KR101986638B1 - Malware preventing system and method for object file to protect - Google Patents

Abstract

The present invention relates to a malware prevention system for a file to be protected, and to a malware prevention method therefor. The malware prevention system for a file to be protected automatically sets a file to be protected in a manner to determine and decide a user writing file which is a main target of a malicious code such as ransomware, and efficiently blocks the attacks from the malicious code such as ransomware in advance without a separate protection target setting procedure by the user.

Description

TECHNICAL FIELD [0001] The present invention relates to a malicious blocking system and a malicious blocking method for a protected file,

The present invention relates to a technology for protecting a file from malicious code, and more particularly, to a technique for automatically protecting a file to be a target of malicious code detection and protection, And more particularly, to a technique capable of effectively blocking an attack from an attacker.

Unlike malicious code that attacks information (file) to the outside, Ransomware modifies information (file) by arbitrarily modifying it by encrypting it or compressing it, Attack in the form of.

Such a randomware is mainly used as a malicious purpose of taking information (file) into an unusable state (modulation), informing the user of the information (file) attack and withdrawing money in return for information (file) restoration.

At this time, since Ransomware modifies the information (file) to an unusable state but does not completely destroy it in order to achieve the purpose of withdrawal of money, it is not easy to recognize Ransomware's attack clearly in advance, It is difficult to do.

In the past, various blocking technologies (security products) have been used to diagnose / block Ransomware based on the threats obtained by analyzing the behavior of various types of Ransomware.

However, in the case of the existing blocking technology (security product), it is premised on a setting procedure for setting (specifying) a file to be protected and a process for allowing the user to access the files directly.

That is, in the existing blocking technology (security product), unless the user sets (designates) a file and process to be protected, it can not be protected from the Ransomware.

However, the conventional method in which a user directly performs a setting procedure for setting (specifying) a file to be protected is very troublesome to the user, and a file that does not need to be protected from the Rangemotor may be set as a protection target There is a problem that the reliability of the protection target file setting can not be optimized because the protection target file can not be set as a protection target even though it is a file that needs to be protected from the RAN firmware.

On the other hand, the main target of Ransomware is not a program file or a system file which can be reinstalled and downloaded in order to achieve the purpose of money withdrawal, but a user author file having a great meaning of restoration is mainly made by the user.

Accordingly, the present invention provides a technology that can automatically detect and protect a file to be a primary attack target of Ransomware, effectively prevent an attack from the Ransomware without a protection target setting procedure by a separate user, .

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and it is an object of the present invention to provide a system and method for automatically detecting and protecting a file to be a main attack target of a malicious code (e.g., A malicious blocking system and a malicious blocking method for a protected file that can effectively prevent an attack from the RANEMWARE without a protection target setting procedure.

According to a first aspect of the present invention, there is provided a malicious blocking method for a file to be protected, the method comprising the steps of: detecting a process of detecting an input by a user according to a predefined user input detection rule; A log generation step of generating a user input log for the identified process; Checking whether a process involved in the generation of the file is a process having a history in which the user input log is generated at the time of file creation; And a protection target setting step of, when the user input log is a process having a history in which the user input log is generated, determining that the file is a user copyright file to be protected to which the predefined malicious blocking rule is applied.

In order to achieve the above object, according to a second aspect of the present invention, there is provided a malicious blocking system for a file to be protected, wherein when a process of detecting an input by a user is detected according to a predefined user input detection rule, A log generation unit for generating a user input log for the identified process; A process confirmation unit for checking whether a process involved in the generation of the file is a process having a history in which the user input log is generated at the time of file creation; And a protection unit configured to determine that the file is a user file to be protected, to which the malicious blocking rule has been applied, when the user input log is a process having a history in which the user input log is generated.

According to the embodiments of the present invention, it is possible to automatically detect and protect a file targeted by an actual malicious code (e.g., Rangomewaware) as an object to be protected, and to perform an attack from the Ransomware It is possible to effectively block it.

Thus, according to the embodiments of the present invention, it is possible to improve the diagnosis and the blocking rate of a malicious code (e.g., Raman software) while improving usability.

FIG. 1 is a block diagram showing the configuration of a malicious blocking system for a file to be protected according to a preferred embodiment of the present invention.
FIG. 2 and FIG. 3 are flowcharts illustrating a malicious blocking method for a file to be protected according to a preferred embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

First, the present invention will be described with reference to FIG. Here, FIG. 1 shows a configuration of a malicious code blocking system for a file to be protected according to a preferred embodiment of the present invention.

As shown in FIG. 1, the malicious blocking system 100 for a file to be protected according to the present invention is preferably installed in an independent user device 200. The malicious blocking system 100 for the protection target file of the present invention may be in the form of an application installed in the user device 200 or a diagnostic engine.

1, a plurality of processes (1, 2, ..., N), which are principals for performing registry, file, network, and process related actions in the user device 200, A file system 210 for controlling I / O for information (files) between information (files) stored in a plurality of processes (1, 2, 150 shown in FIG.

As shown in FIG. 1, in the malicious blocking system 100 for a file to be protected according to the present invention, when a process of detecting an input by a user is detected according to a predefined user input detection rule, A log generation unit 110 for generating a user input log for the identified process, and a process for checking whether the process involved in the generation of the file is a process having a history in which the user input log is generated (120) for judging that the file is a protected user work file to which the predefined malicious blocking rule is applied when the user input log is a history having a generated history, .

Furthermore, the malicious blocking system 100 for a file to be protected according to the present invention may further include a protection function execution unit 140.

The malicious blocking system 100 for a file to be protected according to the present invention may include a backup area 150 itself.

The log generation unit 110 generates a user input log for the process in which the user input detection is confirmed when a process of detecting an input by a user is confirmed according to a predefined user input detection rule.

Here, the user input detection rule includes a process of searching for a window in which at least one of a cursor of a mouse input and a caret of a keyboard input is present, a process of recognizing a process of the searched window, The process of recognizing the recognized process as a process of detecting an input by a user may be included.

That is, the user input detection rule is a rule for detecting an input event which can be regarded as input by a user or otherwise expressed by a user authoring action.

The function of confirming the process of detecting the input by the user according to the user input detection rule may be performed in a separate detection unit (not shown) or in the log generation unit 110.

Hereinafter, for convenience of explanation, it is assumed that the log generating unit 110 performs a function of checking a process of detecting an input by a user according to a user input detection rule.

Specifically, the log generating unit 110 continuously performs an operation of searching for a window in which at least one of a cursor of a mouse input and a caret of a keyboard input exists in accordance with a user input detection rule do.

A window in which at least one of a cursor of a mouse input and a caret of a keyboard input exists is a window in which an input event that can be viewed by a user, that is, a user authoring action, Active window).

The log generation unit 110 recognizes the process of the searched window, that is, the active window, according to the user input detection rule.

When an input event of a mouse input or a keyboard input is generated in the searched window, that is, the active window, the log generation unit 110 confirms the process recognized for the currently active window by a process of detecting input by the user.

For example, it can be assumed that at least one of a cursor of a mouse input and a caret of a keyboard input is located on a screen on which a word file with the name "job.doc" is activated and displayed .

In such a case, the log generation unit 110 will detect a screen in which a word file with the name "job.doc" is activated and displayed as an active window according to the user input detection rule.

Accordingly, the log generator 110 can recognize word.exe as a process of the active window detected this time, and monitors whether or not an input event is generated in the active window detected this time.

At this time, the log generating unit 110 determines whether an input event of a mouse input or a keyboard input is generated based on a procedure of a preset input event monitoring function to monitor and record an input event input through a mouse or a keyboard Can be monitored.

Alternatively, the log generation unit 110 may monitor whether or not an input event of a keyboard input is generated based on a procedure of a predetermined hooking function for hooking a keyboard that is delivered to all threads of the file system 210 can do.

Of course, the log generating unit 110 may monitor whether or not an input event occurs in the active window detected through various methods other than the monitoring method based on the input event monitoring function or the hooking function procedure.

When an input event such as a mouse input or a keyboard input is detected in the currently active window, that is, an input event that can be viewed as a user authoring action, the log generating unit 110 generates a process (word.exe) This can be confirmed by the process in which the input by the user is detected.

As described above, according to the user input detection rule, the log generation unit 110 continuously performs an active window search operation and continuously repeats the operation of confirming the process of detecting the input by the user.

Accordingly, when the process of detecting the input by the user is confirmed according to the user input detection rule, the log generation unit 110 can generate the user input log for the process in which the user input detection is confirmed.

When an arbitrary process (for example, process 1) of a plurality of processes (1, 2, ... N) attempts to access (act) information (file) stored in the user device 200 , The file system 210 will process the I / O according to the attempted access (action) of Process 1 for the file in question.

Accordingly, the log generator 110 can check the I / O processed in the file system 210 and generate a user input log for the process in which user input detection is confirmed as described above.

Specifically, the log generating unit 110 is configured to include at least one of a time at which an input event was generated, a process information for a process, file information in which an input event exists, and a type of an input event, A user input log can be generated.

For example, if an input event (for example, write) occurs in an active window in which a word file with the name "action.doc" is activated as described above, and a process (word.exe) .

In this case, the log generation unit 110 generates a log generation process for the process (word.exe) in which the detection of the user input is confirmed, the time at which the input event occurred (for example, ), The process information about the process (for example, word.exe), the file information where the input event exists (for example, job.doc), and the type of input event (for example, write) .

As can be seen from the above-described configuration of the user input log, the user input log can be understood as log information about when a certain process has performed input to which file.

In this manner, the log generating unit 110 can generate a user input log for a process in which user input detection is confirmed whenever a process of detecting an input by a user is confirmed according to a user input detection rule.

In this case, the malicious blocking system 100 for the protection object file according to the present invention generates the malicious blocking system 100 according to the input by the user in the user device 200, And accumulate / manage user input logs.

The process check unit 120 checks whether a process involved in file creation at the time of file creation is a history having a history in which a user input log is generated.

Specifically, the process check unit 120 can check whether there is a newly generated file by checking the I / O processed in the file system 210, and recognize the process involved in creating a new file.

The process check unit 120 checks whether the process involved in generating the new file is a process having a history in which the user input log is generated.

For example, if there is a user input log of the process information corresponding to the process involved in generation of this file among the pre-accumulated / managed user input logs, the process verification unit 120 may be involved in generation of this file Can be confirmed as a process having a history in which a user input log is generated.

When the process related to the generation of the current file is a process having a history in which a user input log is generated as a result of the confirmation by the process verification unit 120, the protector pending unit 130 deletes the generated file from the predefined malicious blocking rule Is determined to be a user copyrighted file to be protected.

A process having a history in which a user input log is generated refers to a process involved when a direct authoring action (input) is performed by the user.

Accordingly, if the process involved in file creation is a process having a history of generating a user input log, the file to be generated at this time may also be a file in which a user's authoring action (input) can be performed at any time.

If the process related to the generation of the current file is a process having a history in which the user input log is generated as a result of the confirmation of the process verification unit 120, It can be automatically judged as a user's author file of the protected object to be applied.

In this case, the malicious code blocking system 100 for a file to be protected according to the present invention can automatically determine whether or not the file is to be treated as a file to be protected, that is, a user authoring file, at the time of file creation.

The protection function execution unit 140 performs a file protection function for protecting a file according to a malicious blocking rule on a file determined as a user authoring file.

At this time, the present invention does not limit the malicious blocking rule.

However, since the present invention relates to a technology for protecting a file by blocking an attack from malicious code that attempts to attack the form of arbitrarily modifying a file, such as a random software, to an unusable state, If it is a blocking rule, it can be adopted.

That is, when the access attempt is recognized, the protection function execution unit 140 permits access to the file determined as the user authoring file only in the case of an attempt by the previously verified process according to the malicious blocking rule. Files (user authoring files) can be protected from malicious code attacks.

For example, in the present invention, access statistics can be generated based on the pre-accumulated / managed user input log described above.

That is, in the present invention, since malicious code that attacks a form such as random software that arbitrarily modifies a file to make it in an unusable state is actually a user's authoring file, a sufficient learning period And generates access statistics based on accumulated user input logs.

The access statistics for each file (user authoring file) generated as described above are the same as those for the normal operation performed by the normal process from the previous time to the generation of the access statistics, Means statistics for.

In this case, the protection function execution unit 140 determines whether the access attempt is normal based on the access statistics according to the malicious blocking rule when the access attempt is recognized for the file determined as the user authoring file (normal (In agreement with the behavior) or abnormal (ie, inconsistent with the normal behavior included in the access statistics) and judges that the access attempt is a normal access attempt, this may be determined as an attempt by the verified process.

The guard protector 130 may determine a file having an input event by a user among the files previously determined to be a user authoring file as a user authoring file.

For example, if there is a user input log of file information matching the file determined as the user authoring file among the pre-accumulated / managed user input logs, the guard protector 130 deletes the file from the input event It is determined that the file exists, and the file can be determined as a user authoring file.

The file in which the input event by the user exists among the files judged as the user authoring file may be regarded as a file in which the authoring action (input) of the user is actually performed.

In this case, the malicious code blocking system 100 for the protection target file according to the present invention automatically identifies a file to be confirmed as a user authoring file among the files to be protected, that is, a file judged (handled) / Can be confirmed.

The protection function execution unit 140 performs file protection functions of the file determined as the user authoring file and the file determined as the user authoring file at different blocking levels according to the malicious blocking rule.

At this time, the present invention does not limit the malicious blocking rule.

However, since the present invention relates to a technology for protecting a file by blocking an attack from malicious code that attempts to attack the form of arbitrarily modifying a file, such as a random software, to an unusable state, If it is a blocking rule, it can be adopted.

That is, the protection function execution unit 140 permits access only to the file determined as the user authoring file if the access attempt is recognized, if the access attempt is recognized, according to the malicious blocking rule, (User authoring file) judged to be protected can be protected from malicious code attack.

Meanwhile, the protection function execution unit 140 may be configured to allow access to the file determined as the user authoring file only when the access attempt is recognized, if the attempt is for an allowed action of the previously verified process according to the malicious blocking rule , The protected file (user authoring file) determined by the user authoring file can be protected from the malicious code attack.

That is, the malicious blocking system 100 for a file to be protected according to the present invention is a malicious blocking system for a file to be protected, in which a verified process and an authorized right (action) for each verified process are determined by a predetermined or continuous learning process, A blocking rule can be employed.

The protection function execution unit 140 permits access to the file determined as the user authoring file without viewing the permission (activity) in the case of an attempt by the previously verified process according to the malicious blocking rule if an access attempt is recognized .

On the other hand, the protection function execution unit 140 may allow access to the file determined by the user authoring file only when the access attempt is recognized, if the attempt is for an allowed action of the previously verified process according to the malicious blocking rule have.

In this way, the protection function execution unit 140 can be realized by a file that can be performed at any time by a user's authoring action (input), that is, a file judged as a user authoring file and a file in which a user's authoring action For a confirmed file, it is possible to perform a file protection function of a stronger blocking level to a file determined as a user authoring file than a file judged as a user authoring file.

At this time, if the protection function execution unit 140 permits access without viewing the authority (activity) in the case of an attempt by the verified process for the file determined as the user authoring file, It is possible to perform automatic backup in which backup is made to the designated backup area 150. [

As described above, according to the malicious blocking system for the protection target file of the present invention, a file to be protected is automatically set by a method of judging and confirming a user authoring file which is a main attack target of a malicious code (e.g., (Technology) that can effectively prevent an attack from malicious code (eg, RANMAMWARE) without a protection target setting procedure by a separate user.

In this case, according to the present invention, a new malicious blocking technique for automatically setting a file to be protected is realized, thereby enhancing the usability and enhancing the diagnosis and the blocking rate of malicious code (for example, Raman software).

Hereinafter, with reference to FIG. 2 and FIG. 3, a malicious blocking method for a file to be protected according to a preferred embodiment of the present invention will be described in more detail. Here, for convenience of description, the components shown in FIG. 1 will be described with reference to corresponding reference numerals.

First, referring to FIG. 2, a procedure for automatically setting a file to be protected in the malicious blocking method for a file to be protected according to the present invention will be described.

In the malicious blocking method for a file to be protected according to the present invention, the system 100 detects an input (input event) by a user according to a user input detection rule (S100).

Specifically, the user input detection rule includes a process of searching for a window in which at least one of a cursor of a mouse input and a caret of a keyboard input is present, a process of recognizing a process of the searched window, And if the input event of the mouse input or the keyboard input occurs in the window, checking the recognized process as a process of detecting the input by the user.

Accordingly, in the malicious blocking method for a file to be protected according to the present invention, the system 100 may include at least one of a cursor of a mouse input and a caret of a keyboard input according to a user input detection rule Continue searching the window.

In the malicious blocking method for a file to be protected according to the present invention, the system 100 may include at least one of a cursor of a mouse input and a caret of a keyboard input according to a user input detection rule And the process of the active window.

On the other hand, in the malicious blocking method for a file to be protected according to the present invention, when an input event of a mouse input or a keyboard input is generated in a searched window, that is, an active window, (S100).

In the malicious blocking method for a file to be protected according to the present invention, the system 100 determines whether or not the current active window that detects input (input event) by the user is a process (S110).

In the malicious blocking method for a file to be protected according to the present invention, when a process of detecting an input by a user is confirmed according to a user input detection rule (S110) A user input log may be generated (S120).

Specifically, in the malicious blocking method for a file to be protected according to the present invention, the system 100 determines whether the input event has occurred, the process information about the process, The type of the input event, and the type of the input event.

For example, if an input event (for example, write) occurs in an active window in which a word file with the name "action.doc" is activated as described above, and a process (word.exe) .

For this assumption, the system 100 determines the time at which the input event was generated (e.g., Jan 12, 2018 x y 10 seconds) for the process (word.exe) for which this user input detection was verified, You can create a user input log consisting of process information about the process (for example, word.exe), file information where the input event exists (for example, job.doc), and the type of input event (for example, write).

As can be seen from the above-described configuration of the user input log, the user input log can be understood as log information about when a certain process has performed input to which file.

As described above, in the malicious blocking method for the file to be protected according to the present invention, whenever the process of detecting the input by the user is confirmed according to the user input detection rule, A user input log can be generated.

In this case, in the malicious blocking method for the file to be protected according to the present invention, when an input event that can be regarded as input by the user in the user device 200, The generated user input logs will be accumulated / managed.

In addition to the above-described user input log generation process, in the malicious blocking method for the protection target file according to the present invention, the system 100 checks the I / O processed in the file system 210, (Step S130).

In the malicious blocking method for a file to be protected according to the present invention, when the system 100 determines that a new file is created (Yes in S130), the system 100 determines whether the process involved in generating the current file is a history (S140).

For example, when there is a user input log of process information matching the process involved in generation of this file among the user input logs accumulated / managed in the system 100, the system 100 executes a process Can be confirmed as a process having a history in which a user input log is generated.

In the malicious blocking method for a file to be protected according to the present invention, if the process involved in generating the current file is a history having a history in which a user input log is generated (Yes in S140) The created file is judged as a protection target user authoring file to which the previously defined malicious blocking rule is applied (S150).

That is, in the malicious blocking method for the file to be protected according to the present invention, when the process involved in the generation of this file is a process having a history in which a user input log is generated (Yes in S140) The file is also regarded as a file in which a user's authoring action (input) can be performed at any time, and the generated file is determined as a user's authoring file to be protected (S150).

In this case, the malicious code blocking system 100 for a file to be protected according to the present invention can automatically determine whether or not the file is to be treated as a file to be protected, that is, a user authoring file, at the time of file creation.

Furthermore, according to one embodiment, in the malicious blocking method for a file to be protected according to the present invention, the system 100 determines whether there is a file in which there is an input event by a user among the files previously determined as the user authoring file S160), the file in which the input event exists can be determined as a user authoring file (S170).

For example, in the malicious blocking method for a file to be protected according to the present invention, the system 100 may include a user input log of file information matching a file determined as a user authoring file among pre-accumulated / If it exists, the file can be determined as a file in which an input event by the user exists, and the file can be confirmed as a user authoring file.

That is, in the malicious blocking method for a file to be protected according to the present invention, the system 100 can prevent a file having an input event by a user from among files determined as a user authoring file in advance, File, and confirms it as a user copyright file to be protected (S170)

In this case, the malicious code blocking system 100 for the protection target file according to the present invention automatically identifies a file to be confirmed as a user authoring file among the files to be protected, that is, a file judged (handled) / Can be confirmed.

The malicious blocking system 100 for a file to be protected according to the present invention is a system in which the malicious blocking system 100 for a file to be protected stores the above described user input log generation process (S100 to S120) and the aforementioned protection target file The authoring file, and the determined user authoring file), the automatic setting process (S130 to S170) will be repeated.

Referring to FIG. 3, a process of performing a file protection function on a file to be protected in the malicious blocking method for the protection target file according to the present invention will be described.

In the malicious blocking method for the file to be protected according to the present invention, the system 100 does not limit the malicious blocking rule.

However, since the present invention relates to a technology for protecting a file by blocking an attack from malicious code that attempts to attack the form of arbitrarily modifying a file, such as a random software, to an unusable state, If it is a blocking rule, it can be adopted.

In the malicious blocking method for a file to be protected according to the present invention, the system 100 recognizes an access attempt to a file by checking the I / O processed in the file system 210 (S200).

In the malicious blocking method for a file to be protected according to the present invention, when an access attempt to a file is recognized, the system 100 determines whether the access attempt is a user authoring file automatically determined (determined or determined) It is checked whether the file is a file (S210).

In the malicious blocking method for a file to be protected according to the present invention, if the system 100 is not a file to be protected (user authoring file) (S210 No), the system 100 permits access to the access attempt, (S290). In this case, access is controlled in a manner set according to the case.

In the malicious blocking method for a file to be protected according to the present invention, the system 100 determines whether the current file is a file to be protected (user authoring file) (S210 Yes) or not (S220).

In the malicious blocking method for a file to be protected according to the present invention, when the file is judged as a user authoring file (S220 Yes), the system 100 determines whether the malicious blocking rule is an attempt by a previously verified process (S230 Yes) The user can access the file without checking the authority (action) and automatically back up the file to the backup area 150 (S240).

That is, if the access attempt is recognized for the file determined as the user's authoring file, the system 100 can protect the file judged as the user's authoring file in such a manner that access is permitted only in the case of an attempt by the pre- The target file (user authoring file) can be protected from malicious code attack.

Of course, in the malicious blocking method for the file to be protected according to the present invention, the system 100 will block access in the case of an attempt by an unverified process according to the malicious blocking rule (S280).

Meanwhile, in the malicious blocking method for a file to be protected according to the present invention, when the system 100 determines that the file is the user's authoring file (S220 No) (S260) only when it is an attempt (S270).

That is, in the malicious blocking method for the file to be protected according to the present invention, the system 100 can reflect the validated process and the authorized rights (activity) for each verified process through the predetermined or continuous learning process The malicious blocking rule can be adopted.

If the access attempt is recognized for the file determined as the user authoring file, the system 100 may allow the user 100 to access the file only if the access attempt is for an allowed action of the previously verified process according to the malicious blocking rule. The protected file (user authoring file) determined by the authoring file can be protected from the malicious code attack.

Of course, in the malicious blocking method for the file to be protected according to the present invention, the system 100 will block the access in the case of an unauthenticated process or an unauthorized authorization (action) according to the malicious blocking rule (S280).

As described above, in the malicious blocking method for a file to be protected according to the present invention, the system 100 can be configured to include a file that a user's authoring action (input) can be performed at any time, ) Is actually performed, that is, a file determined as a user authoring file, can perform a file protection function of a stronger blocking level to a file determined as a user authoring file than a file judged as a user authoring file.

The malicious blocking system 100 for the file to be protected according to the present invention will repeatedly execute the above-described process of performing the file protection function (S200 to S290) unless the system is terminated (S180 No).

As described above, according to the malicious blocking method for the file to be protected according to the present invention, the file to be protected is automatically detected by the method of determining and confirming the user's authoring file that is the main attack target of the malicious code , And realizes a technique (technique) that can effectively prevent an attack from malicious code (for example, Raman software) without a protection target setting procedure by a separate user.

In this case, according to the present invention, a new malicious blocking technique for automatically setting a file to be protected is realized, thereby enhancing the usability and enhancing the diagnosis and the blocking rate of malicious code (for example, Raman software).

A malicious blocking method for a file to be protected according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

100: Malicious blocking system for protected files
110: log generation unit 120: process verification unit
130: Protector Standing Government 140: Protection Function Department
150: Backup area
200: User device
210: File system

Claims (13)

A log generation step of generating a user input log for a process in which the user input detection is confirmed if a process of detecting an input by a user is confirmed according to a predefined user input detection rule;
Checking whether a process involved in the generation of the file is a process having a history in which the user input log is generated at the time of file creation; And
And a protection target setting step of, when the user input log is a process having a generated history, determining that the file is a user copyright file to be protected, to which a predefined malicious blocking rule is applied, How to block malicious files. The method according to claim 1,
The user input detection rule includes:
Searching for a window in which at least one of a cursor of a mouse input and a caret of a keyboard input is present,
Recognizing a process of the searched window,
And confirming the recognized process as a process of detecting an input by a user when an input event of a mouse input or a keyboard input is generated in the searched window. 3. The method of claim 2,
The log generation step may include:
Generating a user input log including at least one of a time at which the input event was generated, process information for the process, file information in which the input event exists, and a type of the input event for the process in which the user input detection is confirmed Wherein the malicious file is a file to be protected. The method according to claim 1,
Wherein the protection target setting step comprises:
Wherein a file having an input event by a user among files determined as the user authoring file is determined as a user authoring file. 5. The method of claim 4,
Further comprising the step of performing a protection function of performing a file protection function of a different blocking level according to the malicious blocking rule on the file determined as the user authoring file and the file determined as the user authoring file, How to block malicious files. 6. The method of claim 5,
Wherein the performing of the protection function comprises:
And accessing the file determined as the user authoring file only when the access attempt is recognized, if the attempt is based on the malicious blocking rule. 6. The method of claim 5,
Wherein the performing of the protection function comprises:
Wherein when the access attempt is recognized for the file determined as the user authoring file, the access is allowed only when the attempt is for an allowed action of the previously verified process according to the malicious blocking rule. How to block. 8. The method of claim 7,
Wherein the performing of the protection function comprises:
If the access permitted to the file determined as the user authoring file, performs the automatic backup in which the file permitted to access is backed up to the pre-designated backup area. A log generating unit for generating a user input log for a process in which the user input detection is confirmed if a process of detecting an input by a user is identified according to a predefined user input detection rule;
A process confirmation unit for checking whether a process involved in the generation of the file is a process having a history in which the user input log is generated at the time of file creation; And
And a protection unit configured to determine that the file is a user copyright file to be protected, to which the predefined malicious blocking rule is applied, when the user input log is a process having a generated history, Malicious blocking system for. 10. The method of claim 9,
The user input detection rule includes:
Searching for a window in which at least one of a cursor of a mouse input and a caret of a keyboard input is present,
Recognizing a process of the searched window,
And checking the recognized process by a process of detecting an input by a user when an input event of a mouse input or a keyboard input occurs in the searched window. 10. The method of claim 9,
Wherein the protection-
Wherein a file having an input event by a user among the files determined as the user authoring file is determined as a user authoring file. 12. The method of claim 11,
Further comprising a protection function execution unit for performing a file protection function of a different blocking level according to the malicious blocking rule on the file determined as the user authoring file and the file determined as the user authoring file, Malicious blocking system for. 9. A computer-readable recording medium recording a program for performing the method of any one of claims 1 to 8.

Images