KR20190085637A - System and methdo for isolating malicious code - Google Patents

Abstract

The malicious code isolation system according to an embodiment of the present invention receives isolated hash information from an APT system (Advanced Persistent Threat System), receives a file check server and a quarantine command to generate a quarantine command including quarantine hash information, And a file checking agent that encrypts a file corresponding to the isolated hash information and stores the encrypted file in a specified quarantine folder.

Description

{SYSTEM AND METHOD FOR ISOLATING MALICIOUS CODE}

TECHNICAL FIELD The present invention relates to a technology for isolating malicious codes, and more particularly, to a technique for isolating files infected with malicious codes.

Viruses, worms, Trojan horses, spyware, and fraudulent security software are increasing the damage caused by malicious code. As a way to handle malicious code infected files, it is necessary to collect the information of the saved files to find infected files. However, since the process of collecting the information of the file is heavy, there is a problem that the collection of the file information causes a problem in the execution of the other main processes.

A prior art document of the present invention is disclosed in Published Patent Publication No. 2011-0001426.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a malicious code isolation system that reduces the load of a system caused in the process of collecting file information.

According to an aspect of the present invention, a malicious coat isolation system is provided.

The malicious code isolation system according to an embodiment of the present invention includes a file inspection server for receiving isolated hash information from an APT system (Advanced Persistent Threat System), generating a quarantine command including the quarantine hash information, And a file checking agent for encrypting the file corresponding to the isolated hash information and storing the encrypted file in a designated quarantine folder.

According to an embodiment of the present invention, the file checking agent receives a quarantine command from a file checking server and a collecting unit that collects file information about each file of the computing device, and matches the quarantine hash information included in the quarantine command And an isolation unit for isolating a file of the file information, wherein the collecting unit can wait for a designated waiting time during creation of a file data hash among the file information.

The collecting unit may wait for a setup waiting time, which is a waiting time that is preset or initially set by the user, when the user's input does not exist within a predetermined time.

Wherein the collecting unit sets a predetermined waiting time for use if a user's input is present within a predetermined time, and the waiting time for use is a wait time for which the total time for the designated time is the longest Time.

The collecting unit may wait for the occupancy rate waiting time when the CPU occupancy rate of the file checking agent in the computing device is equal to or higher than a predetermined standard, and the occupancy rate waiting time may be longer than the occupancy waiting time.

The collecting unit may newly store file information corresponding to a new file among the files and update and store file information corresponding to the changed file among the files.

The collecting unit stores the file information index, the file path hash representing the path of the file, and the last recording time of the file in the file information memory, and performs a hash processing specified by the file information index and the contents of the file, Storing the file information in the file information data file, and judging that the file path hash corresponding to the file path among the files is not stored in the file information memory as a new file And determines that the file whose last recording time of each file does not coincide with the last recording time stored in the file information memory is a changed file.

According to another aspect of the present invention, a malicious code isolation method is provided.

A malicious code isolation method according to an embodiment of the present invention includes a step of collecting file information about each file of a computing device, Receiving a quarantine command from a file checking server; And isolating a file of the file information matching the isolated hash information included in the isolation command, wherein the step of collecting file information for each file of the computing device comprises: And waiting for a designated waiting time during generation.

According to an embodiment of the present invention, the step of waiting for a designated waiting time during the generation of the file data hash among the file information includes a step of, if there is no user input within a predetermined time, ≪ / RTI > waiting for a set waiting time, which is a time.

Wherein the step of waiting for a designated waiting time during the generation of the file data hash among the file information further includes a step of setting the waiting time to a predetermined waiting time when a user's input is present within a predetermined time, The sum of the waiting times that can be set as the set waiting time may be the longest waiting time for a designated time.

Waiting for a designated waiting time during generation of a file data hash among the file information may include waiting for an occupancy rate waiting time when the CPU occupancy rate of the file checking agent in the computing device is equal to or higher than a predetermined reference, The occupancy restriction waiting time may be a waiting time longer than the use waiting time.

The step of collecting file information of each file of the computing device may include: newly storing file information corresponding to a new file among the files; And updating and storing file information corresponding to the changed file among the files.

Wherein the step of collecting file information for each file of the computing device comprises the steps of: storing a file information index, a file path hash representing a path of a file, and a last recording time of the file in a file information memory, Storing a file data hash generated by performing a specified hash process in a file hash information memory and storing the whole file information in a file information data file, Wherein the step of storing includes determining that a file whose file hash corresponding to the file path of the file is not stored in the file information memory is a new file, Wherein the step of updating and storing the file comprises the steps of: It may comprise determining a file that does not match the last recording time stored in the memory as the changed files.

As described above, according to the present invention, it is possible to efficiently isolate a file infected with a malicious code.

In addition, according to the present invention, the load per unit time generated in the process of generating the file data hash for all the files can be reduced.

Also, according to the present invention, file information is additionally stored only for new or changed files, thereby reducing input / output due to storage of file information.

1 illustrates a malicious code isolation system in accordance with an embodiment of the present invention.
FIG. 2 illustrates a file inspection agent of a malicious code isolation system according to an embodiment of the present invention. FIG.
3 is a flowchart illustrating a process of generating a file data hash for a target file by a file checking agent of a malicious code isolation system according to an exemplary embodiment of the present invention.
4 is a flowchart illustrating a process in which a file checking agent of a malicious code isolation system according to an embodiment of the present invention records file information on a target file.
5 is a diagram illustrating a memory and a file used by a file checking agent of a malicious code isolation system according to an exemplary embodiment of the present invention to record file information;

While the present invention has been described in connection with certain exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and similarities. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

FIG. 1 illustrates a malicious code isolation system according to an embodiment of the present invention. FIG. 2 illustrates a file scanning agent of a malicious code isolation system according to an exemplary embodiment of the present invention. Referring to FIG.

Referring to FIG. 1, a malicious code isolation system according to an exemplary embodiment of the present invention includes a file inspection server 110 and one or more file inspection agents 120.

The file checking server 110 is connected to an APT system 50 and detects hash information (hereinafter referred to as isolated hash information) of a malicious code file detected up to the present time from the APT system 50, . The file check server 110 transmits a quarantine command including the quarantine hash information to each file check agent 120.

The file checking agent 120 is installed in a computing device such as a personal computer and isolates a file infected with a malicious code among files stored in the computing device according to the isolation command received from the file checking server.

Referring to FIG. 2, the file inspection agent 120 includes a collection unit 210 and an isolation unit 220.

The collecting unit 210 collects file information, accumulates the file information in the file information data file, and detects only newly created or modified files based on the file path name and last file recording time information to generate a file data hash. In addition, the collecting unit 210 performs waiting for a predetermined time according to at least one of the input of the user, the setting of the agent driving speed, and the CPU occupancy rate of the agent in the process of generating the file data hash. Accordingly, the collecting unit 210 can reduce the load generated in the process of generating the file data hash for all the files. 3 and 4, the process of generating the file data hash by the collecting unit 210 will be described in detail.

When there is a file data hash that is the same as the isolation hash information included in the isolation command received from the file check server 110 during the file data hash generated by the collecting unit 210, And moves the file to the specified quarantine folder.

3 is a flowchart illustrating a process of generating a file data hash for a target file by a file checking agent of a malicious code isolation system according to an embodiment of the present invention. Hereinafter, the processes performed by the collecting unit 210 of the file checking agent 120 will be collectively referred to as the file checking agent 120 for the sake of brevity and clarity.

Referring to FIG. 3, in step 310, the file checking agent 120 sequentially reads data of a target file. At this time, the target file means a file corresponding to the source of the file data hash.

In step 320, the file checking agent 120 determines whether the size of the data read from the target file is zero. That is, the file checking agent 120 determines whether data to be generated is additionally generated by the file data hash included in the target file.

In step 320, if the size of the read data is 0, the file checking agent 120 determines that the file data hash is not required to be generated for the target file, and ends the file data hash generation process.

If the size of the data read in step 320 is not 0, the file checking agent 120 determines in step 330 whether the user's input exists within a predetermined time (e.g., 5 seconds).

If there is no user input at step 330, at step 340, the file checking agent 120 performs a wait according to the set waiting time. At this time, the setup wait time may be preset by the user or may be an initial wait time. For example, the file checking agent 120 may wait for 1/1000000 (one millionth) second, 1/1000000 (one millionth) second for every 1/10 of the loop rotation in the process of file data hash, The set waiting time can be pre-inputted or initially set by the user in any one of 1/1000000 (one millionth) second waiting per 1/100 times of loop rotation in the hash process.

If there is a user input in step 330, the file checking agent 120 waits in step 350 according to a predetermined use waiting time. For example, the usage wait time can be set to a setup wait time such as to wait 1/1000000 (one millionth) seconds per 1/100 times of loop rotation in the process of a file data hash. The total can be set to the longest time. Accordingly, when the input of the user is present, the file checking agent 120 may set the waiting time to be long so as not to inconvenience the use of the user's computing device.

In step 360, the file checking agent 120 determines whether the CPU occupation rate of the computing device according to the execution of the file checking agent 120 is equal to or higher than a predetermined reference.

If the CPU occupancy is greater than or equal to the predefined criteria in step 360, the file checking agent 120 waits for the specified occupancy rate waiting time in step 370. For example, the occupancy limit latency may be 1/100 second. That is, when the CPU occupancy rate increases, the file checking agent 120 waits for the occupancy rate waiting time to reduce the load caused by the file checking agent 120, so that the normal operation of the process other than the file checking agent 120 in the computing device Can be performed. Thereafter, the file inspection agent 120 may perform step 380. [ At this time, the occupancy restriction waiting time may be a waiting time longer than the used waiting time.

If the CPU occupancy is less than the predetermined criterion in step 360, the file check agent 120 generates a file data hash for the data of the target file in step 380. Thereafter, the file checking agent 120 may repeat the process from step 310. [

Accordingly, the file checking agent 120 waits in the process of generating the file data hash according to the state of the computing device or the user's tendency, thereby reducing the load generation amount per unit time of the file checking agent 120, Ensure that the process is performing normally.

FIG. 4 is a flowchart illustrating a process of recording file information on a target file by a file checking agent of a malicious code isolation system according to an embodiment of the present invention. FIG. 5 is a flowchart illustrating a malicious code isolation process according to an exemplary embodiment of the present invention. And memory and files used by the file checking agent of the system for recording the file information. Hereinafter, the processes performed by the collecting unit 210 of the file checking agent 120 or the subject of each process are collectively referred to as the file checking agent 120 for the sake of brevity and clarity of the invention .

In step 410, the file checking agent 120 loads the accumulated data. For example, as shown in FIG. 5, the file checking agent 120 reads the file information data file, stores the file information index of each file, the file path hash representing the file path, and the last recording time of the file in the file information memory, The file information index and the contents of the file, and stores the generated file data hash in the file hash information memory.

In step 420, the file checking agent 120 detects the target file. For example, the file checking agent 120 detects any one of a plurality of files stored in the computing device as a target file.

In step 430, the file checking agent 120 checks whether the file path name of the target file exists in the file information memory.

If the file path name of the target file does not exist in the file information memory at step 430, the file checking agent 120 at step 440 sets the file information corresponding to the target file as the new file information to the file information data file, Into the hash information memory. Thereafter, the file checking agent 120 performs the process from step 420 again.

If the file path name of the target file exists in the file information memory in step 430, the file checking agent 120 determines in step 450 whether the last recording time of the target file matches the last recording time stored in the file information memory.

If the last recording time of the target file matches the last recording time stored in the file information memory at step 450, the file checking agent 120 repeats the process from step 420. [

If the last recording time of the target file does not match the last recorded time stored in the file information memory at step 450, the file checking agent 120 checks the file information data file, the file information memory, The information of the file hash information memory is updated.

At this time, in steps 440 and 460 described above, the file data hash generation process described above with reference to FIG. 3 may be performed to insert the file information into the file information data file, the file information memory, and the file hash information memory.

Therefore, the file checking agent 120 according to the embodiment of the present invention does not generate hash data for the target file when the target file is not a new file and is not a file requiring updating. That is, the file checking agent 120 minimizes the number of file hash data generation times, thereby reducing disk I / O of the computing device. Thus, the computing device can perform without significantly delaying other processes due to the file checking agent 120, since the file checking agent 120 generates less disk I / O.

The above-described embodiments of the present invention can be implemented by various means. For example, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof. In the case of hardware implementation, the method according to embodiments of the present invention may be implemented in one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices Field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and the like. In the case of an implementation by firmware or software, the method according to embodiments of the present invention may be implemented in the form of a module, a procedure, or a function for performing the functions or operations described above. A computer program recorded with a software code or the like may be stored in a computer-readable recording medium or a memory unit and may be driven by a processor. The memory unit is located inside or outside the processor, and can exchange data with the processor by various known means.

Combinations of the individual blocks of the block diagrams and flowchart illustrations attached to the present invention may also be performed by computer program instructions. These computer program instructions may be embedded in an encoding processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, so that the instructions, performed through the encoding processor of a computer or other programmable data processing apparatus, Thereby creating means for performing the functions described in each step of the flowchart. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce a manufacturing item containing instruction means for performing the functions described in each block or flowchart of the block diagram. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the processing equipment provide the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

In addition, each block or each step may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical function. It should also be noted that in some alternative embodiments, the functions mentioned in the blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order according to the corresponding function.

The present invention has been described above with reference to the embodiments thereof. Many embodiments other than the above-described embodiments are within the scope of the claims of the present invention. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. The disclosed embodiments should, therefore, be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

110: File check server
120: File Scan Agent
210:
220:

Claims (15)

A file checking server for receiving isolated hash information from an APT system (Advanced Persistent Threat System) and generating a quarantine command including the quarantine hash information; And
A file checking agent that receives the quarantine command, encrypts the file corresponding to the quarantine hash information, and stores the encrypted file in a specified quarantine folder;
A malicious code isolation system.
The method according to claim 1,
A collection unit for collecting file information about each file of the computing device; And
An isolation unit for receiving a quarantine command from a file check server and isolating a file of the file information matched with the quarantine hash information included in the quarantine command;
, ≪ / RTI &
Wherein the collecting unit waits for a waiting time during generation of a file data hash among the file information.
3. The method of claim 2,
Wherein,
And if the input of the user is not present within a predetermined time, waiting for a setting wait time which is a standby time preset or initially set by the user.
The method of claim 3,
Wherein the collecting unit sets a predetermined waiting time for use when a user's input is present within a predetermined time,
Wherein the use waiting time is a waiting time having a longest total time of the waiting time set as the setting waiting time.
5. The method of claim 4,
Wherein the collecting unit waits for the occupancy restriction waiting time when the CPU occupancy rate of the file checking agent in the computing device is equal to or larger than a predetermined reference,
Wherein the occupancy restriction waiting time is a waiting time longer than the use waiting time.
3. The method of claim 2,
The collecting unit
Storing new file information corresponding to a new file among the files,
And updating and storing the file information corresponding to the changed file among the files.
The method according to claim 6,
Wherein,
A file information index, a file path hash representing the path of the file, and a last write time of the file are stored in the file information memory, and a file data hash generated by performing the hash processing specified for the file information index and the contents of the file is stored in the file hash information Stores the entire file information in the file information data file,
Judges that the file path hash corresponding to the file path among the files is not stored in the file information memory as a new file,
And determines that the file whose last recording time of each file does not coincide with the last recording time stored in the file information memory is a changed file.
In the method of isolating malicious code by the file scanning agent,
Collecting file information for each file of the computing device;
Receiving a quarantine command from a file checking server; And
Isolating a file of the file information matching the isolated hash information included in the isolation command;
, ≪ / RTI &
The step of collecting file information for each file of the computing device
A step of waiting for a designated waiting time during the generation of a file data hash among the file information
Wherein the malicious code is a malicious code.
9. The method of claim 8,
Wherein the step of waiting for a designated waiting time during creation of a file data hash among the file information comprises:
Waiting for a set waiting time which is a standby time preset or initially set by the user if the user's input does not exist within a predetermined time.
10. The method of claim 9,
Wherein the step of waiting for a designated waiting time during creation of a file data hash among the file information comprises:
If the user's input is present within a predetermined time, setting a predetermined waiting time for use
Further comprising:
Wherein the use waiting time is a waiting time having a longest total time for a designated time out of waiting times that can be set as the setting waiting time.
11. The method of claim 10,
Wherein the step of waiting for a designated waiting time during creation of a file data hash among the file information comprises:
A step of waiting for the occupancy restriction waiting time when the CPU occupancy rate of the file checking agent in the computing device is equal to or higher than a predetermined standard
Further comprising:
Wherein the occupancy restriction waiting time is a waiting time longer than the use waiting time.
9. The method of claim 8,
Wherein collecting file information for each file of the computing device comprises:
Storing new file information corresponding to a new file among the files; And
And updating and storing the file information corresponding to the changed file among the files.
13. The method of claim 12,
Wherein the step of collecting file information for each file of the computing device comprises the steps of: storing a file information index, a file path hash representing a path of a file, and a last recording time of the file in a file information memory, Storing the file data hash generated by performing the specified hash process in the file hash information memory and storing the whole file information in the file information data file,
Wherein the step of newly storing the file information corresponding to the new file among the files includes the step of determining that the file path hash corresponding to the file path among the files is not stored in the file information memory as a new file Lt; / RTI >
Wherein updating and storing the file information corresponding to the changed file among the files includes determining that the file whose last recording time of each file does not match the last recorded time stored in the file information memory is a changed file Wherein the malicious code is a malicious code.
14. A computer-readable medium having recorded thereon a computer program for causing a processor to perform the method of any one of claims 8 to 13.
14. A computer program stored in a computer-readable medium for causing a processor to perform the method of any one of claims 8 to 13.

Images