KR20220145580A - Security Managing Method For Industrial Control System To Detect DLL Injection - Google Patents

Abstract

The present invention relates to a security management method of an industrial control system for detecting DLL injection, comprising the steps of: activating a security mode for detecting DLL injection in order to defend against a DLL injection attack to interfere with the control logic of an industrial control system; monitoring the call status of a DLL load API function generated in a process to be protected using inline hooking, and identifying a caller who called the DLL load API function; and if a malicious DLL injection attack attempt is determined based on the identified caller, recognizing the same as a cyberattack using DLL injection and suspending the DLL load API function call. Therefore, provided is a security management method of an industrial control system for detecting DLL injection, wherein the security level of an industrial control system can be improved.

Description

Security Managing Method For Industrial Control System To Detect DLL Injection

The present invention detects DLL injection that detects and blocks an attack technique called DLL injection for interfering with control logic in advance as one of cyber attacks targeting industrial control systems (ICS) adopted in large-scale industrial facilities including power systems. It relates to a security management method of an industrial control system.

Industrial Control System (ICS) is applied in various types to electricity, water and wastewater, petroleum and natural gas, chemical, pharmaceutical, pulp and paper, food and beverage, manufacturing of individual items (automobile, aerospace and durable goods, etc.) The concept encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as programmable logic controllers (PLCs) that can be found in departments and critical infrastructure.

Cyber attacks targeting industrial control systems (ICS) are increasing day by day. In a malicious cyber attack, an attacker can monitor or manipulate the control command of a legitimate user using the process, and the attacker can abuse the access right granted to the process. One of these cyber attack cases is that the attacker inserts a malicious DLL into the process of the Internet banking program to monitor the financial transaction processing logic and leak the transaction information entered by the Internet banking user. Another example is to attack a uranium enrichment facility. Malware such as Stuxnet or Black Energy 3, which attacked a real-time control system based on a synchrophasor of a power grid, attacked the SCADA system, resulting in an actual attack in which hackers took control of industrial facilities.

However, existing studies and international standards related to the security of industrial control systems (ICS) (eg, IEC 61850 in substation automation systems (SAS)) are It has been pointed out that it is insufficient and vulnerable to the complex attack method in the real world that exploits the computer system itself in this way by staying at the level of discussing security principles.

[Document 1] Korean Patent Publication No. 10-2019-0001325 (published on 01.04. 2019) [Document 2] Korean Patent No. 10-2139140 (Registered on July 23, 2020)

doesn't exist

An attack technique called DLL injection is used in the case of a cyber attack on the industrial control system adopted by large-scale industrial facilities including power systems. For example, malicious code uses an attack technique called DLL injection to interfere with the control logic of the Microsoft Windows-based SCADA control system. Accordingly, there is an urgent need for a method for mitigating security threats from the host system side of the industrial control system.

An object of the present invention is to provide a security management method of an industrial control system that monitors DLL logic API functions through inline hooking and detects DLL injection that can improve the security level of the industrial control system by detecting DLL injection attack attempts in advance. is in providing.

This research was supported by the research grant for the basic research and development project initiated in 2018 by Korea Electric Power Corporation. (Project No.: R18XA01)

The security management method of the industrial control system for detecting DLL injection according to the present invention for achieving the above object is (a) security for DLL injection detection in order to prevent a DLL injection attack for interfering with the control logic of the industrial control system activating the mode; (b) monitoring a call state of a DLL load API function occurring in a process to be protected using inline hooking, and identifying a caller who called the DLL load API function; and (c) when it is determined that a malicious DLL injection attack attempt is attempted based on the caller identified in step (b), recognizing it as a cyber attack using DLL injection and suspending the DLL load API function call; do it with

In addition, the step (b) collects the return address stored in the stack area of the process memory when the DLL load API function is called, and identifies the call subject by comparing the collected return address with the memory address allocated to the process memory. do.

In addition, the malicious DLL injection attack attempt in step (c) is characterized in that it is any one of an attack attempt using a remote thread, an attack attempt using an APC call, and an attack attempt using a window hook.

The present invention can detect and block malicious DLL injection attack techniques in advance by identifying the caller by collecting the return address that called the DLL load API function, thereby improving the security level of the industrial control system.

1 is a diagram schematically showing the process of loading an arbitrary DLL in a Microsoft Windows system;
2 is a diagram for explaining a normal DLL loading attempt;
3 is a diagram for explaining an attempt to load a DLL using malicious DLL injection;
4 is a diagram showing a normal Win32 API calling process;
5 is a diagram showing a calling process of an inline hooked Win32 API;
6 is a view for explaining the operation of the DLL injection detection unit detecting the call subject of the DLL load API function that attempts DLL injection in the process memory to be protected according to an embodiment of the present invention;
7 is a view for explaining the return address of the call subject stored in the stack area immediately after the function call of the window application program;
8 is a flowchart illustrating a security management method of an industrial control system for detecting DLL injection according to an embodiment.

Hereinafter, the present invention will be described by describing embodiments of the present invention with reference to the accompanying drawings. Like reference numerals in each figure indicate like elements. Also, in describing the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Also, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated.

A DLL (Dynamic Link Library) is an executable file that corresponds to the concept of a shared library in Microsoft Windows. It exports functions that can be used by other programs, loads them in other programs, and calls them. can

As shown in Fig. 1, in the process of loading an arbitrary DLL in the Microsoft Windows system, the PE loader loads the DLL as an MMF (memory map file) according to the DLL load API function call command (S10) (S20), and then The DllMain callback function of the loaded DLL is called (S30). As such, when a DLL is loaded in an arbitrary process, the DllMain function of the loaded DLL is called within the context of the process. This is the background of the code injection technique called DLL injection. DLL injection allows an attacker to load a desired DLL into a target process in any way and cause arbitrary actions in the context of the process. It is an attack technique that aims to perform. For example, malicious codes targeting SCADA systems continue to attempt attacks using DLL injection technology in the process of interfering with the core control logic of the SCADA system.

One case of trying to load a normal DLL is static load that calls a DLL load API function at the start of the program as shown in Fig. 2 (a), and the other case is a program in the code area of the program as shown in Fig. 2 (b). It can be divided into dynamic load, which calls the DLL load API function during execution.

On the other hand, one case of maliciously attempting to load a DLL using DLL injection is an attack attempt to create a remote thread as shown in Fig. 3 (a), and another case is a window hook ( It is an attack attempt by installing windows hook), and another case can be divided into an attack attempt by setting an Asynchronous procedure call (APC) call as shown in FIG. 3 ( c ).

Referring to FIG. 4 , the memory structure of the process memory 100 is an executable file with an *.exe extension loaded into the process, an area allocated for a library module with a *.dll extension, and a memory-mapped file (memory-mapped file). file, MMF) area, and a private area for users.

Examples of malicious attack attempts (Fig. 3 (a)(b)(c)) occur at run-time, and as shown in Table 1, the caller calling the DLL load API function different. The caller may check the information of the stack area allocated to the process memory 100 to confirm it. 2 (b) is also a situation that occurs during program execution, but since the caller is located in the code area of the process memory 100, it can be distinguished from the case of a malicious attack attempt.

Remote Thread Windows Hooks APC caller kernel32.dll user32.dll ntdll.dll
Disassembly
(Win 10)
CALL [756A1F88]
CALL ESI
PUSH EAX

PUSH DWORD [EDI+IC]
CALL [768E4308
MOV ESI, EAX]

MOV ECX, [EBP+8]
CALL [EBP+8]
MOV DWORD [EBP-4], -2

In the embodiment, the DLL injection detection unit 200 detects a malicious attack attempt using DLL injection in advance. The DLL injection detection unit 200 attempts a malicious DLL injection attack at run-time by identifying a caller of the DLL load API function that attempts DLL injection in the protected process memory 100 . can be detected. This will be described in detail.

In the normal Win32 API calling process in FIG. 5, the actual function (INSTR) is immediately executed according to the user application's API function call, but the inline hooked Win32 API calling process in FIG. 6 is performed before the actual function (INSTR) is called Using Detour Function, you can replace with a specific function or block the call itself. By applying this inline hooking, the DLL injection detection unit 200 monitors the call state of the DLL load API function generated in the process to be protected.

Referring to FIG. 7 , the return address of the call subject is stored in the stack area immediately after the function call of the window application operating in the IA-32 architecture. Since the stack area includes the call subject's return address information, the DLL injection detection unit 200 acquires the memory address of the caller who called the function based on the return address information, and calls it according to the acquired memory address. The caller can be identified. If the memory address of an arbitrary caller is known, the type of memory area to which the memory address belongs can be obtained by using the API function called VirtualQuery/VirtualQueryEx. Here, if the memory address belongs to the memory area of a certain module, the memory address range of the module loaded into the process for the first time does not change, so it can be recognized whether the module is the caller attempting a malicious attack through the memory address comparison. . For example, if a module called user32.dll is loaded at a memory address (0x760000 ~ 0x76FFFFFF), the memory address of the caller found through the return address of the stack area compares the memory address range, cognition can be identified.

As described above, the present invention monitors DLL logic API functions through inline hooking in order to defend against an attack technique of DLL injection, and detects DLL injection attack attempts in advance.

Hereinafter, a security management method of an industrial control system for detecting DLL injection according to an embodiment will be described in detail.

First, a security mode for detecting DLL injection is activated for the industrial control system (S100). Accordingly, the DLL injection detection unit 200 monitors the call state of the DLL load API function generated in the process to be protected by using inline hooking. At this time, when the DLL load API function is called, the DLL injection detection unit 200 collects a return address from the stack area of the process memory 100 and compares the collected return address with the memory address allocated to the process memory. The caller is identified (S110).

Then, the DLL injection detection unit 200 determines whether the caller is an attack attempt using a remote thread (S120), or whether the caller is an attack attempt using an APC call (S130), or the caller It is determined whether the caller is an attack attempt using a window hook (S140).

If it is determined that the caller is an attack attempt using a remote thread in step S120, the caller is an attack attempt using an APC call in step S130, and an attack attempt using a window hook in step S140, DLL injection detection unit 200 suspends the DLL load API function call by recognizing it as a cyber attack using DLL injection (S150).

On the other hand, if it does not correspond to any one of the attack attempts of steps S120, S130, and S140, it is recognized as normal and the DLL load API function is called (S160).

The foregoing description of the present invention is for illustration, and those of ordinary skill in the art to which the present invention pertains can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be.

100: process memory
200: DLL injection detection unit

Claims (3)

(a) activating a security mode for DLL injection detection in order to prevent a DLL injection attack for interfering with the control logic of the industrial control system;
(b) monitoring a call state of a DLL load API function occurring in a process to be protected using inline hooking, and identifying a caller who called the DLL load API function; and
(c) if it is determined as a malicious DLL injection attack attempt based on the call subject identified in step (b), recognizing it as a cyber attack using DLL injection and suspending the DLL load API function call; characterized in that it comprises; A security management method for industrial control systems that detects DLL injection. According to claim 1,
The step (b) collects the return address stored in the stack area of the process memory when the DLL load API function is called, and compares the collected return address with the memory address allocated to the process memory to identify the caller. A security management method of an industrial control system that detects injection. According to claim 1,
An industrial control system for detecting DLL injection, characterized in that the malicious DLL injection attack attempt in step (c) is any one of an attack attempt using a remote thread, an attack attempt using an APC call, and an attack attempt using a window hook of security management methods.

Images