KR20170096451A - Method and apparatus for analysing dynamic behavior of malicious application - Google Patents

Abstract

The present embodiment includes: receiving an app suspected as a malicious app from an app server and executing the received app in a virtual environment-based emulator; Performing a dynamic behavior test on the received application in the executed virtual environment environment based emulator; Storing log files generated during the progress in a database; Extracting API information and call count information for calling a dynamic analysis API defined at the time of running the application from the log file; And checking the API information and the call count information to detect an abnormal behavior for the application.
Thus, the present embodiment easily detects malicious behavior of malicious apps through dynamic behavior testing based on a virtual environment, prevents personal information leakage, and hard-codes the data of the actual terminals through framework modification to analyze through fingerprinting It is possible to neutralize the avoidance attempt.

Description

[0001] METHOD AND APPARATUS FOR ANALYZING DYNAMIC BEHAVIOR OF MALICIOUS APPLICATION [0002]

The present invention relates to a malicious application dynamic behavior analysis method and apparatus, and a malicious application dynamic behavior analysis method and apparatus for detecting dynamic behavior of a malicious application.

 According to the Gartner report, smartphone market share is expected to account for about 66% of the total mobile market as of June 2014 and over 88% by the end of 2018.

However, there is a growing threat of hacking, such as leakage of personal information (phone number, text message (SMS), account information, etc.) caused by malicious apps on the smartphone.

For example, more than 98% of malicious apps are spread by text messaging (SMS) dissemination method, but when you access a general web site as well as text messages (SMS), the phrase " There are also new ways to get malicious apps to download.

Smartization combined with smart phone SMS and phishing techniques has increased the damage to malicious apps, and smartphone security is attracting attention as an important social issue.

For malicious apps that grow exponentially, related universities and research institutes have limited channels to obtain malicious apps, and channels that are secured by the agency itself are also known as web sites or repositories (app servers) There is a possibility of redundant analysis, and it is necessary to build a malicious app detection infrastructure for collaborative research. However, dynamic analysis of malicious apps has not been done properly.

Korea Patent Publication No. 2015-0096061 (2015.08.24: Disclosure Date)

It is an object of the present invention to provide a method and apparatus for analyzing dynamic behavior of a malicious app using an emulator based on a virtual environment.

According to one embodiment, there is provided a method for analyzing a dynamic behavior of a malicious application using a virtual environment-based emulator in a dynamic behavior analysis apparatus, the method comprising: receiving an application suspected to be a malicious application from an application server; Based emulator; Performing a dynamic behavior test on the received application in the executed virtual environment environment based emulator; Storing log files generated during the progress in a database; Extracting API information and call count information for calling a dynamic analysis API defined at the time of running the application from the log file; And checking the API information and the call count information to detect an abnormal behavior for the application.

The dynamic behavior analysis method further comprises the step of extracting an API return value used for analysis avoidance in response to the detected abnormal behavior from the API information and modifying a framework of a corresponding system attribute associated with the extracted API return value .

The API information may include an API name and an API return value.

The dynamic behavior test may include hash value information, internal / external communication data information, file read / write operation information, class information, exposure information by network, password information, exposure information of SMS, Call may be a test related to exposure information.

The virtualization environment may be a Ubuntu version 14.04 VM.

According to one embodiment, there is provided a dynamic behavior analyzing apparatus for analyzing dynamic behavior of a malicious application using an emulator based on a virtualization environment, the dynamic behavior analyzing apparatus comprising: receiving an app suspected to be a malicious application from an app server; An emulator driver for executing the emulator; A dynamic behavior testing unit for performing a dynamic behavior test on the received application in the executed virtual environment environment based emulator; An information management unit for storing a log file generated during the process in a database; An API extractor for extracting API information and call count information for calling a dynamic analysis API defined when the application is activated from the log file; And a malicious behavior detection unit for detecting the abnormal behavior for the application by checking the API information and the call frequency information.

Wherein the dynamic behavior analysis device extracts an API return value used for analysis avoidance corresponding to the detected abnormal behavior from the API information and modifies a framework of a corresponding system attribute associated with the extracted API return value And the like.

The API information may include an API name and an API return value.

The dynamic behavior test may include hash value information, internal / external communication data information, file read / write operation information, class information, exposure information by network, password information, exposure information of SMS, Call may be a test related to exposure information.

The virtualization environment may be a Ubuntu version 14.04 VM.

As described above, the present embodiment has an effect of easily detecting malicious behavior of malicious apps through dynamic behavior testing based on a virtual environment, thereby preventing personal information from being leaked.

Especially, in case of existing emulator based dynamic analysis system such as Google Bouncer, it is possible to fingerprint the application execution environment. Using these features, it was possible to avoid the analysis and detection by detecting the emulator environment during the production of malicious apps and avoiding malicious behavior in the environment.

However, in the present embodiment, the system attribute corresponding to the main API return value, which is mainly used for analysis avoidance, is hard-coded as data of the actual terminal through modification of the Android framework, thereby making it possible to disable the analysis avoidance attempt through fingerprinting .

The effects described above are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention. However, the technical features of the present embodiment are not limited to the specific drawings, and the features disclosed in the drawings may be combined with each other to constitute a new embodiment.
1 is a flowchart illustrating a method for analyzing a dynamic behavior of a malicious app according to an exemplary embodiment of the present invention.
FIG. 2 is a block diagram showing an example of a malicious app dynamic behavior analyzing apparatus for realizing a dynamic behavior analyzing method of malicious app in FIG. 1;
Figs. 3 and 4 are diagrams illustrating exemplary forms of API information.
5 and 6 are diagrams illustrating the relationship between the API return value and the framework.
7 is a diagram exemplarily showing an example of a framework.
8 is a block diagram illustrating an example of a dynamic behavior analyzing apparatus according to an exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the embodiments of the present invention, detailed description of related arts will be omitted if it is determined that the gist of the embodiments disclosed herein may be obscured.

It is also to be understood that the term " and / or " disclosed in the following embodiments includes any and all possible combinations of one or more of the listed related items.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. , ≪ / RTI > equivalents, and alternatives.

Also, terms such as " comprising ", or "comprising ", etc., which are disclosed in the following embodiments, mean that a component can be implanted unless otherwise specifically stated. But should be understood to include additional elements.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals are used to designate identical or similar elements, and redundant description thereof will be omitted.

<Example of dynamic behavior analysis method>

2 is a block diagram illustrating an example of a malicious app dynamic behavior analyzing apparatus for realizing the dynamic behavior analyzing method of malicious app in FIG. 1; FIG. FIG.

The malicious app dynamic behavior analysis apparatus 100 shown in FIG. 2 downloads an application from a web site 101 or a storage (app server) 102 connected to a communication network and detects whether or not the malicious application is detected. Dynamic behavior can be analyzed.

However, the malicious app dynamic behavior analyzing apparatus 100 accesses the web site 101 or the repository (app server) 102 to determine malicious apps and dynamic behaviors for the apps stored in the web site 101 or the repository 102 It can also be analyzed.

The application may be an application program executed in a mobile terminal or the like, but is not limited thereto.

Meanwhile, the above-mentioned communication network can be configured regardless of the communication modes such as wired and wireless, and can be applied to a wide area network (LAN), a metropolitan area network (MAN), a wide area network (WAN) Network), and the like. Preferably, the network referred to in the present invention may be the World Wide Web (WWW).

Such as the Internet, also referred to as the World Wide Web (WWW), intranet and / or wireless networks such as cellular telephone networks, wireless local area networks (LANs) and / or metropolitan area networks (MANs) As shown in Fig.

The wireless communication may include a Global System for Mobile Communications (GSM), Enhanced Data GSM Environment (EDGE), high-speed downlink packet access (HSDPA), high-speed uplink packet access (HSUPA), wideband code division multiple access (W- , Code division multiple access (CDMA), time division multiple access (TDMA), Bluetooth, wireless fidelity (e.g., IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, and / (e. g., Internet message access protocol (IMAP) and / or post office protocol (POP)), instant messaging (e. g., XMPP (Instant Messaging and Presence Service), and / or Short Message Service (SMS), or developed prior to the filing date of this document, such as extensible messaging and presence protocol (SIMPLE), Instant Messaging and Presence Leveraging Extensions (SIMPLE) Any other appropriate means of communication, including non- Including the protocol, but may use any of a plurality of communications standards, protocols and technologies that are not limited to these.

The dynamic behavior analysis method of malicious apps realized through the above-described malicious app dynamic behavior analysis apparatus 100 is as follows.

Referring to FIG. 1, a method 200 for analyzing a dynamic behavior of a malicious application according to an embodiment of the present invention includes analyzing a dynamic behavior of a malicious application using an emulator based on a virtualization environment through the dynamic behavior analysis apparatus 100, 260 steps.

First, in an exemplary step 210, the dynamic behavior analysis apparatus 100 receives an application suspected of being a malicious application from the application server 102 or the web site 101, and executes the received application in a virtual environment-based emulator ).

The virtualization-based emulator can monitor malicious behavior or malicious suspicious activity based on the VM added in the virtual box. The version installed in the relevant VM may be Ubuntu14.04.

In an exemplary step 220, the dynamic behavior analysis apparatus 100 may perform a dynamic behavior test on an application received from the executed virtual environment environment-based emulator after the virtual environment environment based emulator is executed.

Here, the dynamic behavior test may include information on the hash value of the package generated during the operation of the application, internal / external communication data information, file read / write operation information, class information, exposure information by the network, And a test related to call exposure information.

These dynamic behavior tests can be application reception and application execution phone information check test, SMS / MMS information test, location information test, address information test, call information test, class information test, service information test and network information test.

In exemplary step 230, the dynamic behavior analysis apparatus 100 may generate a log file for the received application during the above-described dynamic behavior test and store it in the database.

In an exemplary step 240, the dynamic behavior analysis apparatus 100 may extract API information and call count information from the log file stored in the database, in which the received application calls the dynamic analysis API defined at the time of operation.

The API information may include an API name and an API return value, and the type of the API information may be represented as shown in FIGS. 3 and 4 according to each log file.

In an exemplary operation 250, the dynamic behavior analysis apparatus 100 may detect an abnormal behavior for an application by comparing the API information and the call count information with the API information of the predetermined malicious behavior and the call count.

However, in the conventional emulator-based dynamic analysis system such as Google Bouncer, it is possible to fingerprint the application execution environment. By using this, it is possible to detect the emulator environment when the malicious application is created and to prevent the malicious action in the environment, Can be avoided.

In order to prevent this, the following step 260 can be performed. That is, in an exemplary operation 260, the dynamic behavior analysis apparatus 100 may extract an API return value used for analysis avoidance from the API information in response to the detected abnormal behavior.

Furthermore, the dynamic behavior analysis apparatus 100 can modify the framework of the corresponding system attributes associated with the API return values extracted from the API information to create malicious behavior analysis and detection.

The relationship between the API return value and the framework can be shown in FIGS. 5 and 6, and an example of the modified framework can be shown in FIG.

Thus, in the present embodiment, the system attribute corresponding to the main API return value mainly used for analysis avoidance can be hard-coded into data of the actual terminal through, for example, modification of the Android framework, thereby disabling the analysis avoidance attempt through fingerprinting .

The dynamic behavior analysis method of malicious app described above can be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable medium.

The computer readable medium may be any medium accessible by the processor. Such media can include both volatile and nonvolatile media, removable and non-removable media, communication media, storage media, and computer storage media.

A communication medium may include computer readable instructions, data structures, program modules, other data of a modulated data signal such as a carrier wave or other transmission mechanism, and may include any other form of information delivery medium known in the art.

The storage medium may be any type of storage medium such as RAM, flash memory, ROM, EPROM, electrically erasable read only memory ("EEPROM"), registers, hard disk, removable disk, compact disk read only memory Or any other type of storage medium.

Computer storage media includes removable and non-removable, nonvolatile, and nonvolatile storage media implemented in any method or technology for storing information such as computer readable instructions, data structures, program modules or other data, Volatile media.

Such computer storage media may be embodied as program instructions, such as RAM, ROM, EPROM, EEPROM, flash memory, other solid state memory technology, CDROMs, digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, Lt; RTI ID = 0.0 &gt; and / or &lt; / RTI &gt;

Examples of program instructions may include machine language code such as those produced by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like.

<Example of Dynamic Behavior Analysis Apparatus>

8 is a block diagram illustrating an example of a dynamic behavior analyzing apparatus according to an exemplary embodiment of the present invention.

The above-described Figs. 3 to 7 will be supplementarily referred to when explaining Fig.

Referring to FIG. 8, the dynamic behavior analysis apparatus 300 includes an emulator driving unit 310, a dynamic behavior testing unit 320, an information management unit 320, An API extraction unit 340, a malicious behavior detection unit 350, a framework correction unit 360, and a database 370. The API extraction unit 340,

First, the exemplary emulator driving unit 310 receives an app suspected as a malicious app from the app server 302 or the web site 301, and can execute (run) the received app in a virtual environment-based emulator.

The virtualization-based emulator can monitor malicious behavior or malicious suspicious activity based on the VM added in the virtual box. The version installed in the relevant VM may be Ubuntu14.04.

The exemplary dynamic behavior testing unit 320 may perform a dynamic behavior test on an application received from the executed virtual environment environment based emulator after the virtual environment environment based emulator is executed.

Here, the dynamic behavior test may include information on the hash value of the package generated during the operation of the application, internal / external communication data information, file read / write operation information, class information, exposure information by the network, And a test related to call exposure information.

These dynamic behavior tests can be application reception and application execution phone information check test, SMS / MMS information test, location information test, address information test, call information test, class information test, service information test and network information test.

The exemplary information management unit 330 may generate a log file for the received application during the above-described dynamic behavior test, and store the log file in the database.

The exemplary API extractor 340 may extract API information and call count information from the log file stored in the database, in which the received application calls the dynamic analysis API defined at the time of operation.

The API information may include an API name and an API return value, and the type of the API information may be represented as shown in FIGS. 3 and 4 according to each log file.

The exemplary malicious behavior detection unit 350 can detect an abnormal behavior for the application by comparing the API information and the call frequency information with the API information of the predetermined malicious behavior and the call frequency.

However, in the conventional emulator-based dynamic analysis system such as Google Bouncer, it is possible to fingerprint the application execution environment. By using this, it is possible to detect the emulator environment when the malicious application is created and to prevent the malicious action in the environment, Can be avoided.

In order to prevent this, the following framework corrector 360 may be performed. That is, the exemplary framework correcting unit 360 can extract the API return value used for the analysis avoidance from the API information in response to the detected abnormal behavior.

Furthermore, the framework modifier 360 may modify the framework of the corresponding system attributes associated with the API return values extracted from the API information to implement malicious behavior analysis and detection.

The relationship between the API return value and the framework can be shown in FIGS. 5 and 6, and an example of the modified framework can be shown in FIG.

Thus, in the present embodiment, the system attribute corresponding to the main API return value mainly used for analysis avoidance can be hard-coded into data of the actual terminal through, for example, modification of the Android framework, thereby disabling the analysis avoidance attempt through fingerprinting .

Finally, the exemplary database 370 includes the emulator driving unit 310, the dynamic behavior testing unit 320, the information managing unit 330, the API extracting unit 340, the malicious behavior detecting unit 350, And can store the processed data processed by the server 360. [

The database 370 is a concept including a computer-readable recording medium. The database 370 includes not only a consultation database but also a database in a broad sense including a data record based on a file system. Even a simple set of logs It is included in the scope of the database referred to in the present invention.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the exemplary embodiments or constructions. You can understand that you can do it. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

100,300: malicious app dynamic behavior analyzer 101,301: website
102, 302 an app server 310 an emulator driving unit
320: Dynamic Behavior Testing Unit 330: Information Management Unit
340: API extraction unit 350: Malicious behavior detection unit
360: framework modifier 370: database

Claims (10)

A method for analyzing dynamic behavior of a malicious app using a virtual environment based emulator in a dynamic behavior analyzer,
Receiving a suspicious malicious app from an app server and executing the received app in a virtual environment based emulator;
Performing a dynamic behavior test on the received application in the executed virtual environment environment based emulator;
Storing log files generated during the progress in a database;
Extracting API information and call count information for calling a dynamic analysis API defined at the time of running the application from the log file; And
Checking the API information and the call count information to detect an abnormal behavior for the application
The method comprising the steps of: The method according to claim 1,
Extracting an API return value used for analysis avoidance in response to the detected abnormal behavior from the API information and modifying a framework of a corresponding system attribute associated with the extracted API return value
Wherein the malicious app's dynamic behavior analysis method further comprises: The method according to claim 1,
Wherein the API information includes an API name and an API return value. The method according to claim 1,
The dynamic behavior test may include:
Related information related to the hash value information, the internal / external communication data information, the file read / write operation information, the class information, the exposure information by the network, the encryption information, the SMS exposure information, and the call exposure information A method of dynamic behavior analysis of malicious apps that is a test. The method according to claim 1,
Wherein the virtualization environment is a VM of Ubuntu. A dynamic behavior analysis apparatus for analyzing dynamic behavior of a malicious app using an emulator based on a virtual environment,
An emulator driver for receiving an application suspected of being a malicious application from an application server and executing the received application in a virtual environment-based emulator;
A dynamic behavior testing unit for performing a dynamic behavior test on the received application in the executed virtual environment environment based emulator;
An information management unit for storing a log file generated during the process in a database;
An API extractor for extracting API information and call count information for calling a dynamic analysis API defined when the application is activated from the log file; And
A malicious behavior detection unit for detecting an abnormal behavior for the application by checking the API information and the call count information,
The dynamic behavior analysis device comprising: The method according to claim 6,
Extracting an API return value used for analysis avoidance in response to the detected abnormal behavior from the API information and modifying a framework of a corresponding system attribute associated with the extracted API return value,
Wherein the dynamic behavior analyzing apparatus further comprises: The method according to claim 6,
Wherein the API information includes an API name and an API return value. The method according to claim 6,
The dynamic behavior test may include:
Related information related to the hash value information, the internal / external communication data information, the file read / write operation information, the class information, the exposure information by the network, the encryption information, the SMS exposure information, and the call exposure information A dynamic behavior analysis device that is a test. The method according to claim 6,
Wherein the virtualization environment is a VM of Ubuntu.

Images