KR20130005609A - System for collecting and analyzing mobile malware automatically - Google Patents

Abstract

The present invention relates to a mobile malicious code automatic collection and analysis system, and more particularly, to a mobile malicious code automatic collection and analysis system mounted on a mobile terminal for automatically detecting mobile malicious code, A collection module; An analysis module for extracting code information and behavior information from the mobile malicious suspicious code collected by the collection module; And a detection module for detecting a mobile malicious code by determining whether the mobile malicious suspicious code is a malicious code based on the code information and action information extracted by the analysis module.

Description

TECHNICAL FIELD [0001] The present invention relates to a mobile malicious code automatic collection and analysis system,

The present invention relates to a mobile malicious code automatic collection and analysis system, and more particularly, to a mobile malicious code collecting and analyzing system which collects mobile malicious suspicious codes through network traffic analysis, statistically and dynamically analyzes them, To be automatically collected and analyzed.

The number of users of smartphones equipped with an operating system (OS) such as a PC increases the number of mobile malicious code that runs on a smartphone OS, and the damage is also increasing.

In order to prevent the spread and harm of mobile malicious code, domestic and overseas vaccine service providers provide smartphone-based vaccine and security programs. Such existing vaccine and security programs mainly detect malicious code by pattern matching method do.

However, according to the pattern-based malicious code detection method using the pattern matching method, it is impossible to detect a new malicious code, and it is impossible to detect a malicious code of a similar variant. Also, There is a limit that can not be.

SUMMARY OF THE INVENTION Accordingly, the present invention has been made to solve the above-mentioned problems occurring in the prior art, and it is an object of the present invention to provide a mobile terminal which can collect malicious suspicious codes by analyzing network traffic, statistically and dynamically analyzing the malicious malicious codes, And to provide a mobile malicious code automatic collection and analysis system capable of collecting and analyzing malicious codes.

According to an aspect of the present invention, there is provided an automatic system for collecting and analyzing mobile malicious code, which is installed in a mobile terminal and automatically detects mobile malicious code, A collection module for collecting mobile malicious suspicious code; An analysis module for extracting code information and behavior information from the mobile malicious suspicious code collected by the collection module; And a detection module for detecting a mobile malicious code by determining whether the mobile malicious suspicious code is malicious code based on the code information and action information extracted by the analysis module.

According to the present invention, mobile malicious code can be collected and analyzed automatically and statistically and dynamically by collecting mobile malicious code through network traffic analysis, and then determining maliciousness from the analysis results.

Therefore, according to the present invention, unlike conventional pattern-based malicious code detection techniques, new malicious codes or similar malicious codes can be detected.

1 is a block diagram of a system for automatically collecting and analyzing mobile malicious codes according to an exemplary embodiment of the present invention;
2 is a detailed block diagram of the acquisition module shown in FIG. 1,
FIG. 3 is a detailed configuration diagram of the analysis module shown in FIG. 1,
4 is a detailed configuration diagram of the detection module shown in FIG. 1, and FIG.
5 is a flowchart illustrating a process of detecting malicious code of a mobile malicious suspicious code by the detection module shown in FIG.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, in order that those skilled in the art can easily carry out the present invention. In the following detailed description of the preferred embodiments of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. In the drawings, like reference numerals are used throughout the drawings.

In addition, in the entire specification, when a part is referred to as being 'connected' to another part, it may be referred to as 'indirectly connected' not only with 'directly connected' . Also, to "include" an element means that it may include other elements, rather than excluding other elements, unless specifically stated otherwise.

Also, the term " module " refers to a unit that performs a particular function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

Also, the term 'malicious code' is a generic term for all software that can adversely affect a computer, where 'computer' is a device that accepts information in the form of digital data, it means. Also, 'smartphone' refers to a mobile phone with a built-in computer function.

1 is a block diagram of a mobile malicious code automatic collection and analysis system according to an embodiment of the present invention.

Referring to FIG. 1, a mobile malicious code automatic collection and analysis system 100 according to an exemplary embodiment of the present invention includes a collection module 110 for collecting malicious suspicious codes through network traffic analysis, a collection module 110, An analysis module 120 for extracting code information and behavior information from the mobile malicious suspicious code collected by the analyzing module 120 and a malicious suspicious code of the malicious suspicious code from the code information and behavior information of the malicious suspicious code extracted by the analysis module 120, And a detection module 130 for detecting a malicious code.

In addition, the mobile malicious code automatic collection and analysis system 100 can automatically collect malicious suspicious code information extracted by the collection module 110, malicious code detection results detected by the detection module 130, And a database 140 for storing information necessary for the operation of the analysis system 100.

Hereinafter, each component constituting the mobile malicious code automatic collection and analysis system 100 will be described in more detail with reference to FIGS. 2 to 5. FIG.

2 is a detailed configuration diagram of the acquisition module shown in FIG.

2, the collecting module 110 monitors network traffic, analyzes network traffic, and extracts mobile malicious suspicious codes from the network traffic. The collecting module 110 includes a network traffic collecting unit 111, a malicious suspicious code extracting unit 112, A malicious suspicious code downloading section 113, a malicious suspicious code information extracting section 114, and a storage section 115.

The network traffic collecting unit 111 collects network traffic from a network interface device (not shown) of the hardware on which the mobile malicious code automatic collection and analysis system 100 is mounted.

The malicious suspicious code extracting unit 112 extracts the malicious malicious code using the packet recombination technique and stores the extracted malicious malicious code in the network traffic collected by the network traffic collecting unit 111. Here, the packet recombination technique refers to extracting a mobile malicious suspicious code by recombining a series of packets corresponding to one execution code in the collected network traffic. Also, the mobile malicious suspicious code means an execution code suspected to correspond to a mobile malicious code.

The malicious suspicious code downloading unit 113 accesses the mobile malicious suspicious code download URL directly when the malicious suspicious code extracting unit 112 fails to extract the malicious suspicious code, downloads and stores the malicious suspicious code, And may be optionally provided.

The malicious suspicious code information extracting unit 114 extracts the mobile malicious suspicious code information from the mobile malicious suspicious code extracted and stored by the malicious suspicious code extracting unit 112 or downloaded and stored by the malicious suspicious code downloading unit 113 . At this time, the extracted malicious suspicious code information may include MD5 (message-digest algorithm 5), SHA1, and file size information.

The storage unit 115 stores the mobile malicious suspicious code information extracted by the malicious suspicious code information extracting unit 114 in the database 140.

3 is a detailed configuration diagram of the analysis module shown in FIG.

Referring to FIG. 3, the analysis module 120 extracts code information and action information by performing static analysis and dynamic analysis on the mobile malicious suspicious code collected by the collection module 110, And a dynamic analyzer 122.

The static analyzer 121 performs a static analysis on the mobile malicious suspicious code to extract the code information of the mobile malicious suspicious code. Here, the code information means information that can be extracted from the code itself without executing the mobile malicious suspicious code. For example, the code information may include information such as hash information, code size information, file header information, Possible string information and operating platform information, and the like.

The dynamic analyzer 122 performs dynamic analysis on the mobile malicious suspicious code to extract the malicious suspicious code action information. Specifically, the dynamic analyzer 122 directly executes the mobile malicious suspicious code in an emulator or a virtual environment configured the same as the mobile terminal or the mobile terminal environment, and detects all the changes occurring in the mobile terminal after the malicious suspicious code is executed, that is, Extract and record information. The action information is different depending on the OS environment of the terminal, but may typically include processes, files, memory, and network information.

4 is a detailed configuration diagram of the detection module shown in FIG.

4, the detection module 130 collects and analyzes static analysis information (i.e., code information) and dynamic analysis information (i.e., behavior information) extracted by the analysis module 120 to generate a mobile malicious suspicious code The malicious code detection unit 131, the malicious code determination unit 132, and the detection result storage unit 133. The malicious code detection unit 131 detects the malicious code,

The analysis information reading unit 131 reads the static analysis information and the dynamic analysis information extracted by the analysis module 120.

The malicious code determining unit 132 determines whether the mobile malicious suspicious code is a known malicious code from the static analysis information and determines whether the malicious code is a known malicious code or not from the dynamic analysis information.

The detection result storage unit 133 stores the detection result in the database 140 when the malicious code determining unit 132 determines that the mobile malicious suspicious code is a malicious code.

5 is a flowchart illustrating a process of detecting malicious code of a mobile malicious suspicious code by the detection module shown in FIG.

First, the detection module 130 reads the static analysis information (S51) and determines whether the mobile malicious suspicious code is a known malicious code (S52).

If the mobile malicious suspicious code corresponds to a known malicious code, the detection result is stored (S55).

On the other hand, if it is not a known malicious code, the dynamic analysis information is read (S53), and it is determined whether the mobile malicious suspicious code is a malicious code (S54).

The present invention is not limited to the above-described embodiments and the accompanying drawings. It will be apparent to those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

100: Mobile malicious code automatic collection and analysis system
110: collection module
111: Network traffic collecting unit
112: malicious suspicious code extracting unit
113: malicious suspicious code download section
114: malicious suspicious code information extracting unit
115:
120: Analysis module
121: Static Analyzer
122: Dynamic Analyzer
130: Detection module
131: Analysis information reading section
132: Malicious Code Judgment Unit
133: Detection result storage unit
140: Database

Claims (10)

A mobile malicious code automatic collection and analysis system mounted on a mobile terminal for automatically detecting mobile malicious code, the system comprising:
A collection module for collecting malicious suspicious codes through network traffic analysis;
An analysis module for extracting code information and behavior information from the mobile malicious suspicious code collected by the collection module; And
And a detection module for detecting a mobile malicious code by determining whether the mobile malicious suspicious code is a malicious code based on code information and action information extracted by the analysis module.
The apparatus of claim 1,
A network traffic collecting unit for collecting network traffic from a network interface device of a hardware equipped with the mobile malicious code automatic collection and analysis system;
A malicious suspicious code extracting unit for extracting and storing a malicious suspicious code from the network traffic collected by the network traffic collecting unit;
A malicious suspicious code information extracting unit for extracting malicious suspicious code information from the malicious suspicious code extracted by the malicious suspicious code extracting unit; And
And a storage unit for storing the mobile malicious suspicious code information extracted by the malicious suspicious code information extracting unit in a database.
3. The method of claim 2,
Wherein the malicious suspicious code extracting unit extracts a mobile malicious code by applying a packet recombination technique to the collected network traffic.
3. The method of claim 2,
Wherein the mobile malicious suspicious code information includes message-digest algorithm (MD5), SHA1, and file size information.
3. The apparatus of claim 2,
And a malicious suspicious code downloading unit for directly accessing the malicious suspicious code download URL and downloading the malicious suspicious code when the malicious suspicious code extracting unit fails to extract the malicious suspicious code by the malicious suspicious code extracting unit. And analysis system.
The apparatus of claim 1,
A static analyzer for performing a static analysis on the mobile malicious suspicious code and extracting code information of the mobile malicious suspicious code; And
And a dynamic analyzer for performing dynamic analysis on the mobile malicious suspicious code and extracting behavior information of the mobile malicious suspicious code.
The method according to claim 6,
Wherein the code information includes hash information, code size information, file header information, identifiable string information included in the code, and operating platform information.
The method according to claim 6,
The dynamic analyzer directly executes the mobile malicious suspicious code in an emulator or a virtual environment configured in the same manner as the mobile terminal or the mobile terminal environment and extracts and records all the changes that occur after the execution of the mobile malicious suspicious code. Mobile malware automatic collection and analysis system.
The method according to claim 6,
Wherein the action information comprises a process, a file, a memory, and network information.
The apparatus of claim 1,
An analysis information reading unit for reading the code information and the behavior information extracted by the analysis module;
A malicious code determining unit for determining whether the mobile malicious suspicious code is a known malicious code from the code information and determining whether the mobile malicious suspicious code is a malicious code from the behavior information if the malicious code is not a known malicious code; And
And a detection result storage unit for storing the detection result in a database when the malicious code determination unit determines that the malicious code is a malicious code.

Images