WO2022149637A1 - User terminal event-associated malicious file determination method and system using same - Google Patents

Abstract

The present invention relates to a method for collecting internally occurring security events by associating various types of security equipment and SIEM with PCs, and analyzing a PC having occurred a corresponding event, thereby determining a malicious file, and a system using same. The present invention may comprise the steps of: generating security event analysis information by analyzing a security event of a user terminal by a monitoring server; extracting file event information including event information of a PE file of the user terminal, which is related to the security event analysis information, by a monitoring agent installed in the user terminal, and transmitting the extracted file event information to the monitoring server; generating PE file security event analysis information and integrated security data by the monitoring server; determining whether the PE file is a malicious file, by analyzing the integrated security data; and generating a past integrated security data group including past integrated security data, wherein the integrated security data is stored in chronological order in the monitoring server, and the past integrated security data thus includes past PE file security event analysis information and past file event information.

Description

User terminal event interlocking malicious file determination method and system using the same

The present invention relates to a method for determining a malicious file linked to a user terminal event and a system using the same, and more particularly, to a user who collects security events that occur inside by linking various security equipment and SIEM with a user terminal, and generates the event The present invention relates to a method and system for analyzing a terminal to determine a malicious file such as malware.

Security equipment detects/blocks abnormal behavior of internal/external networks and blocks threats within the organization in advance. SIEM (Security Information & Event Management) is responsible for collecting and analyzing events of various security equipment to build a more systematic and rapid security system.

Conventionally, when an abnormal symptom is detected in an internal user's PC through such a security system, a security officer manually analyzes the PC to diagnose the presence or absence of a threat.

However, such manual analysis has a problem in that it requires a lot of specialized manpower and time due to the analysis time delay factor due to geographical restrictions and the non-reproducible factor related to one-time actions.

[references]

(Patent Document 1) Republic of Korea Patent No. 10-1414084 (Registered on June 25, 2014)

The present invention has been devised to solve the above problems, and the present invention collects security events that occur inside by linking various security equipment and SIEM with a user terminal, and analyzes the user terminal that generated the event for malware. An object of the present invention is to provide a method for judging user terminal event-linked malicious files that can determine , and a system using the same.

In order to solve the above problem, the method for determining a malicious file linked to a user terminal event of the present invention includes the steps of analyzing a security event of the user terminal in a monitoring server to generate security event analysis information, and the PE of the user terminal related to the security event analysis information Extracting the file event information including the event information of the file to the monitoring agent installed in the user terminal and transmitting it to the monitoring server, the PE file security event analysis information in which the security event analysis information and the event information of the PE file are integrated from the monitoring server Creating integrated security data with integrated file event information, analyzing the integrated security data to determine whether a PE file is a malicious file, and storing the integrated security data in chronological order in the monitoring server to collect past It may include creating a past integrated security data group including past integrated security data consisting of past file event information.

In addition, the user terminal event interlocking malicious file determination system of the present invention includes a security event information collection unit in which user terminal-related security event information is collected, and event information of a PE file of the user terminal installed in the user terminal and related to security event analysis information. It generates security event analysis information by analyzing the security event information of the monitoring agent unit that collects the file event information and the security event information collection unit. It may include a monitoring server unit for generating integrated security data in which the file event information is integrated, and a malicious file determining unit for determining whether a PE file is a malicious file by analyzing the integrated security data generated by the monitoring server unit.

The method for judging a malicious file linked to a user terminal event of the present invention can facilitate analysis and determination of a malicious file as it is operated in conjunction with the user terminal instead of manual analysis by a security officer. That is, the user terminal event-linked malicious file determination method of the present invention collects security events that occur inside by linking various security equipment and SIEM with the user terminal, and analyzes the user terminal that generated the event to determine the malicious file. can

1 is a diagram schematically illustrating a configuration in which a user terminal event-linked malicious file determination system is connected to a user terminal through a network according to an embodiment of the present invention.

2 is a diagram schematically illustrating the configuration of a user terminal event-linked malicious file determination system according to an embodiment of the present invention.

3 is a flowchart illustrating a method for determining a malicious file linked to a user terminal event according to an embodiment of the present invention.

4 is a flowchart illustrating some steps of the method for determining a malicious file linked to a user terminal event of FIG. 3 .

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the technical field to which the present invention belongs It is provided to fully inform the possessor of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout.

Although first, second, etc. are used to describe various elements, components, and/or sections, it should be understood that these elements, components, and/or sections are not limited by these terms. These terms are only used to distinguish one element, component, or sections from another. Accordingly, it goes without saying that the first element, the first element, or the first section mentioned below may be the second element, the second element, or the second section within the spirit of the present invention.

The terminology used herein is for the purpose of describing the embodiments and is not intended to limit the present invention. In this specification, the singular also includes the plural, unless specifically stated otherwise in the phrase. As used herein, "comprises" and/or "made of" refers to a referenced component, step, operation and/or element of one or more other components, steps, operations and/or elements. The presence or addition is not excluded.

Unless otherwise defined, all terms (including technical and scientific terms) used herein may be used with the meaning commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not to be interpreted ideally or excessively unless clearly defined in particular.

In this case, the same reference numerals refer to the same components throughout the specification, and it will be understood that each configuration of the process flowchart drawings and combinations of the flowchart drawings may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, such that the instructions performed by the processor of the computer or other programmable data processing equipment are not described in the flowchart configuration(s). It creates a means to perform functions.

It should also be noted that in some alternative embodiments it is also possible for the functions recited in the configurations to occur out of order. For example, it is possible that two configurations shown one after another may in fact be performed substantially simultaneously, or that the configurations may sometimes be performed in the reverse order according to the corresponding function.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1 is a diagram schematically illustrating a configuration in which a user terminal event-linked malicious file determination system is connected to a user terminal through a network according to an embodiment of the present invention. 2 is a diagram schematically illustrating the configuration of a user terminal event-linked malicious file determination system according to an embodiment of the present invention.

1 and 2 , the user terminal event interlocking malicious file determination system 100 according to the present embodiment includes a security event information collection unit 110 , a monitoring agent unit 120 , a monitoring server unit 130 and It may include a malicious file determination unit 140 .

The security event information collection unit 110 may collect security event information related to the user terminal. That is, the security event information collecting unit 110 may collect user terminal-related security event information through the monitoring agent unit 120 installed in the user terminal.

The monitoring agent unit 120 may be installed in the user terminal to collect file event information including event information of a PE file (EXE, DLL, Drive, Object, etc.) of the user terminal related to security event analysis information.

The monitoring server unit 130 analyzes the security event information of the security event information collecting unit 110 to generate security event analysis information, and the PE file security event analysis information in which the security event analysis information and the event information of the PE file are integrated and Integrated security data in which file event information is integrated can be created.

The malicious file determining unit 140 may determine whether the PE file is a malicious file by analyzing the integrated security data generated by the monitoring server unit 130 .

Here, the security event information collection unit 110 includes a security information event management unit 111 that collects one or more of alarm information, correlation information, and scenario-based information, and security equipment that collects one or more of user terminal-related detection and blocking event information. It may include a unit 112 and a packet mirroring unit 113 that collects packet mirroring information between the user terminal and the Internet and the server zone.

In addition, the security event information collection unit 110 may extract and store an event occurrence time, an alarm name, a source IP, a source port, a destination IP, destination pot information, and a degree of risk from the contents of the alarm information.

The malicious file determining unit 140 may include a malicious file suspicious report generating unit 141 .

The malicious file suspicious report generation unit 141 may generate a malicious file suspicious report by determining whether the PE file is suspected to be a PE file if it is not a malicious file.

As a result, the user terminal event-linked malicious file determination system 100 according to the present embodiment may determine whether the malicious file is a malicious file in association with the user terminal.

3 and 4 are flowcharts schematically illustrating a method for determining a malicious file linked to a user terminal event according to an embodiment of the present invention.

Referring to Figure 3, the user terminal event interlocking malicious file determination method (S200) according to the present embodiment includes the steps of generating security event analysis information (S210), transmitting the file event information to the monitoring server (S220), It may include the step of generating the integrated security data (S230), the step of determining whether the PE file is a malicious file (S240), and the step of generating the past integrated security data group (S250).

In the step of generating the security event analysis information according to the present embodiment (S210), the security event of the user terminal may be analyzed by the monitoring server to generate the security event analysis information.

In an embodiment, the security event analysis information generated in the step (S210) of generating the security event analysis information is, the security information event information of the user terminal generated by the security information event management (SIEM) unit 111, the security equipment unit ( 112) may include one or more of the detection and blocking event information of the user terminal and packet mirroring information between the user terminal and the Internet and the server zone.

That is, in the step (S210) of generating the security event analysis information, the monitoring server collects the security event generated from the user terminal in order to analyze the security event.

First, in the step (S210) of generating security event analysis information, the monitoring server uses an interlocking method such as DB Connection or open API for the security information event information of the user terminal generated in the security information event management (SIEM) unit 111 . By interworking with the server, security information event information can be collected.

In this case, the security information event information of the user terminal may include one of single alarm information, related alarm information, and scenario-based alarm information. And, the monitoring server may extract and store the occurrence time, alarm name, source IP, source port, destination IP, destination port information and risk from the contents of the alarm information.

In addition, in the step (S210) of generating the security event analysis information, the monitoring server collects the detection and blocking event information of the user terminal generated by the security equipment unit 112. IPS, Ddos, Web Firewall (WAF; Web) By receiving the detection/blocking event log generated by the security equipment unit 112 such as Application Fire/Wall) in syslog format, the time of occurrence, alarm name, source IP, source port, destination IP, destination port information and risk are extracted. can be saved

And, in the step (S210) of generating the security event analysis information, the monitoring server collects packet mirroring information between the user terminal and the Internet and the server zone, through the equipment between the user terminal and the Internet or between the user terminal and the server zone. Packets can be collected by mirroring. At this time, it is possible to monitor the BlackIP access behavior of the user terminal and the abnormal access behavior of the server zone through the collected packets. When an access behavior is discovered, the time of occurrence, detection name, source IP, source port, destination IP, and destination port information are stored in the memory.

Here, the information stored by the event analysis in the security information event management (SIEM) unit 111 and the security equipment unit 112, that is, security information event information and detection and blocking event information, is “SEDP”, an abbreviation for Security Event Data Preprocessing. , and the information stored by mirroring analysis is named “MPAR”, an abbreviation of Mirror Packet Analysis Result, and the user terminal IP can be named “UIP”, an abbreviation of UserIP.

In the step of transmitting the file event information to the monitoring server according to the present embodiment (S220), the file event information including the event information of the PE file of the user terminal related to the security event analysis information is extracted and monitored by a monitoring agent installed in the user terminal. can be sent to the server. Here, the event information of the PE file may include the file name of the PE file, a hash value (SHA256), and location information stored in the monitoring server.

In an embodiment, in the step of transmitting the file event information to the monitoring server (S220), the file event information may be transmitted to the monitoring server through a monitoring agent installed in the user terminal.

At this time, in the step of transmitting the file event information to the monitoring server (S220), the following functions may be performed by the monitoring agent. First, it stores all communication details that occur in the user terminal, then receives the command from the monitoring server to execute the command, and then monitors the abnormal connection behavior from the user terminal to the network equipment and the communication between the UIP. , it is possible to compare the finally stored communication history with the monitoring history, extract the matching information, and send it to the server.

Specifically, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent may store all communication details generated in the user terminal. In this case, the communication details may include all communication contents with the outside attempted by the PE file. Each time a PE file attempts to connect, the generation time, PE file name, PE file path, PE file hash, source IP, source port, destination IP, and destination port information can be stored sequentially in pairs. Since a plurality of PE files may be involved in one connection attempt, event information of a plurality of PE files may be stored in a pair.

In addition, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent may receive a command from the monitoring server and perform it. At this time, the command execution function of the monitoring agent can kill the process or logically block the network when it is analyzed that a malicious file such as malware exists in the UIP. Communication between monitoring server and monitoring agent is allowed even if communication is blocked by logical network. Here, the permission of communication between the monitoring server and the monitoring agent is to cancel the blocking of the logical network and the blocking of the corresponding process if it is later determined to be a false positive.

And, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent may monitor the abnormal connection behavior from the user terminal to the network equipment and the communication between the UIP. Here, the file event information may include one or more of abnormal connection event information between the user terminal and the network equipment related to the event information of the PE file, and connection event information between the user terminal and another user terminal.

At this time, in the step of transmitting the file event information to the monitoring server (S220), the monitoring agent stores the occurrence time, source IP, source port, destination IP, and destination port in memory when abnormal behavior to network equipment and communication between UIP occurs. It is stored, and it is possible to extract matching information by comparing the communication history that saved all the communication details generated in the user terminal with the monitoring history, and transmit the extracted contents to the server. can be sent to the server.

In the step of generating the integrated security data according to the present embodiment (S230), the security event analysis information and the event information of the PE file are integrated in the monitoring server, and the integrated security data is generated in which the PE file security event analysis information and the file event information are integrated. can do.

In an embodiment, the PE file security event analysis information generated in the step (S230) of generating the integrated security data is PE file security information event information in which the security information event information and the event information of the PE file are integrated, detection and blocking event information It may include at least one of PE file detection and blocking event information and packet mirroring information in which the event information of the PE file is integrated with the PE file packet mirroring information in which the event information of the PE file is integrated.

Here, in the step of generating the integrated security data (S230), whenever new content is added to SEDP and MPAR, which are security event analysis information, from the monitoring server, a UIP is obtained, and communication details, source IP, and source port are obtained from the monitoring agent of the corresponding UIP. , the destination IP, and the destination port information, it is requested to check whether there is a match, and the event information content of the PE file that matches the request content is transmitted. SEDP and MPAR contents are saved together with the event information of the received PE file. The event information of the PE file may consist of a file name, a hash value (SHA256), and location information on the monitoring server where the file transmitted from the monitoring agent is stored. The stored information is the contents of the event information of the PE file added to SEDP and MPAR, and can be named “PE_SEDP” and “PE_MPAR”. That is, PE_SEDP may include PE file security information event information and PE file detection and blocking event information, and PE_MPAR may include PE file packet mirroring information.

In this way, in the step of generating the integrated security data (S230), the monitoring server integrates a total of four contents: PE_SEDP information, PE_MPAR information, communication history information related to abnormal access behavior of network equipment sent from the monitoring agent, and communication history between user terminals. It can be saved as integrated security data. At this time, the information of the four integrated security data can be named “ISD”, an abbreviation of Integrated Security Data.

In step S240 of determining whether the PE file is a malicious file according to the present embodiment, it is possible to determine whether the PE file is a malicious file by analyzing the integrated security data. At this time, in step S240 of determining whether the PE file is a malicious file, the monitoring agent can determine the malicious file by sending the PE file stored in the ISD to the static/dynamic analyzer by the occurrence of an event. The static/dynamic analyzer that functions as such a malicious file determination unit may be built in the monitoring server or may be built and operated as a separate server. For example, as a dynamic analyzer used in this embodiment, a Cuckoo Sandbox for dynamic analysis of malicious files based on a monitoring agent may be used.

In the step of creating the past integrated security data group according to this embodiment (S250), the integrated security data is stored in the monitoring server in chronological order, including past integrated security data consisting of past PE file security event analysis information and past file event information. You can create a past integrated security data group.

On the other hand, according to the present embodiment, in the step (S240) of determining whether the PE file is a malicious file, if the PE file is determined to be a malicious file, the monitoring server monitors the execution of the PE file in the user terminal or the suspension of the user terminal network may instruct the monitoring agent of the user terminal.

On the other hand, when it is determined that the PE file is not a malicious file, the step of determining whether the PE file is a malicious file (S240) according to the present embodiment includes the step of determining a time period (S240) as shown in FIG. S241), counting past PE file security event analysis information and past file event information (S242), comparing hash values of past PE files (S243), and generating a malicious file suspicion report (S244) can

In the step of determining the time section according to the present embodiment (S241), the monitoring server can determine the time section between the malicious file analysis start time and the past time. In this case, in the step of determining the time period ( S241 ), a time period up to an arbitrary past time may be determined based on the current time for ISD analysis of a specific time band. For example, you can set a time interval in the past time 20 minutes before the current time.

In the step (S242) of counting past PE file security event analysis information and past file event information according to this embodiment, at least one of past PE file security event analysis information and past file event information in a time interval in the past integrated security data group You can count whether a dog has been created. At this time, in the step (S242) of counting the past PE file security event analysis information and the past file event information, the monitoring agent extracts only the content that matches the set time period from the integrated security data ISD, and can divide it into two pieces of information. The first may be information related to the Security Information Event Management (SIEM) unit, and the second may be related to security equipment events and abnormal network access behavior. Two count statistics can be created based on the UIP of each divided content.

Here, the past PE file security event analysis information includes past security information event information of the user terminal generated by the security information event management (SIEM) unit, past detection and blocking event information of the user terminal generated by the security equipment unit 112 and It may include one or more of past packet mirroring information between the user terminal and the Internet and the server zone.

In this case, the past file event information may include one or more of past abnormal access event information between the user terminal and the network equipment related to the event information of the past PE file, and past access event information between the user terminal and another user terminal.

For example, the event occurring in a specific time band for each user terminal may include a SIEM event, an IPS event, a WebF/W event, a Ddos event, a BlackIP access event, an abnormal server zone access event, an abnormal network access event, and the like.

Table 1 below is a table showing statistics of an exemplary event occurring in a specific time band in the user terminal.

number	detection items	count
One	SIEM Events	2
2	IPS event	One
3	Web F/W event	0
4	DDoS events	0
5	BlackIP connection event	2
6	Server zone abnormal connection event	0
7	Network abnormal connection event	One

In the step (S243) of comparing the hash values of the past PE files according to the present embodiment, when the number of generation of one or more of the past PE file security event analysis information and the past file event information is two or more in the time period, two or more past PEs Hash values of two or more past PE files related to file security event analysis information and/or past file event information may be compared. At this time, in the step of comparing the hash values of the past PE files (S243), a UIP having a count of K or more is obtained from two count statistics, and data can be extracted from the ISD under the condition that both the time interval and the UIP are satisfied. K is divided into K1 and K2, and K1 is used in the first count statistics of the step (S242) of counting past PE file security event analysis information and past file event information, and the K2 value is used in the second count statistics. Also, K1 and K2 are constants of “2” or more, and values may be set differently by an administrator.

In Table 1, an event related to the security information event management (SIEM) unit, which is the first item, may be set to K1, and events of the remaining items may be set to K2.

And, in the step of comparing the hash values of the past PE files ( S243 ), ISD data having the same hash value equal to or greater than the Z value among the extracted contents may be extracted. Z is a duplicate constant of the hash value, and it can have a value of “2” or more, and the value can be set differently by the administrator.

Table 2 below is an example showing the contents extracted from the Integrated Security Data (ISD), which is the integrated security data, only the part related to the Security Information Event Management (SIEM) unit in a specific time band.

alarm name	SIP	DIP	port	process	checksum	date
3 SQL Injection Attacks based on source IP	192.168.50.23	1.1.1.1	80	ntpg.exe	4F1712EE489413CEA7AD0CCCFE26C484A7695697DEA5327125517DEC8D8ED214	2020-06-30 20:19:42
IP scan suspect	192.168.50.23	1.1.1.1	6	ntpg.exe	4F1712EE489413CEA7AD0CCCFE26C484A7695697DEA5327125517DEC8D8ED214	2020-06-30 20:21:01
Detect manager port access	192.168.50.23	2.2.2.2	22	ntpg.exe	4F1712EE489413CEA7AD0CCCFE26C484A7695697DEA5327125517DEC8D8ED214	2020-06-30 20:21:55

And, Table 3 below is an example of extracting only events and network abnormal behaviors occurring in the security equipment unit 112 in a specific time band from Integrated Security Data (ISD), which is integrated security data.

Equipment name	detection name	SIP	DIP	port	process	checksum	date
IPS	Cross-Site Scripting Attack	192.168.1.50	151.139. 128.14	80	mbtipv32.exe	35958532EA4AF3B7D99A5C1DF0A6355AEC483EF92A1FA0B2AC4F9DA908320AF2	2020-01-29 09:50:52
BlackIP	-	192.168.1.50	151.139. 128.14	80	mbtipv32.exe	35958532EA4AF3B7D99A5C1DF0A6355AEC483EF92A1FA0B2AC4F9DA908320AF2	2020-01-29 09:51:24

As in Table 2 above, the sum of SIP (or checksum) in the K1 item, that is, the number of collections (3 times) is greater than or equal to “2”, an integer determined by the administrator, and similarly, as in Table 3 above, in the K2 item Since the sum of SIP (or checksum), that is, the number of collections (3 times) is more than “2”, which is an integer determined by the administrator, duplicate counts of two or more PE hash values were collected in each case, and the comparison of the collected files was performed. You can classify the file as a suspicious file.

In the step of generating a malicious file suspicion report ( S244 ) according to the present embodiment, a malicious file suspicion report may be generated for a past PE file having the same hash value among two or more past PE files. In this case, the ISD data contents may be output in the form of a suspicious file report so that the security officer can perform various analysis.

Accordingly, the user terminal event interlocking malicious file determination method ( S200 ) according to the present embodiment may determine a malicious file from security event information generated in the user terminal in conjunction with the user terminal.

In addition, according to the user terminal event-linked malicious file determination method (S200) according to the present embodiment, even if the PE file is determined not to be a malicious file, the file can be classified and managed as a suspicious file by comparing it with the previous PE file. Therefore, the risk of malicious files can be prevented.

On the other hand, the user terminal event interlocking malicious file determination method (S200) according to an embodiment of the present invention can be implemented as one module by software and hardware, and the above-described embodiments of the present invention are written as a program that can be executed on a computer. If possible, it may be implemented in a general-purpose computer that operates the program using a computer-readable recording medium. The computer-readable recording medium is implemented in the form of a magnetic medium such as a ROM, a floppy disk, a hard disk, an optical medium such as a CD or DVD, and a carrier wave such as transmission through the Internet. In addition, the computer-readable recording medium may be distributed in network-connected computer systems to store and execute computer-readable codes in a distributed manner.

And, the components used in the embodiment of the present invention or '~ unit' are tasks, classes, subroutines, processes, objects, execution threads, programs, such as tasks performed in a predetermined area on the memory, or FPGAs. It may be implemented in hardware such as a field-programmable gate array or an application-specific integrated circuit (ASIC), or a combination of the software and hardware. The component or '~ unit' may be included in a computer-readable storage medium, or a part thereof may be distributed and distributed in a plurality of computers.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those of ordinary skill in the art to which the present invention pertains can realize that the present invention can be embodied in other specific forms without changing the technical spirit or essential features. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

Claims (11)

1. generating security event analysis information by analyzing a security event of the user terminal in a monitoring server;

   extracting the file event information including event information of the PE file of the user terminal related to the security event analysis information to a monitoring agent installed in the user terminal and transmitting it to the monitoring server;

   generating, in the monitoring server, the security event analysis information and the PE file security event analysis information in which the event information of the PE file is integrated, and the integrated security data in which the file event information is integrated;

   determining whether the PE file is a malicious file by analyzing the integrated security data; and

   Creating a past integrated security data group comprising the past integrated security data consisting of past PE file security event analysis information and past file event information by storing the integrated security data in chronological order in the monitoring server; User terminal event comprising a; How to determine linked malicious files.
2. According to claim 1,

   The security event analysis information,

   Among the security information event information of the user terminal generated by the security information event management (SIEM) unit, the detection and blocking event information of the user terminal generated by the security equipment unit, and packet mirroring information between the user terminal and the Internet and the server zone A method for determining a malicious file linked to a user terminal event including one or more.
3. 3. The method of claim 2,

   The PE file security event analysis information,

   PE file security information event information in which the security information event information and the event information of the PE file are integrated, PE file detection and blocking event information in which the detection and blocking event information and the event information of the PE file are integrated, and the packet mirroring information and at least one of PE file packet mirroring information in which the event information of the PE file is integrated.
4. 4. The method of claim 3,

   The file event information is

   The user terminal event interlocking malicious file determination method further comprising at least one of abnormal access event information between the user terminal and network equipment related to the event information of the PE file and access event information between the user terminal and another user terminal.
5. According to claim 1,

   The event information of the PE file is,

   A method for determining a malicious file linked to a user terminal event including the file name of the PE file, a hash value (SHA256), and location information stored in the monitoring server.
6. According to claim 1,

   In the step of determining whether the PE file is a malicious file,

   When the PE file is determined to be a malicious file, instructing the monitoring server to stop the execution of the PE file or to stop the user terminal network to the user terminal to the monitoring agent of the user terminal; A method for judging malicious files linked to terminal events.
7. According to claim 1,

   In the step of determining whether the PE file is a malicious file, if it is determined that the PE file is not a malicious file,

   determining, in the monitoring server, a time interval between the malicious file analysis start time and the past time;

   counting how many at least one of the past PE file security event analysis information and the past file event information is generated in the time period in the past integrated security data group;

   When the number of generation of one or more of the past PE file security event analysis information and the past file event information in the time period is two or more, the two or more pieces of the past PE file security event analysis information and/or the past file event information comparing hash values of two or more related past PE files; and

   and generating a malicious file suspicion report for a past PE file having the same hash value among the two or more past PE files.
8. 8. The method of claim 7,

   The past PE file security event analysis information is,

   Past security information event information of the user terminal generated by the security information event management (SIEM) unit, past detection and blocking event information of the user terminal generated by the security equipment unit, and the past between the user terminal and the Internet and server zone contains one or more of packet mirroring information;

   The past file event information is,

   A user terminal event interlocking malicious file determination method comprising at least one of past abnormal access event information between the user terminal and network equipment related to the event information of the past PE file and past access event information between the user terminal and another user terminal.
9. a security event information collection unit for collecting user terminal-related security event information;

   a monitoring agent unit installed in the user terminal to collect file event information including event information of a PE file of the user terminal related to security event analysis information;

   The security event information is analyzed by the security event information collection unit to generate the security event analysis information, and the security event analysis information and the event information of the PE file are integrated, and the PE file security event analysis information and the file event information are integrated. Monitoring server unit for generating integrated security data; and

   and a malicious file determination unit that analyzes the integrated security data generated by the monitoring server unit to determine whether the PE file is a malicious file.
10. 10. The method of claim 9,

    The security event information collection unit,

    A security information event management unit that collects one or more of alarm information, correlation information, and scenario-based information, a security equipment unit that collects at least one of detection and blocking event information related to the user terminal, and a packet between the user terminal and the Internet and server zone A user terminal event-linked malicious file determination system including a packet mirroring unit for collecting mirroring information.
11. 10. The method of claim 9,

    The malicious file determination unit,

    and a malicious file suspicious report generator for generating a malicious file suspicion report by determining whether the PE file is suspected of being a malicious file when the PE file is not a malicious file.

Images