WO2020189822A1

WO2020189822A1 - Diagnosis apparatus, diagnosis method, and diagnosis system for malicious code in cloud environment

Info

Publication number: WO2020189822A1
Application number: PCT/KR2019/003218
Authority: WO
Inventors: 한관석; 김의탁; 강민규
Original assignee: 주식회사 하우리
Priority date: 2019-03-20
Filing date: 2019-03-20
Publication date: 2020-09-24

Abstract

The present invention relates to a malicious code diagnosis apparatus for examining whether a file (110) being diagnosed is a normal file that is not suspected of being infected with a malicious code, before a user computer (130) requests a cloud server (170) for malicious code infection diagnosis, the malicious code diagnosis apparatus comprising: a diagnosis cache (131) for examining whether the file being diagnosed is a normal file on the basis of file key information and file information extracted from the file (110) being diagnosed; a pre-processing white filter (133) for examining whether the file is a normal file on the basis of a file path, a file size, and a file hash value extracted from the file determined to be a non-normal file by the diagnosis cache (131); and a pre-processing Bloom filter (135) for examining whether the file is a normal file on the basis of a partial CRC32 value, file size information, and a file hash value extracted from the file determined to be a non-normal file by the pre-processing white filter (133).

Description

Malware diagnosis device, diagnosis method and diagnosis system in cloud environment

This application is the result of a study (No. 2016-0-00078, Cloud-based intelligent security technology development to provide customized security services) conducted with the support of the Korea Information and Communication Planning and Evaluation Agency with the funding of the Government of the Republic of Korea (Ministry of Science and ICT) in 2018. It is filed by.

The present invention relates to a malicious code diagnosis apparatus, a diagnosis method, and a diagnosis system for diagnosing whether a computer file is infected with malicious code. In particular, the user computer primarily distinguishes between a normal file and a file suspected of being infected with malicious code, and The present invention relates to a malicious code diagnosis apparatus, a diagnosis method, and a diagnosis system in a cloud environment that diagnoses whether a malicious code is infected by transmitting a signature of a file suspected of being infected with a malicious code among them to a cloud server.

When browsing webpages, using illegal copying programs, direct installation by hackers, attachments of e-mails or messenger files, personal computers, general purpose computers, or mobile communication terminals (hereinafter referred to as In the specification, these are collectively referred to as ``user computer''), and the damage caused by so-called malicious codes that invade network traffic, degrade system performance, delete files, and leak personal information is increasing rapidly, and accompanying this Malware diagnosis technology, which diagnoses whether a file is infected with malicious code, is also developing in various forms.

Diagnosis of such malicious codes is usually carried out through a diagnosis engine having signature data for determining whether or not malicious codes, but recently, as the number and types of malicious codes increase exponentially, the diagnosis signature data has also increased significantly. It is difficult to diagnose whether all files to be diagnosed are infected with malicious codes in the user computer itself with limited resources, and as an alternative to this, a so-called cloud-based malicious code diagnosis method has been proposed.

However, the method of requesting diagnosis by transmitting the signatures of all files in the user's computer to the cloud server has a limitation in that the amount of data transmitted between the user computer and the cloud server is inevitably increased, and accordingly, the delay in diagnosis time and network load. There is a problem of causing a problem, which leads to an increase in cost.

As an alternative to these problems, there is a technology disclosed in Patent Document 1, and in Patent Document 1, a pre-diagnosis filter such as a bloom filter is installed in a user computer (specifically, a portable terminal), and the pre-diagnosis filter By classifying the application to be diagnosed into an application suspected of being infected by malicious code and an application that is not suspicious of infection, only the application suspected of infection is requested to be diagnosed to the cloud server, thereby improving diagnosis speed and reducing network resources. To prevent.

However, in Patent Document 1, the pre-diagnosis filter is designed to filter files that may be malicious codes based on probability based on the blacklist, which is a list of malicious codes generated in a compressed form of hash value information of malicious codes. There is only a description of the degree that it can be mounted on a portable terminal by downloading from a distribution server, etc., but how the application to be diagnosed by the pre-diagnosis filter installed on the portable terminal is There is a problem that a specific method for classifying by application is not described.

In addition, the technology of Patent Document 1 checks whether or not all files to be diagnosed are suspicious files for malicious code infection by a single pre-diagnosis filter consisting of a bloom filter, and the pre-diagnosis filter is the hash value of the previously discovered malicious code. As the size of the blacklist compressed the hash value information of the malicious code increases, there is a problem that it takes more time.

The number of files owned by one user's computer reaches as many as thousands, and in order to scan all of these files, the scan time per file must be minimized as much as possible. For example, it takes too much time to extract the hash value, compare the extracted hash value with the blacklist, and diagnose whether there is a malicious code infection. As time passes, the blacklist data that compresses the hash value information of the malicious code As the amount of is increased, the problem of time delay becomes larger.

Therefore, in the diagnosis method as in Patent Document 1, the scan time of the suspicious malicious code infection file within the user's computer can be reduced to a minimum, and the diagnosis target file is incorrectly diagnosed as a suspicious infection file even though it is not a malicious code infection suspicious file. It is important to minimize the possibility of misdiagnosis as not suspicious files even though they are suspicious files or suspicious infections (誤診).

{Prior technical literature}

{Patent Literature}

(Patent Document 1) Registered Patent No. 10-1473658 (announced on December 18, 2014)

The present invention has been made in consideration of the above problems of the prior art, and the diagnosis of whether a file to be diagnosed is suspicious of a malicious code infection performed on a user's computer is started from a relatively simple method, and is gradually expanded in a complex method to be executed in stages. The object of the present invention is to provide a malicious code diagnosis device, diagnosis method, and diagnosis system in a cloud environment that can minimize the scan time for whether a file exists and minimize the possibility of misdiagnosis or misdiagnosis.

The malicious code diagnosis apparatus of the present invention for solving the above problem is to check whether the diagnosis target file is a normal file that is not suspicious of malicious code infection before the user computer requests the cloud server to diagnose whether the malicious code is infected. A malicious code diagnostic device, a diagnostic cache that checks whether the diagnostic target file is the normal file from the file key information and file information extracted from the diagnostic target file, and a file extracted from the file determined that the diagnostic cache is not a normal file A pre-processed white filter that checks whether the file is the normal file from the path, file size, and file hash value, and some CRC32 values, file size information, and file hash extracted from the file determined by the pre-processing white filter as not a normal file It includes a pre-processing bloom filter that checks whether the file is the normal file from the value.

In addition, the method for diagnosing malicious code of the present invention for solving the above problem is to determine whether the file to be diagnosed is a normal file that is not suspicious of malicious code infection before the user computer requests the cloud server to diagnose whether the malicious code is infected. A method for diagnosing malicious code to be inspected, in step a) of checking whether the file to be diagnosed is the normal file from the file key information and file information extracted from the file to be diagnosed, and determining that the file is not a normal file in the step a). Step b) of checking whether the file is the normal file from the file path, file size, and file hash value extracted from the file, and some CRC32 values and file sizes extracted from the file determined as not a normal file in step b) And step c) of checking whether the file is the normal file from the information and the file hash value.

In addition, the malicious code diagnosis system of the present invention for solving the above problems is connected to a user computer having the malicious code diagnosis device and a communication network with the user computer, and the file requested from the user computer is It includes a cloud server that diagnoses malware infection.

According to the present invention, the diagnosis of whether or not a file to be diagnosed is suspicious of malicious code infection performed on a user's computer starts from a relatively simple method, and is gradually expanded to a more complex method, thereby reducing the scan time for a suspected malicious code file to a minimum. At the same time, it is possible to obtain the effect of minimizing the possibility of misdiagnosis or misdiagnosis.

1 is a system block diagram showing a schematic configuration of a malware diagnosis system according to a preferred embodiment of the present invention.

2 is a diagram showing an example of a configuration of a bloom filter database;

3 is a flowchart showing the flow of a method for diagnosing a malicious code according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

First, a description will be given of a malware diagnosis system according to a preferred embodiment of the present invention. 1 is a system block diagram showing a schematic configuration of a malware diagnosis system according to a preferred embodiment of the present invention.

In the malicious code diagnosis system 100 of the preferred embodiment of the present invention, the user computer 130 and the cloud server 170 are connected to enable communication via the communication network 150, and the cloud server 170 is It may also be connected to an external diagnostic pattern update server 190.

The user computer 130 may be a personal computer such as a desktop or laptop, a general purpose computer used for purposes such as office or science or control, or, for example, a portable communication terminal such as a smartphone. , In the present invention, at least one diagnosis target file 110, which is a target for diagnosis of malicious code infection, is stored in an internal storage device.

However, the file to be diagnosed 110 is not limited to a file stored in the internal storage device of the user computer 130, and includes, for example, a file input into the user computer 130 from outside such as e-mail. All files processed in (130) become diagnostic target files.

In the malicious code diagnosis system 100 of the present embodiment, diagnosis of whether or not the file to be diagnosed is actually infected with malicious code (hereinafter, it may be simply described as “malware infection”) (hereinafter, simply “malignant code” Code infection diagnosis”) is in charge of the cloud server 170, and the user computer 130 requests the cloud server 170 to diagnose whether the file to be diagnosed is infected with malicious code. , Check whether the file is a file suspected of being infected with malicious code (hereinafter, it may be simply described as ``Suspicious Malware Infection'') (hereinafter simply described as ``Suspicious Malware Infection Check'') In some cases), the cloud server 170 diagnoses the presence of malicious code only for files suspected of being infected with malicious code (hereinafter, it may be simply described as “a suspicious file of malicious code infection”). For this purpose, the user computer 130 includes a diagnostic cache 131, a preprocessed white filter 133, a preprocessed bloom filter 135, and a diagnosis request unit 137.

In addition, the diagnostic cache 131, the preprocessed white filter 133, and the preprocessed bloom filter 135 have a cache database 131a, a white pattern database 133a, and a bloom filter database 135a, respectively.

The diagnostic cache 131 extracts file key information and file information from the file to be diagnosed 110, and the file having the extracted file key is a file in which a diagnosis has been made to whether a malicious code has been infected, and is stored in the cache database 131a. It checks whether the file key information is stored, and if a file that has been diagnosed with malicious code infection before as a result of the check, checks whether the file information has been altered.

Confirmation of the alteration of the file information is made by comparing the file information extracted from the file to be diagnosed 110 with the file information of the file stored in the cache database 131a as a file previously diagnosed for infection with malicious code. As a result of checking whether the file information has been altered or not, if it is not altered, it is determined as a normal file and the inspection is terminated.

Here, the meaning of "normal file" as a result of diagnosis by the user computer 130 does not mean that the file is not infected with malicious code. It means I am not in doubt.

In addition, even when the file having the file key extracted from the file to be diagnosed 110 is not a file that has previously been diagnosed with malicious code infection, the inspection by the preprocessing white filter 133 proceeds.

The cache database 131a stores file key information and file information of a previously diagnosed file. Here, the file key information is information unique to each individual file (a value different from the hash value), and is a value consisting of, for example, a file ID and a partition ID, and the file information is information for confirming whether the file has been changed. As such, it includes time information consisting of the creation time, change time, and access time of the file, and file size information indicating the size of the file, but is not limited thereto, but in the present embodiment, the change time among the time information is stored in the cache database 131a. Holds on.

Next, the preprocessing white filter 133 diagnoses whether a file that is not determined as a normal file as a result of the inspection by the diagnostic cache 131 is suspected of being infected with a malicious code, and the file path and file size from the diagnosis target file 110 The hash value is extracted, and it is checked whether information identical to the extracted file path, file size, and hash value is stored in the white pattern database 133a.

The white pattern database 133a stores information on the file path, file size, and hash value of the file diagnosed as not infected by the malicious code as a result of the previous malicious code diagnosis, and the result of the inspection by the preprocessing white filter 133 If a file having the file path, file size, and hash value extracted from the file to be diagnosed 110 is in the white pattern database 133a, the file is determined as a white file that is not suspicious of malicious code infection, that is, a normal file, and is examined. To finish.

Here, the file size information may be directly extracted from the diagnosis target file 110 by the preprocessing white filter 133, and the diagnosis cache 131 utilizes the file size information in the file information extracted from the diagnosis target file 110. It may be good.

In addition, if a file having a file path, a file size, and a hash value extracted from the diagnosis target file 110 does not exist in the white pattern database 133a as a result of the inspection, the preprocessing proceeds to the inspection by the bloom filter 135.

Next, the pre-processed bloom filter 135 is a file to be diagnosed when the diagnosis target file 110 is not a file stored in the white pattern database 133a as a normal file as a result of the inspection by the pre-processed white filter 133. Partial CRC32 values and file size information of (110) are extracted, and it is checked whether information corresponding to some of the CRC32 values of the extracted diagnosis target file 110 exists in the bloom filter database 135a.

Here, the bloom filter database 135a has malicious code information (BM) in the form of a bitmap obtained from the result of diagnosis of a previously performed malicious code infection, and the preprocessing bloom filter 135 is a part extracted from the diagnosis target file 110 By comparing the CRC32 value, file size information, and information on the total hash value with the malicious code information stored in the bloom filter database 135a, it is possible to check whether the file to be diagnosed 110 is a file suspicious of malicious code infection.

2 is a diagram showing an example of the configuration of the bloom filter database 135a, and the malicious code information (BM) in the form of a bitmap stored in the bloom filter database 135a is determined to be infected with a malicious code in the previous malicious code diagnosis process. It consists of a CRC map (CM) that is bitmapped using some CRC32 values and file size information of a file, and a hash map (HM) that bitmaps the entire hash value of the malicious code infected file.

The CRC map (CM) is a CRC32 of 4 bytes from 512 bytes of data that is the sum of 256 bytes of data at the top and 256 bytes of data at the top of a file that was determined to be infected with malicious code in the previous diagnosis process. Extract the value, apply a seed value of 0 to the extracted CRC32 value of 4 bytes, and map the file size using the 8 megabyte bitmap and seed value obtained by mapping in the Murmur hash 3 method. It is a bitmap consisting of an 8 megabyte bitmap obtained by applying and mapping in the Murmur hash 3 method.

In addition, the hash map (HM) extracts the hash value from the file diagnosed as infected with malicious code in the previous diagnosis process using the MD5 (Message Digest Algorithm 5) method, and divides the extracted 16-byte MD5 hashes into 4 byte units. It is a bitmap of 4 files of 8 megabytes obtained by mapping in the Mooremoore hash 3 method by applying a seed value of 0 to each of 4 MD5 files.

The Moore Moore hash 3 and MD5 hashes are known, so detailed descriptions are omitted here.

Checking whether a file corresponding to some CRC32 values extracted from the diagnosis target file 110 exists in the bloom filter database 135a is performed by using some CRC32 values and file size information extracted from the diagnosis target file 110. It can be achieved by bitmapping the malicious code information (BM) held by (135a) in the same way as the CRC map (CM) creation process, and then comparing it with the CRC map (CM).

As a result of checking, if information corresponding to some CRC32 values and file size information of the diagnosis target file 110 does not exist in the bloom filter database 135a, it is determined as a normal file and ends.

In addition, if some CRC32 values and file size information of the diagnosis target file 110 exist in the bloom filter database 135a, the preprocessing bloom filter 135 extracts the entire hash value of the diagnosis target file 110, and the extracted It is checked whether information corresponding to the total hash value exists in the bloom filter database 135a, and if the total hash value extracted as a result of the check does not exist in the bloom filter database 135a, it is determined as a normal file and ends.

If information corresponding to the extracted total hash value exists in the bloom filter database 135a, the pre-processing bloom filter 135 determines whether the file to be diagnosed is a malicious code infection suspicious file and whether the cloud server 170 has infected malicious code. It is determined as a file that needs diagnosis, and the diagnosis request unit 137 of the user computer 130 transmits the entire hash value of the file determined as a malicious code infection suspicious file by the preprocessing bloom filter 135 to the cloud server 170 Then, request a diagnosis of malware infection.

To check whether information corresponding to the extracted total hash value exists in the bloom filter database 135a, the pre-processing bloom filter 135 creates the hash map (HM) described above with the total hash value extracted from the diagnosis target file 110. It is achieved by bitmapping in the same way as the process and then comparing it with a hash map (HM).

Here, the file size information extracted by the pre-processed bloom filter 135 from the file to be diagnosed 110 may be directly extracted by the pre-processed bloom filter 135 from the file to be diagnosed 110, and the diagnosis cache 131 is diagnosed. File size information in the file information extracted from the target file 110 may be utilized.

The communication network 150 may be either a wired communication network or a wireless communication network as long as the communication network 150 connects the user computer 130 and the cloud server 170 to each other in a wired or wireless manner.

The cloud server 170 is a known cloud server, and may be a public cloud server that can be used jointly by a large number, but in the present embodiment, it is more preferable to use a private cloud server for reasons such as security.

The cloud server 170 includes a malicious code diagnosis unit 171 and a database synchronization unit 173, and the malicious code diagnosis unit 171 includes a diagnosis pattern database 171a. Since the cloud server 170 of the present embodiment functions substantially the same as the cloud server of Patent Document 1, detailed descriptions are omitted here.

However, although not limited thereto, the cache database 131a, the white pattern database 133a, and the bloom filter database 135a have “information on malicious code infected files” in the above description. As information obtained from the result of diagnosis of malicious code, the database synchronization unit 173 distributes to the cache database 131a, the white pattern database 133a, and the bloom filter database 135a, respectively, through the communication network 150, thereby The cache database 131a, the white pattern database 133a, and the bloom filter database 135a are updated whenever the server 170 determines that the file to be diagnosed 110 is infected with a malicious code, or periodically.

The diagnosis pattern update server 190 is a separate server from the cloud server 170 of the malicious code diagnosis system 100 of the present embodiment, and the cloud server 170 is obtained in the process of diagnosing whether it is infected with malicious code. At the same time, malicious code information is accumulated in the diagnosis pattern database 171a as a diagnosis pattern, and it is provided to a cloud server of another malicious code diagnosis system or received from another server through a communication network. It may be an update server 190. In addition, in the malicious code diagnosis system 100 of the present invention, the diagnosis pattern update server 190 is not essential and may be included as necessary.

Next, a method for diagnosing a malicious code according to a preferred embodiment of the present invention will be described. 3 is a flowchart showing the flow of a method for diagnosing a malicious code according to a preferred embodiment of the present invention.

When the user computer 130 starts checking whether the diagnosis target file 110 is suspicious of a malicious code infection, first, the diagnosis cache 131 extracts file key information and file information from the diagnosis target file 110 (step S1).

The start of diagnosis for suspected malicious code infection can be started for a file set at a set scan time, for example, if a scheduled scan is set in the user's computer 130, and if the user starts the scan at a random time, the It starts at the time, or when an unknown file is input to the user computer 130 from the outside, a test may be started prior to execution of the input file.

Subsequently, proceeding to step S2, the diagnostic cache 131 checks whether the file key extracted from the file to be diagnosed 110 is stored in the cache database 131a, and the extracted file key is the cache database ( 131a) (step S2 = YES), the process proceeds to step S3 to check whether the file information of the file to be diagnosed 110 has been altered.

If the file information has not been altered as a result of the confirmation in step S3 (step S3 = NO), the process proceeds to step S10, and the diagnosis target file 110 is determined to be a normal file that is not suspicious of malicious code infection, and the inspection is terminated. If it is determined in step S3 that the file information has been altered (step S3 = YES), the process proceeds to step S4.

In addition, if the file key information extracted from the diagnosis target file 110 is not in the cache database 131a (step S2 = NO) as a result of checking in step S2, the diagnosis target file 110 has never been infected with malicious code. Since the file has not been diagnosed, the process proceeds to step S4 for the next step.

The method of checking whether file information has been altered is the same as the method described above.

In step S4, the preprocessing white filter 133 extracts the file path, file size, and hash value of the file determined to be not a normal file as a result of the inspection by the diagnostic cache 131, and extracts the file path and file size in step S5. And whether the same information as the hash value is stored in the white pattern database 133a. If a file having a file path, file size, and hash value extracted from the diagnosis target file 110 in step S5 is in the white pattern database 133a (step S=YES), the preprocessing white filter 133 is a diagnosis target file (110) is determined as a normal file (or "white file"), and the inspection ends.

If the file having the file path, file size, and hash value extracted from the diagnosis target file 110 does not exist in the white pattern database 133a (step S5 = NO), this file is not a white file. It proceeds to step S6.

Subsequently, in step S6, the preprocessing bloom filter 135 extracts some CRC32 values and file size information of the file determined to be not a normal file as a result of the inspection by the preprocessing white filter 133, and proceeds to step S7 to extract the extracted It is checked whether information corresponding to some CRC32 values of the diagnosis target file 110 exists in the bloom filter database 135a.

As a result of the inspection in step S7, if information corresponding to some CRC32 values and file size information of the diagnosis target file 110 does not exist in the bloom filter database 135a (step S7 = NO), the process proceeds to step S10 and the file is normalized. It judges as a file and ends the inspection.

Further, if some CRC32 values and file size information of the diagnosis target file 110 exist in the bloom filter database 135a (step S=YES), the process proceeds to step S8, and in step S8, the preprocessing bloom filter 135 The entire hash value of the file 110 is extracted, and it is checked whether information corresponding to the extracted total hash value exists in the bloom filter database 135a.

If the total hash value extracted as a result of the confirmation in step S9 does not exist in the bloom filter database 135a, the process proceeds to step S10, the file is determined as a normal file, and ends.

In addition, as a result of confirming in step S9, if information corresponding to the extracted total hash value exists in the bloom filter database 135a, the pre-processing bloom filter 135 is a malicious code infection suspicious file and A file that is determined to be a file that needs to be diagnosed with malicious code infection and proceeds to step S11, and in step S11, the diagnosis request unit 137 of the user computer 130 is a file determined as a malicious code infection suspicious file by the preprocessing bloom filter 135 The entire hash value of is transmitted to the cloud server 170 to request diagnosis of malware infection.

Confirmation of whether or not information corresponding to some CRC32 values and file sizes of the extracted diagnosis target file 110 and information corresponding to the total hash value exist in the bloom filter database 135a is the same as described above.

As described above, the present invention has been described by preferred embodiments, but the present invention is not limited to the above embodiments, and it is natural that various changes or modifications are possible within the scope of the present invention.

For example, in the above embodiment, the partial CRC32 value is set as a CRC32 value of 4 bytes extracted from data of 256 bytes at the front and 256 bytes at the end of the diagnosis target file 110, but is not limited thereto. , As long as it consists of CRC32 values extracted from data at two or more of the entire files of the diagnosis target file 110, it may be extracted from data at any location, and the size is not necessarily limited to 256 bytes each.

In addition, in the above embodiment, the hash map (HM) is 4 files of 8 megabytes obtained by mapping with the Moore Moore hash 3 method by applying a seed value of 0 to 4 MD5 files of 4 bytes each extracted by the MD5 method. Although it is a bitmap consisting of, the extraction and mapping of the hash value is not necessarily limited to the MD5 method and the Mooremoore hash 3, and other known methods may be used.

In addition, when it is determined that a malicious code infection is not suspected as a normal file as a result of the inspection by the preprocessing white filter 133 described in the above embodiment, the file key information and file information of the file determined as a normal file are stored in a cache database ( It may be added to 131a), and the same applies to a file determined as a normal file for which malicious code infection is not suspected as a result of the inspection by the preprocessing bloom filter 135 described in the above embodiment.

{Explanation of sign}

100 Malware Diagnosis System

110 File to be diagnosed

130 user computers

131 diagnostic cache

131a cache database

133 Pretreatment White Filter

133a white pattern database

135 Pretreatment Bloom Filter

135a Bloom Filter Database

170 Cloud Server

190 diagnostic pattern update server

Claims

This is a malicious code diagnosis device that is installed on the user's computer and checks whether the file to be diagnosed is a normal file that is not suspicious of malicious code infection before the user computer requests the cloud server to diagnose malicious code infection.

A diagnostic cache for checking whether the diagnostic target file is the normal file from the file key information and the file information extracted from the diagnostic target file;

A pre-processing white filter for checking whether the file is the normal file from the file path, file size, and file hash value extracted from the file that the diagnosis cache is determined to be not a normal file among the files to be diagnosed;

Malware including a pre-processed bloom filter that checks whether the file is the normal file from some CRC32 values, file size information, and file hash values extracted from files that are determined to be non-normal files among the diagnosis target files Code diagnosis device.
The method according to claim 1,

The malicious code diagnosis device holds in a cache database file key information of a file that has not been infected with malicious code along with file information of a file for which a malicious code infection has been diagnosed previously,

The diagnostic cache,

If the file key information extracted from the file to be diagnosed is in the cache database, it is checked whether the file information of the file to be diagnosed is altered,

Malware diagnosis device that determines the file as a normal file if the file information is not altered as a result of the scan.
The method according to claim 1,

The malicious code diagnosis device retains information on the file path, file size, and total hash value of a file diagnosed as not infected by malicious code as a result of a previously performed malicious code infection diagnosis in a white pattern database,

The pre-processing white filter converts the file to a normal file if a file corresponding to a file path, file size, and total hash value extracted from a file that is determined to be a non-normal file among the diagnosis target files is in the white pattern database. Malware diagnosis device to determine.
The method according to claim 1,

The malware diagnosis device is in the form of a bitmap created from a CRC map in the form of a bitmap created from some CRC32 values and file size information of a file diagnosed as infected with a malicious code as a result of a previously performed malware infection diagnosis, and a bitmap form created from the entire hash value of the file. It holds malicious code information consisting of hash maps of the bloom filter database,

The pretreatment bloom filter,

If a bitmapped value using some CRC32 values and file size information extracted from a file that is determined to be a non-normal file among the diagnosis target files is not in the CRC map, the file is determined as a normal file,

When it is determined that the bitmapped value using some CRC32 values and file size information extracted from the file determined by the preprocessing white filter as not being a normal file is not a normal file in the CRC map, the file is not considered a normal file. A malicious code diagnosis device that determines a file as a normal file if the bitmapped value by using the entire hash value of the determined file is not in the hash map.
The method of claim 4,

Some CRC32 values are CRC32 values extracted from the sum data of some data at the top and some data at the end of the file to be diagnosed.

The CRC map is a bitmap created by applying a seed value of 0 to the CRC32 value extracted from a file diagnosed as infected with a malicious code in the previous diagnosis process and applying a Moore Moore hash 3 and file size information as a seed value to the CRC32 value. Malware diagnosis device consisting of bitmaps created in the Moore Moore hash 3 method by applying.
The method of claim 4,

The hash map is a malware diagnosis device that is a bitmap created in a Moore Moore hash 3 method by applying a seed value of 0 to each of the four MD5 files extracted in the MD5 method from the file diagnosed as infected with the malicious code in the previous diagnosis process.
The method according to claim 1,

The malicious code diagnosis device transmits a file determined by the preprocessing bloom filter as not a normal file to the cloud server to request diagnosis of malicious code infection.
Malware diagnosis by a malicious code diagnosis device that is installed on the user's computer and checks whether the file to be diagnosed is a normal file that is not suspicious of malicious code infection before the user computer requests the cloud server to diagnose malicious code infection. Way,

Step a) of checking whether the diagnosis target file is the normal file from the file key information and the file information extracted from the diagnosis target file;

Step b) of checking whether the file is the normal file from the file path, file size, and file hash value extracted from the file determined to be not a normal file in step a); and

And step c) of checking whether the file is the normal file from some CRC32 values, file size information, and file hash values extracted from the file determined as not being a normal file in step b).
The method of claim 8,

The user computer holds the file key information of the file not infected with the malicious code in the cache database along with the file information of the file for which the malware infection has been diagnosed previously,

In step a),

If the file key information extracted from the diagnosis target file is in the cache database, it is checked whether the file information of the diagnosis target file is altered,

Malware diagnosis method that determines the file as a normal file if the file information is not altered as a result of the scan.
The method of claim 8,

The user computer holds information on the file path, file size, and total hash value of the file diagnosed as not infected by the malicious code as a result of the previously performed malicious code infection diagnosis in the white pattern database,

In step b), if a file corresponding to a file path, file size, and total hash value extracted from a file determined as not a normal file in step a) among the files to be diagnosed is in the white pattern database, the file is saved as a normal file. Malware diagnosis method determined by
The method of claim 8,

The user computer is a bitmap-type hash created from a bitmap-type CRC map created from some CRC32 values and file size information of a file diagnosed as infected with a malicious code as a result of a previously performed malware infection diagnosis result, and a bitmap-type hash created from the entire hash value of the file. Malicious code information consisting of maps is held in the Bloom Filter database,

In step c),

If a bitmapped value using some CRC32 values and file size information extracted from the files determined to be non-normal in step b) among the diagnosis target files is not in the CRC map, the file is determined as a normal file,

If it is determined that the bitmapped value using the partial CRC32 value and file size information extracted from the file determined to be not a normal file in step b) is not a normal file in the CRC map, it is determined that the file is not a normal file. A method for diagnosing malicious code in which if a bitmapped value by using the entire hash value of the determined file is not in the hash map, the file is determined as a normal file.
The method of claim 8,

A method for diagnosing malicious code, further comprising step d) of requesting diagnosis of malicious code infection by transmitting a file determined to be non-normal in step c) among the files to be diagnosed to the cloud server.
A user computer provided with the malicious code diagnostic device of any one of claims 1 to 7,

A malicious code diagnosis system comprising a cloud server that is connected to the user computer and communicates through a communication network and diagnoses whether a file requested from the user computer is infected with a malicious code.