KR100367129B1 - A polymorphic virus analysis system and a method thereof - Google Patents

Abstract

The disclosed invention relates to a polymorphic virus diagnosis system and method for diagnosing that a virus infecting a file stored on a hard disk or a floppy disk using a predetermined rule repeatedly executed during simulation is a polymorphic virus.

The present invention provides a diagnostic region for storing at least one file infected with a virus, a polymorphic virus simulation program storage region for storing a simulation program for diagnosing whether a polymorphic virus has been infected for the stored files of the diagnostic region, and A polymorphic virus diagnostic module that reads a file stored in the diagnostic area according to a simulation execution request and diagnoses whether a virus infected with the file stored in the diagnostic area is a polymorphic virus while executing the file stored in the diagnostic area stored in the simulation program storage area; do.

Description

A polymorphic virus analysis system and a method

The present invention relates to a polymorphic virus diagnostic system and method thereof.

More specifically, the present invention relates to a polymorphic virus diagnosis system and a method for diagnosing that a virus infecting a file stored on a hard disk or a floppy disk is a polymorphic virus by using predetermined rules repeatedly executed during simulation.

In general, computer virus writers use a variety of techniques to infect their viruses by evading anti-virus programs (Vaccines).

In the early days when computer viruses were discovered, viruses emerged with a certain pattern of infection, and vaccines began to make diagnostic modules easily. Started to be generated by

Of course, the vaccines also have an advanced diagnostic technology to cope with the above-mentioned virus, the brief description of the above-described diagnostic technology for each type of virus as follows.

First, as a simple virus, even if another normal file is infected by the above-described simple virus-infected file, the vaccine is infected with the same pattern, and the vaccine extracts a unique pattern of the virus and diagnoses it.

Secondly, as an encrypted virus, the above-mentioned encrypted virus is designed to encrypt the virus body and execute a short decryption code first since the vaccine is easily diagnosed when the pattern is kept the same as a simple virus.

Therefore, every time a normal file is infected with the above-mentioned encryption virus, the virus body is encrypted with a different value so that the vaccine cannot be diagnosed with a certain pattern.

However, the vaccine extracts and diagnoses the decryption code in the above-mentioned encryption virus because it has the same pattern every time it is infected.

Third, as a polymorphic virus, a polymorphic virus is an advanced encryption virus, which is designed not only to change the body of the virus every time it is infected but also to change the decryption code part every time it is infected. Therefore, the virus cannot be diagnosed using only one pattern diagnosis method.

Therefore, in order to diagnose the above-mentioned virus, a virus is installed by mounting an emulator in the vaccine and diagnosing a pattern of the virus main body that appears after the execution of the decryption code of the virus itself.

Referring to Figure 1 of the conventional general polymorphic virus diagnosis described above in more detail with reference to the accompanying drawings.

First, it is determined whether the mock execution request signal is input by the user (S100). When the mock execution request signal is input as a result of the determination, a test file sequentially reading test files stored in a storage medium such as a hard disk or a floppy disk. Perform the preparation process (S110).

When the inspection file preparation process (S110) is completed as described above, the up counter N for checking the number of execution steps of the virus simulation program is initialized (S120).

Then, the up counters are counted one by one while executing the above-described virus simulation program step by step (S130) (S140).

As described above, it is determined whether the value of the counted up counter N is greater than the preset value Nc while executing the simulation program step by step (S150).

As a result of the determination, when the upcounter N value is smaller than the preset value Nc, the process is performed again from the above-described process (S130), and when the upcounter N value is larger than the preset value Nc, it is determined as a polymorphic virus body. The search for the diagnostic pattern is started (S160).

At this time, the above-described preset value Nc is determined to be greater than or equal to the total number of steps calculated by multiplying the number of repetitions required to release the encrypted virus and the number of steps of the decryption section based on empirical statistics.

However, in the aforementioned method for diagnosing a polymorphic virus, when the preset value Nc is increased in order to determine the body of the encrypted virus, the processing speed becomes slow, and when the preset value Nc decreases, the virus body appears properly. There was a problem that can not be diagnosed.

In addition, even in the case of a normal file, since the simulation should be performed by a predetermined value (Nc), there was a problem that the overall processing speed of the vaccine was reduced.

An object of the present invention is to provide a polymorphic virus diagnosis system and method for diagnosing that a virus infecting a file stored on a hard disk or a floppy disk is a polymorphic virus using predetermined rules repeatedly executed during simulation to solve the above problems. To provide.

1 is a schematic flowchart of a conventional method for diagnosing a general polymorphic virus.

Figure 2 is a block diagram for conceptually explaining the configuration of a polymorphic virus diagnostic system according to the present invention. Figure 3 is a schematic flowchart of a polymorphic virus diagnostic method according to the present invention.

Explanation of symbols on the main parts of the drawings

100: diagnosis area

110: polymorphic virus diagnostic module

The apparatus of the present invention for achieving the above object is a polymorphism by reading a file stored in the diagnostic area in accordance with a diagnostic area having at least one file and a user's simulation execution request, and applying the read file to the simulation execution program It includes a polymorphic virus diagnostic module for diagnosing the virus.

The method of the present invention for achieving the above object, (1) the process of determining whether the simulation execution request signal of the user is input, and (2) when the simulation execution request signal is input by the user, the first up counter Initializing the second up counter and the third up counter; (3) determining whether the first executable code exists in a file read from the diagnostic area after performing the initialization process; and (4) the first execution. If the code exists, determining whether the specific address in which the first execution code is located is repeatedly executed; counting the first up counter when repeating; and (5) the first execution code does not exist or the first execution code exists. Determining whether the second executable code exists if the specific address where is located is not repeatedly executed, and (6) if the second executable code exists in the file read from the diagnostic area, the second executable code is executed. Determining whether the specific address located is repeatedly executed; (7) determining whether the specific address where the second execution code is located is repeatedly executed; counting the second up counter if repeated; Determining whether the value accumulated by the counter coincides with the value calculated by multiplying the value accumulated by the second up counter by a predetermined value, and determining whether the predetermined value exists, and (9) when the predetermined value exists, Determining whether the value up-counted by the first up counter or the second up counter is greater than a predetermined number of times, or the repetition is completed; and (10) the up-up counter by the first up counter or the second up counter. If the value is greater than a certain number of times, or if the repetition ends, determining that the file read from the diagnostic area is encrypted, and (11) the second executable code does not exist or the second executable code Counting a third up counter when a specific address is not repeatedly executed or when the predetermined value does not exist; (12) determining whether a value counted by the third up counter is greater than a specified number of times; (13) If the value counted by the third up counter is greater than the specified number of times, a message corresponding to the third up counter is output.

Hereinafter, a polymorphic virus diagnostic system of the present invention will be described in detail with reference to the accompanying drawings.

Figure 2 is a block diagram for conceptually explaining the configuration of a polymorphic virus diagnostic system according to the present invention.

As shown, the diagnostic area 100 has at least one file.

The polymorphic virus diagnosis module 110 reads a file stored in the diagnosis area 100 according to a user's simulation execution request and applies the read file to a simulation execution program to diagnose whether the polymorphic virus is infected.

The mock execution program applied to the polymorphic virus diagnosis module 110 described above determines whether the first executable code exists while simulating a file read from the diagnostic area 100 according to a user's mock execution request, and then executes the first executable code. Is repeated and it is determined that the specific address in which the first execution code is located is repeatedly executed, the first up counter is counted, and the first execution code does not exist or the specific address in which the first execution code is located is repeated. If it is not executed, it is determined whether the second execution code exists, and if it is repeatedly executed by determining whether the second execution code exists and the specific address where the second execution code is located is repeatedly executed, the second up counter is counted. It is determined whether the value accumulated by the up counter matches the value calculated by multiplying the value accumulated by the second up counter by a predetermined value. If the calculated values match, the value counted by the first up counter or the second up counter is greater than a certain number of times, or when the repetition is terminated, the file read from the diagnostic area is determined to be encrypted. Is not present or the specific address where the second execution code is located is not repeatedly executed, counting the third up counter, determining whether the value of counting the third up counter is greater than the specified number of times, If the value is larger than the specified number of times, the message is output and then terminated to determine whether the given file is infected with the polymorphic virus.

The first executable code described above refers to a command for changing the contents of a specific address, which is necessarily used when the virus attempts to decrypt the virus. Specifically, move save instruction such as MOVE, STORE, arithmetic operation instruction such as ADD, SUB, DIV, MUL, logical operation instruction such as OR, AND, NOT, XOR, Shift, Rotate instruction such as SHR, SHL, ROR, ROL, etc. It is a command to change the contents of a specific address by stack manipulation or stack change instruction such as, PUSH, POP, CALL, RET.

Some examples are

MOV [1234], Reg; Store the Reg value at the address 1234.

SUB [Addr], Reg; Subtract the Reg value from the contents of the Addr address.

SHR [Addr], 1; Shift the value of the Addr address 1 bit to the right.

PUSH Reg; Push the Reg value to the default stack. The stack is also a structure maintained at a specific address, so it can be said to change the contents of a specific address.

AND [Addr], Reg; The result of ANDing the contents of the Addr address and the Reg value is stored in the Addr address.

Here, Addr and Reg may be constants or registers. The above-described instructions are described based on Intel's 80x86 series of processors, but other processors have almost the same instruction group, so generalization is possible. In other words, if the contents of a specific address change due to a given operation result, the operation instruction is called the first executable code.

While virus writers may deliberately complicate the design to avoid the diagnosis of a vaccine, a polymorphic virus must have at least one first executable code.

The second execution code described above means a conditional branch instruction. The control instructions of the microprocessor include an unconditional branch instruction that unconditionally branches to a specified address and a conditional branch instruction that branches according to the result of the immediately preceding operation. This includes repeating commands such as the LOOP command. The result of the operation is reflected bit by bit in the flag register. The conditional branch instruction does not branch or branch to the given address based on this bit value.

In addition, the polymorphic virus must repeatedly execute the first executable code in order to decrypt itself. Since the virus must be released as much as the size of the virus, the second executable code that executes the branch instruction must be used until a condition is satisfied. none.

The predetermined number of times Nk described above is set to have a value larger than the size of the pattern having the maximum size among the patterns held for diagnosing the polymorphic virus. In other words, it should be set to be greater than or equal to the size of the interval for which decryption is required for polymorphic virus testing.

On the other hand, the designated number Nc 'is set to be greater than or equal to the expected number of steps based on empirical statistics from the start of the simulation execution of the given file until the first execution code or the second execution code first appears.

Next, the diagnostic method performed in the polymorphic virus diagnosis system according to the present invention configured as described above will be described in detail with reference to FIG. 3.

First, the polymorphic virus diagnosis module 110 determines whether a user's simulation execution request signal is input (S310). When the simulation execution request signal is input by the user as a result of the determination, the first up counter n1, the second up counter n2, and the third up counter n3 are initialized (S315).

Then, after performing the above-described initialization process (S315), after reading one file from the above-described diagnosis region 100, the polymorphic virus diagnostic module 110 performs a step of copying the file with a simulation program embedded therein. Each step (S320).

It is determined whether the first executable code exists in the step (S325).

If the first execution code exists in the step, it is determined whether the specific address in which the first execution code is located is repeatedly executed (S330), and if the specific address is repeatedly executed, the first up counter n1 is present. It is counted (S335).

On the other hand, if the first executable code does not exist in the read file or if the specific address in which the first executable code is located is not repeatedly executed, it is determined whether the second executable code exists (S340).

If the second executable code exists in the file read from the diagnosis area 100, it is determined whether the specific address where the second executable code is located is repeatedly executed (S345).

As a result of determination, when the specific address where the second execution code is located is repeatedly executed, the second up counter n2 is counted (S350).

Then, it is determined whether the value accumulated by the first up counter n1 is equal to the value calculated by multiplying the value accumulated by the second up counter n2 with a predetermined value, and then a constant value (constant k It is determined whether there is a (S355).

In other words, if the first up counter n1 and the second up counter n2 increase at the same time and a proportional relationship is established between the two counter values, the polymorphic virus attempts to decrypt the predetermined value (k). ) To determine the existence.

If the predetermined value k exists in the above-described process (S355), the above counted up value by the first up counter n1 and the second up counter n2 is greater than the predetermined number Nk. Or, it is determined whether the repetition is finished (S360).

As a result of the determination of the above-described step S360, if not, the process is performed again from the step S320 of performing the simulation step by step. If the above-described process S360 continues to be executed, the virus diagnosis region may be decoded by a predetermined number Nk.

On the other hand, as a result of the determination of S360 described above, when the value up counted by the first up counter n1 and the second up counter n2 is greater than a predetermined number Nk, or when the repetition is completed, the diagnostic area. It is reported that the decryption is partially performed as a result of simulation execution of the file read from (100), and the polymorphic virus infection is diagnosed (S365), and a message such as 'The virus file is infected with the polymorphic virus' is output to the user. .

On the other hand, if the second execution code does not exist in the above-described process (S340), or if the specific address where the second execution code is located in the above-mentioned process (S345) is not repeatedly executed, or in the above-described process (S355) If the value k does not exist, the third up counter n3 is counted (S370).

Then, it is determined whether the value counted by the third up counter n3 described above is greater than the designated number Nc '(S375).

As a result of determination, when the value counted by the third up counter n3 is larger than the designated number Nc, a message such as 'A virus scan result does not find a polymorphic virus in this file' is output to the user. Quit. Otherwise, the process is performed again from the step S320 of performing the simulation step by step.

As described above, the present invention differs from the prior art in which the number of times of decryption is determined by multiplying the number of steps of decryption based on empirical statistics and the number of iterations necessary to release the encrypted virus when determining the number of designated times Nc. Nc ') is set to the expected number of steps based on empirical statistics until the first execution code or the second execution code appears.

On the other hand, the number of steps of the repetition count and the decryption interval required for releasing the encrypted virus for determining the conventional designated number Nc is multiplied by the above two numbers based on empirical statistics, and thus the determination range is very large. Therefore, it is difficult to determine the designated number Nc described above, and in the worst case, it may be set to the number of steps until the encryption in the polymorphic virus is completely released.

Therefore, the present invention is intended to solve the situation of viruses, which prevent virus producers from deliberately increasing the number of steps by using the weaknesses of vaccines in which these techniques are used. 2 Since the designated number Nc 'is determined only by the expected number of steps until the execution code appears, the number of times can be set much smaller than that of the conventional designated number Nc.

Therefore, when the present invention is applied, the time required for diagnosing whether or not a predetermined file is infected with a polymorphic virus is greatly shortened compared with the prior art.

In other words, the actual number of times specified in the prior art (Nc) is determined in the vicinity of 10000 ~ 200000, and the specified number of times (Nc ') in the present invention was determined to be determined in the vicinity of 2000 ~ 4000.

Therefore, the present invention is due to a small number of designated times Nc 'that are small when the first executable code or the second executable code does not appear when mocking a given file, that is, if the attempt to decrypt the password does not appear more than once. Because the simulation is stopped, the diagnosis speed is very fast in case of the normal file which is not caught by the polymorphic virus.

Also, in the present invention, when the first executable code or the second executable code appears more than once, the number of occurrences of the first executable code or the second executable code, that is, the first up counter n1 and the second up counter n2 described above. Since it starts comparing the upcounted value with the predetermined number of times (Nk), even if the virus intentionally increases the number of steps, it provides the effect that the decryption interval of the required number of times (Nk) can be guaranteed.

Herein, while the present invention has been described with reference to the preferred embodiments, those skilled in the art will variously modify the present invention without departing from the spirit and scope of the invention as set forth in the claims below. And can be changed.

Claims (9)

A diagnostic area for storing at least one file; A polymorphic virus diagnostic module for diagnosing whether a polymorphic virus is infected by reading a file stored in a diagnostic area according to a user's simulation execution request and applying the read file to a mock execution program. The diagnostic module checks whether the first executable code exists, measures the repetition number of the first executable code, checks whether the second executable code exists, and measures the repetition number of the second executable code. Virus diagnosis system, characterized in that for diagnosing the virus . delete delete The method of claim 1, wherein the mock executable program applied to the polymorphic virus diagnostic module, It is determined whether the simulation execution request signal of the user is input, When the simulation execution request signal is input by the user, the first up counter, the second up counter, and the third up counter are initialized. After performing the initialization process, the file read out from the diagnostic area is simulated step by step, and it is determined whether the first executable code exists. If the first execution code exists, it is determined whether the specific address in which the first execution code is located is repeatedly executed, and if it is repeated, the first up counter is counted. If the first executable code does not exist or if the specific address where the first executable code is located is not repeatedly executed, it is determined whether the second executable code exists. When the second executable code exists in the file read from the diagnostic area, it is determined whether the specific address where the second executable code is located is repeatedly executed, Counting the second up counter when the specific address in which the second execution code is located is repeatedly executed; Determine whether the value accumulated by the first up counter matches the value calculated by multiplying the value accumulated by the second up counter by a predetermined value, and determining whether the predetermined value exists, If the predetermined value exists, it is determined whether the value up counted by the first up counter or the second up counter is greater than a predetermined number of times, or the repetition is completed. Diagnosing whether a polymorphic virus is infected by reporting that the decryption of the file is partially performed as a result of the simulation execution of the file when the value up-counted by the first up counter or the second up counter is greater than a certain number of times, or when the repetition ends. If the second execution code does not exist, or if the specific address where the second execution code is located is not repeatedly executed, or if the predetermined value does not exist, a third up counter is counted; It is determined whether the value counted by the third up counter is greater than a predetermined number of times, And outputting a message corresponding to the value counted by the third up counter when the value counted by the third up counter is greater than a predetermined number of times. The polymorphic virus diagnosis according to claim 4, wherein the first execution code means an instruction for changing the content of the specific address, and the second execution code means a conditional branch instruction. system. The method of claim 4, wherein the predetermined number of times is set to be greater than a maximum size of a preset diagnostic virus pattern, and greater than or equal to a size of a preset virus scan area. And the specified number of times is set to an expected number of steps based on empirical statistics until the first execution code or the second execution code appears. (1) determining whether a simulation execution request signal of the user is input; (2) initializing a first up counter, a second up counter, and a third up counter when a simulation execution request signal is input by the user; (3) A process of simulating and executing the file read from the diagnostic area step by step after performing the initialization process. (4) determining whether the first executable code exists at the address immediately after the simulation step by step; (5) if the first execution code exists, determining whether the specific address where the first execution code is located is repeatedly executed and counting the first up counter when repeating; (6) determining whether the second executable code exists when the first executable code does not exist or when the specific address where the first executable code is located is not repeatedly executed; (7) if the second executable code exists, determining whether the specific address where the second executable code is located is repeatedly executed; (8) counting a second up counter when the specific address in which the second execution code is located is repeatedly executed; (9) determining whether the value accumulated by the first up counter matches the value calculated by multiplying the value accumulated by the second up counter by a predetermined value, and determining whether the predetermined value exists; (10) if the predetermined value exists, determining whether the value up counted by the first up counter or the second up counter is greater than a predetermined number of times or the repetition is completed; (11) Diagnosing polymorphic virus infection by reporting that the decryption of the file has been partially performed as a result of the simulation execution of the file when the value counted up by the first up counter or the second up counter is greater than a certain number of times, or the repetition is terminated. Process, if not, repeat process from (3) (12) counting a third up counter when the second execution code does not exist, or when the specific address where the second execution code is located is not repeatedly executed or the predetermined value does not exist; (13) determining whether the value counted by the third up counter is greater than a predetermined number of times; And (14) polymorphic virus diagnosis comprising the step of outputting a message corresponding to the value counted by the third up counter greater than a specified number of times, and if not, performing the process again from step (3). Way. 8. The method of claim 7, wherein the first execution code refers to an instruction for changing the content of the specific address, and the second execution code refers to a conditional branch instruction. The method of claim 7, wherein the predetermined number of times is set to be greater than a maximum size of a preset diagnostic virus pattern and greater than or equal to a size of a preset virus scan area. The predetermined number of times, the polymorphism virus diagnostic method, characterized in that it is set to be greater than or equal to the expected number of steps until the first execution code or the second execution code appears during the execution of the preset file.