KR20050107651A - System and method for preventing from network virus, and computer-readable storage medium recorded program thereof - Google Patents

Abstract

The present invention relates to a network virus blocking system and method for blocking a computer spreading a virus in a network, and a recording medium recording the program, comprising: a monitoring step of collecting packets on a network, and an analysis step of parsing the packets And a virus detection step of checking whether a virus exists in the parsed packet, and a blocking step of blocking a virus distribution computer if a virus is detected. It can heal computers infected with viruses.

Description

SYSTEM AND METHOD FOR PREVENTING FROM NETWORK VIRUS, AND COMPUTER-READABLE STORAGE MEDIUM RECORDED PROGRAM THEREOF}

The present invention relates to a network virus protection system and method for blocking a computer spreading a virus in a network and a recording medium recording the program.

Existing computer viruses are mainly infected through diskettes, but recently, infections from outside via email or the Internet have become mainstream. As the network and the Internet spread in general, the infection rate and range of viruses are developing at a very rapid rate, and the damage is also seriously increasing.

In order to be safe for all computers in a network environment, antivirus programs must be installed on each computer, but 100% of the installation and maintenance is not possible for various reasons.

As described above, since the conventional virus response technology is mainly based on a host, there is a problem that the degree of virus immunity depends on whether each computer is installed with a virus when a virus is propagated in a network.

Also, if any computer inside the network is infected with a virus, it will continue to try to infect other computers that are shared on the network. Therefore, there is a problem that the entire network is down because virus-infected computers, which were initially only one, rapidly increase network traffic.

The present invention has been made to solve the above problems, and an object of the present invention is to provide a network virus blocking system and method for blocking a computer spreading viruses in a network and a recording medium recording the program.

Another object of the present invention is to provide a network virus blocking system and method for treating a computer infected with a virus through network sharing, and a recording medium recording the program.

It is still another object of the present invention to provide a network virus blocking system and method for minimizing damage from viruses even if a vaccine program is not installed in an entire computer inside a network, and a recording medium recording the program.

One embodiment of the present invention for achieving the above object is a monitoring step of collecting packets on the network; Parsing the packet; A virus detection step of checking whether a virus exists in the parsed packet; And a blocking step of blocking a virus spreading computer when a virus is detected.

The virus detection step is characterized by comparing the parsed packet with a predetermined pattern code to check whether a worm virus exists.

The blocking step is characterized by blocking the network connection by transmitting a FIN signal or ICMP packet to the virus distribution computer.

In another embodiment of the present invention, the analyzing step parses the packet and analyzes whether it includes a command related to a file change, a copy or a creation, and the virus detecting step includes a command related to a file change, a copy, or a creation in the packet. If it is included, it checks whether the file of the network path is infected with a virus, and the blocking step provides a network virus blocking method characterized in that the virus distribution computer is blocked when a virus infection is detected.

The virus detecting step is characterized by detecting a virus by reading a file corresponding to the network path and searching for a code matching a virus pattern.

The virus detection step is characterized in that for treating the file of the network path.

The blocking step may include: a first step of broadcasting an ARP (Address Resolution Protocol) request signal using the same duplicate IP as the virus distribution computer; Discarding a response signal received from another computer on the network; And a third step of repeating the first step and the second step when an ARP request signal is received from the virus distribution computer.

In the two method embodiments, the blocking step is characterized in that the virus distribution computer is blocked when a predetermined blocking policy is satisfied.

The blocking step may output virus distribution computer blocking information including time, IP of a virus distribution computer, IP of a virus infected computer, and a virus name.

Yet another embodiment of the present invention provides a monitoring process for collecting packets on a network; An analysis process for parsing the packet; A virus detection process that checks for the presence of a virus in the parsed packet; And a recording medium recording a network virus protection program including a blocking process for blocking a virus spreading computer when a virus is detected.

The virus detection process checks whether a worm virus exists by comparing the parsed packet with a predetermined pattern code.

The blocking process is characterized by blocking the network connection by transmitting a FIN signal or ICMP packet to the virus distribution computer.

In another embodiment of the present invention, the analysis process parses the packet and analyzes whether it contains a command related to a file change, a copy or a creation, and the virus detection process is related to a file change, a copy or a creation in the packet. If a command is included, the file of the corresponding network path is scanned for a virus infection, and the blocking process provides a recording medium for recording a network virus blocking program, characterized in that the virus distribution computer is blocked when a virus infection is detected.

The virus detection process detects a virus by reading a file corresponding to the network path and searching for a code matching a virus pattern.

The virus detection process is characterized in that the file of the network path to be treated.

The blocking process includes a first process of broadcasting an ARP (Address Resolution Protocol) request signal using the same redundant IP as the virus spreading computer; A second process of discarding a response signal received from another computer on the network; And a third process of repeating the first process and the second process when an ARP request signal is received from the virus distributing computer.

In the two recording medium embodiments, the blocking process blocks the virus distributing computer when a predetermined blocking policy is satisfied.

The blocking process may output virus distribution computer blocking information including a time, an IP of a virus distribution computer, an IP of a virus infected computer, and a virus name.

Yet another embodiment of the present invention provides an apparatus for monitoring a network, comprising: monitoring means for collecting a packet on a network; Analysis means for parsing the packets collected by the monitoring means; Virus detection means for examining whether a virus exists in the parsed packet; And a network blocking means for blocking the virus spreading computer when a virus is detected.

The virus detecting means checks whether a worm virus exists by comparing the parsed packet with a predetermined pattern code.

The blocking means is characterized by blocking the network connection by transmitting a FIN signal or ICMP packet to the virus distribution computer.

In another embodiment of the present invention, the analyzing means parses the packet and analyzes whether it contains a command related to a file change or a copy or a generation, and if the packet includes a command related to a file change, a copy or a generation, The virus detecting means checks whether a file in the corresponding network path is infected with a virus, and if a virus infection is detected, the blocking means blocks a virus distributing computer.

The virus detecting means detects a virus by reading a file corresponding to the network path, searching for a code matching a virus pattern, and treating a file of the corresponding network path.

The blocking means may block the virus distributing computer if the blocking policy is set in advance.

The blocking means may output virus distribution computer blocking information including a time, an IP of a virus distribution computer, an IP of a virus infected computer, and a virus name.

The blocking means broadcasts an ARP (Address Resolution Protocol) request signal using the same duplicate IP as the virus distribution computer, discards the response signal received from another computer on the network, and distributes the virus. When the ARP request signal is received from the computer, it is characterized by repeating the broadcasting using the redundant IP and discarding the response signal.

The objects, features and advantages of the present invention will be more readily understood by reference to the accompanying drawings and the following detailed description.

The present invention proposes as a preferred embodiment a method for blocking a computer spreading a virus in a network and a system implemented to support the same.

In the following description, a case where a specific program is a remote installation target will be described as an example.

A preferred embodiment of the present invention includes a computer readable recording medium having recorded thereon a program implemented to execute the method of the present invention on a computer system. Such recording media include magnetic storage media (e.g., floppy disks, hard disks, etc.) and optical storage media (e.g., CDs, DVDs, etc.).

1 is a configuration diagram for schematically explaining a network virus blocking system according to the present invention. In the following description, a case where computer A infected with a virus attempts to infect computer B through a network sharing access will be described as an example.

The network virus protection device 100 may be installed inside the computer 10 connected to the switch stage S / W, or may be independently connected to the switch stage. At this time, it is preferable that the switch stage is set to read all packets.

Although not shown, the network virus protection system may further include a management server for managing the network virus protection device 100.

Figure 2 is a block diagram showing an embodiment of a network virus protection device.

The network virus protection device 100 includes a monitoring means 110 for collecting packets on a network, an analysis means 120 for parsing packets collected by the monitoring means 100, and a test for checking whether a virus exists in the parsed packet. Virus detection means 130, and a network blocking means 140 for blocking the virus distribution computer when a virus is detected.

Figure 3a is a block diagram showing an embodiment of the monitoring means.

The monitoring means 110 includes a dump unit 112 for dumping all packets on the network, a filter unit 114 for filtering only some packets among the dumped packets, and a queuing unit 116 for storing the filtered packets. .

In the present invention, a case in which both the worm virus and the virus through a network share are configured to be described will be described, and each may be implemented as an independent device.

Figure 3b is a block diagram showing an embodiment of the analysis means.

Referring to FIG. 3, the analyzing means 120 basically includes a TCP / IP parser 122, and further includes a network sharing parser 128 for virus analysis through sharing of a network. The network share parser unit 128 is preferably configured to parse network sharing protocols such as Server Message Block (SMB) and Common Internet File System (CIFS).

The IPX / SPX parser 124 and the NetBios 126 may be further included to extend parsing per session.

Figure 3c is a block diagram showing an embodiment of the virus detection means and network blocking means.

Figure 4 is a flow chart showing an embodiment of a network virus blocking method according to the present invention, showing a process of blocking the virus distribution computer via a network share.

In the present invention configured as described above, when the network virus blocking system monitors a packet on a network and detects a file infected with a virus, the process of treating the corresponding file and blocking the computer spreading the virus is described in detail with reference to FIGS. 1 to 4. The explanation is as follows.

First, the process of blocking the virus distribution computer through the network share will be described.

The monitoring means 110 of the network virus protection device 100 collects and temporarily stores packets on the network (S200). The dump unit 112 dumps all packets on the network from the network card 11, and the filter unit 114 passes only some packets among the dumped packets.

The first filter unit 114a passes an Ethernet-based packet, and the packet passing through the first filter unit 114a is temporarily stored in the first queuing unit 116a. The second filter 114b filters the packets using the network sharing port among the packets filtered by the first filter 114a and temporarily stores them in the second queuing unit 116b.

The parser units 122, 124, and 126 of the analysis unit 120 parse the packets stored in the second queuing unit 116b for each session (TCP / IP, IPX / SPX, NetBios), and the network share parser unit 128 parses them. Parse the car (S210).

Next, the network sharing parser unit 128 searches whether the packet includes instructions related to file change, copy, or creation (S220). If such a command is not included in the packet, it is searched if a session end command is included (S222). If a session end command is found, the session information is deleted (S224) and terminated. If the session termination command is not included in step S222, the process proceeds from step S220 again.

When a command related to changing or copying or creating a file is searched for in step S220, the analyzing unit 120 notifies the virus detecting unit 130 of the file sharing network path.

The network virus detection unit 132 of the virus detection unit 130 accesses the corresponding network path and checks whether the file is infected with a virus (S240). In the present embodiment, the network virus detection unit 132 may access the computer B, read the file, and search for a code that matches the virus pattern.

As a result of the check in step S240, if the virus is not infected, the process is repeated from step S220. If the virus is infected, the session information and the virus information are transmitted to the management server and then the file is cured (S250).

Since the computer B infected with the virus has been given write permission to all the computers on the network, the virus detecting means 130 can recover the original file or delete the file. Then, the virus detecting means 130 transmits the session information and virus information to the network blocking means 140.

The access blocking unit 142 of the network blocking unit 140 determines whether the session information received from the virus detecting unit 130 and the virus information satisfy a predetermined blocking policy (S260).

The access blocking unit 142 checks whether the virus information received from the virus detection unit 130 is duplicated with the previously transmitted virus information, and if the same virus exists, the virus distributor IP of the session checks the same number of times. Therefore, when more than the predetermined number of times, it is determined that the blocking policy is satisfied.

For example, computer A continues to infect other computers, so that when the virus infected by computer A is found 10 times or more, the blocking policy is satisfied.

If it is determined that the blocking policy is satisfied, the access blocking unit 142 transmits the virus distributing computer blocking information (including time, IP of the virus distributing computer, IP of the virus infected computer, and virus name) to the management server, and sends the virus distributing computer. Blocks (S270).

In the present invention, the virus distribution computer is blocked in the following manner.

First, the network blocking means 140 broadcasts an ARP (Address Resolution Protocol) request signal to the network using the same redundant IP as the computer A. Then, it is as if there is another computer in the network using the IP of computer A.

The response signal of the other computer to the network access of the computer A is received by the network virus protection device 100 through the analysis means 120. Since the network virus blocking device 100 receiving the response signal immediately discards the response signal, the computer A cannot receive the response signal within the response time. Therefore, computer A must terminate the network connection and become temporarily inaccessible to the network.

After a certain time, computer A broadcasts an ARP request signal back to the network to reestablish the connection.

At this time, when the network virus protection device 100 receives the connection reset signal of the computer A, by transmitting the ARP request signal of the computer A to the network again and discards the response signal as described above, computer A is unable to access the network again. It becomes a state.

In this manner, the access blocking unit 142 blocks the A computer that spreads the virus for a predetermined time, and releases the block when the predetermined time exceeds the predetermined reference time. The reference time can be changed and set by the system administrator.

If the blocking policy is not satisfied at step S260 or at step S270, the session information and virus information received from the virus detection unit 130 are stored (S280) and the process ends.

In the above, it is determined whether the blocking policy is satisfied and the virus distribution computer is blocked. However, regardless of whether the blocking policy is satisfied, when the session information and virus information are received from the network virus detection unit 132, the computer may be blocked.

The management server stores and manages the session information received from the virus detection means 130, the virus information, and the virus distribution computer blocking information transmitted by the network blocking means 140.

Meanwhile, the TCP / IP parser 122 parses the packets collected by the first queuing unit 116a firstly and outputs them to the worm virus detection unit 134. The worm virus detection unit 134 checks the worm virus by comparing the parsed packet with a predetermined pattern code, and notifies the connection blocking unit 144 if a worm virus is found. The connection blocking unit 144 blocks the network connection by transmitting a TCP FIN signal or an ICMP (Internet Control Message Protocol) packet to the virus distributing computer according to the blocking policy. Of course, it can be configured to block the virus distribution computer regardless of whether the blocking policy is satisfied.

For example, the FIN signal blocks the connection to computer B by informing the computer A of a false signal that data transmission has ended. ICMP also blocks the connection to computer B by notifying computer A that a data transfer to computer B is not possible.

The present invention is not limited to the embodiments described above, and various modifications and changes can be made by those skilled in the art, which are included in the spirit and scope of the present invention as defined in the appended claims.

As described above, the present invention can block a computer spreading a virus in a network and treat a computer infected with a virus through network sharing.

In addition, there is an advantage such as minimizing the damage from viruses even if the antivirus program is not installed in the entire computer inside the network.

1 is a configuration diagram for schematically explaining a network virus blocking system according to the present invention,

Figure 2 is a block diagram showing an embodiment of a network virus blocking device,

Figure 3a is a block diagram showing an embodiment of the monitoring means,

Figure 3b is a block diagram showing an embodiment of the analysis means,

Figure 3c is a block diagram showing an embodiment of the virus detection means and network blocking means,

Figure 4 is a flow chart showing an embodiment of a network virus blocking method according to the present invention.

<Description of the symbols for the main parts of the drawings>

100: network virus protection device 110: monitoring means

120: analysis means 130: virus detection means

140: network blocking means

Claims (9)

A monitoring step of collecting packets on a network; Parsing the packet; A virus detection step of checking whether a virus exists in the parsed packet; And A network virus protection method that includes a blocking step that blocks a virus spreading computer when a virus is detected. The method of claim 1, wherein the virus detection step, And comparing the parsed packet with a predetermined pattern code to check whether a worm virus exists. The method of claim 1, wherein the blocking step, Virus distribution A network virus blocking method characterized by blocking a network connection by transmitting a FIN signal or ICMP (Internet Control Message Protocol) packet to a computer. The method of claim 1, The analyzing step parses the packet and analyzes whether a command related to file change, copy or creation is included. The virus detection step checks whether a file in the corresponding network path is infected with a virus if the packet includes a command related to a file change, copy or creation, The blocking step is a network virus blocking method characterized in that to block the virus distribution computer when a virus infection is detected. The method of claim 4, wherein the virus detection step, The network virus blocking method of detecting a virus by reading a file corresponding to the network path and searching for a code matching a virus pattern. The method of claim 4, wherein the virus detection step, Network virus blocking method, characterized in that for treating the file of the network path. The method of claim 4, wherein the blocking step, A first step of broadcasting an ARP (Address Resolution Protocol) request signal using the same redundant IP as the virus spreading computer; Discarding a response signal received from another computer on the network; And And a third step of repeating the first step and the second step when an ARP request signal is received from the virus distribution computer. The method according to any one of claims 1 to 7, wherein the blocking step, The network virus blocking method characterized in that the virus distribution computer is blocked if a predetermined blocking policy is satisfied. The method according to any one of claims 1 to 7, wherein the blocking step A network virus screening method comprising outputting virus distribution computer blocking information including time, IP of a virus-distributing computer, IP of a virus-infected computer, and virus name.