140 may be configured to store a plurality of learning results previously learned by the learning unit 130 . Here, the learning result previously learned by the learning unit 130 is relation information between processes learned by the learning unit 130 , and relation information between normal processes may be stored.

For example, it is assumed that the current process is the A process, the parent process of the current process is the PA process, and both the A process and the PA process are determined to be normal processes. In this case, pre-learned relationship information for the PA process and the P process may be stored in the storage unit 140 .

That is, the learning result stored in the storage unit 140 is relationship information between normal processes, and is information that can be compared between the current process learned by the learning unit 130 and the relationship information on the parent process. For example, if the learning result stored in the storage 140 includes relationship information on the current process learned by the learning unit 130 and the parent process, the current process may be determined as a normal process. Conversely, if the learning result stored in the storage 140 does not include relationship information between the current process learned by the learning unit 130 and the parent process, the current process may be determined to be an abnormal process.

The storage unit 140 includes data, commands, and software required for the overall operation of the control unit 150 , as well as relationship information learned by the learning unit 130 and process information collected by the information collection unit 110 . can be saved.

For example, the storage unit 140 may include a flash memory type, a hard disk type, a solid state disk type (SSD), a silicon disk drive type (SDD), and a multimedia card micro type (multimedia). card micro type), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM) ) may include at least one type of storage medium.

The controller 150 may be configured to request the information collection unit 110 to collect information on the current process when a process execution for the current process is requested.

For example, the control unit 150 is a processor that is connected to the information collection unit 110 , the identification information generation unit 120 , the learning unit 130 , and the storage unit 140 to exchange data with each other. The controller 150 is hardware, ASICs (application specific integrated circuits), DSPs (digital signal processors), DSPDs (digital signal processing devices), PLDs (programmable logic devices), FPGAs (field programmable gate arrays), microprocessors ( microprocessors) and may be implemented using at least one of electrical units for performing other functions.

When receiving a process execution request according to a user, another process, and/or external access, the control unit 150 may request the information collection unit 110 to collect information on a process to be executed. Here, the process targeted for information collection is the current process targeted for execution.

For example, when the controller 150 receives the execution request for the process A, the controller 150 may request the information collection unit 110 to collect information on the process A. The information collection unit 110 may collect information of process A and information of a parent processor of process A.

Also, the controller 150 may check whether the learned relationship information is included in the plurality of learning results stored in the storage 140 .

For example, as in the previous embodiment, it is assumed that the current process is the A process and the parent process of the current process is the PA process. The controller 150 may first check whether the learning result for the PA process is stored in the learning result stored in the storage unit 140 . When the learning result for the PA process is stored in the storage unit 140 , the control unit 150 determines whether the relationship information between the process A and the PA process learned in the learning unit 130 is stored in the storage unit 140 . can be checked. That is, the controller 150 may check whether the PA process has a history of generating the A process.

The control unit 150 may be configured to block execution of the current process based on a result of the check.

For example, in the previous embodiment, when the PA process has a history of generating the A process, the learning result stored in the storage 140 may include relationship information between the A process and the PA process. Accordingly, if the learning result stored in the storage unit 140 includes relationship information on the A process and the PA process, the controller 150 may determine that the A process is a normal process.

Conversely, if the learning result stored in the storage unit 140 does not include relationship information on the A process and the PA process, the controller 150 may determine that the A process is an abnormal process. In addition, the controller 150 may block the execution of the process A determined to be an abnormal process.

For example, execution blocking of a process may be divided into execution blocking based on the path of the process and execution blocking of the process itself. Here, in the case of blocking execution based on the path of the process, if the path of the process is changed, there may be a problem in that execution blocking for the corresponding process is not accurately performed. Accordingly, the controller 150 blocks the execution of the current process based on the learning result stored in the storage 140 , thereby blocking the execution of the process even if the path of the current process is changed.

Accordingly, the abnormal behavior detection apparatus 100 according to an embodiment of the present invention may block execution of malicious programs such as malware and malicious code by blocking the execution of an abnormal process in advance. Accordingly, there is an advantage that problems such as personal information leakage and system damage due to an abnormal process can be prevented in advance.

The information collection unit 110 may collect information on the current process including a Process Identifier (PID) of the current process, a creation time of the current process, and user terminal information. Here, the user terminal may include a personal computer (PC), a tablet PC, a smart phone, etc. in which the process is executed.

Since the information collection unit 110 has access to computer resource information, when it receives a request for information collection from the control unit 150, it collects the ID of the current process that is the request for information collection, the generation time of the current process, and user terminal information. can do.

Also, the information collection unit 110 may be configured to collect information on the parent process including a Parent Process Identifier (PPID) of the parent process. Here, the parent process is a process that generated the current process, and the information collection unit 110 may further collect the ID of the parent process together with the ID of the current process, the generation time of the current process, and user terminal information.

For example, the information collection unit 110 may collect the ID of the current process, the generation time of the current process, the unique number of the user terminal, such as a MAC (Media Access Control) address, and the ID of the parent process.

The identification information generating unit 120 may be configured to generate process identification information for the current process based on the ID of the current process, the generation time of the current process, and the user terminal information.

The process identification information is information for specifying a current process. Accordingly, the identification information generating unit 120 may generate process identification information by combining the ID of the current process for specifying the current process, the generation time of the current process, and user terminal information.

Here, the process ID is a process identifier and is a number used by the operating system kernel. That is, the process may be temporarily identified through the process ID. For example, the process ID of process X is 1000, but after rebooting the computer, the process ID of process X may be changed to 1100. Therefore, there is a problem that the process cannot be specified only by the process ID. Also, since the process creation time is not a unique value for one process, it is difficult to use it as single information for specifying the process. For example, since a plurality of processes generated at the same time have the same process creation time, there is a problem in that the process cannot be specified only by the process creation time.

As such, in order to solve the difficulty of identifying a process based on single information, the identification information generating unit 120 may generate identification information for the current process by combining the ID of the current process, the generation time of the current process, and user terminal information. have. Accordingly, the process identification information generated by the identification information generating unit 120 may be unique identification information that can specify the current process. However, in an embodiment of the present invention, an example in which process identification information is generated based on a process ID, a process creation time, and user terminal information is described, but factors used to generate the process identification information are not limited. That is, any combination of information capable of generating process identification information capable of identifying a corresponding process may be applied without limitation.

The abnormal behavior detection apparatus 100 according to an embodiment of the present invention may generate process identification information for specifying a current process by utilizing information such as a process ID, a process creation time, and a user terminal. Accordingly, since the determination of whether the current process itself is an abnormal process is made, there is an advantage that the determination result of the current process can be maintained even if the path of the current process is changed.

The learning unit 130 may be configured to receive the process identification information generated by the identification information generation unit 120 and information on the parent process. That is, the learning unit 130 may learn relationship information between the current process and the parent process based on the process identification information and the parent process information.

In this case, since the learning unit 130 uses the process identification information that can specify the current process, even if the path of the current process is changed, the corresponding relationship between the current process and the parent process during learning may be maintained.

For example, it is assumed that the current process is an X process and the parent process is a PX process. Even if the path of the X process is changed for any reason, the process identification information for the X process may not be changed. Accordingly, even if the path of the X process is changed, the relationship information between the X process and the PX process may be maintained.

Also, the learning unit 130 may be configured to output a value obtained by combining the process identification information and the parent process information as the learned relationship information based on machine learning.

The learning unit 130 may use machine learning when combining the process identification information and the parent process information. Here, machine learning is one of the research fields of artificial intelligence, and refers to a technology that learns based on empirical data and improves its own performance. In general, machine learning can take the approach of building specific models to make predictions or decisions based on input data. In particular, since machine learning pre-processes and optimizes data to be learned using big data, the learning effect of big data using machine learning can be maximized.

For example, when the user terminal is a PC, a large number of processes are being executed while the PC is being used, and execution of a large number of processes may be requested. In this case, since the process for which information collection is requested by the control unit 150 may be a plurality of processes, the process information collected by the information collection unit 110 and the information of the parent process of the corresponding process may be large-scale big data. can

Therefore, the abnormal behavior detection apparatus 100 according to an embodiment of the present invention performs learning based on machine learning, and outputs the learned relationship information as a result, so that the vast amount of information collected by the information collection unit 110 is obtained. There is an advantage of efficiently learning and processing the information of the current process of the scale and the information of the parent process.

Preferably, the learned relationship information may include a hash value in which the process identification information and information of the parent process are combined. That is, the learning unit 130 may output a hash value in which the process identification information and the information of the parent process are combined as relationship information between the current process and the parent process.

For example, the learning unit 130 uses machine learning to generate one hash value for the input process identification information and information of the parent process, and output the generated hash value as relationship information between the current process and the parent process. can In this case, as a hash function algorithm for generating a hash value, an algorithm that cannot infer process identification information and information of a parent process from the generated hash value may be applied.

Accordingly, the abnormal behavior detection apparatus 100 according to an embodiment of the present invention provides unique relationship information (hash value) with respect to the ID of the current process constituting the process identification information, the creation time of the current process, and the user terminal information and the information of the parent process. ) can be created. Accordingly, there is an advantage that data integrity for the learning result can be guaranteed. In addition, since relationship information with guaranteed data integrity is stored as a learning result, and whether the current process is an abnormal process is determined based on the stored learning result, anomalies can be detected quickly and accurately for the same process. have.

When the learned relationship information is included in the plurality of learning results stored in the storage unit 140 , the controller 150 may determine the current process as a normal process and execute the current process.

Here, the learned relationship information is information learned by the learning unit 130 , and is relationship information based on process identification information for a current process and information on a parent process. Accordingly, when the learned relationship information is included in the storage 140 , it may mean that there is a history of a current process being generated by a parent process. In this case, the controller 150 may determine that the current process is a verified normal process, and execute the current process according to a response to the input request for execution of the current process.

Conversely, if the learned relationship information is not included in the plurality of learning results stored in the storage unit 140 , the controller 150 may determine the current process as an abnormal process and block execution of the current process.

When the learned relationship information is not included in the storage unit 140 , it may mean that there is no history of a current process being generated by a parent process. In this case, the controller 150 may determine that the current process is an abnormal process, and may block execution of the current process.

The abnormal behavior detection apparatus 100 according to an embodiment of the present invention may determine whether the current process is a normal process based on the integrity-guaranteed learning result stored in the storage unit 140 . Accordingly, there is an advantage in that normal/abnormal determination for the current process can be accurately made. In addition, since normal/abnormal determination is made for the current process depending on whether the parent process has a history of generating the current process, there is an advantage in that the determination can be made quickly.

When it is determined that the current process is the abnormal process, the control unit 150 may be configured to store process identification information on the current process as blocking information in the storage unit 140 .

The storage unit 140 may store not only the relationship information between the current process and the parent process output by the learning unit 130 , but also process identification information for the current process. However, preferably, the process identification information for the current process may be stored only when the controller 150 determines that the current process is an abnormal process.

That is, when the current process is a normal process, since the current process and the parent process are related between the child and the parent, the storage unit 140 may store relationship information between the current process and the parent process. On the other hand, when the current process is an abnormal process, process identification information for identifying the current process may be stored in the block list provided in the storage unit 140 .

That is, the abnormal behavior detection apparatus 100 according to an embodiment of the present invention may store process identification information for an abnormal process as a block list and provide the stored block list to the user or the outside. Accordingly, there is an advantage in that information on the abnormal process is disclosed, and damage to the user or a third party by the abnormal process can be prevented.

Also, for example, when the current process is a normal process, but is initially created, the relationship information with the parent process is not stored in the storage unit 140 , so it may be stored in the block list. In this case, the user may check the block list provided from the abnormal behavior detection apparatus 100 and subsequently release the block of the current process. Accordingly, the apparatus 100 for detecting anomalies according to an embodiment of the present invention has an advantage in that the post management of the process can be easily performed by providing a block list for the process.

When it is determined that the current process is the abnormal process, the control unit 150 may be configured to search the reputation of the current process before blocking execution of the current process.

When the relationship information between the current process and the parent process is not included in the learning result previously stored in the storage 140 , the controller 150 may determine the current process as an abnormal process. In this case, the controller 150 may search the reputation of the current process without immediately blocking the execution of the current process. For example, although the current process is a normal process, since there may be a case where relationship information between parent processes is not stored in the storage 140 after being first created in the user terminal, the controller 150 prevents the execution of the current process. You can explore the reputation of the current process before.

In this case, process reputation information in which a reputation for a process is recorded may be previously stored in the storage unit 140 . The process reputation information may be information downloaded from an external server and stored in the storage unit 140 . The controller 150 may access the process reputation information stored in the storage 140 to search for a reputation for the current process. Alternatively, the controller 150 may search for a reputation for a current process by directly accessing an external server capable of inquiring a reputation for a process.

The controller 150 may be configured to block execution of the current process based on the search result.

That is, as a result of the controller 150 searching for the reputation of the current process, if there is a history of registering the current process as an abnormal process, the controller 150 may block the execution of the current process.

For example, the reputation search result of the process may be divided into a normal process, a warning process, and an abnormal process. Here, the normal process is a process in which no malicious code or the like is detected, and may be a normal process. Although the warning process does not have a detected history of malicious code, etc., there is a possibility that some security problems may occur due to low access rights to the process, or it may be a process that uses excessive system resources. An abnormal process is a process with a history of detecting malicious code, etc., and may be an abnormal process requiring blocking. When the reputation search result of the current process is a normal process or a warning process, the controller 150 may determine that the current process is a normal process and execute it. Conversely, when the reputation search result of the current process is an abnormal process, the controller 150 may block execution of the current process.

Also, the controller 150 may provide a search result of the current process to the user. For example, when the reputation search result of the current process is a warning process, the controller 150 may provide information that the current process is a warning process to the user while executing the current process. In this case, the user may prevent a security problem or excessive use of system resources by terminating the current process based on the provided information.

As another example, the reputation search result of the process may be divided into steps 1 to 10. In this case, the closer the reputation search result of the process is to step 1, the more likely it is to be a normal process, and the closer to step 10, the more likely it is to be an abnormal process. As in the previous example, the controller 150 may provide a search result of the current process to the user. The user may determine whether to block the current process based on the search result of the current process provided from the controller 150 .

That is, the abnormal behavior detection apparatus 100 according to an embodiment of the present invention may primarily determine whether the current process is an abnormal process based on relationship information between the current process and the parent process. Then, by searching the reputation of the current process, it is possible to determine whether the current process is an abnormal process secondarily. Accordingly, since whether the current process is an abnormal process is determined from various aspects, there is an advantage in that the reliability of the judgment of the current process can be improved.

The controller 150 may be configured to control the information collection unit 110 to collect log information of the current process when it is determined that the current process is the normal process.

That is, the controller 150 may control the information collection unit 110 to collect log information of the current process only when it is determined that the current process is a normal process.

Also, the control unit 150 may be configured to store log information of the current process collected by the information collection unit 110 in the storage unit 140 .

For example, when it is determined that the current process is a normal process, the control unit 150 may store log information of the current process collected by the information collection unit 110 in the storage unit 140 .

Conversely, when it is determined that the current process is an abnormal process, the control unit 150 may store process identification information on the current process in the block list provided in the storage unit 140 .

Also, when a log output request is input, the controller 150 may be configured to output log information about a process that is a target of the log output request among a plurality of log information stored in the storage 140 .

For example, when a log output request for a normal process is input, the controller 150 may output log information about the corresponding process stored in the storage 140 . In this case, the user may be provided with information such as process creation or execution by checking log information of the process.

The abnormal behavior detection apparatus 100 according to an embodiment of the present invention may provide process log information so that the process can be managed post-mortem. That is, the apparatus 100 for detecting anomaly according to an embodiment of the present invention has the advantage of providing log information to the process, so that the post management of the process can be easily performed.

Hereinafter, as the abnormal behavior detection apparatus 100 according to another embodiment of the present invention, an apparatus for detecting an abnormal behavior in a network connection will be described. As described above, the abnormal behavior detection apparatus 100 may detect the abnormal behavior of the current process and block the execution of the current process, and may detect the abnormal behavior of the network connection in parallel thereto. A network to be described below may mean an IP address of a remote location that has attempted to access a process or an IP address of a remote location that a process wants to access. That is, hereinafter, “network” may be used as a word meaning a network IP address related to the current process.

For convenience of explanation, a part different from the description of the abnormal behavior detection apparatus 100 according to an embodiment of the present invention described above will be described in detail.

The information collection unit 110 may be configured to collect information on a current process and information on a network when receiving a request to collect information on the network.

Here, the current process may be a process to access the information collection requested network or a process to be executed through the information collection requested network.

For example, when process A attempts to access the N network, the information collection unit 110 may be requested to collect information on the N network. In addition, the information collection unit 110 may collect information of process A and information of network N. The information of the N network collected here may be an IP address (Internet protocol address) of the N network.

The identification information generating unit 120 may be configured to generate process identification information for the current process based on the information collected by the information collecting unit 110 .

Here, the process identification information for the current process is identification information for specifying the current process, and may be generated by a combination of a process ID, a process creation time, and user terminal information.

Based on the process identification information generated by the identification information generating unit 120 and the network information collected by the information collecting unit 110 , the learning unit 130 provides relation information between the current process and the information of the network. can be configured to generate for

As described above, the learning unit 130 may learn relationship information between process identification information and network information based on machine learning, and may output the learned relationship information.

The storage unit 140 may be configured to store a plurality of learning results previously learned by the learning unit 130 . Here, the learning result stored in the storage unit 140 may be relationship information between a process determined as a normal process and a network determined as a normal network.

For example, the learning result stored in the storage unit 140 may be stored as a hash value. That is, the relationship information output from the learning unit 130 may be a hash value, and the hash value may be stored in the storage unit 140 .

The control unit 150 may be configured to request the information collection unit 110 to collect information on the network when a connection request from the current process to the network or a connection to the current process from the network is requested.

Then, the control unit 150 checks whether the relationship information learned by the learning unit 130 is included in the plurality of learning results stored in the storage unit 140 , and connects to the network based on the verification result can be configured to block.

That is, when the plurality of learning results stored in the storage unit 140 include the current process learned by the learning unit 130 and relationship information on the network, the control unit 150 determines that the network is a normal network and converts the network into a network. can allow access.

Conversely, if the plurality of learning results stored in the storage 140 do not include the relationship information on the network and the current process learned by the learning unit 130 , the controller 150 determines that the network is an abnormal network, You can block access to In this case, the controller 150 may block both access from the current process to the abnormal network and from the network to the current process.

When determining whether the network is normal or abnormal to allow network access, the abnormal behavior detection apparatus 100 according to another embodiment of the present invention may consider relationship information with a process. Accordingly, the abnormal behavior detection apparatus 100 has the advantage of being able to select the abnormal network with higher reliability and prevent various problems due to the connection of the abnormal network.

The learning unit 130 receives the process identification information and the network information generated by the identification information generation unit 120, and calculates a value obtained by combining the process identification information and the network information based on machine learning. It may be configured to output the learned relationship information.

That is, the abnormal behavior detection apparatus 100 according to another embodiment of the present invention may process big data using machine learning. In particular, the abnormal behavior detection apparatus 100 has an advantage in that it can more accurately determine whether the network is normal or abnormal because it learns the relationship information between the process identification information for which integrity is guaranteed and the information on the network.

When the access is requested, the controller 150 may determine whether the current process is a normal process based on information on the current process and a parent process of the current process.

For example, when an access from the current process to the network or access from the network to the current process is requested, the controller 150 may first determine whether the current process is normal. In this case, the control unit 150 may request the information collection unit 110 to collect information on the current process, and the information collection unit 110 may collect information on both the current process and the parent process of the current process.

According to an embodiment of the present invention, the process of determining whether the current process is a normal process based on the information of the current process and the information of the parent process has been described above, and thus will be omitted hereinafter.

Also, when the current process is determined to be a normal process, the controller 150 may be configured to request the information collection unit 110 to collect information on the network.

That is, the control unit 150 firstly determines whether the current process is a normal process, secondly determines whether relation information about the current process and the network is included in the pre-stored learning result, and thirdly determines the reputation of the network By determining , it is possible to block access to the abnormal network.

Therefore, the abnormal behavior detection apparatus 100 according to another embodiment of the present invention has the advantage of reducing the time required for determining whether the network is normal for allowing access to the network. In addition, since it is determined whether the network is normal after first determining whether the process is normal, there is an advantage in that the reliability of determining whether the network is normal can be improved.

2 is a diagram schematically illustrating an abnormal behavior detection system according to another embodiment of the present invention.

Referring to FIG. 2 , an abnormal behavior detection system according to another embodiment of the present invention may include a user terminal group 200 including user terminals 200a , 200b and 200c and a central server 300 .

In the embodiment shown in FIG. 2 , for convenience of explanation, an example in which the first user terminal 200a, the second user terminal 200b, and the third user terminal 200c are included in the user terminal group 200 is illustrated. Although illustrated, it should be noted that the number of user terminals that may be included in the user terminal group 200 is not limited.

The user terminal group 200 may include user terminals 200a, 200b, and 200c equipped with the abnormal behavior detection apparatus 100 according to an embodiment of the present invention. For example, as shown in FIG. 2 , the user terminal group 200 may include three user terminals 200a , 200b and 200c . In addition, each of the user terminals 200a, 200b, and 200c may include the abnormal behavior detection apparatus 100 .

The central server 300 may be configured to be connected to the user terminals 200a , 200b and 200c included in the user terminal group 200 wirelessly or by wire.

For example, the central server 300 may be an intranet server connected to the user terminal or an Internet server. In this case, the user terminal may be connected to the central server 300 by wire or wirelessly using WIFI, BLUETOOTH, or a communication network.

When receiving the learning result stored in the storage unit 140 from the user terminal included in the user terminal group 200, the central server 300 may store the received learning result.

Here, the storage unit 140 is included in the anomaly detection apparatus 100 provided in the user terminals 200a, 200b, and 200c, and includes relationship information between a current process and a parent process and/or a relationship between the current process and the network. It may be a memory unit in which information is stored.

In addition, the central server 300 may be configured to distribute the received learning result to all the user terminals 200a, 200b, and 200c belonging to the user terminal group 200 .

For example, in the embodiment of FIG. 2 , the central server 300 stores the first learning result and the second learning result stored in the storage unit 140 included in the first user terminal 200a from the first user terminal 200a. Assume that you have received The central server 300 stores the first learning result and the second learning result received from the first user terminal 200a, and stores the first learning result and the second learning result in the user terminal ( 200a, 200b and 200c). Preferably, the central server 300 provides only the second user terminal 200b and the third user terminal 200c among the user terminals 200a, 200b and 200c belonging to the user terminal group 200, the first learning result and the second Learning results can be distributed.

That is, the central server 300 may serve as a hub for sharing the learning results among the user terminals 200a , 200b and 200c belonging to the user terminal group 200 .

The user terminals 200a, 200b, and 200c may be configured to selectively store learning results not stored in the storage 140 among the learning results distributed by the central server 300 . That is, the user terminals 200a, 200b, and 200c may selectively store only new learning results without storing duplicate learning results.

For example, it is assumed that the first learning result transmitted by the first user terminal 200a to the central server 300 is a learning result on the connection relationship between process A (child process) and process a1 (parent process). The second user terminal 200b may receive the first learning result from the central server 300 . If the learning result for the connection relationship between process A and process a1 is not stored in the second user terminal 200b, the second user terminal 200b stores the first learning result received from the central server 300 can Preferably, the second user terminal 200b determines whether the first learning result (a hash value generated by the combination of the A process and the a1 process) is included in the learning results (hash values) stored in the storage unit 140 . can judge And, if the first learning result is not included in the storage unit 140 , the second user terminal 200b may store the first learning result in the storage unit 140 .

That is, the user terminals 200a , 200b , and 200c may receive and store information learned about processes and/or networks that are not directly determined through the central server 300 .

Therefore, the abnormal behavior detection system according to another embodiment of the present invention shares the learned information between the user terminals 200a, 200b, and 200c included in the user terminal group 200 with each other to detect malicious programs or malware. It has the advantage of being able to block abnormal networks such as abnormal processes and harmful sites in advance. Accordingly, there is an advantage in that the security of the process and network of the user terminals 200a , 200b and 200c included in the user terminal group 200 can be strengthened.

Hereinafter, an abnormal behavior detection method according to another embodiment of the present invention will be described. The abnormal behavior detection method according to another embodiment of the present invention may be performed by the abnormal behavior detection apparatus 100 according to an embodiment of the present invention.

3 is a diagram schematically illustrating an embodiment for blocking the execution of an abnormal process in the abnormal behavior detection method S100 according to another embodiment of the present invention.

Referring to FIG. 3 , the abnormal behavior detection method ( S100 ) according to another embodiment of the present invention includes an information collection step ( S110 ), a relationship information generation step ( S120 ), a relationship information confirmation step ( S130 ), and a blocking step ( S140 ). ) may be included.

The information collecting step S110 is a step of collecting information on the current process and a parent process of the current process when a process execution for the current process is requested, and may be performed by the information collecting unit 110 .

That is, when execution of the current process is requested from the controller 150 , the controller 150 may request the information collection unit 110 to collect information on the current process.

Since the information collection unit 110 has access to computer resource information, the information collection unit 110 collects information on the parent process of the current process as well as information on the current process that is the target of the information collection request. can be collected

The relationship information generation step (S120) is a step of generating relationship information about the current process and the parent process based on the information of the current process and the information of the parent process collected in the information collection step (S110). 130) can be carried out.

The learner 130 may generate relationship information about a current process and a parent process based on machine learning. Preferably, the learning unit 130 generates process identification information of the current process and relationship information on the parent process, and the process identification information is information that can identify the current process and is generated by the identification information generation unit 120 . can be

For example, the identification information generator 120 may generate the process identification information based on the process ID of the current process, the process creation time, and unique information of the user terminal. In addition, the learning unit 130 may input process identification information and parent process information into machine learning to learn and generate relationship information between the current process and the parent process. Here, as the information of the parent process, the ID of the parent process may be used.

The relationship information checking step ( S130 ) is a step of checking whether the relationship information generated in the relationship information generation step ( S120 ) is included in the pre-stored learning result, and may be performed by the controller 150 .

Here, the pre-stored learning result is relation information previously learned and generated by the learning unit 130 , and may be data stored in advance in the storage unit 140 .

Preferably, the learning result pre-stored in the storage 140 may be relationship information between a process determined as a normal process by the controller 150 and a parent process of the corresponding process.

For example, assume that the child process is a C process and the parent process is a PC process. As a result of the determination of the control unit 150 , if the C process is determined to be a normal process, the control unit 150 may store relationship information between the C process and the PC process generated by the learning unit 130 in the storage unit 140 . The relationship information between the C process and the PC process may be stored in the storage unit 140 as a learning result.

That is, the controller 150 may determine whether the current process is a normal process by checking whether the relationship information between the current process and the parent process is previously stored in the storage 140 .

Based on the result of the confirmation of the relationship information confirmation step ( S130 ), the blocking step ( S140 ) of blocking the execution of the current process may be performed by the controller 150 . For example, if the relationship information between the current process and the parent process is not included in the learning result previously stored in the storage 140 , the controller 150 may determine that the current process is an abnormal process. In this case, the controller 150 may block the execution of the current process.

Preferably, the blocking step may further include a reputation search step (S141), a process execution blocking step (S143), a relationship information storage step (S145), and a process execution step (S147).

The reputation search step ( S141 ) is a step of searching for a reputation for the current process when the generated relationship information is not included in the pre-stored learning result, and may be performed by the controller 150 .

For example, when the generated relationship information is not included in the pre-stored learning result, it may include a case in which the current process is first generated in the user terminal. In this case, the relationship information between the current process and the parent process is not included in the learning result previously stored in the storage 140 , but the current process may be a normal process. Accordingly, in this case, in order to prevent erroneously determining the current process as an abnormal process, the controller 150 may search for a reputation for the current process.

That is, in order to prevent erroneous judgment on the current process, the controller 150 may first compare the relationship information with the pre-stored learning result, and secondarily search the reputation of the current process.

The reputation of the current process may be determined as a normal process or an abnormal process, or may be further subdivided into a normal process, a warning process, or an abnormal process.

The process execution blocking step S143 is a step performed by the controller 150 when it is determined that the current process is an abnormal process as a result of the reputation search.

The controller 150 may block execution of the current process. In addition, the control unit 150 may store process identification information on the current process generated by the identification information generation unit 120 in the block list provided in the storage unit 140 .

The relationship information storage step ( S145 ) is a step performed by the controller 150 when it is determined that the current process is a normal process as a result of the reputation search. In the relation information storage step S145 , relation information between the current process and the parent process generated by the learning unit 130 may be stored in the storage unit 140 .

For example, the relation information storage step ( S145 ) may be performed for a normal process that was initially generated in the user terminal or does not have a learning result. That is, although the current process is a normal process, when the user terminal is first generated, the learning result for the current process may not be stored in the storage 140 . However, when it is determined that the current process is a normal process as a result of the reputation search for the current process, the controller 150 may store relationship information between the current process and the parent process in the storage 140 .

The process execution step S147 is a step of executing the current process determined to be a normal process, and may be performed by the controller 150 .

The process execution step ( S147 ) may be performed when the relationship information generated in the pre-stored learning result is included in the relationship information checking step ( S130 ) or after the relationship information storage step ( S145 ).

Additionally, the control unit 150 may control the information collection unit 110 to collect log information about the current process determined to be a normal process. In addition, log information collected by the information collection unit 110 may be stored in the storage unit 140 . Thereafter, when a request for outputting log information for a process is input, the controller 150 may output and provide log information of the corresponding process stored in the storage 140 .

The abnormal behavior detection method S100 according to another embodiment of the present invention primarily determines whether the current process is abnormal based on a pre-stored learning result, and secondarily determines whether the current process is abnormal based on the reputation of the current process. can judge Accordingly, since the abnormality of the process can be determined from more various aspects, there is an advantage in that the possibility of erroneous judgment on the process can be reduced.

4 is a diagram schematically illustrating an embodiment for blocking access to an abnormal network in the abnormal behavior detection method S200 according to another embodiment of the present invention.

Referring to FIG. 4 , the abnormal behavior detection method ( S200 ) according to another embodiment of the present invention includes an information collection step ( S210 ), a relationship information generation step ( S220 ), a relationship information confirmation step ( S230 ) and a blocking step ( S240 ). ) may be included.

The information collection step (S210) is a step of collecting information on the current process and the network when a connection request from the current process to the network or a connection to the current process from the network is requested. The information collection unit 110 can be performed by

Here, both cases in which the current process attempts to access the external network as well as cases in which the external network attempts to connect to the current process are included.

The information collected by the information collection unit 110 may include a process ID for a current process, a process creation time, user terminal information, and a network IP address.

The relationship information generation step (S220) is a step of generating relationship information about the current process and the network based on the information of the current process and the network information collected in the information collection step (S210), and the learning unit 130 can be performed in

The learner 130 may generate relationship information about the current process and the network based on machine learning. Preferably, the learning unit 130 may learn and generate process identification information of the current process and relationship information on the network.

The relationship information checking step ( S230 ) is a step of checking whether the relationship information generated in the relationship information generation step ( S220 ) is included in the pre-stored learning result, and may be performed by the controller 150 .

Here, the pre-stored learning result is relation information previously learned and generated by the learning unit 130 , and may be data stored in advance in the storage unit 140 . Preferably, the learning result pre-stored in the storage 140 may be relationship information between a process determined by the controller 150 to be a normal process and the network.

For example, it is assumed that the current process is process C, which is a normal process, and the IP address of the network is address X, which is a normal address. The X address may be the network IP address that the C process wants to access, or may be the network IP address that the C process wants to access. In both cases, the learning result pre-stored in the storage unit 140 may be relationship information between the C process identification information and the X address.

The control unit 150 may determine whether the network is a normal network by checking whether the relationship information between the current process and the network is previously stored in the storage unit 140 .

Based on the result of the confirmation of the relationship information confirmation step ( S230 ), the blocking step ( S240 ) of blocking the access to the network may be performed by the controller 150 . For example, if the relationship information between the current process and the network is not included in the learning result pre-stored in the storage unit 140 , the controller 150 may determine that the network is an abnormal network. In this case, the controller 150 may block both the access to the network and the access from the network.

Preferably, the blocking step may further include a reputation search step (S241), a network access block step (S243), a relationship information storage step (S245), and a network access step (S247).

The reputation search step ( S241 ) is a step of searching for a reputation for the network when the generated relationship information is not included in the pre-stored learning result, and may be performed by the controller 150 .

For example, when the generated relationship information is not included in the pre-stored learning result, when a current process is first created in the user terminal, when a first access to the network is attempted from the current process, and when the network returns to the current process This may include a case of trying to connect for the first time. In this case, the relationship information between the current process and the network is not included in the learning result pre-stored in the storage unit 140 , but the network may be a settlement network. Accordingly, in this case, in order to prevent a normal network from being incorrectly determined as an abnormal network, the controller 150 may search for a reputation for the network.

That is, in order to prevent an erroneous determination of a normal network, the controller 150 may first compare the relationship information with a pre-stored learning result, and secondarily search the reputation of the network.

The network access blocking step S243 is a step performed by the controller 150 when it is determined that the network to which the current process wants to access or the network to which the current process wants to access is an abnormal network as a result of the reputation search.

In this case, the controller 150 may block both the network access to the current process and the current process access to the network. In addition, the control unit 150 may store network information in a block list provided in the storage unit 140 . For example, the control unit 150 may store the IP address of the network in the block list provided in the storage unit 140 .

The relation information storage step ( S245 ) is a step performed by the controller 150 when it is determined that the network is a normal network as a result of the reputation search. In the relation information storage step ( S245 ), relation information between the current process and the network generated by the learning unit 130 may be stored in the storage unit 140 .

The network access step ( S247 ) is a step of allowing the access of the network to the current process and the access of the current process to the network, and may be performed by the controller 150 .

The network access step ( S247 ) may be performed even when the relationship information generated in the relationship information check step ( S230 ) is included in the pre-stored learning result.

The abnormal behavior detection method S200 according to another embodiment of the present invention primarily determines whether a network to be accessed in the current process or a network to be accessed in the current process is abnormal based on a pre-stored learning result, and the current process Whether the network is abnormal may be secondarily determined based on the reputation of . Accordingly, since the abnormality of the network can be determined from various aspects, there is an advantage in that the possibility of erroneous determination of the network state can be reduced.

5 and 6 are diagrams schematically illustrating another embodiment for blocking access to an abnormal network in the abnormal behavior detection method S300 according to another embodiment of the present invention. Hereinafter, for the convenience of explanation, a part different from the abnormal behavior detection method S200 described with reference to FIG. 4 will be mainly described.

The information collection step (S320), the information generation step (S330), the relationship information check step (S340), the reputation search step (S351), the network connection blocking step (S320) included in the abnormal behavior detection method (S300) of FIGS. 5 and 6 S353), the relationship information storage step (S355) and the network access step (S357) are the information collection step (S210), the information generation step (S220), and the relationship information confirmation step included in the abnormal behavior detection method (S200) of FIG. 4, respectively. (S230), the reputation search step (S241), the network connection blocking step (S243), the relationship information storage step (S245) and may be steps corresponding to the network access step (S247).

That is, the abnormal behavior detection method S300 illustrated in FIGS. 5 and 6 may further include a process determination step S310 in the abnormal behavior detection method S200 illustrated in FIG. 4 .

The process determination step ( S310 ) is a step of determining whether the current process is a normal process before the information collection step ( S320 ), and may be performed by the controller 150 .

Preferably, the process determination step S310 is a step of first determining whether the current process is a normal process before information on the current process and the network is collected by the information collecting unit 110 .

For example, when a network connection to the current process or a network connection from the current process is requested, the controller 150 may request the information collection unit 110 to collect information on the current process. In this case, the information collection unit 110 may collect information on both the current process and the parent process of the current process. Specifically, in the process determination step (S310), the information collection step (S110), the relationship information generation step (S120), the relationship information learning step (S130), the reputation search step (S100) of the abnormal behavior detection method (S100) shown in FIG. S141) and the relation information storage step (S145) may be performed.

If it is determined that the current process is an abnormal process, since the information collection step S320 is not performed, information on the network is not collected, and the network connection blocking step S353 may be performed.

Conversely, when it is determined that the current process is a normal process, the information collection step S320 of collecting information on the current process and the network may be performed.

The abnormal behavior detection method ( S300 ) according to another embodiment of the present invention primarily checks whether the current process is normal, secondly determines whether relation information about the current process and the network has been previously learned, and tertiarily It has the advantage of being able to block access to an abnormal network more accurately and reliably by searching for the reputation of the network.

The embodiment of the present invention described above is not implemented only through the apparatus and method, and may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium in which the program is recorded. The implementation can be easily implemented by those skilled in the art to which the present invention pertains from the description of the above-described embodiments.

In the above, although the present invention has been described with reference to limited embodiments and drawings, the present invention is not limited thereto and will be described below with the technical idea of the present invention by those of ordinary skill in the art to which the present invention pertains. Of course, various modifications and variations are possible within the scope of equivalents of the claims.

In addition, since the present invention described above can be various substitutions, modifications and changes within the scope that does not depart from the technical spirit of the present invention for those of ordinary skill in the art to which the present invention pertains, the above-described embodiments and attachments It is not limited by the illustrated drawings, and all or part of each embodiment may be selectively combined and configured so that various modifications may be made.

100: anomaly detection device
110: information collection unit
120: identification information generating unit
130: study unit
140: storage
150: control unit
200: user terminal group
300: central server

Claims (16)

an information collection unit configured to collect information on the current process and information on a parent process of the current process when receiving a request to collect information on the current process;
an identification information generation unit configured to generate process identification information for the current process based on the information collected by the information collection unit;
a learning unit configured to generate relationship information about the current process and the parent process based on the process identification information generated by the identification information generating unit and the information of the parent process collected by the information collecting unit;
a storage unit configured to store a plurality of learning results previously learned by the learning unit; and
When a process execution for the current process is requested, the information collection unit is requested to collect information on the current process, and it is determined whether the relationship information learned by the learning unit is included in the plurality of learning results stored in the storage unit. and a control unit configured to check and block execution of the current process based on a result of the confirmation.
According to claim 1,
The information collection unit,
and collecting information of the current process including the ID of the current process, the creation time of the current process and user terminal information, and collecting information of the parent process including the ID of the parent process,
The identification information generating unit,
and generating process identification information for the current process based on the ID of the current process, the generation time of the current process, and the user terminal information.
According to claim 1,
The learning unit,
configured to receive the process identification information and the parent process information generated by the identification information generating unit, and output a combined value of the process identification information and the parent process information as the learned relationship information based on machine learning Abnormal behavior detection device, characterized in that.
4. The method of claim 3,
The learned relationship information is,
and a hash value in which the process identification information and the parent process information are combined.
According to claim 1,
The control unit is
When the learned relationship information is included in the plurality of learning results stored in the storage unit, the current process is determined as a normal process, and the current process is executed,
and when the learned relationship information is not included in the plurality of learning results stored in the storage unit, the current process is determined as an abnormal process, and the execution of the current process is blocked.
6. The method of claim 5,
The control unit is
and when it is determined that the current process is the abnormal process, store process identification information on the current process as blocking information in the storage unit.
7. The method of claim 6,
The control unit is
When it is determined that the current process is the abnormal process, the reputation of the current process is searched before blocking the execution of the current process, and the execution of the current process is blocked based on the search result. Device.
6. The method of claim 5,
The control unit is
When the current process is determined to be the normal process,
control the information collection unit to collect log information of the current process, store log information of the current process collected by the information collection unit in the storage unit, and when a log output request is input, a plurality of Anomaly detection apparatus, characterized in that the log information is configured to output log information on a process that is a target of the log output request.
an information collection unit configured to collect information on a current process and information on a network when requested to collect information on the network;
an identification information generation unit configured to generate process identification information for the current process based on the information collected by the information collection unit;
a learning unit configured to generate relationship information between the current process and the information of the network, based on the process identification information generated by the identification information generating unit and the information of the network collected by the information collecting unit;
a storage unit configured to store a plurality of learning results previously learned by the learning unit; and
When access from the current process to the network or access from the network to the current process is requested, the information collection unit is requested to collect information on the network, and the learning unit records a plurality of learning results stored in the storage unit. and a control unit configured to check whether the relationship information learned by
10. The method of claim 9,
The learning unit,
and receiving the process identification information and the network information generated by the identification information generating unit, and outputting a combined value of the process identification information and the network information based on machine learning as the learned relationship information. an anomaly detection device.
10. The method of claim 9,
The control unit is
When the access is requested, it is determined whether the current process is a normal process based on information on the current process and a parent process of the current process. Anomaly detection device, characterized in that configured to request information collection.
A user terminal group including a user terminal equipped with an abnormal behavior detection device according to any one of claims 1 to 11; and
A central server configured to be connected to a user terminal included in the user terminal group wirelessly or by wire,
The central server,
When receiving the learning result stored in the storage unit from the user terminal included in the user terminal group, store the received learning result, and is configured to distribute the received learning result to all user terminals belonging to the user terminal group,
The user terminal is
Abnormal behavior detection system, characterized in that configured to selectively store the learning results not stored in the storage unit among the learning results distributed by the central server.
an information collecting step of collecting information on the current process and a parent process of the current process when a process execution for the current process is requested;
a relationship information generation step of generating relationship information on the current process and the parent process based on the information on the current process and the information on the parent process collected in the information collection step;
a relationship information checking step of checking whether the relationship information generated in the relationship information generation step is included in the pre-stored learning result; and
and a blocking step of blocking execution of the current process based on a result of the checking of the relationship information checking step.
14. The method of claim 13,
The blocking step is
a reputation search step of searching for a reputation for the current process when the generated relationship information is not included in the pre-stored learning result; and
and a process execution blocking step of blocking execution of the current process based on the reputation of the current process found in the reputation search step.
an information collection step of collecting information on the current process and the network when a connection request from the current process to the network or access to the current process from the network is requested;
a relationship information generation step of generating relationship information on the current process and the network based on the information on the current process and the information on the network collected in the information collection step;
a relationship information checking step of checking whether the relationship information generated in the relationship information generation step is included in the pre-stored learning result; and
and a blocking step of blocking access to and from the network based on a result of checking the relationship information check step.
16. The method of claim 15,
The blocking step is
a reputation search step of searching for a reputation for the network when the generated relationship information is not included in the pre-stored learning result; and
and a network access blocking step of blocking access to the network based on the reputation of the network discovered in the reputation search step.

Images