WO2018043885A1

WO2018043885A1 - System for detecting malicious code and method for detecting malicious code

Info

Publication number: WO2018043885A1
Application number: PCT/KR2017/006466
Authority: WO
Inventors: 강경완; 김유현
Original assignee: 주식회사 안랩
Priority date: 2016-09-02
Filing date: 2017-06-20
Publication date: 2018-03-08
Also published as: KR101857575B1; KR20180026139A

Abstract

The present invention implements a malicious code detecting technique which detects a malicious code before an actual damage is caused by the malicious code, wherein the technique is exposed only to a process to be detected without being exposed to a user or a malicious code creator.

Description

Malware Detection System and Malware Detection Method

The present invention relates to a technique for protecting a file from malicious code.

More specifically, the present invention relates to a malware detection technology that detects malicious code before actual damage caused by the malicious code occurs, but is exposed only to a process to be detected without being exposed to a user or a malicious code producer.

Malicious code can be attacked in various forms, such as attacks that randomly tamper with information (files), disable them, leak information (files) to the outside, or delete information (files). There are various kinds of ventures.

For example, a malicious code that performs an attack in the form of randomly tampering with information (files) and makes it unusable may be difficult to see again by users by randomly tampering, such as encrypting or compressing information (files). Exploit the attack made with).

This malicious code is not used to destroy information (files), but to make it unusable, and it is used for malicious purposes to inform users of information (file) attacks and extort money in return for information (file) restoration.

On the other hand, other malicious codes such as an attack that leaks information (files) to the outside, an attack that deletes information (files), and the like, access or leak information or delete the information (files) without the user's knowledge. Attack

Since it is difficult to recover damage after the actual attack caused by the malicious code, it would be ideal to detect the malware before the damage occurred.

However, the existing malicious code detection technique detects malicious codes based on indirect actions such as distribution method or infection method of malicious code, not detection based on direct malicious behavior of malicious code, that is, attack.

Conventional malware detection methods are based on indirect actions such as distribution and infection methods of malicious code. Therefore, malicious code is detected after malicious damage or unique behaviors are caused by malicious activity. There is a problem that detection may fail.

On the other hand, in the case of existing malware detection techniques that detect malicious code before the actual damage occurs, there is a risk of over-detecting the normal process behavior as malicious behavior, and the core element for detecting malicious code before actual damage occurs. Because of the exposure, there is concern that this key element may be misunderstood by users as malware or used by malware authors to develop variant malware.

Accordingly, the present invention, while the malicious code is detected before the actual damage caused by the malicious code, to propose a new malware detection technique that is exposed only to the process to be detected without being exposed to the user or malicious code producer.

An object of the present invention is to realize a new malware detection technique that detects malicious code before actual damage caused by the malicious code, but is exposed only to a process to be detected without being exposed to a user or a malicious code producer. .

Malware detection method according to an embodiment of the present invention, the step of creating a separate random file for malware detection, defining a path of the virtual file associated with the arbitrary file; Discriminating whether the process is a normal process or a suspicious process when a process of attempting to search for a target file for performing an action is identified; A first providing step of providing a path of the searched target file to the process as a search result when it is distinguished from a normal process; When distinguished by a suspicious process, when providing a path of the target file as a search result to the process, the path of the virtual file is provided together, so that the arbitrary file associated with the path of the virtual file only in a process identified as a suspicious process. And a second providing step of allowing the presence of the to be recognized.

Malware detection system according to an embodiment of the present invention, the file generation and path definition unit for generating a separate random file for malware detection, and defines the path of the virtual file associated with the arbitrary file; A process discriminating unit for discriminating whether the process is a normal process or a suspicious process when a process of attempting to search for a target file for performing an action is confirmed; If it is classified as a normal process, the path of the target file searched according to the target file search attempt is provided to the process as a search result, and if it is classified as a suspicious process, the path of the target file is provided to the process as a search result. When including the control unit to provide the path of the virtual file.

Therefore, according to the present invention, the malicious code is detected before the actual damage caused by the malicious code, but through a malicious code detection technique that is limited to only the process to be detected, the malicious code without being easily exposed to the user or malicious code producer Derive the effect of effectively detecting

1 is a block diagram showing the configuration of a malicious code detection system according to an embodiment of the present invention.

2 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention.

It is to be noted that the technical terms used herein are merely used to describe particular embodiments and are not intended to limit the spirit of the technology disclosed herein. In addition, the technical terms used herein should be construed as meanings generally understood by those skilled in the art to which the technology disclosed herein belongs, unless defined otherwise in this specification. It should not be interpreted in a comprehensive sense, or in an overly reduced sense. In addition, when the technical terms used herein are incorrect technical terms that do not accurately express the spirit of the technology disclosed herein, it should be replaced with technical terms that can be understood correctly by those skilled in the art. In addition, the general terms used herein should be interpreted as defined in the dictionary, or according to the context before and after, and should not be interpreted in an excessively reduced sense.

Also, the singular forms used herein include the plural forms unless the context clearly indicates otherwise. In this specification, terms such as “consisting of” or “comprising” should not be construed as necessarily including all of the various components or steps described in the specification, and some of the components or some steps It should be construed that it may not be included or may further include additional components or steps.

In addition, terms including ordinal numbers, such as first and second, as used herein may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, and the same or similar components will be given the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted.

In addition, in describing the technology disclosed herein, if it is determined that the detailed description of the related known technology may obscure the gist of the technology disclosed herein, the detailed description thereof will be omitted. In addition, it is to be noted that the accompanying drawings are only for easily understanding the spirit of the technology disclosed in this specification, and the spirit of the technology should not be construed as being limited by the accompanying drawings.

Hereinafter, one embodiment of the present invention will be described in detail by way of example drawings. In adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are assigned to the same components as much as possible even though they are shown in different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention.

1 shows a configuration of a malicious code detection system according to an embodiment of the present invention.

As shown in FIG. 1, the malware detection system 100 according to an embodiment of the present invention is preferably mounted on an independent user device 500 such as a computer. The malware detection system 100 of the present invention may be in the form of an application installed in the user device 500.

In FIG. 1, for convenience of description, a process of attempting to access a storage unit 400 storing information (file) in the user device 500 and information (file) stored in the storage unit 400 ( The configuration of the file system 200 that controls the I / O for information (file) between the storage unit 300 and the storage unit 300 is illustrated.

As shown in FIG. 1, the malware detection system 100 according to an embodiment of the present invention generates a separate random file for malware detection and defines a path of a virtual file associated with the random file. When the file creation and path definition unit 110 and the process of attempting to search the target file for performing the action are confirmed, the process discrimination unit 120 distinguishes whether the process is a normal process or a suspicious process. When the target file is searched, the path of the searched target file is provided to the process as a search result, and when it is classified as a suspicious process, the virtual file is provided when the path of the target file is provided to the process as a search result. It includes a control unit 130 to provide a path with.

In the present invention, while detecting the malicious code before the actual damage caused by the malicious code, we propose a new malware detection technique that is limited to only the process to be detected.

Therefore, in the present invention, by generating a random file in the form of a file (for example, document, media, etc.) that the malicious code targets the attack, the malicious code itself to attack the arbitrary file to attack It is important to make sure that it is recognized as the target file.

In other words, the arbitrary file is not a file that actually stores meaningful data, but a file having only the purpose of performing malicious behavior (attack) of the malicious code instead of the file that is the actual target of the malicious code.

Accordingly, the file generation and path definition unit 110 stores information (files) in an arbitrary file in the form of a file (for example, document, media, etc.) that the malicious code targets for performing malicious actions. It is created in a directory (path) for exposing to malicious code in the storage unit 400.

In addition, when the file generation and path definition unit 110 generates an arbitrary file as described above, the file generation and path definition unit 110 defines the path of the virtual file associated with the arbitrary file.

In this case, the virtual file is a file that does not actually exist, unlike an arbitrary file that is actually created and exists. Therefore, the path of the virtual file is also information associated with an arbitrary file and is not an actual accessible directory (path).

That is, the file generation and path defining unit 110 defines the path of the virtual file as information associated with the arbitrary file when generating the arbitrary file as described above.

When the process 300 that attempts to search for a target file for performing an action is confirmed, the process discriminating unit 120 distinguishes whether the process 300 is a normal process or a suspect process.

In detail, the process discrimination unit 120 may distinguish whether the process 300 is a normal process or a suspect process according to a predefined discrimination policy.

For example, the discrimination policy may be a policy for distinguishing a process belonging to a whitelist based on the accumulated malware detection result as a normal processor, and distinguishing a process not belonging to the whitelist as a suspicious process.

In this case, the process discrimination unit 120, according to the discrimination policy, if the process 300 belongs to the white list, it will be classified as a normal process, and if not belonging to the white list, it will be classified as a suspicious process.

Alternatively, the discrimination policy identifies a process that belongs to a whitelist based on the accumulated malware detection result and does not have an unknown module among the loaded modules as a normal processor. The module may be a policy that distinguishes a process having an unknown module among the modules as a suspicious process.

In this case, according to the discrimination policy, if the process 300 belongs to the whitelist and there is no module that is unknown among the modules to be loaded, the process discrimination unit 120 classifies the process as a normal process and does not belong to or belong to the whitelist. Even if it is known, any module that is loaded will be identified as a suspicious process.

The two examples of the above-mentioned distinction policy are only the embodiments mentioned for convenience of description.

In the present invention, it is not limited to the two examples described above, and in addition to this, it is possible to distinguish normal processes / suspect processes by pre-defined various discrimination policies.

When the process 300 is classified as a normal process, the controller 130 provides the process 300 with the path of the searched target file as a search result according to the target file search attempt.

Hereinafter, for convenience of description, a process 300 distinguished as a normal process will be referred to as a normal process 300, and a process 300 distinguished as a suspicious process will be referred to as a suspicious process 300.

That is, the controller 130 provides a path of the target file searched according to the target file search attempt as a search result to the normal process 300 that attempts to search the target file for performing the action.

This is a general search result providing method in which a process attempts to search a target file for performing an action and receives a path (directory) of the target file as a search result.

Meanwhile, when the process 300 is classified as a suspicious process, the controller 130 provides the path of the previously defined virtual file when providing the path of the target file to the process 300 as a search result.

That is, the control unit 130 provides the suspect process 300 that attempts to search the target file for performing the action, as a search result, as well as the path of the target file searched according to the target file search attempt, as a search result. It is.

In this case, the suspicious process 300, unlike the normal process 300 that receives only the path (directory) of the target file through the target file search as a search result, the path (directory) and virtual of the target file through the target file search The path of the file is provided as a search result.

Thus, in the present invention, since the suspicious process 300 provides the path (directory) of the target file and the path of the virtual file as a search result, the presence of any file associated with the path of the virtual file is only present in the suspicious process 300. It can be recognized.

That is, according to the present invention, since the normal process 300 cannot recognize the existence of any file associated with the path of the virtual file because the path of the virtual file is not known, the malicious code of the present invention based on the arbitrary file. The detection technique is not exposed to normal process 300.

On the other hand, according to the present invention, the process that may be the malware to be detected, that is, the suspicious process 300, since the path of the virtual file is known, recognizes the existence of any file associated with the path of the virtual file, and thus, The malware detection technique of the present invention based on the file is limited to the suspicious process 300 only.

On the other hand, the malicious code to be detected in the present invention may be a malicious code to attack in the form of randomly tampering with information (file), or to leak information (file) to the outside It may be malicious code that performs an attack or malicious code that performs an attack in the form of deleting information (file).

The controller 130 detects the suspicious process 300 as malicious code based on an action performed by the suspicious process 300 in an arbitrary file by accessing the path of the virtual file.

That is, in the present invention, when the suspicious process 300 accesses a path of a virtual file that is only information associated with an arbitrary file and does not actually exist, the suspicious process 300 accesses an arbitrary file associated with a path of the virtual file. .

Thus, the controller 130 is based on the action performed by the suspicious process 300 in the arbitrary file after accessing the path of the virtual file to the arbitrary file, the malicious behavior of the malicious code (detected in the present invention) ( Attack), the suspicious process 300 may be detected as being malicious code.

At this time, since the random file that the suspicious process 300 has performed a malicious action (attack) is not a file that actually stores meaningful data, the malicious behavior (attack of the suspicious process 300 performed on the random file this time) There is no actual damage caused by).

If the suspicious process 300 is detected as malicious code, the controller 130 may block the suspicious process 300 from accessing another file anymore.

Thus, according to the present invention, if the suspicion process 300 is to only access the path of the virtual file of the path of the target file and the path of the virtual file provided as a search result first, if the suspicious process 300 is malicious code, the actual damage Can be detected as malware before it occurs.

However, the suspicious process 300 accesses the path of the target file before the path of the virtual file among the paths of the target file and the virtual file provided as a search result to detect malicious behavior (attack) in the target file, that is, the actual target file. If you do, you may encounter a situation where you cannot detect malware before the actual damage caused by the malware occurs.

In order to prevent such a situation, the present invention proposes a function of causing the suspicious process 300 to preferentially access the path of the virtual file among the path of the target file and the path of the virtual file provided as a search result.

Specifically, the controller 130 may include a specific factor that causes the suspicious process 300 to access the path of the virtual file before the path of the target file when the file is accessed based on the search result. Provide after reflecting on the path.

That is, the controller 130 provides the path of the virtual file as a search result when providing the path of the target file and the path of the virtual file searched to the suspicious process 300 that attempts to search the target file for performing an action. Will reflect on and provide.

Here, the specific factor is defined as a factor that causes the suspicious process 300 to attempt to access the path of the virtual file before the path of the target file when the file is accessed based on the search result.

Therefore, a specific factor may be defined based on a result of analyzing a file access pattern in which order the malware to be detected accesses the files in order to access the files.

For example, after analyzing the file access pattern, if the malicious code to detect attempts to access a file with a path (directory) beginning with "!" When accessing multiple files, " ! "

In this case, when providing the path of the target file and the virtual file searched by the suspicious process 300 as a search result, the controller 130 reflects a specific factor "!" At the beginning of the path of the virtual file and provides the result. will be.

The suspicious process 300 then attempts to access the path of the virtual file beginning with "!" Of the path of the target file and the path of the virtual file provided as a search result, so that the suspicious process 300 In the case of malware, it can be detected as malware before the actual damage occurs.

On the other hand, among the malicious codes, there are malicious codes that randomly access files when accessing several files, and these malicious codes actually apply only a specific factor (eg!) Suggested above to the virtual file path. It can be difficult to detect before damage occurs.

Accordingly, the controller 130 provides a pair of paths of the virtual file for each path of the target file in units of paths of the target file searched according to the target file search attempt, and the suspicious process 300 randomly based on the search result. Even if the file is accessed, try to access the virtual file path before the target file path.

That is, the controller 130, when providing the path of the target file and the virtual file searched by the suspicious process 300 as a search result, the virtual file reflecting a specific factor (for example!) For each path of the target file To provide the path of the pair together.

For example, assuming that there are five paths of the target file searched according to the target file search attempt (for example, paths 1, 2, 3, 4, and 5), the controller 130 controls each target in units of paths of the target file. The path of the virtual file and the path of the target file 1, the path of the virtual file, and the destination file are paired by pairing the path of the virtual file reflecting a specific factor (e.g.!) For each file path 1, 2, 3, 4, 5. The search results are provided in the form of path 2, path of virtual file and path of target file 3, path of virtual file and path of target file 4, path of virtual file and path 5 of target file.

In this case, the suspicious process 300 attempts to access a path (eg, path 2) of the first target file selected at random among the paths of the target file provided as a search result. Since the path is paired with the path2 of the target file, we will attempt to access the path of the virtual file starting with "!" Before the path2 of the target file.

As described above, in the present invention, the suspicious process 300 through a method of reflecting a specific factor (eg,!) In the path of the virtual file and / or providing a path of the virtual file in pairs with the path of the target file. Attempts to access the path of the virtual file first when accessing the file based on the search result, so that the random file is preferentially accessed, so that if the suspicious process 300 is malicious code, the malicious code before the actual damage occurs. Can be detected.

In addition, in the present invention, even malicious code that randomly accesses a file and performs malicious actions (attack) can be detected before actual damage occurs.

In addition, in the present invention, if the process 300 that attempts to perform an action on the arbitrary file by directly accessing the path of the arbitrary file is confirmed, regardless of whether the process 300 is a normal process or a suspect process, Block access

This is to prevent the random deletion of a key element for detecting malicious code before actual damage occurs.

As described above, the malicious code detection system 100 according to an embodiment of the present invention implements a new malicious code detection technique for detecting malicious code before actual damage caused by the malicious code occurs.

In particular, in the present invention, the malware detection technique of the present invention is a detection target through a method in which the path of the virtual file is unknown to the normal process 300 and only the path of the virtual file is known to the suspicious process 300. Limited exposure to suspicious process 300 is provided.

Therefore, in the present invention, a key element for detecting malicious code, i.e., an arbitrary file is easily exposed before the actual damage occurs, so that the user misunderstands the arbitrary file as the malicious code and deletes it arbitrarily, It also achieves the effect of preventing the use of files with impure intentions.

Hereinafter, referring to FIG. 2, the malicious code detection method according to an exemplary embodiment of the present invention will be described in more detail. Here, for the convenience of description, the configuration shown in FIG. 1 described above will be described with reference to the corresponding reference numerals.

For convenience of description, the malicious code detection method according to an embodiment of the present invention will be described by referring to the operation method that is operated by the malicious code detection system 100 shown in FIG.

The operation method of the malicious code detection system 100 according to an embodiment of the present invention may be any type of file such as a file type (eg, document, media, etc.) that the malicious code targets to perform malicious actions. In the storage unit 400 that stores the information (file), it is created in a directory (path) for exposing to malicious code (S100).

In addition, the file generation and operation method of the malicious code detection system 100 according to an embodiment of the present invention, when generating an arbitrary file as described above, defines the path of the virtual file associated with the arbitrary file (S100).

At this time, the arbitrary file is not a file that actually stores meaningful data, but a file having only the purpose of performing malicious behavior (attack) of the malicious code instead of the file which is the actual attack target of the malicious code.

In this case, the virtual file is a file that does not exist, unlike a random file that is actually created and exists. Therefore, the path of the virtual file is also information associated with an arbitrary file and is not an actual accessible directory (path).

That is, in the method of operating the malicious code detection system 100 according to an embodiment of the present invention, when a random file is generated as described above, the path of the virtual file is defined as information associated with the random file.

In the method of operating the malware detection system 100 according to an embodiment of the present invention, when the process 300 for attempting to search for a target file for performing an action is confirmed (S110), the process 300 is suspected to be a normal process. The process is distinguished (S120).

Specifically, the operation method of the malware detection system 100 according to an embodiment of the present invention may distinguish whether the process 300 is a normal process or a suspect process according to a predefined discrimination policy.

In this case, the operation method of the malicious code detection system 100 according to an embodiment of the present invention, if the process 300 belongs to a white list according to the discrimination policy, distinguished as a normal process, and if it does not belong to the white list, We will distinguish it by process.

In this case, the operation method of the malware detection system 100 according to an embodiment of the present invention is normal if there is no known module among the modules that the process 300 belongs to the whitelist and loads according to the discrimination policy. It will be identified as a process, and even if it is not on the whitelist or if it is a module that is unknown, it will be identified as a suspicious process.

In the method of operating the malware detection system 100 according to an embodiment of the present invention, when the process 300 is classified as a normal process (S120 No), a search result of the target file searched according to the target file search attempt is searched. As provided to the process 300 (S160).

That is, the operating method of the malicious code detection system 100 according to an embodiment of the present invention includes a path of the target file searched according to the target file search attempt to the normal process 300 that attempts to search the target file for performing the action. As a search result.

On the other hand, the operating method of the malware detection system 100 according to an embodiment of the present invention, when the process 300 is distinguished as a suspicious process (S120 Yes), the process 300 to the path of the target file as a search result When providing to provide the path of the previously defined virtual file (S130).

That is, the operation method of the malicious code detection system 100 according to an embodiment of the present invention includes a path of the target file searched according to the target file search attempt to the suspicious process 300 attempting to search the target file for performing an action. In addition, the path of the previously defined virtual file is also provided as a search result.

In this case, the suspicious process 300, unlike the normal process 300 that receives only the path (directory) of the target file through the target file search as a search result, the path (directory) and virtual of the target file through the target file search Since the path of the file is provided as a search result, only the suspicious process 300 will recognize the existence of any file associated with the path of the virtual file.

On the other hand, according to the present invention, the process that may be malicious code, that is, the suspicious process 300 to be detected, recognizes the existence of any file associated with the path of the virtual file because the path of the virtual file is known. The malware detection technique of the present invention based on arbitrary files is limited to the suspicious process 300 only.

If the suspicious process 300 accesses the path of the target file before the path of the virtual file among the paths of the target file and the virtual file provided as a search result, and performs malicious action (attack) on the target file, that is, the file that is the actual target of attack. However, there may be situations where the malware cannot be detected before the actual damage caused by the malware occurs.

In order to prevent such a situation, in the present invention, when providing a search result to the suspicious process 300, the method and / or the path of the virtual file reflects a specific factor (eg!) In the path of the next virtual file. Provides a way to pair with the path of the target file.

Specifically, in the method of operating the malware detection system 100 according to an embodiment of the present invention, when the suspicious process 300 accesses a file based on a search result, the path of the virtual file is larger than the path of the target file. Provide a specific argument to try to access the file first, as reflected in the path of the virtual file.

That is, the operating method of the malicious code detection system 100 according to an embodiment of the present invention, together with the path of the target file and the path of the virtual file detected by the suspicious process 300 attempting to search the target file for performing the action. When providing as a search result (S130), it is provided after reflecting a specific factor to the path of the virtual file.

In this case, the operation method of the malware detection system 100 according to an embodiment of the present invention, the path of the target file and the virtual file searched by the suspicious process 300 attempting to search the target file for performing the action When provided as a search result, the specific argument "!" Is provided at the beginning of the path of the virtual file.

Accordingly, the operation method of the malware detection system 100 according to an embodiment of the present invention provides a pair of paths of a virtual file for each path of each target file in units of paths of the target files searched according to a target file search attempt. Thus, even when the suspicious process 300 randomly accesses the file based on the search result, the suspicious process 300 attempts to access the path of the virtual file before the path of the target file.

That is, the operating method of the malicious code detection system 100 according to an embodiment of the present invention, together with the path of the target file and the path of the virtual file detected by the suspicious process 300 attempting to search the target file for performing the action. When providing as a search result (S130), the path of the virtual file reflecting a specific factor (for example!) Is provided together in pairs for each path of the target file.

For example, assuming that five (eg, paths 1, 2, 3, 4, 5) paths of a target file searched according to a target file search attempt, the malware detection system 100 according to an embodiment of the present invention. ), The path of the virtual file in pairs of the paths of the target file reflecting a specific factor (for example,!) For each path 1, 2, 3, 4, 5 of the target file. Path 1 of the target file, path of the virtual file and path of the target file 2, path of the virtual file and path of the target file 3, path of the virtual file and path of the target file 4, path of the virtual file and path of the target file 5 To provide search results.

Then, the operation method of the malware detection system 100 according to an embodiment of the present invention, if the suspicious process 300 performs an action performed on an arbitrary file by accessing the path of the virtual file (S140 Yes), The suspicious process 300 is detected as malware based on the behavior (S150).

Thus, the operation method of the malware detection system 100 according to an embodiment of the present invention, the suspicious process 300 accesses the path of the virtual file based on the action performed on the arbitrary file after accessing the arbitrary file In the present invention, if it is determined that the malicious activity (attack) of the malicious code to be detected, the suspicious process 300 may be detected as the malicious code.

In addition, when the malicious code detection system 100 operates according to an embodiment of the present invention, when the suspicious process 300 is detected as malicious code, the suspicious process 300 may block access to another file. Can be.

As described above, the operation method of the malicious code detection system 100, that is, the malicious code detection method according to an embodiment of the present invention, detects malicious code before actual damage caused by the malicious code, but is limited to only the process to be detected. New malware detection techniques are exposed, which can effectively detect malware without being easily exposed to users or malware authors.

Meanwhile, the functional operations and implementations of the subject matter described in this specification may be implemented in digital electronic circuitry, computer software, firmware or hardware including the structures and structural equivalents disclosed herein, or one or more of them. It can be implemented in combination. Implementations of the subject matter described herein are one or more computer program products, ie one or more modules pertaining to computer program instructions encoded on a program storage medium of tangible type for controlling or by the operation of a processing system. Can be implemented.

The computer readable medium may be a machine readable storage device, a machine readable storage substrate, a memory device, a composition of materials affecting a machine readable propagated signal, or a combination of one or more thereof.

As used herein, the term "system" or "device" encompasses all the instruments, devices, and machines for processing data, including, for example, programmable processors, computers, or multiple processors or computers. The processing system may include, in addition to hardware, code that forms an execution environment for a computer program on demand, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more thereof. .

Computer programs (also known as programs, software, software applications, scripts, or code) may be written in any form of programming language, including compiled or interpreted languages, or a priori or procedural languages. It can be deployed in any form, including components, subroutines, or other units suitable for use in a computer environment. Computer programs do not necessarily correspond to files in the file system. A program may be in a single file provided to the requested program, in multiple interactive files (eg, a file that stores one or more modules, subprograms, or parts of code), or part of a file that holds other programs or data. (Eg, one or more scripts stored in a markup language document). The computer program may be deployed to run on a single computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communication network.

Computer-readable media suitable for storing computer program instructions and data, on the other hand, include, for example, semiconductor memory devices such as EPROM, EEPROM, and flash memory devices, such as magnetic disks such as internal hard disks or external disks, magneto-optical disks, and CDs. It may include all types of nonvolatile memory, media and memory devices, including -ROM and DVD-ROM disks. The processor and memory can be supplemented by or integrated with special purpose logic circuitry.

Implementations of the subject matter described herein may include, for example, a backend component such as a data server, or include a middleware component such as, for example, an application server, or a web browser or graphical user, for example, where a user may interact with the implementation of the subject matter described herein. It may be implemented in a computing system that includes a front end component, such as a client computer with an interface, or any combination of one or more of such back end, middleware or front end components. The components of the system may be interconnected by any form or medium of digital data communication such as, for example, a communication network.

Although the specification includes numerous specific implementation details, these should not be construed as limiting to any invention or the scope of the claims, but rather as a description of features that may be specific to a particular embodiment of a particular invention. It must be understood. Likewise, certain features described herein in the context of separate embodiments may be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable subcombination. Furthermore, while the features may operate in a particular combination and may be initially depicted as so claimed, one or more features from the claimed combination may in some cases be excluded from the combination, the claimed combination being a subcombination Or a combination of subcombinations.

In addition, although the drawings depict operations in a particular order, it is to be understood that such operations must be performed in the specific order or sequential order shown in order to obtain desirable results or that all illustrated acts must be performed. Can not be done. In certain cases, multitasking and parallel processing may be advantageous. Moreover, the separation of the various system components of the above-described embodiments should not be understood as requiring such separation in all embodiments, and the described program components and systems will generally be integrated together into a single software product or packaged into multiple software products. It should be understood that it can.

As such, the specification is not intended to limit the invention to the specific terms presented. Thus, while the present invention has been described in detail with reference to the above examples, those skilled in the art can make modifications, changes, and variations to the examples without departing from the scope of the invention. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

Claims

A definition step of creating a separate random file for malware detection and defining a path of a virtual file associated with the random file;

Discriminating whether the process is a normal process or a suspicious process when a process of attempting to search for a target file for performing an action is identified;

A first providing step of providing a path of the searched target file to the process as a search result when it is distinguished from a normal process;

When distinguished as a suspicious process, when providing a path of the target file as the search result to the process, the path of the virtual file is provided together, such that the process identified as suspicious process is associated with the path of the virtual file. Malware detection method comprising a second providing step to recognize the presence of.
The method of claim 1,

And detecting the process as malicious code based on an action of the process accessing the path of the virtual file and executing the random file.
The method of claim 1,

The distinguishing step,

According to a predefined discrimination policy, the malware detection method, characterized in that distinguishing whether the process is a normal process or a suspect process.
The method of claim 1,

The second providing step,

When a process accesses a file based on a search result, a malicious factor is provided after reflecting a specific factor to the path of the virtual file before attempting to access the path of the virtual file rather than the path of the target file. Code detection method.
The method of claim 4, wherein

The second providing step,

Malware detection method characterized in that it provides a pair of paths of the virtual file for each path of the target file in the unit of the path of the target file retrieved in accordance with the target file search attempt.
The method of claim 1,

If the process of attempting to perform an action on the arbitrary file by directly accessing the path of the arbitrary file is confirmed, further comprising the step of blocking access regardless of whether the process is a normal process or a suspect process Code detection method.
A file generation and path definition unit for generating a separate random file for malware detection and defining a path of a virtual file associated with the random file;

A process discriminating unit for discriminating whether the process is a normal process or a suspicious process when a process of attempting to search for a target file for performing an action is confirmed;

When it is classified as a normal process, the path of the target file searched according to the target file search attempt is provided to the process as a search result, and when it is classified as a suspicious process, the path of the target file is provided to the process as a search result. Malware detection system comprising a control unit for providing a path of the virtual file.
The method of claim 7, wherein

The control unit,

And detecting the process as malicious code based on an action performed by the process in the arbitrary file by accessing the path of the virtual file.
The method of claim 8,

The control unit,

When a process accesses a file based on a search result, a malicious factor is provided after reflecting a specific factor to the path of the virtual file before attempting to access the path of the virtual file rather than the path of the target file. Code Detection System.
The method of claim 9,

The control unit,

And a path of the virtual file in pairs for each path of the target file in units of paths of the target file searched according to the target file search attempt.