KR102121741B1 - Malicious code detecting apparatus based on bipartite graph - Google Patents

Abstract

The present invention relates to an apparatus for detecting a malicious code based on a binary graph, and includes a basic block determination unit and a basic block to analyze at least one basic block by analyzing each of a plurality of malicious files included in the analysis population according to specific criteria. It includes a malicious code similarity calculation unit for generating a similarity graph between a plurality of malicious files by generating a binary graph of a plurality of malicious files as a basis, and a malicious code classification unit for classifying a plurality of malicious files based on the similarity.

Description

Malware detection device based on binary graph {MALICIOUS CODE DETECTING APPARATUS BASED ON BIPARTITE GRAPH}

The present invention relates to a malicious code detection technology, and more particularly, to a malicious code detection device based on a binary graph that can detect and classify a malicious code using a binary graph.

Internet and computer technologies are continually being developed, and there are increasing attempts to exploit these technologies to take advantage of them. For example, there are increasing methods of installing and distributing malicious code on users' computers to take unfair advantage from users.

Here, the malicious code refers to a program that penetrates or is installed on a computer without the user's permission and performs malicious actions. Accordingly, security experts are seeking various solutions.

Korean Patent Publication No. 10-2009-0055669 (2009.06.03)

One embodiment of the present invention is to provide a malicious code detection device based on the binary graph that can detect and classify the malicious code using the binary graph.

An embodiment of the present invention generates a binary graph of a plurality of malicious files in the analysis population and basic blocks constituting each of the plurality of malicious files, and each of the basic blocks is divided into a plurality of malicious files from the binary graph It is intended to provide a malicious code detection device based on a binary graph that can calculate similarity between a plurality of malicious files by using the frequency that appears.

According to an embodiment of the present invention, even if a new malicious file is registered in the analysis population, a binary component capable of calculating similarity between a new malicious file and a malicious file to be compared based on a basic block constituting the new malicious file without generating a new binary graph. It is intended to provide a graph-based malware detection device.

Among the embodiments, the apparatus for detecting a malicious code based on the bipartite graph includes: a basic block determination unit that analyzes each of a plurality of malicious files included in the analysis population according to a specific criterion to determine at least one basic block; A malicious code similarity calculating unit generating a binary graph of the plurality of malicious files based on the basic block to calculate similarities between the plurality of malicious files; And a malicious code classification unit classifying the plurality of malicious files based on the similarity.

The malicious code similarity calculator divides the malicious code analysis population into a malicious file set and a basic block set, and generates a corresponding relationship between the malicious file set and the basic block set in the binary graph.

The malicious code similarity calculator calculates a weight using the frequency of the basic block appearing in the malicious file set based on the binary graph, and calculates the similarity based on the calculated weight.

The malicious code similarity calculator calculates the reciprocal of the frequency as the weight. The malicious code similarity calculating unit may calculate the similarity between the malicious files to be compared by summing the weights of the basic blocks corresponding to common malicious files to be compared among the plurality of malicious files.

Then, when the malicious code similarity calculating unit registers a new malicious file in the malicious code analysis population, it compares the new malicious file with the weight calculated from the bipartite graph based on the basic block of the new malicious file. It is characterized by calculating the similarity between the malicious files.

The malicious code similarity calculator calculates the similarity between the new malicious file and the malicious file to be compared by summing the weights of the basic blocks corresponding to the new malicious file and the malicious file to be compared.

In addition, the basic block determining unit may perform any one of a basic unit command sequence, a function unit command sequence, and a dynamic analysis of the malicious file IP address, domain address, string, mutex, and API from the malicious file static analysis. It is characterized in that it is determined by the basic block.

Among the embodiments, the malicious code detection device based on the bipartite graph determines at least one basic block by analyzing the new malicious file according to a specific criterion when a new malicious file is registered in an analysis population including a plurality of malicious files A basic block determining unit; A malicious code similarity calculating unit calculating a similarity level between the plurality of malicious files and the new malicious file from a binary graph previously generated based on the plurality of malicious files; And a malicious code classification unit that classifies the new malicious file based on the similarity.

The similarity calculating unit divides the analysis population into a set of malicious files for the plurality of malicious files and a set of basic blocks for the basic blocks constituting each of the plurality of malicious files, and between the set of malicious files and the set of basic blocks. It is characterized in that the corresponding relationship is generated by the binary graph.

The malicious code similarity calculating unit calculates the similarity between the malicious files to be compared with the new malicious files by using the frequency of occurrence of the basic blocks constituting the new malicious file in the malicious file set among the basic block sets. Is done.

The similarity calculator calculates the sum of the reciprocal of the frequency of the basic block corresponding to the new malicious file and the malicious file to be compared to the similarity.

The disclosed technology can have the following effects. However, since the specific embodiment does not mean that all of the following effects should be included or only the following effects are included, the scope of rights of the disclosed technology should not be understood as being limited thereby.

The apparatus for detecting a malicious code based on a binary graph according to an embodiment of the present invention may detect and classify a malicious code using the binary graph.

The apparatus for detecting a malicious code based on a binary graph according to an embodiment of the present invention generates a binary graph of a plurality of malicious files in the analysis population and basic blocks constituting each of the multiple malicious files, and from the binary graph Similarity between the plurality of malicious files may be calculated by using the frequency of each of the basic blocks in the plurality of malicious files.

The malicious code detection device based on the binary graph according to an embodiment of the present invention is compared with the new malicious file based on the basic block constituting the new malicious file without the need to generate a new binary graph even if a new malicious file is registered in the analysis population. Similarity between malicious files can be calculated.

1 is a diagram illustrating a malicious code detection system based on a binary graph according to an embodiment of the present invention.
FIG. 2 is a block diagram showing the malicious code detection device in FIG. 1.
FIG. 3 is a flowchart illustrating a malicious code detection process performed by the malicious code detection device in FIG. 1.
FIG. 4 is an exemplary diagram illustrating a process of calculating the similarity between malicious files constituting the malicious code analysis population in the malicious code similarity calculation unit in FIG. 2.
FIG. 5 is an exemplary diagram illustrating a process of calculating the similarity between a new malicious file and the remaining malicious files when a new malicious file is registered in the malicious code analysis population in the malicious code similarity calculating unit of FIG. 2.

Since the description of the present invention is merely an example for structural or functional description, the scope of the present invention should not be interpreted as being limited by the examples described in the text. That is, since the embodiments can be variously changed and have various forms, it should be understood that the scope of the present invention includes equivalents capable of realizing technical ideas. In addition, the purpose or effect presented in the present invention does not mean that a specific embodiment should include all of them or only such an effect, and the scope of the present invention should not be understood as being limited thereby.

Meanwhile, the meaning of terms described in the present application should be understood as follows.

Terms such as "first" and "second" are for distinguishing one component from other components, and the scope of rights should not be limited by these terms. For example, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

When a component is said to be "connected" to another component, it may be understood that other components may exist in the middle, although they may be directly connected to the other component. On the other hand, when a component is said to be "directly connected" to another component, it should be understood that no other component exists in the middle. On the other hand, other expressions describing the relationship between the components, that is, "between" and "immediately between" or "neighboring to" and "directly neighboring to" should be interpreted similarly.

Singular expressions are to be understood as including plural expressions unless the context clearly indicates otherwise, and terms such as “comprises” or “have” are used features, numbers, steps, actions, components, parts or the like. It is to be understood that a combination is intended to be present, and should not be understood as pre-excluding the existence or addition possibility of one or more other features or numbers, steps, actions, components, parts or combinations thereof.

In each step, the identification code (for example, a, b, c, etc.) is used for convenience of explanation. The identification code does not describe the order of each step, and each step clearly identifies a specific order in context. Unless stated, it may occur in a different order than specified. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be embodied as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all kinds of recording devices in which data readable by a computer system is stored. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, and optical data storage devices. In addition, the computer-readable recording medium can be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

All terms used herein have the same meaning as generally understood by a person skilled in the art to which the present invention pertains, unless otherwise defined. The terms defined in the commonly used dictionary should be interpreted as being consistent with the meanings in the context of the related art, and cannot be interpreted as having ideal or excessively formal meanings unless explicitly defined in the present application.

1 is a diagram illustrating a malicious code detection system based on a binary graph according to an embodiment of the present invention.

Referring to FIG. 1, the malware detection system 100 may include a user terminal 110, a malware detection device 130, and a database 150. The user terminal 110 corresponds to a computing device that provides a target file that is a target of malicious code analysis to the malicious code detection device 130, and may be implemented as a smart phone, a laptop, or a computer. The present invention is not limited to this, and may be implemented with various devices such as a tablet PC.

The user terminal 110 may be connected to the malware detection device 130 through a network, and a plurality of user terminals 110 may be simultaneously connected to the malware detection device 130. The user terminal 110 may provide the malware detection apparatus 130 with a malware analysis population implemented as a set of target files that are targeted for malware analysis.

The malicious code detection device 130 may be implemented as a server corresponding to a computer or program capable of detecting and classifying malicious code by analyzing a target file provided from the user terminal 110 or the database 150 through a network. . The malware detection device 130 may be wirelessly connected to the user terminal 110 through Bluetooth, WiFi, or the like, and may transmit and receive data to and from the user terminal 110 through a network.

The malware detection device 130 may be implemented including the database 150, and may be implemented separately from the database 150. When implemented separately from the database 150, the malware detection device 130 is connected to the database 150 to transmit and receive data.

The database 150 may store various information used by the malware detection device 130 to detect and classify the malware. For example, the database 150 may store information on a bipartite graph used by the malware detection device 130 to detect malware, and target file information targeted for malware detection Can be saved. Here, the binary graph is a graph in which a set of vertices of a graph can be divided into two, and vertices belonging to each set are not adjacent to each other.

The database 150 may be composed of at least one independent sub-database that stores information belonging to a specific range, and may be composed of an integrated database in which at least one independent sub-database is integrated into one. When composed of at least one independent sub-database, each sub-database may be wirelessly connected through Bluetooth, WiFi, etc., and may transmit and receive data between each other through a network. When configured as an integrated database, each sub-database may be integrated into one and may include a control unit that manages data exchange and control flows with each other.

FIG. 2 is a block diagram showing the malicious code detection device in FIG. 1.

Referring to FIG. 2, the malicious code detection device 130 may include a basic block determination unit 210, a malicious code similarity calculation unit 230, a malicious code classification unit 250, and a control unit 270. The basic block determining unit 210 analyzes each of a plurality of files (hereinafter referred to as malicious files) classified as malicious codes in the malicious code analysis population according to a specific criterion to determine at least one basic block.

More specifically, the basic block determination unit 210 may determine a basic unit of instruction (opcode) sequence or function-based instruction sequence resulting from static analysis of the malicious file as a basic block. In addition, the basic block determining unit 210 may determine an IP address, a domain address, a string, a mutex, and an application programming interface (API) obtained by dynamically analyzing a malicious file as a basic block.

The malicious code similarity calculator 230 calculates the similarity by generating a binary graph of a plurality of malicious files based on the basic block determined by the basic block determining unit 210. More specifically, the malicious code similarity calculating unit 230 may generate a binary graph by matching the basic blocks of each of the plurality of malicious files and the plurality of malicious files. That is, the malicious code similarity calculating unit 230 may divide the malicious code analysis population into a malicious file set and a basic block set, and generate a correspondence relationship between the malicious file set and the basic block set in a binary graph.

The malicious code similarity calculating unit 230 calculates, as a weight, an inverse number of frequencies each of the plurality of basic blocks appears in the plurality of malicious files based on the bipartite graph, and two malicious files to be compared among the plurality of malicious files commonly include The similarity between two malicious files to be compared can be calculated by summing all the weights of the basic blocks.

In one embodiment, when the malicious code similarity calculating unit 230 registers a new malicious file in the malicious code analysis population, the malicious code similarity calculating unit 230 uses the weight calculated from the previously generated binary graph based on the basic block constituting the new malicious file. Similarity between malicious files and malicious files to be compared can be calculated.

More specifically, the malicious code similarity calculating unit 230 calculates the similarity between the new malicious file and the malicious file to be compared by summing all the weights of the basic block of the malicious file to be compared that commonly includes the basic block composing the new malicious file. Can be.

That is, the malicious code similarity calculating unit 230 may calculate the similarity between the malicious file to be compared with the new malicious file by using the weight calculated from the previously generated binary graph whenever a new malicious file is registered in the malicious code analysis population. .

The malicious code classification unit 250 may classify malicious files according to the similarity calculated through the malicious code similarity calculation unit 230. For example, if the similarity of malicious files to be compared is calculated to be higher than a preset reference value, the malicious files can be grouped into similar malicious files.

The embodiment of the present invention is not limited thereto, and the similarity of the malicious files to be compared is calculated according to the basic block type through the malicious code similarity calculation unit 230, and the similarity calculated by the malicious code classification unit 250 is calculated for each type. Malicious files can be classified on the basis. For example, malicious files may be classified by complexly determining the similarity calculated in the basic unit of the command sequence and the similarity calculated in the function unit.

The embodiment of the present invention is not limited to this, and the malicious code analysis population may be composed of a malicious file and an unclassified file, and the unclassified file may be classified as a malicious file or a normal file based on the similarity between the malicious file and the unclassified file.

The control unit 250 controls the overall operation of the malicious code detection device 130, and controls the control flow or data flow between the basic block determination unit 210, the malicious code similarity calculation unit 230, and the malicious code classification unit 250. Can be managed.

FIG. 3 is a flowchart illustrating a malicious code detection process performed by the malicious code detection device in FIG. 1.

In FIG. 3, the malicious code detection device 130 may analyze each of the malicious files in the malicious code analysis population according to a specific criterion through the basic block determination unit 210 to determine at least one basic block (step) S310).

The malicious code detection device 130 may divide the malicious code analysis population into the malicious file set and the basic block set through the malicious code similarity calculating unit 230, and generate a binary graph of the correspondence between the malicious file set and the basic block set. (Step S320).

For example, the malicious code similarity calculator 230 divides a plurality of malicious files into a set of malicious files each having a different node, and a plurality of basic blocks each having a plurality of basic blocks, and a plurality of malicious files. The basic blocks constituting each of the files can be connected to each other with a trunk line to create a binary graph.

The malware detection device 130 may calculate the similarity between a plurality of malicious files based on the binary graph generated by the malware similarity calculation unit 230 (step S330). In one embodiment, the malicious code similarity calculating unit 230 calculates as a weight the inverse of the frequency of each of the plurality of basic blocks appearing in malicious files constituting the malicious code analysis population, and compares two of the multiple malicious files. The similarity between two malicious files to be compared can be calculated by summing all the weights of the basic blocks commonly included in the malicious files.

In addition, in one embodiment, the malicious code similarity calculating unit 230 is a basic block common between the basic blocks constituting the new malicious file and the basic blocks constituting the malicious file when the new malicious file is registered in the malicious code analysis population. The similarity between the new malicious file and the malicious file to be compared can be calculated by adding the weights of.

The malicious code detection device 130 may classify a plurality of malicious files through the malicious code classification unit 250 based on the similarity calculated from the malicious code similarity calculation unit 230 (step S340).

FIG. 4 is an exemplary diagram illustrating a process of calculating the similarity between malicious files constituting the malicious code analysis population in the malicious code similarity calculation unit of FIG. 2.

4, the malicious code similarity calculating unit 230 is divided into a set of a plurality of malicious files (f1 to f4) and a set of basic blocks (b1 to b6) constituting the malicious code analysis population, and a plurality of malicious files (f1 to f4) Binary graphs can be generated by matching each of the basic blocks (b1 to b6) through the edges.

For example, the malicious file f1 is composed of basic blocks b1, b2, and b4, and the malicious file f2 is composed of basic blocks b1, b2, b4, and b6, and the malicious file f3 is It may be composed of basic blocks (b1, b3, b6). In addition, the malicious file f4 may be composed of basic blocks b1, b4, and b6.

Then, the malicious code similarity calculating unit 230 may calculate the weight w of each of the basic blocks b1 to b6 based on the binary graph. For example, since the basic block b1 is included in the four malicious files f1 to f4, the weight w1 of the basic block b1 may be calculated as 1/4. Since the basic block b2 is included in the two malicious files f1 and f2, the weight w2 of the basic block b2 may be calculated as 1/2.

Similarly, since the basic block b3 is included in one malicious file f3, the weight w3 of the basic block b3 may be calculated as 1. In this way, the weight w4 of the basic block b4 may be calculated as 1/3, the weight w5 of the basic block b5 may be calculated as 1, and the weight w6 of the basic block b6 may be calculated as 1/3. .

In one embodiment, the malicious code similarity calculator 230 may calculate similarities between the malicious files f1 to f4 as shown in Table 1 below.

That is, when the malicious code similarity calculating unit 230 compares the malicious file f1 and the malicious file f2, the basic blocks b1, b2, and b4 that the malicious file f1 and the malicious file f2 commonly include The similarity can be calculated as 13/12 by summing each weight. Likewise, when comparing the malicious file f1 and the malicious file f4, the malicious code similarity calculating unit 230 includes the basic blocks b1 and b4, which are commonly included in the malicious file f1 and the malicious file f4, respectively. The similarity can be calculated as 7/12 by summing all the weights of.

FIG. 5 is an exemplary diagram illustrating a process of calculating the similarity between a new malicious file and the remaining malicious files when a new malicious file is registered in the malicious code analysis population in the malicious code similarity calculating unit of FIG. 2.

Referring to FIG. 5, in the malicious code similarity calculating unit 230, a new malicious file f5 is registered in the malicious code analysis population, and basic blocks constituting the new malicious file f5 are b1, b4, b5, and b6 ( As shown in <Table 2> below, the similarity between the malicious files (f1 ~ f5) can be calculated.

That is, the malicious code similarity calculating unit 230 compares at least one of the basic blocks (b1, b4, b5, and b6) constituting the new malicious file (f5), and compares the basic blocks of each of the malicious files (f1 to f4). Similarity can be calculated by adding the weights of.

For example, since the malicious file f1 includes the basic blocks b1 and b4 of the new malicious file f5 in common, the similarity between the malicious files f1 and f5 includes both the weights of the basic blocks b1 and b4. It can be calculated as 7/12 combined. Similarly, since the malicious file f2 includes the basic blocks b1, b4, and b6 of the new malicious file f5 in common, the similarity between the malicious files f2 and f5 is similar to that of the basic blocks b1, b4, and b6. It can be calculated as 11/12 summing all the weights.

Although described above with reference to preferred embodiments of the present invention, those skilled in the art variously modify and change the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. You can understand that you can.

100: malware detection system
110: user terminal 130: malware detection device
150: database 210: basic block determining unit
230: malicious code similarity calculation unit 250: malicious code classification unit
270: control unit

Claims (12)

A basic block determining unit that analyzes each of the plurality of malicious files included in the malicious code analysis population according to a specific criterion to determine at least one basic block;
A malicious code similarity calculation unit generating a binary graph of the plurality of malicious files based on the basic block to calculate the similarity between the plurality of malicious files and the new file; And
A malicious code classification unit to classify whether the new file is malicious code based on the similarity,
The malicious code similarity calculating unit is a first step of generating a set of malicious files including the plurality of malicious files and a basic block set including basic blocks derived from each of the plurality of malicious files based on the malicious code analysis population, A second step of generating a binary graph of the correspondence between the malicious file set and the basic block set, as a reciprocal of the frequency of appearance in the malicious file set for each basic block of the basic block set based on the binary graph A third step of calculating a block weight, a fourth step of determining common basic blocks corresponding to each file in common with respect to a file pair composed of any one of the plurality of malicious files and the new file, and the common basic block Binary graph-based malware detection device, characterized in that sequentially performing a fifth step of calculating the similarity for the pair of files by adding the block weights of each of them.
delete delete delete According to claim 1, The malicious code classification unit
When the new file is classified as a malicious code, the malicious code detection device based on the bipartite graph, characterized in that the new file is registered as the new malicious file in the malicious code analysis population.
The method of claim 5, wherein the malicious code similarity calculation unit
When the new malicious file is registered in the malicious code analysis population, the malicious file set and the basic block set are updated respectively, and the block weight for each basic block of the basic block set is updated. Code detection device.
The method of claim 1 , wherein the malicious code classification unit
The malicious code detection device based on the bipartite graph, characterized in that it determines whether or not the malicious code for the new file is based on the file pair having the highest similarity among the plurality of malicious files and the file pair for the new file.
The method of claim 1, wherein the basic block determining unit
Determining any one of the basic unit command sequence, function unit command sequence, and the malicious file dynamic analysis IP address, domain address, character string, mutex, and API as the basic block obtained by statically analyzing the malicious file. Characterized by binary graph based malware detection device.
delete delete delete delete

Images