WO2011002146A2 - Système et procédé pour détecter un programme malveillant - Google Patents

Système et procédé pour détecter un programme malveillant Download PDF

Info

Publication number
WO2011002146A2
WO2011002146A2 PCT/KR2010/002375 KR2010002375W WO2011002146A2 WO 2011002146 A2 WO2011002146 A2 WO 2011002146A2 KR 2010002375 W KR2010002375 W KR 2010002375W WO 2011002146 A2 WO2011002146 A2 WO 2011002146A2
Authority
WO
WIPO (PCT)
Prior art keywords
driver
malicious code
api
user process
analysis
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/KR2010/002375
Other languages
English (en)
Korean (ko)
Other versions
WO2011002146A3 (fr
Inventor
김윤동
서성원
연성호
이지남
정영석
한명호
최재영
이재홍
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Inca Internet Co Ltd
Original Assignee
Inca Internet Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Inca Internet Co Ltd filed Critical Inca Internet Co Ltd
Publication of WO2011002146A2 publication Critical patent/WO2011002146A2/fr
Publication of WO2011002146A3 publication Critical patent/WO2011002146A3/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring

Definitions

  • the present invention relates to a malware detection system and method, and more particularly, to a system and method for accurately detecting whether any application contains malware by applying a heuristic technique.
  • malware malicious code
  • the actual definition of malware refers to all programs and executable parts designed to cause psychological and substantial harm to others.
  • the cracker's technology for producing malicious code increases, so does the security threat.
  • Methods for analyzing such malware include a signature test, a cyclic redundancy check (CRC) test, and a heuristic test.
  • Fingerprint scanning is one of the ways that security programs diagnose malware, as fingerprints are used to distinguish people. In other words, it collects unique strings (patterns) owned by malicious codes and stores them in the database, and analyzes the malicious codes using a method that the security program matches the patterns.
  • the fingerprint inspection method has a sequential string inspection method and a specific string inspection method.
  • the sequential string inspection method has a disadvantage in that the detection rate of the malware is fast, but the detection rate of the malicious code is low.
  • the fingerprint inspection method detects malicious code by comparing the same string pattern, there is a problem that the malicious code cannot be detected when some of the patterns of the malicious code are modified. For this reason, in order to increase the malware detection rate, there is a problem that the security company must repeat the operation of storing the modified pattern of the malware in the database every time the pattern of the malware is modified again.
  • the CRC test is an error detection method for verifying the reliability of data in serial transmission. It has a merit of low error rate. However, even if the data is modified by 1 byte, the malicious code cannot be diagnosed.
  • a heuristic technique that improves the function of the fingerprint inspection method is mainly used as a method for analyzing malicious codes, which is one of learning-based analysis methods that analyze itself or analyze the behavior of malicious codes.
  • a malicious virus program often uses a unique combination of API commands, and the heuristic technique learns a combination of these unique API commands to determine whether the malicious code is based on the API commands.
  • the object of the present invention which is devised to solve the above-mentioned problem, is to detect and deassemble API command patterns used by arbitrary application programs running on a computer system in a kernel level domain to grasp behavior patterns of the corresponding application programs. It is intended to provide a system and method for accurately detecting whether an application contains malicious code.
  • Kernel driver search unit for selecting the driver to be scanned
  • Kernel driver conversion unit for checking the API functions used by the driver to be scanned
  • a kernel driver analyzing unit that analyzes whether the malicious code suspect API is included among the API functions used by the test target driver, and disassembles the malicious code suspect API and parameter values used by the test target driver. It characterized in that it comprises a malicious code analysis unit for analyzing whether the malicious code suspect API is a malicious code API.
  • a kernel driver search step for selecting a driver to be scanned
  • a kernel driver conversion step for identifying the API functions used by the driver to be scanned
  • the test object Kernel driver analysis step of analyzing whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the inspection target driver It is characterized by including a malicious code analysis step of analyzing whether the API is a malicious code API.
  • a kernel driver search unit for selecting a driver to be scanned, a kernel driver conversion unit for checking the API functions used by the driver to be scanned, and the test target
  • the kernel driver analysis unit that analyzes whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the scan target driver
  • a malicious code analysis unit for analyzing whether an API is a malicious code API
  • a user process search unit for investigating a user process using the target driver when the malicious code API is included in the scan target driver as a result of the analysis of the malicious code analysis unit. And analyzing whether the user process calls the malicious code API. Characterized in that it comprises a user process analysis unit for detecting whether the malicious code API of the driver is actually executed.
  • a kernel driver search step for selecting a driver to be scanned, a kernel driver conversion step for confirming the API functions used by the driver to be scanned, and the test object Kernel driver analysis step of analyzing whether the malicious code suspect API is included among the API functions used by the driver, and the malicious code suspect API by disassembling the malicious code suspect API and parameter values used by the inspection target driver
  • a user process analysis step of detecting whether the malicious code API of the driver to be inspected is actually executed.
  • the above-described malicious code detection system and method according to the present invention has an effect of accurately detecting whether malicious code is included in any application program running on a computer system.
  • FIG. 1 is a functional block diagram of a malware detection system according to an embodiment of the present invention.
  • FIG. 2 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention
  • FIG. 3 is a functional block diagram of a malware detection system according to another embodiment of the present invention.
  • FIG. 4 is an operation flowchart showing a malicious code detection method according to another embodiment of the present invention.
  • the driver information store of the computer system stores the names of kernel level programs (commonly referred to as kernel drivers) of the executed application programs and memory address values referenced by each kernel driver. . All kernel drivers in the driver list stored in this driver information store are the drivers to be inspected in the present invention. If the driver to be scanned in the driver list is converted to a PE structure, the API functions used by the kernel driver and the memory address information of the corresponding API functions can be extracted.
  • an application program containing malicious code among application programs running on a computer system is called a malicious code program, and API functions used in the malicious code are called a malicious code suspect API.
  • FIG. 1 is a block diagram of a malicious code detection system according to an embodiment of the present invention.
  • the malware detection system of the present invention uses a kernel driver search unit (11) for selecting a driver to be inspected from a list of drivers stored in the driver information storage (1), and converts the driver to a PE structure to be used by the driver to be scanned. Kernel driver converting unit 12 to check the API functions that are being used, Kernel driver analysis unit 13 to analyze whether the malicious code suspect API among the API functions used by the test target driver, and the test target driver And a malicious code analysis unit 14 for analyzing whether the malicious code suspect API is a malicious code API by disassembling the malicious code suspect API and parameter values.
  • the malicious code detection system of the present invention further includes a disabling processor 15 for blocking the operation of the inspection target driver using the malicious code API as a result of the analysis of the malicious code analysis unit 14.
  • the kernel driver search unit 11 selects a driver to be inspected from a list of drivers stored in the driver information storage 1.
  • the kernel driver converting unit 12 converts the inspected driver into a PE structure, and then list information of API functions used by the inspected driver is obtained.
  • the kernel driver analyzing unit 13 analyzes whether the malicious code suspect API is included among the API functions used by the inspected driver.
  • the malicious code suspect API may be an API function related to key input / output or keyboard port access used by a key logger, an API function that reads or stores a USB input / output function or a file, It may be an associated API function or an API function related to memory manipulation.
  • the kernel driver analyzing unit 13 extracts address information of a memory in which the malicious code core API actually exists if the malicious code core API is included among the API functions used by the driver to be scanned.
  • the malicious code suspect API may or may not be a malicious code API, and the malicious code analyzing unit 14 analyzes whether the malicious code suspect API is a malicious code API.
  • the malicious code analysis unit 14 extracts and disassembles a code value of a predetermined byte (a disassembly target byte) around a memory address of the malicious code suspect API. At this time, the disassembly target byte is set to include the malicious code suspect API and the parameter value used by the malicious code suspect API in the code value to be disassembled. The malicious code analysis unit 14 analyzes the disassembled malicious code suspect API and its parameter values to check whether the malicious code suspect API accesses a resource to be protected, thereby determining whether the malicious code suspect API is a malicious code API. Judge.
  • a malicious code suspect API related to hardware has an address of a port as a parameter value.
  • the malicious code suspect API for example, ReadPortUChar API
  • the scanned driver using the malicious code suspect API will attempt to access the keyboard. Judging by the code
  • the neutralization processing unit 15 disables the driver to be inspected by the malicious code analysis unit 14 as including the malicious code.
  • the technique for disabling the driver can simply apply a conventionally known technique.
  • FIG. 2 is an operation flowchart illustrating a malicious code detection method of a malicious code detection system according to an exemplary embodiment of the present invention.
  • the inspection target driver is selected from the driver list (S21).
  • FIGS. 1 and 2 if the kernel driver contains malicious code, all of them are disabled to block its execution. However, even if the kernel driver contains malicious code, the malicious code is not executed unless the actual user level process executes it. However, the embodiment of FIGS. 1 and 2 has a problem of blocking all cases. 3 is a solution for solving this problem.
  • FIG. 3 is a block diagram illustrating a malicious code detection system according to another embodiment of the present invention.
  • the malware detection system of the present invention uses a kernel driver search unit 31 for selecting any driver to be scanned from a list of drivers stored in the driver information storage 1, and converts the driver to be a PE structure to be used by the driver to be scanned.
  • Kernel driver converting unit 32 for checking the API functions that are being used
  • Kernel driver analysis unit 33 for analyzing whether the malicious code suspect API among the API functions used by the inspection target driver, and the inspection target driver It analyzes whether the malicious code suspect API is a malicious code API by disassembling the malicious code suspect API and parameter values, and stores the driver handle and malicious code API information of a target driver that uses the malicious code API in a shared memory ( 2) Scan target dry by using the malicious code analysis unit 34 to store in the driver, and the driver handle information stored in the shared memory
  • a user process search section 35 for examining a user process list using the user
  • a user process analysis section 36 for checking whether each user process in the user process list calls the malicious code API, and a malicious code API for calling
  • the disable processing unit 37 blocks the execution of the malicious code by closing the driver handle of the inspection target driver or terminating the user process.
  • the functions and operations of the kernel driver search unit 31, the kernel driver conversion unit 32, and the kernel driver analysis unit 33 are the kernel driver search unit 11 and the kernel of FIG.
  • the functions and operations of the driver converter 32 and the kernel driver analyzer 33 are the same, and detailed descriptions thereof are omitted here.
  • the malware analysis unit 34 extracts and disassembles the code value of the disassembly target byte around the memory address of the malicious code suspect API, and analyzes the deassembled malicious code suspect API and its parameter values. By checking whether the malicious code suspect API accesses a resource to be protected, it is determined whether the malicious code suspect API is a malicious code API. If it is determined that the inspection target driver uses the malicious code API, the malicious code analysis unit 34 stores the driver handle of the inspection target driver and the malicious code API information in use in the shared memory 2.
  • the user process searching unit 35 uses the driver handle information stored in the shared memory to investigate the user processes using the driver to be inspected to create a user process list. Since kernel drivers and user processes are not in a one-to-one matching relationship, there may or may not be many user processes using the driver to be inspected.
  • the user process analysis unit 36 analyzes whether the user process of the user process list calls the malicious code API included in the inspection target driver. When the user process calls the malicious code API included in the inspection target driver, since the malicious code is executed, the neutralization processing unit 37 disables the malicious code so as not to be executed. If the user process does not call the malicious code API included in the scan target driver, there is no possibility of exploitation of the malicious code API.
  • the disabling processing unit 37 disables the malicious code so that the malicious code cannot be executed by closing the driver handle of the inspection target driver or terminating the user process.
  • FIG. 4 is a flowchart illustrating a malicious code detection method of a malicious code detection system according to another exemplary embodiment of the present invention.
  • the inspection target driver is selected from the driver list (S41).
  • the malicious code suspect API is included among the API functions (S43), and the malicious code suspect API and parameter values are disassembled (S44).
  • the driver handle of the driver of the inspection target driver using the malicious code API and the malware code in use are stored in the shared memory (S46).
  • the driver handle information is used to examine a list of user processes using the driver to be inspected (S47), and analyze whether the corresponding user process calls a malicious code API (S48). Finally, when the user process calls the malicious code API as a result of the analysis of step S48, the execution of the malicious code is disabled (S49). This may be achieved by closing the driver handle or terminating the user process.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Quality & Reliability (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

La présente invention concerne un système et un procédé permettant de détecter avec précision si un programme d'application arbitraire contient un programme malveillant par application d'une technique heuristique. Un système pour détecter un programme malveillant selon l'invention comprend un programme de recherche de pilote central, lequel programme de recherche sélectionner un pilote cible de recherche, un convertisseur de pilote central qui vérifie les fonctions API utilisées par le pilote cible de recherche, un programme d'analyse du pilote central qui détermine si une API de programme malveillant suspecte est contenue ou non dans les fonctions API utilisées par le pilote cible de recherche, et un programme d'analyse du programme malveillant qui désassemble l'API de programme malveillant suspecte utilisée par le pilote cible de recherche et une valeur de paramètre pour déterminer si l'API du programme malveillant suspectée est ou non une API de programme malveillant.
PCT/KR2010/002375 2009-06-30 2010-04-16 Système et procédé pour détecter un programme malveillant Ceased WO2011002146A2 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
KR10-2009-0058960 2009-06-30
KR1020090058960A KR101161008B1 (ko) 2009-06-30 2009-06-30 악성코드 탐지시스템 및 방법

Publications (2)

Publication Number Publication Date
WO2011002146A2 true WO2011002146A2 (fr) 2011-01-06
WO2011002146A3 WO2011002146A3 (fr) 2011-02-17

Family

ID=43411537

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2010/002375 Ceased WO2011002146A2 (fr) 2009-06-30 2010-04-16 Système et procédé pour détecter un programme malveillant

Country Status (2)

Country Link
KR (1) KR101161008B1 (fr)
WO (1) WO2011002146A2 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103150513A (zh) * 2013-03-20 2013-06-12 北京奇虎科技有限公司 拦截应用程序中的植入信息的方法及装置
US10242200B1 (en) * 2015-03-06 2019-03-26 Tripwire, Inc. Static analysis of vulnerabilities in application packages
CN116049814A (zh) * 2022-12-27 2023-05-02 安天科技集团股份有限公司 建立信息安全防护的方法、装置、存储介质及电子设备

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101206853B1 (ko) * 2011-06-23 2012-11-30 주식회사 잉카인터넷 네트워크 접근 제어시스템 및 방법
CN103186740B (zh) * 2011-12-27 2015-09-23 北京大学 一种Android恶意软件的自动化检测方法
KR101404882B1 (ko) * 2013-01-24 2014-06-11 주식회사 이스트시큐리티 행위를 기반으로 한 악성코드 분류시스템 및 분류방법
KR101724412B1 (ko) * 2015-09-23 2017-04-10 한국전자통신연구원 확장 코드를 이용한 어플리케이션 분석 장치 및 방법

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
AU1329601A (en) * 1999-10-01 2001-05-10 Infraworks Corporation System and method for providing data security
US7743257B2 (en) * 2002-06-27 2010-06-22 Nxp B.V. Security processor with bus configuration
KR100509650B1 (ko) * 2003-03-14 2005-08-23 주식회사 안철수연구소 코드 삽입 기법을 이용한 악성 스크립트 감지 방법
US7603715B2 (en) * 2004-07-21 2009-10-13 Microsoft Corporation Containment of worms
KR100704721B1 (ko) * 2004-09-10 2007-04-06 (주) 세이프아이 실시간 감시를 통한 컴퓨터 보호 방법 및 이에 따라 보호되는 컴퓨터 보호 시스템과 실행가능한 파일이 보호되는 시스템
KR100628869B1 (ko) * 2004-12-14 2006-09-27 한국전자통신연구원 악성 코드가 숨겨진 오피스 문서 탐지장치 및 그 방법
KR100666562B1 (ko) * 2005-08-11 2007-01-09 주식회사 웨어플러스 커널 드라이버 및 프로세스 보호 방법
US20090064337A1 (en) * 2007-09-05 2009-03-05 Shih-Wei Chien Method and apparatus for preventing web page attacks

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103150513A (zh) * 2013-03-20 2013-06-12 北京奇虎科技有限公司 拦截应用程序中的植入信息的方法及装置
US10242200B1 (en) * 2015-03-06 2019-03-26 Tripwire, Inc. Static analysis of vulnerabilities in application packages
CN116049814A (zh) * 2022-12-27 2023-05-02 安天科技集团股份有限公司 建立信息安全防护的方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
KR101161008B1 (ko) 2012-07-02
WO2011002146A3 (fr) 2011-02-17
KR20110001426A (ko) 2011-01-06

Similar Documents

Publication Publication Date Title
Carmony et al. Extract Me If You Can: Abusing PDF Parsers in Malware Detectors.
RU2526716C2 (ru) Эвристический способ анализа кода
CN113162945B (zh) 漏洞检测分析方法、装置及基于此的漏洞验证方法、系统
US8627478B2 (en) Method and apparatus for inspecting non-portable executable files
JP5265061B1 (ja) 悪意のあるファイル検査装置及び方法
WO2011002146A2 (fr) Système et procédé pour détecter un programme malveillant
CN113158197B (zh) 一种基于主动iast的sql注入漏洞检测方法、系统
JP4732484B2 (ja) 仮想環境を利用した非実行ファイル内のエクスプロイトコード分析方法及び装置
US9804948B2 (en) System, method, and computer program product for simulating at least one of a virtual environment and a debugging environment to prevent unwanted code from executing
US8646076B1 (en) Method and apparatus for detecting malicious shell codes using debugging events
WO2012176978A2 (fr) Système et procédé de commande d'accès à un réseau
WO2011055945A2 (fr) Appareil et procédé pour détecter des sites malveillants
CN101183414A (zh) 一种程序检测的方法、装置及程序分析的方法
CN105184169A (zh) Windows操作环境下基于插桩工具的漏洞检测方法
CN105868630A (zh) 恶意pdf文档检测方法
Ladisa et al. Towards the detection of malicious java packages
CN107103237A (zh) 一种恶意文件的检测方法及装置
KR101110308B1 (ko) 실행압축 특성을 이용한 악성코드 탐지장치 및 그 방법
JP6407184B2 (ja) 攻撃対策判定システム、攻撃対策判定方法及び攻撃対策判定プログラム
WO2011037321A2 (fr) Procédé de recherche de modification du noyau windows
KR100628869B1 (ko) 악성 코드가 숨겨진 오피스 문서 탐지장치 및 그 방법
WO2010093071A1 (fr) Système de sécurité pour site internet, et procédé correspondant
CN112347479B (zh) 恶意软件检测的误报纠正方法、装置、设备和存储介质
CN119227087B (zh) 基于多智能体协作的Android应用程序漏洞检测方法及系统
WO2014168406A1 (fr) Appareil et procédé permettant de diagnostiquer une attaque qui contourne des mécanismes de protection de mémoire

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10794281

Country of ref document: EP

Kind code of ref document: A2

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10794281

Country of ref document: EP

Kind code of ref document: A2