WO2017094990A1

WO2017094990A1 - Device and method for monitoring malicious code encrypting user files

Info

Publication number: WO2017094990A1
Application number: PCT/KR2016/006650
Authority: WO
Inventors: 배상민; 김준섭; 김건우
Original assignee: (주)이스트소프트; 주식회사 이스트시큐리티
Priority date: 2015-11-30
Filing date: 2016-06-23
Publication date: 2017-06-08
Also published as: KR101710918B1; KR101737794B1

Abstract

A device for monitoring a malicious code according to the present invention comprises: a target file generation module for generating a target file for monitoring a malicious code on a storage device in which a user file is stored; a monitoring module for, if a request for write access is issued to the target file, confirming a thread which issued the request for write access; and a running program abort module for forcibly stopping the thread identified by the monitoring module.

Description

Apparatus and method for monitoring malicious code encrypting user files

The present invention relates to a technique for detecting a computer virus or malware.

As is well known, with the development of memory and communication technology, the performance of computers has been greatly improved compared to the past, and in particular, the spread of the Internet is being expanded by the development of network infrastructure. With the development of communication technologies such as the Internet, numerous computers are connected to each other to share information, and the number of users is increasing day by day.

The environment in which many computers are connected to each other by networking further accelerates the damage caused by malware or computer viruses. Malware (or viruses) that hack information of other Internet users without permission and use it illegally or infiltrate computer terminals and servers of other Internet users are emerging as serious social problems. In particular, malicious code causes problems in various forms, such as when a user who uses the Internet sends data to another person's computer, or by changing an internal system registry of the user's computer so that the wrong site that the user does not intend is set as an Internet site. . Such malware is usually installed on a user's computer through file programs that are easily available on the Internet, or simply by accessing the Internet to arbitrary sites.

On the other hand, recently, after the malware infected with the user system to encrypt the user file, such as a document file, and warns the user, and to recover the encrypted document, such as malware to request the user money with Bitcoin is on the rise. This kind of malware can be detected by an antivirus program or the like, and the malicious code file can be deleted, but it is difficult to recover the document file of an already encrypted user. That is, the antivirus program used to date can delete the file after detecting the malicious code. However, since the decryption key is not known due to the nature of the vaccine, it is impossible to recover the document file of an already encrypted user.

In order to prevent damage caused by malware that encrypts a user file, it is necessary to detect and block the malicious code before encrypting the user file. To this end, an object of the present invention is to provide a malicious code monitoring apparatus and method that can detect the execution of the malicious code encrypting the user file for the first time to prevent the important file stored in the user computer is encrypted.

The malicious code monitoring apparatus according to the present invention includes a target file generation module for monitoring a malicious code encrypting a user file and generating a target file for monitoring the malicious code in a storage device in which the user file is stored; A monitoring module for checking a thread which sends the request when a write access right request is made to the target file; And an execution program interrupting module forcibly terminating the thread identified by the monitoring module.

Here, the target file generation module preferably generates a trap folder in the highest path of the storage device, and generates the target file in the trap folder. At this time, it is more preferable that the trap folder has a folder name searched first by the malicious code. In addition, the trap folder is preferably created with a hidden attribute.

In addition, the apparatus according to the present invention may further include an alarm module for outputting a malicious code infection message when a request for write access permission is made to the target file. Further, the monitoring module preferably blocks the request when there is a request for write access permission to the target file.

The method for monitoring malicious code encrypting a user file according to the present invention includes: a first step of generating, by a target file generation module, a target file for monitoring the malicious code in a storage device in which a user file is stored; A second step of checking, by the monitoring module, a thread which has sent the request, when there is a request for write access right to the target file; And a third step of executing, by the execution program interruption module, the thread forcibly terminating the thread identified by the monitoring module.

In the first step, it is preferable that the target file generation module generates a trap folder in the highest path of the storage device and generates the target file in the trap folder. In addition, the target file generation module preferably generates the trap folder having a folder name searched first by the malicious code. In particular, the target file generation module may more preferably generate the trap folder as a hidden attribute.

In addition, when there is a request for write access permission to the target file, the method may further include outputting a malware infection message by the alarm module.

In the second step, the monitoring module preferably blocks the request if there is a request for write access to the target file.

In order to solve the problem of the present invention, it is possible to provide a computer-readable recording medium in which a program for executing the malicious code monitoring method on a computer is recorded.

According to the malware monitoring apparatus and method according to the present invention, an important file of a user can be effectively prevented from being encrypted by malware. Conventional antivirus programs can detect malware and delete it, but it is not possible to recover user files that have already been encrypted. However, according to the present invention, while creating a virtual target object to be first encrypted by the malicious code and monitoring the processing of the target object, the execution of the application executed by the malicious code or by the accompanying malicious code is executed. By stopping, the user's important files can be prevented from being encrypted in advance.

1 is a schematic block diagram of a malicious code monitoring apparatus according to the present invention.

2 is a flowchart illustrating a process of performing a malicious code monitoring method according to the present invention.

3 illustrates an example in which a trap folder is generated in a user system according to an apparatus and a method for monitoring malware according to the present invention.

4 illustrates an example in which a target file is generated in a trap folder created in a user system according to a malicious code monitoring apparatus and method according to the present invention.

Prior to the description of the present invention, the terms or words used in the specification and claims described below should not be construed as being limited to the ordinary or dictionary meanings, and the inventors should consider their own invention in the best way. For the purpose of explanation, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention on the basis of the principle that it can be appropriately defined as the concept of term. Therefore, the embodiments described in the present specification and the configuration shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all of the technical idea of the present invention, and various equivalents may be substituted for them at the time of the present application. It should be understood that there may be water and variations.

In addition, the combination of each block in the accompanying block diagram and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

Hereinafter, a preferred embodiment of the malicious code monitoring method according to the present invention will be described in detail. However, detailed descriptions of well-known functions and configurations that may blur the gist of the present invention will be omitted.

First, Figure 1 is a schematic block diagram of a malicious code monitoring apparatus 100 according to an embodiment of the present invention, the target file generation module 110, monitoring module 120, execution program interruption module 130 It may include an alarm module 140.

Here, the malicious code infected with the user's system and encrypting arbitrary files of the user (hereinafter, referred to as 'user file') selectively encrypts only files expected to be user files without encrypting general computer system files. To this end, the malware detects (1) a plurality of files in the user storage device, (2) detects an encryption target that is expected to be a user file, and (3) encrypts the target user file (4). This is done by changing the extension of the user file.

Here, the malicious code may be an executable file that encrypts any user document file of the user system. In addition, the user file encrypted by the malicious code may be various types of files that the user stores and manages in his / her system, such as document files, image files such as pictures, and video files.

Such malware may be executed as an independent executable file, but may be executed by parasitic execution of any executable program capable of processing a user file to be encrypted.

In view of the manner in which the malicious code is executed, the present invention first generates any target object to be encrypted by the malicious code, and monitors whether the target object is processed, if it is detected that the target object is processed. Through the process of terminating the execution program processing the target object, the user file is prevented from being encrypted by the malicious code.

In addition, the malicious code monitoring apparatus and method according to the present invention may be executed together with a security program (vaccine) installed and executed in a user system or as a separate execution program.

Referring to Figures 1 and 2, it will be described the specific implementation of the malicious code monitoring apparatus and method according to the present invention.

[Creation of target object]

When the malicious code monitoring apparatus 100 for executing the malicious code monitoring method according to the present invention is installed and executed in a user system, first, the target file generation module 110 generates a target object in the user system (S110). In this case, the target object is generated as a file that can be encrypted by malicious code, and a file extension of a type generally generated by a user (eg, "hwp", "doc", so that the malicious code can be recognized as a user file). "jpg", "txt", etc.). This target file functions as a trap file recognized as a user file by malicious code.

On the other hand, in general, malicious codes executed in the Windows operating system environment are searched from the root of the drive by using an application program interface (API) such as FindFirstFile and FindNextFile. Malware that encrypts user files retrieves user files from the user's main drive (usually a "C" drive) to a removable disk. In other words, the malicious code searches the root of the main drive to find the target to encrypt, and if there is no target file to encrypt in the root, it searches the subfolders in order.

With this in mind, the target file is formed in the highest path in the storage device (fixed drive, removable drive, etc.) in which the user file is stored in the user system. That is, the target file is preferably created to have a file name that can be searched before a user file in a file search by malicious code, or is created in a folder that can be searched first by malicious code. At this time, since the target file is generated for the monitoring of malicious code, the user should not access it randomly. For this purpose, the target file may be set as a "hidden property", but in this case, the malicious code may not recognize the target file as a user file. Therefore, it is preferable that the target file is generated in the trap folder created in the top path, rather than directly in the top path (root) of the user storage device.

3 illustrates a state in which a trap folder is generated in a top path of a user storage device (root of a C drive). Here, the trap folder 210 is generated to have a folder name that can be searched first by malicious code. For example, when the user system is operated by the WINDOW OS, the WINDOW OS is created to have a folder name starting with a lower-order letter of ASCII code among the allowable characters in the path name (ie, folder name). In other words, except for characters that cannot be used as path names (or file names), files or folders are searched in the following order: "!", "@", "#", "$", And so on. ! " For example, a target to be encrypted is detected for a file in a folder whose name starts with a lower ASCII code character.

3 and 4 show an example in which a target file 211 having various types of extensions is created in a trap folder 210 having a folder name "@ $ HbgVF" first searched for by malicious code. It was. When the target file is generated in this manner, the malicious code first attempts to encrypt the target file 211 generated in the trap folder 210. At this time, the folder attribute of the trap folder 210 is set as a "hidden attribute", whereby it is desirable to prevent the user from accessing the trap folder 210 and the target file 210 therein arbitrarily.

[Monitoring processing of target file]

Next, the monitoring module 120 constantly monitors whether the generated target file is processed (S120). For example, malicious code running in the Windows operating system environment can access a file (CreateFile or ZwCreateFile) or modify a file (WriteFile or ZwWriteFile) to secure write access rights to a target when performing encryption. ), The API execution sequence of handle termination (CloseHandle or ZwClose) is performed. As a result, malicious code inevitably requires write access to the file in order to encrypt the file. Therefore, the monitoring module 120 continuously monitors whether a request for obtaining write access permission is received for the generated target files (S121).

On the other hand, if a user writes a request for write access to the target file by any executable program while using his system, the thread will block the request and request write access to the target file. Check (S122). Here, a "thread" is a unit of flow executed in a process when executing a computer program, that is, a series of executable code, and generally has its own unique ID. Therefore, the monitoring module 120 checks a thread that requests write access to the target files, and stores a unique ID of the thread.

[Interruption of Execution Program]

When the thread that attempts to access the target file is checked by the monitoring module 120, the thread ID of the thread is provided to the execution program stopping module 130. Then, the execution program interruption module 130 forcibly terminates the thread corresponding to the unique ID (S130).

Even if the monitoring module 120 blocks the write access permission request for the target file, the malicious code may continuously try to encrypt other user files. Therefore, after checking the thread requesting the write access permission by the monitoring module 120, the thread making the request must be forcibly terminated to prevent the encryption of the user file due to the execution of the malicious code.

On the other hand, if the user system is infected with malware, the malware first encrypts the target file among the files of the user system. In this case, the malicious code may be driven in various ways to encrypt the target file. The malicious code may process and encrypt the target file by itself, or may be parasitic to any executable program and be executed by the target program. You can also encrypt files while processing them. When the malicious code itself processes and encrypts the target file, execution of the malicious code may be forcibly terminated by the execution program interruption module 130. However, if the malicious code is injected and run on an unspecified normal system process, it is preferable to selectively terminate only the corresponding thread rather than terminating the normal system process. Only one thread may exist inside a normal process in which malicious code is injected, but two or more threads may be created. Therefore, it is preferable to selectively find only the thread injected with malicious code in the normal process and forcefully terminate the thread through the method of terminating only the thread that has requested write access to the target file.

[Warning about malware infection]

If the user system is confirmed that the malicious code is infected, that is, if the request for the write access rights to the target file by the monitoring module 120, the alarm module 140 notifies the user that the system is infected with malware. It may be displayed (S140). Through this, the user can back up his important document file to another storage device, thereby effectively preventing his important user file from being encrypted by malware.

Conventional antivirus programs can detect malware and delete it, but it is not possible to recover user files that have already been encrypted. However, as described above, according to the malware monitoring apparatus and method according to the present invention, it is possible to effectively prevent the user's important files are encrypted by the malware.

In addition, the present invention may be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and are also implemented in the form of carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Although a preferred embodiment of the present invention has been described so far, those skilled in the art will be able to implement in a modified form without departing from the essential characteristics of the present invention. Therefore, the embodiments of the present invention described herein are to be considered in descriptive sense only and not for purposes of limitation, and the scope of the present invention is shown in the appended claims rather than the foregoing description, and all differences within the equivalent scope are set forth in the present invention. Should be interpreted as being included in.

Claims

A target file generation module for generating a target file for monitoring malicious codes in a storage device in which a user file is stored;

A monitoring module for checking a thread which sends the request when a write access right request is made to the target file; And

And an execution program interruption module forcibly terminating the thread identified by the monitoring module.
The method of claim 1,

The target file generation module generates a trap folder in a top path of the storage device and generates the target file in the trap folder.
The method of claim 2,

The trap folder is characterized in that it has a folder name first searched by the malicious code, malware monitoring device.
The method of claim 2,

The trap folder is characterized in that the generated hidden attribute, malware monitoring device.
The method of claim 1,

And an alarm module for outputting a malicious code infection message when there is a request for write access permission to the target file.
The method of claim 1,

The monitoring module may block the request if there is a request for write access permission to the target file.
As a method of monitoring malicious codes that encrypt user files,

A first step of generating, by the target file generation module, a target file for monitoring the malicious code in a storage device in which a user file is stored;

A second step of checking, by the monitoring module, a thread which has sent the request, when there is a request for write access right to the target file; And

And a third step in which an execution program interruption module forcibly terminates the thread identified by the monitoring module.
The method of claim 7, wherein

In the first step, the target file generation module, characterized in that for generating a trap folder in the highest path of the storage device, and generates the target file in the trap folder, malicious code monitoring method.
The method of claim 8,

The target file generation module generates the trap folder having a folder name first searched by the malicious code.
The method of claim 8,

The target file generation module generates the trap folder as a hidden attribute, malicious code monitoring method.
The method of claim 7, wherein

And outputting a malicious code infection message by an alarm module when a write access right request is made for the target file.
The method of claim 7, wherein

In the second step, the monitoring module, if there is a request for write access permission for the target file, characterized in that to block the request, malware monitoring method.
A computer-readable recording medium having recorded thereon a program for executing the malicious code monitoring method according to any one of claims 7 to 12.