WO2014098387A1

WO2014098387A1 - Apparatus and method for diagnosing malicious application

Info

Publication number: WO2014098387A1
Application number: PCT/KR2013/010994
Authority: WO
Inventors: 주설우
Original assignee: 주식회사 안랩
Priority date: 2012-12-17
Filing date: 2013-11-29
Publication date: 2014-06-26

Abstract

According to the present invention, in diagnosing a malicious application in a portable terminal such as an Android OS-based smart phone, the malicious application can be rapidly and accurately diagnosed, and performance degradation of the terminal can be prevented by extracting a DEX file including the execution codes of an application in an apk file which is an installation file of the application, uncompressing only a partial region of a DEX file header including hash information for verifying the DEX file in the DEX file, and checking for the presence of the malicious application by comparing the hash information recorded in the DEX file header with signature hash information.

Description

Malicious application diagnosis device and method

The present invention relates to the diagnosis of malicious applications. In particular, in diagnosing malicious applications in a mobile terminal such as an Android OS-based smartphone, a malicious application can be diagnosed more quickly and accurately while using minimal hardware resources. The present invention relates to an apparatus and method for diagnosing malicious applications.

Recently, with the development of mobile communication technology as well as wired and wireless Internet, mobile phones having various functions such as wireless Internet function as well as telephone call function have been widely used. In particular, the smart phone (smartphone) has been spreading in recent years, it is possible to install a variety of applications such as multimedia playback function, users are using the smartphone for various purposes.

In general, a smart phone combines the advantages of a mobile phone and a personal digital assistant (PDA). The smart phone is implemented by integrating data communication functions such as scheduling, fax transmission and Internet access. In general, a smart phone is equipped with a wireless communication module such as Wi-Fi, and can transmit and receive data through the Internet network. Also, it is possible to search for information on the Internet and to send and receive picture information such as directions by using an electronic pen on the liquid crystal display. .

Such smartphones have their own operating systems, and active development of applications that can be executed by the operating systems is being made.

Among the operating systems of smartphones, the Android platform is an open source platform opened by Google's OHA (Open Handset Alliance). It is a Linux kernel, a virtual machine (VM) and a frame. Framework refers to a software package that includes both the application and the application.

As the expectation of users on the Android platform rises and the number of portable devices such as smartphones equipped with the Android platform increases due to the high response of the terminal manufacturers and mobile communication service providers, the Android application market has begun to be activated. Demand for Android applications is growing.

On the other hand, as the number of smartphone users equipped with the Android platform increases, malicious codes targeting the Android OS are also rapidly increasing, and the Android malware producers use various techniques learned in the existing PC environment to produce Android malicious applications. Reflecting, it is developing faster than that on PC.

In the past, the malicious application is typically produced by modifying the classes.dex and AndroidManifest.xml files included in the Android application APK file.

Accordingly, in order to detect Android malicious applications as described above, the apk file of the Android application is decompressed to detect a hash value for all apk decompressed files, and the detection is performed by comparing with a DB having a signature for the malicious application. .

However, in the conventional method of decompressing all apk files of an application to obtain hash information for all the decompressed files and diagnosing a malicious application based on the signature hash information, it takes a long time to decompress the apk file. As a result, there was a problem such as a decrease in the performance of the portable terminal.

Accordingly, the present invention is to diagnose a malicious application in a portable terminal such as an Android OS-based smartphone, the header of the DEX file containing the executable code of the application in the apk (application package) file that is the installation file of the application It extracts the hash information of the application to be diagnosed by extracting only part of the image, and compares the extracted hash information with pre-stored signature hash information to check whether the malicious application is a malicious application while using minimal hardware resources. To provide a device and method for diagnosing malicious applications that can diagnose the virus more quickly and accurately.

The present invention described above is a malicious application diagnosis apparatus, and includes a signature DB storing normal or malicious signature hash information for an application that can be installed in a portable terminal, and execution code and hash information of the application from the APK file of the application. A file extracting unit for extracting a specific file, a diagnostic information extracting unit for extracting hash information of the application from the specific file extracted by the file extracting unit, and hash information of the application extracted from the diagnostic information extracting unit; And a diagnosis unit for comparing the signature hash information previously stored in the signature DB, and diagnosing whether the corresponding application is malicious.

The file extracting unit may extract and extract only the specific file from the APK file.

The diagnostic information extracting unit may extract the hash information by parsing a header of the specific file.

The hash information may be recorded in a predetermined area set in the header.

The hash information may be recorded in 20 bytes from 0x0C to 0x1F on the header.

The specific file may be a DEX file.

The diagnostic unit may diagnose the application as a normal application when the hash information of the application matches the normal signature hash information stored in the signature DB.

The diagnosis unit may diagnose the application as a malicious application when the hash information of the application matches the malicious signature hash information stored in the signature DB.

The diagnostic unit may block installation of the mobile terminal with respect to the application diagnosed as a malicious application or delete the application with respect to an already installed application.

In addition, the portable terminal is characterized in that the electronic device equipped with the Android OS.

The present invention also provides a method for diagnosing malicious applications, the method comprising: extracting a specific file including execution code and hash information of the application from an APK file of an application existing in a portable terminal; and hash information of the application from the specific file. Extracting and comparing hash information of the application with previously stored normal or malicious signature hash information, and diagnosing whether the application is malicious or normal based on the comparison result.

The diagnosing may include checking whether the hash information of the application matches the normal or malicious signature hash information, and if the hash information of the application matches the normal signature hash information, the application returns to the normal application. And diagnosing the application as a malicious application when the hash information of the application coincides with the malicious signature hash information.

In addition, if it is determined that the application is a malicious application, blocking the installation of the application to the portable terminal, and if the application is already installed in the portable terminal further comprises the step of deleting the application It features.

The extracting of the specific file may include extracting and extracting only the specific file from the APK file.

The hash information may be included in the header of the specific file and extracted through parsing the header.

The hash information may be recorded in a predetermined area set in the header.

The specific file may be a DEX file.

In the present invention, in diagnosing a malicious application in a mobile terminal such as an Android OS-based smartphone, the DEX file including the executable code of the application in the apk file, which is the installation file of the application, is extracted, and the DEX file in the DEX file is verified. By extracting only a part of the DEX file header containing the hash information to compare the signature information with the hash information recorded in the DEX file header, it checks whether the malicious application is a malicious application while preventing the performance degradation of the device. There is an advantage that can be diagnosed more quickly and accurately.

1 is a detailed block diagram of a malicious application diagnostic apparatus according to an embodiment of the present invention;

2A is a diagram illustrating a structure of a DEX file to which an embodiment of the present invention is applied;

2b is a diagram illustrating a structure of a DEX file header to which an embodiment of the present invention is applied;

3 is an operation control flowchart for diagnosing malicious applications according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, when it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the specification.

Combinations of each block of the accompanying block diagram and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

1 is a detailed block diagram of a diagnostic apparatus 100 for diagnosing a malicious application of a portable terminal according to an embodiment of the present invention. The file extracting unit 104, the diagnostic information extracting unit 106, and the diagnosing unit ( 108), signature DB (database) 102, and the like. Such a portable terminal may include a terminal such as a smartphone and a tablet PC.

Hereinafter, an operation of each part of the malicious application diagnosis apparatus 100 of the present invention will be described in detail with reference to FIG. 1.

First, the signature DB 102 stores white signature hash information and / or malware signature hash information for an application installed in the portable terminal.

The file extraction unit 104 extracts only the DEX file 150 from an application newly downloaded and installed in the portable terminal or an APK file of a previously installed application. The DEX file 150 may include hash information for verifying the execution code of the application and the DEX file. Therefore, the present invention extracts only the DEX file 150 without decompressing and checking all the files of the APK so that the application can be used to quickly and accurately check the maliciousness of the application.

The diagnostic information extractor 106 extracts the hash information included in the DEX file 150 extracted by the file extractor 104 to verify the execution code of the application. In this case, since the hash information as described above may exist in the header of the DEX file 150, the diagnostic information extracting unit 106 does not decompress the entire DEX file 150, and the hash information is recorded on the header. Hash information can be extracted by decompressing only the region. Such hash information may be, for example, a SHA-1 hash, and may be recorded in 20 bytes from 0x0C to 0x1F on the header of the DEX file 150.

The diagnosis unit 108 compares the hash information of the diagnosis target application extracted from the diagnosis information extraction unit 106 with normal or malicious signature hash information previously stored in the signature DB 102 and diagnoses whether the corresponding application is malicious. do.

That is, the diagnosis unit 108 may determine, for example, that the application is a normal application when the hash information of the application coincides with the normal signature hash information stored in the signature DB 102. In addition, the diagnosis unit 108 may diagnose the malicious application when the hash information of the application coincides with the malicious signature hash information. In this case, the diagnosis unit 108 may block the installation of the mobile terminal for the corresponding application diagnosed as the malicious application as above, or delete the corresponding application for the already installed application.

2A and 2B show the structure of the DEX file 150 and the structure of the DEX file header, respectively.

As shown in FIG. 2A, the DEX file header 200 is positioned at the beginning of the file in the structure of the DEX file 150, and the structure of the DEX file header 200 is illustrated in FIG. 2B.

As shown in Fig. 2B, it can be seen that SHA-1 hash information is recorded in a predetermined area 250 of the DEX file header 200, for example, a 20 byte area from 0x0C to 0x1F.

Therefore, only 20 bytes from 0x0C to 0x1F are extracted in the area of the DEX file header 200 to extract hash information, and the extracted hash information and the malicious or normal signature hash information previously stored in the signature DB 102 are thus extracted. By comparing, you can determine whether the application is malicious.

That is, the diagnostic apparatus 100 as described above does not decompress the entire DEX file 150, but for example, the predetermined area 250 of the DEX file header 200 in which hash information is recorded, that is, 0x0C to 0x1F. By decompressing only 20 bytes up to a diagnosis, the minimum hardware resource can be used and the diagnosis time can be minimized. Also, due to the nature of the SHA-1 hash, the redundancy rate is close to 0, which is possible. Can be greatly reduced.

Hereinafter, with reference to the configuration described above, the operation control process for diagnosing malicious applications in the malicious application diagnosis apparatus 100 according to an embodiment of the present invention will be described in detail with reference to the flowchart of FIG.

First, when a malicious application diagnosis for a portable terminal is requested, the file extractor 104 in the diagnosis apparatus 100 performs a file type analysis on the files installed in the portable terminal (S300).

According to the file type analysis, the file extraction unit 104 searches for an application having the apk file format in the analysis target files (S302).

In this case, when an application having an apk file format is searched, the file extractor 104 extracts a specific file, for example, a DEX file 150, having hash information capable of verifying whether the application is malicious from an apk file of the corresponding application. (S304). The DEX file 150 may include an execution code of the application and hash information for verifying the DEX file 150.

Subsequently, the diagnostic information extracting unit 106 extracts the hash information included in the DEX file 150 extracted by the file extracting unit 104 to verify the execution code of the application (S306). In this case, the above hash information may exist in the header 200 of the DEX file 150.

That is, the diagnostic information extracting unit 106 does not decompress the entire DEX file 150, but decompresses only a predetermined area 250 of the DEX file header 200 in which the hash information is recorded on the header 200. The hash information recorded in the predetermined area 250 of the 200 may be extracted. In this case, the hash information may be, for example, a SHA-1 hash, and may be recorded in 20 bytes from 0x0C to 0x1F on the DEX file header 200. Therefore, the diagnostic information extraction unit 106 extracts the hash information by decompressing only 20 bytes from 0x0C to 0x1F on the DEX file header 200 without decompressing the entire DEX file 150.

As described above, the hash information of the application extracted from the diagnostic information extraction unit 106 may be provided to the diagnosis unit 108 for diagnosing whether the application is malicious.

Then, the diagnosis unit 108 compares the hash information of the diagnosis target application extracted from the diagnosis information extraction unit 106 with the normal or malicious signature hash information previously stored in the signature DB 102 to diagnose whether the application is malicious. It may be (S308).

That is, the diagnosis unit 108 may determine, for example, that the application is a normal application when the hash information of the application coincides with the normal signature hash information stored in the signature DB 102. In addition, the diagnosis unit 108 may diagnose the malicious application when the hash information of the application coincides with the malicious signature hash information.

According to the result of the diagnosis of the malicious application, the diagnosis unit 108 blocks the installation of the portable terminal when the diagnosis target application is diagnosed as the malicious application (S310), or deletes the application for the already installed application. Can be made (S312).

As described above, in the present invention, in diagnosing a malicious application in a portable terminal such as an Android OS-based smartphone, a DEX file including an executable code of an application in an apk file, which is an installation file of the application, is extracted and the DEX file is extracted. Decompresses only a portion of the DEX file header that contains the hash information to verify my DEX file, and compares the hash information recorded in the DEX file header with the signature hash information to check whether the application is malicious or not. It also helps to diagnose malicious applications more quickly and accurately.

Meanwhile, in the above description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the invention should be determined by the claims rather than by the described embodiments.

Claims

A signature DB storing normal signature hash information or malicious signature hash information for an application that can be installed in a portable terminal;

A file extraction unit for extracting a specific file including execution code and hash information of the application from the application package (Apk) file of the application;

A diagnostic information extraction unit for extracting hash information of the application from the specific file extracted by the file extraction unit;

A diagnosis unit for comparing the hash information of the application extracted from the diagnostic information extraction unit with the signature hash information previously stored in the signature DB, and then diagnoses whether the application is malicious

Malicious application diagnostic device comprising a.
The method of claim 1,

The file extraction unit,

Malicious application diagnostic apparatus, characterized in that to extract and extract only the specific file from the APK file.
The method of claim 1,

The diagnostic information extraction unit,

And extracting the hash information by parsing the header of the specific file.
The method of claim 3, wherein

The hash information,

Malicious application diagnostic apparatus, characterized in that recorded in the predetermined predetermined area on the header.
The method of claim 4, wherein

The hash information,

Malicious application diagnostic apparatus, characterized in that recorded in 20 bytes from 0x0C to 0x1F on the header.
The method of claim 1,

The specific file is,

Malicious application diagnostic device, characterized in that the DEX file.
The method of claim 1,

The diagnostic unit,

And if the hash information of the application matches the normal signature hash information stored in the signature DB, diagnosing the corresponding application as a normal application.
The method of claim 1,

The diagnostic unit,

And when the hash information of the application matches the malicious signature hash information stored in the signature DB, diagnosing the corresponding application as a malicious application.
The method of claim 8,

The diagnostic unit,

Apparatus for diagnosing a malicious application characterized in that the installation of the portable terminal is blocked for the application diagnosed as a malicious application or deletes the application for an already installed application.
The method of claim 1,

The portable terminal,

Malicious application diagnostic device, characterized in that the electronic device equipped with Android OS.
Extracting a specific file including execution code and hash information of the application from the APK file of the application existing in the portable terminal;

Extracting hash information of the application from the specific file;

Comparing the hash information of the application with previously stored normal signature hash information or malicious signature hash information;

Diagnosing whether the application is malicious or normal based on the comparison result

Malicious application diagnostic method comprising a.
The method of claim 11,

The diagnosing step is

Checking whether the hash information of the application matches the normal signature hash information or malicious signature hash information;

Diagnosing the application as a normal application when the hash information of the application matches the normal signature hash information;

Diagnosing the application as a malicious application when the hash information of the application matches the malicious signature hash information.

Malicious application diagnostic method comprising a.
The method of claim 12,

If it is determined that the application is a malicious application, blocking the installation of the application to the portable terminal;

Deleting the application if the application is already installed in the portable terminal;

Malicious application diagnostic method characterized in that it further comprises.
The method of claim 11,

Extracting the specific file,

Malicious application diagnostic method characterized in that to extract and extract only the specific file from the APK file.
The method of claim 11,

The hash information,

It is included in the header of the particular file, characterized in that extracted through the parsing of the header application diagnostic method.
The method of claim 15,

The hash information,

Malicious application diagnostic method, characterized in that recorded in the predetermined predetermined area on the header.
The method of claim 16,

The hash information,

Malicious application diagnostic method, characterized in that recorded in 20 bytes from 0x0C to 0x1F on the header.
The method of claim 11,

The specific file is,

Malicious application diagnostic method, characterized in that the DEX file.