WO2011002146A2

WO2011002146A2 - System and method for detecting malicious code

Info

Publication number: WO2011002146A2
Application number: PCT/KR2010/002375
Authority: WO
Inventors: 김윤동; 서성원; 연성호; 이지남; 정영석; 한명호; 최재영; 이재홍
Original assignee: (주)잉카인터넷
Priority date: 2009-06-30
Filing date: 2010-04-16
Publication date: 2011-01-06
Also published as: WO2011002146A3; KR101161008B1; KR20110001426A

Abstract

The present invention relates to a system and method which accurately detect whether or not an arbitrary application program includes malicious code by applying a heuristic technique. A system for detecting malicious code according to the present invention includes a kernel driver searcher that selects a search target driver, a kernel driver converter that checks API functions used by the search target driver, a kernel driver analyzer that analyzes whether or not a suspected malicious code API is included in the API functions used by the search target driver, and a malicious code analyzer that disassembles the suspected malicious code API used by the search target driver and a parameter value to analyze whether or not the suspected malicious code API is a malicious code API.

Description

Malware Detection System and Method

The present invention relates to a malware detection system and method, and more particularly, to a system and method for accurately detecting whether any application contains malware by applying a heuristic technique.

Recently, the threat of information protection has been concentrated on malicious codes (exploit code, malicious code), and these malicious codes are causing overall problems against the purpose of information protection, which is concentrated on confidentiality, integrity, and availability. The actual definition of malware refers to all programs and executable parts designed to cause psychological and substantial harm to others. As the cracker's technology for producing malicious code increases, so does the security threat.

Methods for analyzing such malware include a signature test, a cyclic redundancy check (CRC) test, and a heuristic test.

Fingerprint scanning is one of the ways that security programs diagnose malware, as fingerprints are used to distinguish people. In other words, it collects unique strings (patterns) owned by malicious codes and stores them in the database, and analyzes the malicious codes using a method that the security program matches the patterns. The fingerprint inspection method has a sequential string inspection method and a specific string inspection method. The sequential string inspection method has a disadvantage in that the detection rate of the malware is fast, but the detection rate of the malicious code is low.

Since the fingerprint inspection method detects malicious code by comparing the same string pattern, there is a problem that the malicious code cannot be detected when some of the patterns of the malicious code are modified. For this reason, in order to increase the malware detection rate, there is a problem that the security company must repeat the operation of storing the modified pattern of the malware in the database every time the pattern of the malware is modified again.

The CRC test is an error detection method for verifying the reliability of data in serial transmission. It has a merit of low error rate. However, even if the data is modified by 1 byte, the malicious code cannot be diagnosed.

Therefore, in recent years, a heuristic technique that improves the function of the fingerprint inspection method is mainly used as a method for analyzing malicious codes, which is one of learning-based analysis methods that analyze itself or analyze the behavior of malicious codes. In other words, a malicious virus program often uses a unique combination of API commands, and the heuristic technique learns a combination of these unique API commands to determine whether the malicious code is based on the API commands.

However, in general, malicious code and security programs often use similar API command combinations, which causes false detection of security programs as malicious code when an empirical technique determines whether any application contains malicious code. There is this.

Disclosure of Invention The object of the present invention, which is devised to solve the above-mentioned problem, is to detect and deassemble API command patterns used by arbitrary application programs running on a computer system in a kernel level domain to grasp behavior patterns of the corresponding application programs. It is intended to provide a system and method for accurately detecting whether an application contains malicious code.

Malware detection system according to an embodiment of the present invention for achieving the above object, Kernel driver search unit for selecting the driver to be scanned, Kernel driver conversion unit for checking the API functions used by the driver to be scanned And a kernel driver analyzing unit that analyzes whether the malicious code suspect API is included among the API functions used by the test target driver, and disassembles the malicious code suspect API and parameter values used by the test target driver. It characterized in that it comprises a malicious code analysis unit for analyzing whether the malicious code suspect API is a malicious code API.

In addition, the malware detection method according to an embodiment of the present invention, a kernel driver search step for selecting a driver to be scanned, a kernel driver conversion step for identifying the API functions used by the driver to be scanned, and the test object Kernel driver analysis step of analyzing whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the inspection target driver It is characterized by including a malicious code analysis step of analyzing whether the API is a malicious code API.

In addition, the malware detection system according to another embodiment of the present invention, a kernel driver search unit for selecting a driver to be scanned, a kernel driver conversion unit for checking the API functions used by the driver to be scanned, and the test target The kernel driver analysis unit that analyzes whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the scan target driver A malicious code analysis unit for analyzing whether an API is a malicious code API, and a user process search unit for investigating a user process using the target driver when the malicious code API is included in the scan target driver as a result of the analysis of the malicious code analysis unit. And analyzing whether the user process calls the malicious code API. Characterized in that it comprises a user process analysis unit for detecting whether the malicious code API of the driver is actually executed.

In addition, the malware detection method according to another embodiment of the present invention, a kernel driver search step for selecting a driver to be scanned, a kernel driver conversion step for confirming the API functions used by the driver to be scanned, and the test object Kernel driver analysis step of analyzing whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the inspection target driver A malicious code analysis step of analyzing whether an API is a malicious code API, and a user process search for investigating a user process using the target driver when the malicious code API is included in the driver to be scanned as a result of the analysis of the malicious code analysis step. And analyzing whether the user process calls the malicious code API. And a user process analysis step of detecting whether the malicious code API of the driver to be inspected is actually executed.

As described above, the above-described malicious code detection system and method according to the present invention has an effect of accurately detecting whether malicious code is included in any application program running on a computer system.

1 is a functional block diagram of a malware detection system according to an embodiment of the present invention;

2 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention;

3 is a functional block diagram of a malware detection system according to another embodiment of the present invention;

4 is an operation flowchart showing a malicious code detection method according to another embodiment of the present invention.

1: Driver Information Store 2: Shared Memory

11, 31: kernel driver search unit 12, 32: kernel driver conversion unit

13, 33: kernel driver analysis unit 14, 34: malware analysis unit

15: disable processing unit 35: user process search unit

36: user process analysis unit 37: neutralization processing unit

Hereinafter, a malicious code detection system and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

When an application program is executed on a computer system, the driver information store of the computer system stores the names of kernel level programs (commonly referred to as kernel drivers) of the executed application programs and memory address values referenced by each kernel driver. . All kernel drivers in the driver list stored in this driver information store are the drivers to be inspected in the present invention. If the driver to be scanned in the driver list is converted to a PE structure, the API functions used by the kernel driver and the memory address information of the corresponding API functions can be extracted.

In the present invention, an application program containing malicious code among application programs running on a computer system is called a malicious code program, and API functions used in the malicious code are called a malicious code suspect API.

1 is a block diagram of a malicious code detection system according to an embodiment of the present invention.

The malware detection system of the present invention uses a kernel driver search unit (11) for selecting a driver to be inspected from a list of drivers stored in the driver information storage (1), and converts the driver to a PE structure to be used by the driver to be scanned. Kernel driver converting unit 12 to check the API functions that are being used, Kernel driver analysis unit 13 to analyze whether the malicious code suspect API among the API functions used by the test target driver, and the test target driver And a malicious code analysis unit 14 for analyzing whether the malicious code suspect API is a malicious code API by disassembling the malicious code suspect API and parameter values. The malicious code detection system of the present invention further includes a disabling processor 15 for blocking the operation of the inspection target driver using the malicious code API as a result of the analysis of the malicious code analysis unit 14.

The kernel driver search unit 11 selects a driver to be inspected from a list of drivers stored in the driver information storage 1. The kernel driver converting unit 12 converts the inspected driver into a PE structure, and then list information of API functions used by the inspected driver is obtained.

The kernel driver analyzing unit 13 analyzes whether the malicious code suspect API is included among the API functions used by the inspected driver. Here, the malicious code suspect API may be an API function related to key input / output or keyboard port access used by a key logger, an API function that reads or stores a USB input / output function or a file, It may be an associated API function or an API function related to memory manipulation.

The kernel driver analyzing unit 13 extracts address information of a memory in which the malicious code core API actually exists if the malicious code core API is included among the API functions used by the driver to be scanned. The malicious code suspect API may or may not be a malicious code API, and the malicious code analyzing unit 14 analyzes whether the malicious code suspect API is a malicious code API.

The malicious code analysis unit 14 extracts and disassembles a code value of a predetermined byte (a disassembly target byte) around a memory address of the malicious code suspect API. At this time, the disassembly target byte is set to include the malicious code suspect API and the parameter value used by the malicious code suspect API in the code value to be disassembled. The malicious code analysis unit 14 analyzes the disassembled malicious code suspect API and its parameter values to check whether the malicious code suspect API accesses a resource to be protected, thereby determining whether the malicious code suspect API is a malicious code API. Judge.

For example, a malicious code suspect API related to hardware has an address of a port as a parameter value. In order to secure the keyboard, if the malicious code suspect API (for example, ReadPortUChar API) related to the keyboard input / output has 60h or 64h as a parameter value, the scanned driver using the malicious code suspect API will attempt to access the keyboard. Judging by the code

The neutralization processing unit 15 disables the driver to be inspected by the malicious code analysis unit 14 as including the malicious code. The technique for disabling the driver can simply apply a conventionally known technique.

2 is an operation flowchart illustrating a malicious code detection method of a malicious code detection system according to an exemplary embodiment of the present invention.

First, the inspection target driver is selected from the driver list (S21). Check the API functions used by the inspected driver by converting the inspected driver into a PE structure (S22). It analyzes whether the malicious code suspect API is included among the API functions (S23), and disassembles the malicious code suspect API and parameter values (S24). Then, it is analyzed whether the malicious code core API is a malicious code API using the disassembled malicious code core API and parameter values (S25). Finally, the analysis result of step S25 disables the inspection target driver using the malicious code API (S26).

1 and 2, if the kernel driver contains malicious code, all of them are disabled to block its execution. However, even if the kernel driver contains malicious code, the malicious code is not executed unless the actual user level process executes it. However, the embodiment of FIGS. 1 and 2 has a problem of blocking all cases. 3 is a solution for solving this problem.

3 is a block diagram illustrating a malicious code detection system according to another embodiment of the present invention.

The malware detection system of the present invention uses a kernel driver search unit 31 for selecting any driver to be scanned from a list of drivers stored in the driver information storage 1, and converts the driver to be a PE structure to be used by the driver to be scanned. Kernel driver converting unit 32 for checking the API functions that are being used, Kernel driver analysis unit 33 for analyzing whether the malicious code suspect API among the API functions used by the inspection target driver, and the inspection target driver It analyzes whether the malicious code suspect API is a malicious code API by disassembling the malicious code suspect API and parameter values, and stores the driver handle and malicious code API information of a target driver that uses the malicious code API in a shared memory ( 2) Scan target dry by using the malicious code analysis unit 34 to store in the driver, and the driver handle information stored in the shared memory A user process search section 35 for examining a user process list using the user, a user process analysis section 36 for checking whether each user process in the user process list calls the malicious code API, and a malicious code API for calling And a disabling process 37 for disabling the user process.

The disable processing unit 37 blocks the execution of the malicious code by closing the driver handle of the inspection target driver or terminating the user process.

In the malware detection system configured as described above, the functions and operations of the kernel driver search unit 31, the kernel driver conversion unit 32, and the kernel driver analysis unit 33 are the kernel driver search unit 11 and the kernel of FIG. The functions and operations of the driver converter 32 and the kernel driver analyzer 33 are the same, and detailed descriptions thereof are omitted here.

The malware analysis unit 34 extracts and disassembles the code value of the disassembly target byte around the memory address of the malicious code suspect API, and analyzes the deassembled malicious code suspect API and its parameter values. By checking whether the malicious code suspect API accesses a resource to be protected, it is determined whether the malicious code suspect API is a malicious code API. If it is determined that the inspection target driver uses the malicious code API, the malicious code analysis unit 34 stores the driver handle of the inspection target driver and the malicious code API information in use in the shared memory 2.

The user process searching unit 35 uses the driver handle information stored in the shared memory to investigate the user processes using the driver to be inspected to create a user process list. Since kernel drivers and user processes are not in a one-to-one matching relationship, there may or may not be many user processes using the driver to be inspected.

The user process analysis unit 36 analyzes whether the user process of the user process list calls the malicious code API included in the inspection target driver. When the user process calls the malicious code API included in the inspection target driver, since the malicious code is executed, the neutralization processing unit 37 disables the malicious code so as not to be executed. If the user process does not call the malicious code API included in the scan target driver, there is no possibility of exploitation of the malicious code API.

The disabling processing unit 37 disables the malicious code so that the malicious code cannot be executed by closing the driver handle of the inspection target driver or terminating the user process.

4 is a flowchart illustrating a malicious code detection method of a malicious code detection system according to another exemplary embodiment of the present invention.

First, the inspection target driver is selected from the driver list (S41). Check the API functions used by the inspected driver by converting the inspected driver into a PE structure (S42). The malicious code suspect API is included among the API functions (S43), and the malicious code suspect API and parameter values are disassembled (S44). Then, it is analyzed whether the malicious code core API is a malicious code API using the disassembled malicious code core API and parameter values (S45). As a result of the analysis of step S45, the driver handle of the driver of the inspection target driver using the malicious code API and the malware code in use are stored in the shared memory (S46).

The driver handle information is used to examine a list of user processes using the driver to be inspected (S47), and analyze whether the corresponding user process calls a malicious code API (S48). Finally, when the user process calls the malicious code API as a result of the analysis of step S48, the execution of the malicious code is disabled (S49). This may be achieved by closing the driver handle or terminating the user process.

The technical spirit of the present invention has been described above with reference to the accompanying drawings, but this is by way of example only for describing the best embodiment of the present invention and not for limiting the present invention. In addition, it is obvious that any person skilled in the art can make various modifications and imitations without departing from the scope of the technical idea of the present invention.

Claims

Kernel driver search unit for selecting the driver to be scanned,

A kernel driver converting unit for checking API functions used by the inspected driver;

A kernel driver analysis unit for analyzing whether a malicious code suspect API is included among the API functions used by the inspected driver;

And a malicious code analysis unit for analyzing whether the malicious code core API is a malicious code API by disassembling the malicious code core API and parameter values used by the inspection target driver.
The malware detection system of claim 1, further comprising a disabling processing unit configured to disable operation of the inspection target driver when the inspection target driver uses the malware API as a result of the analysis of the malware analysis unit.
The malware detection system of claim 2, wherein the disabling processor closes the driver handle of the driver to be inspected.
Kernel driver search step of selecting the driver to be scanned,

A kernel driver converting step of checking API functions used by the inspected driver;

A kernel driver analysis step of analyzing whether a malicious code suspect API is included among API functions used by the target driver;

And a malicious code analysis step of analyzing whether the malicious code core API is a malicious code API by disassembling the malicious code core API and parameter values used by the inspection target driver.
The method of claim 4, further comprising disabling a processing step of disabling the operation of the inspection target driver when the inspection target driver uses the malware API as a result of the analysis of the malware analysis step. .
The method of claim 5, wherein the disabling process closes the driver handle of the driver to be inspected.
Kernel driver search unit for selecting the driver to be scanned,

A kernel driver converting unit for checking API functions used by the inspected driver;

A kernel driver analysis unit for analyzing whether a malicious code suspect API is included among the API functions used by the inspected driver;

A malicious code analysis unit for analyzing whether the malicious code core API is a malicious code API by disassembling the malicious code core API and parameter values used by the inspection target driver;

A user process search unit for investigating a user process using the scan target driver when the malicious code API is included in the scan target driver;

And a user process analyzer for analyzing whether the user process calls the malicious code API to detect whether the malicious code API of the driver to be inspected is actually executed.
8. The malicious code detection system according to claim 7, further comprising a disabling processing unit for disabling the operation of the inspection target driver when the user process calls the malicious code API as a result of the analysis of the user process analyzing unit.
The system of claim 8, wherein the disabling processor closes the driver handle of the driver to be inspected.
The system of claim 8, wherein the disabling processing unit terminates the user process.
The method of claim 8, wherein when the malicious code analysis unit includes the malicious code API, the malicious code analysis unit stores the driver handle and malicious code API information of the scanning target driver in a shared memory, and the user process searching unit stores the scanning target. And a user process using the driver to be scanned using a driver handle of a driver.
Kernel driver search step of selecting the driver to be scanned,

A kernel driver converting step of checking API functions used by the inspected driver;

A kernel driver analysis step of analyzing whether a malicious code suspect API is included among API functions used by the target driver;

A malicious code analysis step of analyzing whether the malicious code core API is a malicious code API by disassembling the malicious code core API and parameter values used by the inspection target driver;

A user process search step of examining a user process using the scan target driver if the malicious code API is included in the scan target driver as a result of the analysis of the malicious code analysis step;

And a user process analysis step of detecting whether the malicious code API of the driver to be inspected is actually executed by analyzing whether the user process calls the malicious code API.
The malicious code detection method according to claim 12, further comprising a disabling process for disabling the operation of the driver to be inspected when the user process calls the malicious code API as a result of the analysis of the user process analysis step.
The method of claim 13, wherein the disabling process closes the driver handle of the driver to be inspected.
14. The malicious code detection method according to claim 13, wherein said disabling process terminates said user process.
The method of claim 12, wherein when the malicious code API is included in the driver to be scanned, the malicious code analysis step stores the driver handle and malicious code API information of the driver to be scanned in a shared memory. And detecting a user process using the driver to be scanned using the driver handle of the driver to be scanned.