WO2014088276A1

WO2014088276A1 - Abnormal path call detecting apparatus and abnormal path call detecting method

Info

Publication number: WO2014088276A1
Application number: PCT/KR2013/011069
Authority: WO
Inventors: 김일용; 최유나
Original assignee: 주식회사 안랩
Priority date: 2012-12-04
Filing date: 2013-12-02
Publication date: 2014-06-12
Also published as: KR20140071818A; KR101444929B1

Abstract

Disclosed are an abnormal path call detecting apparatus and an abnormal path call detecting method. Embodiments of the present invention pertain to a technology for efficiently increasing the reliability of a determination result of whether a function call is an abnormal path call by determining whether a significant function not exposed externally is called through an abnormal path by a malicious subject using a last branch record (LBR).

Description

Abnormal path call detection device and abnormal path call detection method

Embodiments of the present invention relate to techniques that can effectively increase the reliability of a determination result of determining whether a malicious function is called through an abnormal path to an important function not exposed to the outside.

Currently, malicious behavior that targets online games by malicious behavior that calls critical functions in the unlicensed memory area to use critical functions provided by the critical functions even in unauthorized situations is possible. It is reported a lot in the tool.

Now, when an important function is called, the return address checking method that checks the return address and detects whether the call is a malicious action or not, and the thread information by checking the thread information, the call is caused by a malicious action. These malicious behaviors are detected by using thread information inspection methods that detect whether they are aware or not.

However, there is a structural problem that the return address checking method cannot be applied when the call stack is not generated according to the compilation method, and even if it is generated, a branch instruction to malicious code in a normal position is generated. There is a problem that it can be easily bypassed when modifying the return address to the corresponding position when calling a critical function.

On the other hand, the thread information checking method is widely known to access and modify the thread information structure existing in the user area, and it is possible to easily bypass the thread information by modifying its thread information to valid information before calling important functions. If the critical function is abnormally called by intercepting the execution flow of a normal thread using a technique such as hooking, the thread information itself is normal and thus cannot be detected.

Therefore, the above limitations of the return address checking method and the thread information checking method are overcome, and whether an important function that is not exposed to the outside is called by malicious behavior, that is, whether it is called through an abnormal path by a malicious subject. There is a growing need for measures that can be judged with high reliability.

Accordingly, the present invention intends to propose a method for effectively increasing the reliability of a determination result of determining whether an important function that is not exposed to the outside, that is, a protected object function is called through an abnormal path by a malicious subject.

Embodiments of the present invention by using the LBR function to determine whether an important function that is not exposed to the outside through the abnormal path by the malicious subject, effectively the reliability of the determination result of the abnormal path call of the function call It is possible to propose technical measures to increase.

Abnormal path call detection method according to a first aspect of the present invention for achieving the above object, the protected object function call step of calling a specific protected object function; Among the stack information recorded by the last branch record (LBR) function, recording is performed between a first time point at which the specific protection subject function is called and a second time point earlier than the first time in relation to the specific protection target function. A stack information checking step of checking the stacked stack information; And an abnormality determination step of determining whether the specific protected object function is called through an abnormal path based on the stack information recorded between the first time point and the second time point.

The abnormal path call detection apparatus according to the second aspect of the present invention for achieving the above object is related to the specific protected object function from the stack information recorded by the LBR function when a specific protected object function designated as a protected object is called. A stack information verification unit for confirming stack information recorded between a first time point at which the specific protected object function is called and a second time point that is earlier than the first time point by a specific time point; And an abnormality determination unit determining whether the specific protected object function is called through an abnormal path based on the stack information recorded between the first time point and the second time point.

Embodiments of the present invention can derive an effect that can effectively increase the reliability of the determination result of determining whether an important function not exposed to the outside is called through the abnormal path by the malicious subject.

1 is an exemplary view showing an execution path according to a call of an abnormal path call detection device and a protection target function according to an embodiment of the present invention.

2 is a flowchart illustrating an operation flow of an abnormal path call detection method according to an embodiment of the present invention.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the drawings, similar reference numerals are used for similar elements.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention.

First, an abnormal path call detection apparatus according to an embodiment of the present invention will be described with reference to FIG. 1.

As shown in FIG. 1, the apparatus 100 for detecting abnormal path calls according to an embodiment of the present invention includes a stack information checking unit 120 and an abnormality determining unit 130, and further, an LBR function activation control unit. 110 may further include.

The abnormal path call detection apparatus 100 may be included in a computer system equipped with a functional unit (for example, a CPU) that basically supports the LBR function, and furthermore, may be mounted in the computer system in the form of a module.

When the LBR function is activated, the LBR function is activated every time a branch instruction such as Call, Jump, Return, etc. is executed at the machine level, and whenever an interrupt instruction or an exception instruction is executed. This function is used to store a specified number of LBR stacks in a designated storage location, for example, a model-specific register (MSR).

The LBR function activation control unit 110 activates the LBR function before a specific protection target function designated as a protection target is called.

Here, the protected object function may be previously designated as an important function for providing an important function that should not be exposed to the outside.

Accordingly, the LBR function activation control unit 110 may activate the LBR function supported by the CPU as described above before the predetermined specific protection target function is called as described above.

For example, an execution path according to a call when a call is made by a normal subject, that is, a normal subject of an allowed memory region, is predictable for a specific protected function.

Accordingly, the LBR function activation control unit 110 calls the LBR function activation function (eg, Enable_LBR ()) in the execution path when the LBR function activation function is called by the normal subject with respect to the specific protected object function, thereby calling the specific protected object function. You can enable the LBR function as Enable_LBR () is called before. Of course, the LBR function activation control unit 110 may adopt any one of various existing methods in addition to this, and may activate the LBR function before a specific protection target function is called.

As such, when the LBR function is activated by the LBR function activation control unit 110, whenever a branch statement such as Call, Jump, Return, etc. is executed according to the activated LBR function, and when an interrupt command or an exception command is executed Each time, these instructions will be stored / written to the specified number of LBR stacks located inside the MSR.

Therefore, the stack information recorded on the LBR stack by the LBR function is stored in the call subject for each function call event of each function executed / called by the aforementioned branch statement, interrupt instruction, or exception instruction. The address information and the called target address information in which the called function is stored may be mapped and stored in pairs.

The stack information checking unit 120, when the specific protection target function specified as the protection target is called, the first point in time and the tactic in which the specific protection target function is called in relation to the specific protection target function among the stack information recorded by the LBR function. The stack information recorded between the second time point preceding the specific time point of the first time point is checked.

That is, when the specific protected object function is called by an external subject (normal or abnormal subject), the stack information checking unit 120 calls this time among the stack information recorded in the LBR stack located inside the MSR by the LBR function. Check the stack information associated with the specific protected function.

In this case, the stack information checking unit 120 may check all of the stack information recorded between the first time point at which the specific protection target function is called and the second time point earlier than the first time point described above among the stack information. .

For example, the stack information checking unit 120 may check a stack information related to a specific protected object function called this time among stack information recorded in the LBR stack in the execution path of the specific protected object function (eg, LBR_IsValidCall ()). ), As a function (eg, LBR_IsValidCall ()) is called, it may be possible to check the stack information recorded between the first time point and the second time point as described above. Of course, the stack information confirming unit 120 adopts any one of various existing methods, and displays the stack information recorded between the first time point and the second time point related to the specific protected object function that is called this time from the stack information. You will see.

Here, the second time point is a time point at which the LBR function is activated by the LBR function activation control unit 110 or after a time point at which the LBR function is activated by the LBR function activation control unit 110 and before the first time point described above. It may be a time point.

Accordingly, as shown in FIG. 1, referring to the case where a specific protected object function is Function_Idx1 (), the function_Idx1 () is an external subject (normal) in the abnormal path call detection apparatus 100 according to an embodiment of the present invention. When called by a subject or an abnormal subject, explain the execution path according to the call.

That is, in the abnormal path call detection apparatus 100 according to an embodiment of the present invention, as described above, the LBR function activation control unit 110 before the protected object function, that is, Function_Idx1 () is called, that is, Enable_LBR (). The LBR function is activated by a function call. When the protected object function, that is, Function_Idx1 () is called by an external subject (normal subject or abnormal subject), the abnormal path call detection apparatus 100 according to an embodiment of the present invention, the stack information check unit 120, and the like. That is, the stack information recorded between the first time point and the second time point related to the specific protected object function called this time can be checked from the stack information recorded on the LBR stack by the LBR_IsValidCall () function call during the execution of Function_Idx1 (). .

Thus, as shown in Table 1 below, the stack information checked by the stack information checking unit 120 includes, for each function call event of each function, call subject address information and a called function stored therein. Stored call destination address information will be mapped in pairs to have a stored structure.

Table 1

Stack Information	Caller Address Information (FromIP)	Destination address information (ToIP)
...	...	...
4	...	...
5	① address information	② address information (= address information of Function_Idx1 ())
6	③ address information	LBR_IsValidCall () address information
...	...	...

Specifically, as shown in Table 1, for each function call event of each function, the address information and the protected object function of ① where the subject ① calling the protected function Function_Idx1 () is stored for the function call event of the protected function. Address information of ②, which is the starting position of Function_Idx1 (), is mapped into a pair, and address information of the subject ③ that calls LBR_IsValidCall () function for the function call event of LBR_IsValidCall () function and starting position of LBR_IsValidCall (). The address information of LBR_IsValidCall () will be mapped and stored in pairs.

In this case, stack information, for example, stack information 5 in which address information of ① and address information of ② are mapped in pairs, corresponds to the first point of time described above, and the stack information checking unit 120 starts from the first point of time, that is, stack information 5. We will check all stack information up to the second time point, such as stack information 4, stack information 3, etc ..

The abnormality determination unit 130 determines whether a specific protected object function is called through an abnormal path based on the stack information recorded between the first time point and the second time point checked by the stack information checking unit 120 described above. To judge.

More specifically, the abnormality determination unit 130 checks the stack information recorded between the first time point and the second time point in the stack information checking unit 120 described above, and thus, the stack between the first time point and the second time point. If there is no information, that is, if no information is recorded in the LBR stack, it is determined that the LBR function is not activated by a malicious subject, and it is determined that the specific protected function called this time was called through an abnormal path. can do.

For example, if the protected object function is called by a normal subject, the LBR function may be activated by the LBR function activation control unit 110, that is, the LBR function activation function (eg, Enable_LBR ()), during the execution path. If the malicious subject (eg, hacking tool) in memory area calls the protected object directly through hooking such as Jump, the LBR function may not be activated.

Thus, the abnormality determination unit 130 has the stack information between the first time point and the second time point as a result of checking the stack information recorded between the first time point and the second time point in the stack information checking unit 120 described above. Otherwise, if no information is recorded in the LBR stack, it can be determined that the LBR function has not been activated by a malicious subject, and as a result, it is determined that the specific protected function called this time was called through an abnormal path. Can be.

Meanwhile, the abnormality determination unit 130 checks the call subject address information for each function call event of the stack information recorded between the first time point and the second time point in the stack information checking unit 120 described above, and then returns to the normal path. If address information other than the designated address information belonging to the terminal is confirmed, it may be determined that the specific protection target function called this time is called through an abnormal path.

For example, the abnormality determination unit 130, the address information of the calling subject that can be included in the execution path when the protection target function is called by the normal subject, that is, the predetermined address information that can be determined to belong to the normal path May have them in advance.

Therefore, the abnormality determination unit 130 confirms the call subject address information for each function call event of the stack information recorded between the first time point and the second time point in the stack information checking unit 120 described above, and makes each call. By comparing the address information of the subject with the address information belonging to the normal path, it can be determined that the specific protected object function called this time is called through the abnormal path when the address information other than the address information belonging to the normal path is confirmed.

As described above, the abnormal path call detection apparatus 100 according to an exemplary embodiment of the present invention determines whether an important function that is not exposed to the outside is called through an abnormal path by a malicious subject of an unauthorized memory area. In the judgment, it is possible to effectively increase the reliability of the determination result of the abnormal path call of the function call by judging using a stable and difficult to bypass function provided by the hardware, that is, the LBR (Last Branch Record) function.

Hereinafter, a method for detecting an abnormal path call according to an embodiment of the present invention will be described with reference to FIG. 2. Here, for the convenience of description, the configuration shown in FIG. 1 described above will be described with reference to the corresponding reference numerals.

The abnormal path call detection method according to an embodiment of the present invention activates the LBR function before a specific protection target function previously designated as a protection target is called (S100). Here, the protected object function may be previously designated as an important function for providing an important function that should not be exposed to the outside.

Accordingly, the abnormal path call detection method according to an embodiment of the present invention may activate the LBR function supported by the CPU as described above before the predetermined specific protection target function is called as described above.

Therefore, the abnormal path call detection method according to an embodiment of the present invention, by calling the LBR function activation function (for example, Enable_LBR ()) in the execution path when the call to the specific protected function by the normal subject, It is possible to enable the LBR function as Enable_LBR () is called before the protected function is called. Of course, the abnormal path call detection method according to an embodiment of the present invention, in addition to adopting any one of a variety of existing methods, it will be possible to activate the LBR function before a specific protected object function is called.

In the abnormal path call detection method according to an embodiment of the present invention, when a specific protected object function designated as a protected object is called (S110 Yes), the specific path object detection function is related to the specific protected object function from the stack information recorded by the LBR function. The stack information recorded between the first time point at which the protection target function is called and the second time point earlier than the first time point described above is checked (S120).

That is, in the abnormal path call detection method according to an embodiment of the present invention, when a specific protected object function is called by an external subject (either a normal subject or an abnormal subject), the LBR function is recorded in the LBR stack located inside the MSR by the LBR function. Among the stack information, check the stack information related to the specific protected function called this time.

At this time, in the abnormal path call detection method according to an embodiment of the present invention, a stack recorded between the first time point that the specific protected object function is called and the second time point earlier than the first time point described above among the stack information. You can check all the information.

For example, an abnormal path call detection method according to an embodiment of the present invention includes a function for confirming stack information related to a specific protected object function called this time among stack information recorded in the LBR stack in the execution path of the specific protected object function. As a function (eg, LBR_IsValidCall ()) is called by calling LBR_IsValidCall (), it may be possible to check the stack information recorded between the first time point and the second time point as described above. Of course, the abnormal path call detection method according to an embodiment of the present invention, in addition to adopting any one of a variety of existing methods, between the first time point and the second time point associated with the specific protected object function that is called this time from the stack information You will see the stack information recorded in.

Here, the second time point may be a time point at which the LBR function is activated or a specific time point after the time point at which the LBR function is activated and before the first time point described above.

Therefore, the abnormal path call detection method according to an embodiment of the present invention, based on the stack information recorded between the first time point and the second time point identified in step S120 described above, whether the specific protection target function is called through the abnormal path; Determine whether or not.

More specifically, in the abnormal path call detection method according to an embodiment of the present invention, as a result of checking stack information recorded between the first time point and the second time point, there is no stack information between the first time point and the second time point. If no information is recorded in the LBR stack (S130 No), it is determined that the LBR function is not activated by a malicious subject, and it is determined that a specific protected function called this time is called through an abnormal path. It may be (S160).

For example, if the protected function is called by a normal subject, the LBR function may have been activated by the above LBR function activation function (e.g. Enable_LBR ()) in the execution path, but it may be a malicious subject (eg : LBR function may not be activated if hacking tool) calls protected target function through hooking such as Jump.

Therefore, the abnormal path call detection method according to an embodiment of the present invention, if the stack information between the first time point and the second time point as a result of checking the stack information recorded between the first time point and the second time point, that is, LBR If no information is recorded on the stack, it can be determined that the LBR function is not activated by a malicious subject, and as a result, it can be determined that the specific protected function called this time was called through an abnormal path.

On the other hand, in the abnormal path call detection method according to an embodiment of the present invention, if the stack information between the first time point and the second time point as a result of the determination in step S130 described above (S130 Yes), the first time point and the second time point When the address information of each function call event recorded in the stack information recorded between is checked and address information other than the designated address information belonging to the normal path is checked (S140 Yes), the specific protected object function called this time is an abnormal path. It may be determined that the call through (S160).

For example, in the abnormal path call detection method according to an embodiment of the present invention, it may be determined that the abnormal path call detection method belongs to address information, that is, normal path, which may be included in an execution path when a protected function is called by a normal subject. It may have previously specified address information.

Therefore, in the abnormal path call detection method according to an embodiment of the present invention, the call subject address information for each function call event of the stack information recorded between the first time point and the second time point is checked, and the address information of each call subject is determined. By comparing the address information belonging to the normal route with the previously held, if the address information other than the address information belonging to the normal path is confirmed, it can be determined that the specific protection target function called this time is called through the abnormal path (S160). If the address information other than the address information is not confirmed, it may be determined that the specific protection target function called this time is called through the normal path (S150). In addition, the abnormal path call detection method according to an embodiment of the present invention may deactivate the LBR function again after a predetermined time elapses after the protection target function is called (S170).

As described above, the abnormal path call detection method according to an exemplary embodiment of the present invention provides a method for determining whether an important function that is not exposed to the outside is called through an abnormal path by a malicious subject of an unauthorized memory region. In addition, by using the stable and difficult to bypass function provided by the hardware, that is, the LBR (Last Branch Record) function, the reliability of the decision result of the abnormal path call of the function call can be effectively increased.

Abnormal path call detection method according to an embodiment of the present invention is implemented in the form of program instructions that can be executed by various computer means may be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all the things that are equivalent to or equivalent to the claims as well as the following claims will belong to the scope of the present invention. .

Claims

A protected object function calling step in which a specific protected object function is called;

Of the stack information recorded by the last branch record (LBR) function, the stack of the specific protected object function recorded between the first time point at which the specific protected object function is called and the second time point earlier than the first time point by the specific time point. Stack information checking step of checking information; And

And an abnormality determination step of determining whether the specific protected object function is called through an abnormal path based on the stack information of the specific protected object function recorded between the first time point and the second time point. Abnormal path call detection method.
The method of claim 1,

And activating the LBR function before the specific protected object function is called.
The method of claim 2,

The second point of time, the abnormal path call detection method, characterized in that after the time or when the LBR function is activated.
The method of claim 1,

The stack information recorded by the LBR function is

For each function call event in which each function is called, abnormal path call detection method, characterized in that the calling party address information stored in the subject calling the function and the call destination address information stored in the called function are mapped and stored in pairs.
The method of claim 1,

The abnormal determination step,

If there is no stack information of the specific protected object function recorded between the first time point and the second time point, it is determined that the LBR function is not activated by a malicious subject, and the specific protected object function is abnormal. The abnormal path call detection method, characterized in that it is determined that the call through the path.
The method of claim 4, wherein

The abnormal determination step,

When the address information of each function call event of the stack information of the specific protected object function recorded between the first time point and the second time point is checked, and address information other than the address information designated as a normal path is confirmed, The abnormal path call detection method, characterized in that it is determined that the specific protected object function is called through the abnormal path.
When a specific protected object function that is designated as a protected object is called, it is recorded between a first time point at which the specific protected object function is called and a second time earlier than the first time point among the stack information recorded by the LBR function. A stack information checking unit for checking stack information of the specific protected target function; And

And an abnormality determination unit determining whether the specific protected object function is called through an abnormal path based on the stack information of the specific protected object function recorded between the first time point and the second time point. Abnormal path call detection device.
The method of claim 7, wherein

An LBR function activation control unit for activating the LBR function before the specific protected object function is called;

The second time point, the abnormal path call detection device, characterized in that the time when the LBR function is activated.
The method of claim 7, wherein

The stack information recorded by the LBR function is

Device for abnormal path call detection, characterized in that for each function call event that each function is called, the calling party address information stored in the subject calling the function and the call destination address information stored in the called function is mapped and stored in pairs.
The method of claim 8,

The abnormal determination unit,

If there is no stack information of the specific protected object function recorded between the first time point and the second time point, it is determined that the LBR function is not activated by a malicious subject, and the specific protected object function is abnormal. Abnormal path call detection device, characterized in that it is determined that the call through the path.
The method of claim 9,

The abnormal determination unit,

When the address information of each function call event of the stack information of the specific protected object function recorded between the first time point and the second time point is checked, and address information other than the address information designated as a normal path is confirmed, The abnormal path call detection device, characterized in that it is determined that the specific protected object function is called through the abnormal path.
A computer-readable recording medium having recorded thereon a program for performing the method of any one of claims 1 to 6.