KR20230108819A - Server, method and computer program for detecting malicious file - Google Patents

Abstract

A server that detects malicious files in an environment where no program is running is a storage unit that stores information on all PE files including a plurality of previously secured normal PE files and malicious PE files in a database, and information on all PE files. an analysis unit that analyzes information on the detection target PE file based on the detection target PE file, a generator that generates true positive determination information for the detection target PE file based on the analyzed detection target PE file information, and a true false positive determination information for an operator terminal It may include a transmission unit for transmitting to.

Description

Server, method and computer program for detecting malicious files {SERVER, METHOD AND COMPUTER PROGRAM FOR DETECTING MALICIOUS FILE}

The present invention relates to a server, method and computer program for detecting malicious files.

Most malicious codes operate through PE (Portable Executable) files that run on the Windows operating system.

Many attacks are being made using the vulnerability of programs supported by the Windows operating system to execute arbitrary malicious codes hidden in PE files.

Here, the PE file is an executable file used in the Windows operating system, and includes, for example, an EXE file, a DLL file, and the like.

Referring to FIG. 1, the existing malicious PE file detection method performs static analysis on the target PE file, extracts libraries and functions from the target PE file, and extracts the target PE file through a machine learning (ML) model. This is a method of notifying the operator of the probability that the library and function are malicious.

The machine learning model used for detecting such a malicious PE file tends to have higher predictive performance but lower interpretability as the model becomes more complex. In addition, information on the probability that the library and function of the target PE file derived through the machine learning model is malicious is insufficient for an operator to determine a false positive for the target PE file.

Korean Registered Patent Publication No. 10-2010468 (registered on August 7, 2019)

The present invention is to solve the above-mentioned problems of the prior art, and analyzes information on detection target PE files based on information on all previously secured PE files, and based on the information on the analyzed detection target PE files It is intended to generate false positive determination information for the PE file to be detected and transmit it to the operator terminal.

However, the technical problem to be achieved by the present embodiment is not limited to the technical problems described above, and other technical problems may exist.

As a technical means for achieving the above-described technical problem, the server detecting malicious files in an environment in which the program according to the first aspect of the present invention is not executed includes all of the previously secured normal PE files and malicious PE files. a storage unit that stores information about the PE file in a database; an analysis unit that analyzes information on a PE file to be detected based on the information on all PE files; a generator that generates false positive determination information for the PE file to be detected based on the information on the PE file to be detected; and a transmitter for transmitting the false positive determination information to an operator terminal.

A method for detecting a malicious file performed by a malicious file detection server in an environment in which a program is not executed according to a second aspect of the present invention is a method for detecting a plurality of previously secured normal PE files and all PE files including malicious PE files. storing the information in a database; analyzing information on a PE file to be detected based on the information on all PE files; generating false positive determination information for the PE file to be detected based on the analyzed information on the PE file to be detected; and transmitting the false positive determination information to an operator terminal.

A computer program stored in a computer-readable recording medium including a sequence of instructions for detecting a malicious file in an environment in which the program according to the third aspect of the present invention is not executed is executed by a computing device, and the plurality of previously secured normal PEs Information on all PE files including files and malicious PE files is stored in a database, information on detection target PE files is analyzed based on the information on all PE files, and information on the analyzed detection target PE files is analyzed. It may include a sequence of instructions for generating true positive determination information for the PE file to be detected based on the information and transmitting the false positive determination information to an operator terminal.

The above-described means for solving the problems is only illustrative and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description.

According to any one of the above-described problem solving means of the present invention, the present invention analyzes information on detection target PE files based on previously secured information on all PE files, and determines the information on the analyzed detection target PE files. Based on this, false positive determination information for the PE file to be detected may be generated and transmitted to the operator terminal.

Through this, the present invention provides the operator terminal with the malicious prediction result of the detection target PE file predicted by the machine learning model and the false positive determination information for the detection target PE file, so that the operator determines the true false positive for the detection target PE file. Through the information, it is possible to understand why the malicious prediction result of the PE file to be detected was derived.

In addition, the present invention can reduce the time it takes for an operator to classify false positives in the malicious prediction result of the PE file to be detected through false positive determination information on the PE file to be detected.

1 is a diagram for explaining a conventional malicious file detection method.
2 is a block diagram of a malicious file detection server according to an embodiment of the present invention.
3 is a diagram for explaining a method of detecting a malicious file according to an embodiment of the present invention.
4 is an exemplary view showing information on all PE files stored in a database according to an embodiment of the present invention.
5 is a diagram for explaining a method of calculating the degree of association with a malicious PE file for each function of a PE file to be detected according to an embodiment of the present invention.
6 is a flowchart illustrating a method of detecting a malicious file according to an embodiment of the present invention.
7 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to an embodiment of the present invention.
8 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.
9 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.
10 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail so that those skilled in the art can easily practice the present invention with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected" but also the case where it is "electrically connected" with another element interposed therebetween. . In addition, when a certain component is said to "include", this means that it may further include other components without excluding other components unless otherwise stated.

In this specification, a "unit" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. Further, one unit may be realized using two or more hardware, and two or more units may be realized by one hardware.

In this specification, some of the operations or functions described as being performed by a terminal or device may be performed instead by a server connected to the terminal or device. Likewise, some of the operations or functions described as being performed by the server may also be performed in a terminal or device connected to the corresponding server.

Hereinafter, specific details for the implementation of the present invention will be described with reference to the accompanying configuration diagram or process flow chart.

2 is a block diagram of a malicious file detection server 20 according to an embodiment of the present invention.

Referring to FIG. 2 , the malicious file detection server 20 may include a storage unit 200 , an analysis unit 210 , a generation unit 220 and a transmission unit 230 . However, the malicious file detection server 20 shown in FIG. 2 is only one implementation example of the present invention, and various modifications are possible based on the components shown in FIG. 2 .

Hereinafter, FIG. 2 will be described with reference to FIG. 3 .

The storage unit 200 may store in the database 32 information on all PE files including a plurality of previously secured normal PE files and malicious PE files. Here, in the information on all PE files, for example, a normal label (eg, label 0) may be displayed for each of a plurality of normal PE files, and a malicious label (eg, label 1) may be displayed for each of a plurality of malicious PE files. .

For a moment, information on all PE files stored in the database 32 will be described with reference to FIG. 4 .

Referring to FIG. 4 , the storage unit 200 may store a library list, a function list 40, and hash values in a database 32 for each normal PE file and malicious PE file included in all PE files.

Here, the library list means a set containing a function in order to use a certain function in a PE file in units of collections of functions. A function list is a collection of routines or subroutines compiled together. The hash value refers to the value to which the MD5 hash function is applied after converting the 'library name: function name' imported from the PE file into lowercase letters, converting the converted lowercase letters into a byte array.

The storage unit 200 may store the number 42 of normal PE files and malicious PE files for each library in the database 32 . For example, the storage unit 200 may create a data structure for the number of normal PE files and the number of malicious PE files based on 'library name' and store it in the database 32 .

The storage unit 200 may store the number of normal PE files and the number 44 of malicious PE files for each function in the database 32 . For example, the storage unit 200 may generate a data structure for the number of normal PE files and the number of malicious PE files based on 'library name: function name' and store it in the database 32 .

Returning to FIG. 2 again, the analysis unit 210 extracts libraries and functions included in the detection target PE file 30 from the detection target PE file 30 through static analysis of the detection target PE file 30. can

The analyzer 210 inputs the extracted library and function of the PE file 30 to be detected into a machine learning model, and derives a malicious prediction result including a probability that the corresponding library and function are malicious through the machine learning model. .

The analyzer 210 may analyze information about the detection target PE file 30 based on information about all PE files stored in the database 32 .

The generation unit 220 may generate false positive determination information 34 for the detection target PE file 30 based on the analyzed information on the detection target PE file 30 .

<First Embodiment>

The analysis unit 210 extracts a library list by normal labeled normal PE file and a library list by malicious labeled malicious PE file from the database 32, and between the extracted library list by normal PE file and the library list by malicious PE file. difference can be calculated.

The analysis unit 210 may extract a library list belonging only to a plurality of normal PE files based on a result of the difference set.

The analyzer 210 calculates an intersection between the library list extracted from the extracted normal PE file and the library list extracted from the detection target PE file 30 only for the extracted normal PE file, and based on the result of the intersection, information about the detection target PE file 30 can be analyzed.

For example, if the result of the intersection is equal to or greater than a preset threshold (eg, 1), the analyzer 210 may determine that there is a high probability that the library of the PE file 30 to be detected includes a library belonging only to normal PE files. there is. This is because malicious PE files use native functions to run on many Windows operating systems, but normal PE files are free to use non-native functions.

The generating unit 220 may generate false positive determination information 34 indicating that the library of the PE file 30 to be detected includes a library belonging only to normal PE files.

<Second Embodiment>

The analyzer 210 searches for PE files matching the hash value of the detection target PE file 30 among the hash values of all PE files, and the number of normal PE files and the number of malicious PE files constituting the searched PE files. Information on the PE file 30 to be detected may be analyzed based on .

The analysis unit 210 determines the number of normal PE files and malicious PE files among the searched PE files that match the hash value of the detection target PE file 30 and normal PE files and malicious PE files among all PE files stored in the database 32. Based on the ratio occupied by each PE file, it is possible to calculate the perfect match ratio in which the PE file 30 to be detected completely matches the malicious PE file through [Equation 1]. In this case, the higher the calculated perfect matching rate, the higher the probability that the PE file 30 to be detected is a malicious PE file.

[Equation 1]

here, is the number of files that match the hash value of the PE file to be detected among a plurality of malicious PE files included in the database, is a weight for malicious files, calculated as the ratio of malicious PE files to all PE files included in the database, is the number of files that match the hash value of the PE file to be detected among a plurality of normal PE files included in the database, is the weight for normal files, and is the ratio of normal PE files among all PE files included in the database (1- ), and α is a value to prevent the denominator from becoming 0.

The generation unit 220 may generate a list of malicious PE files matching the hash value of the detection target PE file 30 among the searched PE files as the false positive determination information 34 .

<Third Embodiment>

The analyzer 210 may calculate a similarity between the function list of all PE files and the function list of the PE file 30 to be detected. This can improve the limitation of not considering a malicious PE file partially modified from an existing malicious PE file.

The analyzer 210 vectorizes the 'library name: function name' of the entire PE file using a one-hot encoding method, and vectorizes the 'library name: function name' of the PE file to be detected 30 using a one-hot encoding method. After that, the cosine similarity between the vectorized function list of the entire PE file and the vectorized function list of the PE file 30 to be detected can be calculated based on the cosine similarity formula between the two vectors. At this time, the cosine similarity can be calculated through [Equation 2]. The cosine similarity has a prime number between 0 and 1, and the closer to 1, the higher the similarity.

[Equation 2]

here, is the cosine similarity result between the vector for the function imported by the malicious PE file m included in the database 32 and the vector for the function imported by the PE file to be detected, T is the cosine similarity threshold function, It is a function that sets to 0 when the value of is lower than a specific cosine similarity (eg, 0.8). is a weight for malicious files, calculated as the ratio of malicious PE files to all PE files included in the database, is a cosine similarity result between a vector for a function imported by a normal PE file b included in the database 32 and a vector for a function imported by a PE file to be detected, is the weight for normal files, and is the ratio of normal PE files among all PE files included in the database (1- ), and α is a value to prevent the denominator from becoming 0.

The analysis unit 210 extracts a function list of a PE file having a similarity exceeding a predetermined threshold among function lists of all PE files, and determines a function list for the PE file 30 to be detected based on the function list of the extracted PE file. information can be analyzed.

The analysis unit 210, through [Equation 2], is a malicious PE whose similarity with the function list of the PE file 30 to be detected among the function lists of a plurality of malicious PE files included in the entire PE file exceeds a preset threshold. You can extract a function list from a file. At this time, the higher the value calculated through [Equation 2], the higher the probability that the PE file 30 to be detected is a malicious PE file.

The generation unit 220 calculates the similarity between the function list of the extracted malicious PE file and the function list of the extracted malicious PE file and the function list of the detection target PE file 30 to determine false positive information for the detection target PE file 30. (34) can be generated.

<The fourth embodiment>

The analyzer 210 may calculate the degree of association between the function of the PE file 30 to be detected and the malicious PE file based on the number of normal PE files and the number of malicious PE files for each function stored in the database 32. . In this case, the higher the correlation with the malicious PE file, the higher the possibility that the function used in the PE file 30 to be detected is a function used in the malicious PE file.

For example, referring to FIG. 5 , when the detection target PE file 30 includes the 'GetLastError' function, the number of normal PE files importing the 'GetLastError' function 50 from the database 32 is 10963. , the number of malicious PE files is 21040, the sum of the number of normal PE files and the number of malicious PE files is 32003, and the degree of correlation of the function of the PE file to be detected (30) with the malicious PE file is about 0.66. It can be calculated as (= 21040/32003).

The generation unit 220 may generate a function list of the malicious PE file as the false positive determination information 34 for the PE file 30 to be detected based on the calculated correlation with the malicious PE file.

The transmission unit 230 may transmit false positive determination information 34 for the detection target PE file 30 to the operator terminal together with the malicious prediction result for the detection target PE file 30 derived through the machine learning model. .

Meanwhile, those skilled in the art will fully understand that each of the storage unit 200, the analysis unit 210, the generation unit 220, and the transmission unit 230 can be implemented separately or implemented by integrating one or more of them. .

6 is a flowchart illustrating a method of detecting a malicious file according to an embodiment of the present invention.

Referring to FIG. 6 , in step S601, the malicious file detection server 20 may store information on all PE files including a plurality of previously secured normal PE files and malicious PE files in a database.

In step S603, the malicious file detection server 20 may analyze information about PE files to be detected based on information about all PE files.

In step S605, the malicious file detection server 20 may generate false positive determination information for the PE file to be detected based on the analyzed information on the PE file to be detected.

In step S607, the malicious file detection server 20 may transmit false positive determination information to the operator terminal.

In the foregoing description, steps S601 to S607 may be further divided into additional steps or combined into fewer steps, depending on an embodiment of the present invention. Also, some steps may be omitted if necessary, and the order of steps may be changed.

7 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to an embodiment of the present invention.

Referring to FIG. 7 , in step S701, the malicious file detection server 20 may calculate the difference between the library list for each normal PE file and the library list for each malicious PE file stored in the database.

In step S703, the malicious file detection server 20 may extract a library list belonging only to a plurality of normal PE files from the database based on the result of the calculated difference set.

In step S705, the malicious file detection server 20 may calculate an intersection between the library list belonging only to the extracted normal PE file and the library list extracted from the PE file to be detected.

In step S707, the malicious file detection server 20 may analyze information on the PE file to be detected based on the calculated intersection result.

In step S709, the malicious file detection server 20 may generate false positive determination information for the PE file to be detected based on the analyzed information on the PE file to be detected.

In the above description, steps S701 to S709 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. Also, some steps may be omitted if necessary, and the order of steps may be changed.

8 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.

Referring to FIG. 8 , in step S801, the malicious file detection server 20 may search for a PE file that matches the hash value of the PE file to be detected among hash values of all PE files stored in the database.

In step S803, the malicious file detection server 20 may analyze information about PE files to be detected based on the number of normal PE files and the number of malicious PE files constituting the searched PE files.

In step S805, the malicious file detection server 20 assigns a list of malicious PE files matching the hash value of the detection target PE file among the detected PE files based on the analyzed detection target PE file information to the detection target PE file. It can be generated as false positive determination information for

In the above description, steps S801 to S805 may be further divided into additional steps or combined into fewer steps, depending on an embodiment of the present invention. Also, some steps may be omitted if necessary, and the order of steps may be changed.

9 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.

Referring to FIG. 9 , in step S901, the malicious file detection server 20 may calculate a similarity between the function list of all PE files stored in the database and the function list of the PE file to be detected.

In step S903, the malicious file detection server 20 selects a function list of a malicious PE file whose similarity with the function list of a PE file to be detected exceeds a predetermined threshold among function lists of a plurality of malicious PE files included in the entire PE file. can be extracted from the database.

In step S905, the malicious file detection server 20 may generate a function list and similarity of the extracted malicious PE file as false positive determination information for the PE file to be detected.

In the above description, steps S901 to S905 may be further divided into additional steps or combined into fewer steps, depending on an embodiment of the present invention. Also, some steps may be omitted if necessary, and the order of steps may be changed.

10 is a flowchart illustrating a method of generating false positive determination information for a PE file to be detected according to another embodiment of the present invention.

Referring to FIG. 10, in step S1001, the malicious file detection server 20 associates the function of the PE file to be detected with the malicious PE file based on the number of normal PE files and the number of malicious PE files for each function stored in the database. figure can be calculated.

In step S1003, the malicious file detection server 20 extracts the function list of the malicious PE file from the database based on the calculated correlation with the malicious PE file, and converts the function list of the extracted malicious PE file to the detection target PE file. It can be generated as false positive determination information.

In the above description, steps S1001 to S1003 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. Also, some steps may be omitted if necessary, and the order of steps may be changed.

An embodiment of the present invention may be implemented in the form of a recording medium including instructions executable by a computer, such as program modules executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer readable media may include all computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the claims to be described later rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts thereof should be construed as being included in the scope of the present invention. .

20: malicious file detection server
200: storage unit
210: analysis unit
220: generating unit
230: transmission unit

Claims (19)

In a server that detects malicious files in an environment where a program is not executed,
a storage unit for storing information on all PE files including a plurality of previously secured normal PE files and malicious PE files in a database;
an analysis unit that analyzes information on a PE file to be detected based on the information on all PE files;
a generator that generates false positive determination information for the PE file to be detected based on the information on the PE file to be detected; and
Transmission unit for transmitting the false positive determination information to an operator terminal
To include, malicious file detection server.
According to claim 1,
Wherein the storage unit stores a library list, a function list, and a hash value for each normal PE file and malicious PE file included in the entire PE file in the database.
According to claim 2,
wherein the storage unit stores the number of normal PE files and the number of malicious PE files for each library, and stores the number of normal PE files and the number of malicious PE files for each function in the database.
According to claim 3,
The analysis unit
Extracting a library list belonging only to the plurality of normal PE files based on a result of a difference between the library list for each normal PE file and the library list for each malicious PE file;
and analyzing information on the PE file to be detected based on a result of intersection between the extracted library list and the library list extracted from the PE file to be detected.
According to claim 3,
The analysis unit
Searching for a PE file that matches the hash value of the detection target PE file among the hash values of all the PE files,
and analyzing information on the PE file to be detected based on the number of normal PE files and the number of malicious PE files constituting the searched PE file.
According to claim 5,
the generator
And generating a list of malicious PE files matching the hash value of the detection target PE file among the searched PE files as the false positive determination information.
According to claim 3,
The analysis unit
Calculate a similarity between a function list of the entire PE file and a function list of the PE file to be detected;
Extracting a function list of a PE file having a similarity exceeding a predetermined threshold among function lists of all PE files;
and analyzing information about the PE file to be detected based on the function list of the extracted PE file.
According to claim 7,
The analysis unit
Extracting a function list of a malicious PE file whose similarity with the function list of the PE file to be detected exceeds the predetermined threshold among the function lists of the plurality of malicious PE files included in the entire PE file;
the generator
and generating a function list and similarity of the extracted malicious PE file as the false positive determination information.
According to claim 3,
The analysis unit
Based on the number of normal PE files and the number of malicious PE files for each function stored in the database, the degree of association between the function of the PE file to be detected and the malicious PE file is calculated,
the generator
and generating a function list of the malicious PE file as the false positive determination information based on the calculated correlation with the malicious PE file.
A method for detecting a malicious file performed by a malicious file detection server in an environment where a program is not executed,
Storing information on all PE files including a plurality of previously secured normal PE files and malicious PE files in a database;
analyzing information on a PE file to be detected based on the information on all PE files;
generating false positive determination information for the PE file to be detected based on the analyzed information on the PE file to be detected; and
Transmitting the false positive determination information to an operator terminal
To include, a malicious file detection method.
According to claim 10,
Storing in the database
and storing a library list, a function list, and a hash value for each normal PE file and malicious PE file included in the entire PE file in the database.
According to claim 11,
Storing in the database
and storing the number of normal PE files and the number of malicious PE files for each library, and storing the number of normal PE files and the number of malicious PE files for each function in the database.
According to claim 12,
The step of analyzing information about the detection target PE file
Extracting a library list belonging only to the plurality of normal PE files based on a result of a difference between the library list for each normal PE file and the library list for each malicious PE file; and
And analyzing information about the detection target PE file based on a result of intersection between the extracted library list and the library list extracted from the detection target PE file.
According to claim 12,
The step of analyzing information about the detection target PE file
Searching for a PE file matching the hash value of the detection target PE file among hash values of all the PE files; and
And analyzing information on the PE file to be detected based on the number of normal PE files and the number of malicious PE files constituting the searched PE file.
15. The method of claim 14,
The step of generating false positive determination information for the PE file to be detected is
And generating a list of malicious PE files matching the hash value of the detection target PE file among the searched PE files as the false positive determination information.
According to claim 12,
The step of analyzing information about the detection target PE file
calculating a similarity between a function list of all PE files and a function list of the PE file to be detected;
Extracting a function list of a PE file having a similarity exceeding a predetermined threshold among function lists of all PE files; and
and analyzing information about the PE file to be detected based on the function list of the extracted PE file.
17. The method of claim 16,
The step of analyzing information about the detection target PE file
Extracting a function list of a malicious PE file whose similarity with the function list of the PE file to be detected exceeds the predetermined threshold among function lists of a plurality of malicious PE files included in the entire PE file;
The step of generating false positive determination information for the PE file to be detected is
and generating a function list and similarity of the extracted malicious PE file as the false positive determination information.
According to claim 12,
The step of analyzing information about the detection target PE file
Calculating a degree of association with a malicious PE file for a function of the PE file to be detected based on the number of normal PE files and the number of malicious PE files for each function stored in the database;
The step of generating false positive determination information for the PE file to be detected is
and generating a function list of the malicious PE file as the false positive determination information based on the calculated correlation with the malicious PE file.
A computer program stored in a computer readable recording medium containing a sequence of instructions for detecting a malicious file in an environment where the program is not executed,
When the computer program is executed by a computing device,
Store information on all PE files including a plurality of previously secured normal PE files and malicious PE files in a database;
Analyzing information on a PE file to be detected based on the information on all PE files;
generating false positive determination information for the PE file to be detected based on the information about the analyzed PE file to be detected;
A computer program stored on a computer readable recording medium, comprising a sequence of instructions for transmitting the false positive determination information to an operator terminal.

Images