KR20220096155A - a method and apparatus for detecting and stopping a PC running malware attacking a file server - Google Patents

Abstract

The present invention relates to a method and apparatus for stopping a client PC connected to a file server when it is determined that a request for data from the connected client PC or server exceeds a pre-set value or is an abnormal pattern in a state that the file server storing important data provides a network drive to the PC or server.

Description

{a method and apparatus for detecting and stopping a PC running malware attacking a file server}

The present invention relates to a method and apparatus for protecting data in a file server, and more particularly, when a file server policy management unit acquires a file request event occurring in a file server and determines that the event is an attack, the PC that generates the file request It relates to a method and device for protecting data files in a file server that stops the server.

A ransomware attack that encrypts data or a phishing attack that leaks data to the outside usually induces user error and runs it on the PC. Encrypt data in transit or transmit data to an external network.

However, in the past, the trend of technology to prevent ransomware attacks that encrypt data or phishing attacks that steal data has mainly been the endpoint protection technology that is installed in the PC and detects abnormal behavior or the network protection that detects abnormal data packets in the network. . However, since this technology has to detect all disk and network I/O, audit resources are generated and the accuracy is low. There is a limit to the security effect because it tries to protect the data in the file server.

In the present invention, when the file server storing important data provides a network drive to the PC or server, and the data request coming from the connected client PC or server exceeds a preset value or is determined to be an abnormal pattern, the file server and We want to develop a method and device for stopping the connected client PC and server.

According to one aspect of the present invention, the file server policy unit acquires a file request event from a file server corresponding to a data request coming through a network drive of a connected client PC in real time to exceed a preset value or to a preset abnormal pattern. Provided are a method and an apparatus for issuing a command to stop a client PC and a server connected to a file server when it is determined.

In one embodiment, when the file server policy management unit acquires a file event from the file server, a function of stopping a connected PC or server corresponding to a user ID in the file server may be included.

In one embodiment, when it is suspected that the file server policy management unit is being attacked, it may send a command to stop the operation of the host without delay by sending an 'immediate shutdown' command to the corresponding PC or server.

In one embodiment, a function may be included to notify the administrator of which PC or server the attack was made by e-mail, text message, push message, or the like.

In one embodiment, the file server policy management unit may include a function of determining whether to attack by setting a separate management policy for each file server user ID.

In one embodiment, a method of sending a notification to the user when the file server policy management unit uses artificial intelligence technology in a method different from the usual method and automatically stopping the PC when it does not respond to the notification will be provided. can

According to the method of stopping the malware-driven PC that attacks the file server according to the embodiment of the present invention, when the malware runs on the PC or server and encrypts or reads data in the connected network drive to take over the file server in the network It is possible not only to check who the PC or server is attacking, but also to stop the PC as soon as it is judged, thereby minimizing the damage of cyber attacks within the same network. In addition, since there is no need for resources used to monitor file events in the PC or server, it is possible to prevent the terminal from slowing down.

1 is a reference diagram for explaining a method and apparatus for stopping a client PC or server connected to a file server when an incoming file request from a connected client PC or server exceeds a preset value or is determined to be an abnormal pattern.

Since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description process of the present specification are merely identification symbols for distinguishing one component from other components.

Also, throughout the specification, when an element is referred to as “connected” or “connected” with another element, the one element may be directly connected or directly connected to the other element, but in particular It should be understood that, unless there is a description to the contrary, it may be connected or connected through another element in the middle. In addition, throughout the specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented as one or more hardware or software or a combination of hardware and software .

Hereinafter, with reference to the accompanying drawings, the file policy management unit acquires a file event occurring in the file server according to an embodiment of the present invention, determines which PC or server connected to the file server is attacking, and selects the corresponding PC or server. Describes the method and device for stopping.

1 shows a flow of requesting a file using a network drive connected to a file server from a PC or server, and a flow showing a file server application unit and a file server policy management unit in the file server.

A PC or server is connected to the network file server application and exchanges files. Whenever a file request enters the file server application unit, a file request event (creation, reading, modification, deletion, etc.) occurs in real time to the file server policy management unit. Provides API for sending or viewing.

Depending on the type and format of the file server, some file servers may have APIs that transmit file server events to the outside, some file servers may store file events in DB or files, and some file servers may have external file servers. File request events can be driven to be inaccessible at all.

If the file server accumulates file request events in the DB or log files in the form of logs, the file server policy management unit can acquire the file request events from the DB or log files with the corresponding event values, and files that do not allow access to the file request events. In the case of a server, it is also self-evident that events can be extracted by detecting events in the storage in the file server. It is also apparent that a conventional technique such as a callback file system or FUSE (Filesystem in Usermode) can be used as a method of detecting a file event in the file server.

The file server policy management unit detects an event for a file, and if the frequency of the file request event exceeds the number of times previously set by the file policy management unit, it is determined that an attack is in progress on the PC or server. For example, it can be judged as a ransomware attack when viewing, editing, and deletion events within the same folder occur consecutively more than 100 times, and can be judged as data leakage if file or folder viewing events occur more than 1,000 times consecutively. self-evident It is also self-evident that by setting a separate policy for each user ID in the file server, the event setting value in the file server for each user ID can be set differently.

It is also self-evident that, in constructing the judgment criteria of the file server policy management unit, artificial intelligence can be used to determine the file request event in a learned manner rather than a method in which the frequency is set in advance.

The file server policy management unit may directly transmit a computer shutdown command to the PC corresponding to the connected user ID when the file request event is determined to be a pre-set or learned attack. (Depending on the connection configuration, the computer shutdown command can be terminated via the file server)

To this end, it is also self-evident that the agent can be installed on the host (PC or server) connected in advance, and the 'Shutdown' command can be transmitted by connecting to the terminal to the host using the remote host access command script.

It is also self-evident that an option to shut down the computer without delay can be transmitted along with the command to shut down the computer.

Also, it is self-evident that, depending on the configuration, a method of notifying a warning to the previously registered administrator before the file server policy management unit gives a stop command to the host may be added.

Although described above with reference to the embodiments of the present invention, those of ordinary skill in the art can variously modify the present invention within the scope not departing from the spirit and scope of the present invention described in the claims below. and can be changed.

Claims (1)

The file server policy management unit acquires a file event within the file server and sends a command to stop the host connected to the file server when the read, write, modify, or delete event exceeds a preset value or is detected as an abnormal operation event. A device that detects and stops a PC running malware that attacks a file server, including a management unit.

Images