KR20180135601A - Method and apparatus for real-time detection and prevention of Ransomware of computer system - Google Patents

Abstract

FIELD OF THE INVENTION The present invention relates to a method for detecting and intercepting the operation of a Raman software in real time in a computer system.
The present invention is characterized by creating an access control list and allowing only programs / processes included in the access control list to access the file.
The present invention is characterized in that it real-time monitors that a program / process accesses a file and determines whether or not a file access is permitted depending on whether a program / process to access the file is included in the access control list.
According to the present invention, it is possible to prevent the damage of the computer system user by detecting the operation of the RANUMWARE through the management and operation of the access control list in advance.

Description

Technical Field [0001] The present invention relates to a real-time detection and prevention method of a computer system,

The present invention relates to a method and apparatus for detecting and blocking the behavior of Ransomware of a computer system in real time. The present invention creates an access control list by constructing a pair of a list of programs permitted to access files belonging to a file type and a file registered on the computer system, The process accesses the file and attempts to change the file, such as encapsulation, in real time.

Representative figure - figure 6.

Ransomware is a kind of malicious code that normally installs and runs on a computer system without user consent.

Ransomware requires the cost of recovering this file after encrypting or deleting important files such as system files or user documents of the computer system.

The way to cope with Ransomware is to detect the Ransomware installed on the computer system using the antivirus solution, to copy the important files using the backup solution, and to analyze the Ransomware using reverse engineering And a method of decrypting an encrypted file are generally proposed.

However, these static analysis and countermeasures have limitations in that they can not actively and immediately respond to new variants of Ransomware or existing Ransomware using vulnerabilities of newly discovered computer systems.

Therefore, there is a need for a method to detect and block the operation of the Raman software in real time on the computer system.

The present invention is a technology for solving the problems of existing Ransomware countermeasures. The present invention generates an access control list, detects a real time when a program running on a computer system attempts to access / change a file, and then compares the detected result with data of an access control list to access / The present invention provides a method and apparatus for real-time detection and blocking of a Ramsomware attack on a computer system by denying access to a file or stopping the operation of a corresponding program in the case of an unauthorized program.

To achieve the above object, according to the present invention, there is provided an access control list generating method comprising: a first step of generating an access control list; A second step in which a program operating in the computer system monitors an attempt to access / change the file; A third step of comparing information on a program attempting to access / change a file with an access control list to determine whether file access / change is permitted; If the file access is denied, the fourth step is to block access to the file.

In the first step, the access control list is formed of elements composed of {file type information, file access program information list} pairs. One example of the file type information is an extension of the file. An example of file access program information is information of a program operating in a computer system or information of a process. The file access program information may include a plurality of program information.

The access control list is composed of elements of the list as {file type information, file access program information list} inputted by the user.

The access control list is formed by creating {file type information, file access program information list} using the configuration and operation information set in the computer system to configure the elements of the list.

In step 2, when the program / process running on the computer system accesses the file to read or change the file, the 'I / O manager' of the computer system notifies the file system kernel / driver of the computer system of the file access request The file monitor receives and processes the notification before the file system kernel of the computer system.

The file monitor analyzes the received file access request to acquire the type of the access target file and the access attempt program / process information.

The file monitor notifies the 'access manager' of the type of the access target file analyzed and information of the access attempt program / process.

In step 3, the access manager searches the access control list with {file type of access target file, access attempt program / process information} notified by the file watcher, and searches the access control list for the list of file types Element is present.

The access manager searches the access control list with {file type of access target file, access attempt program / process information} notified by the file supervisor, and retrieves an element of the list having the same file type as that of the notified access target file , It is determined that the program / process corresponding to the notified access attempt program / process information can access the access target file.

The access manager searches the access control list with {file type of access target file, access attempt program / process information} notified by the file supervisor, and retrieves an element of the list having the same file type as that of the notified access target file , It is confirmed whether the same information as the notified access attempt program / process information is included in the file access program information of the retrieved element.

If the access manager finds an element of the access control list composed of the same file type as the type of the access target file notified by the file supervisor, the same information as the notified access attempt program / process information is included in the file access program information list of the retrieved element The process determines that the program / process corresponding to the notified access attempt program / process information can access the access target file.

If the access manager finds an element of the access control list composed of the same file type as the type of the access target file notified by the file supervisor, the same information as the notified access attempt program / process information is included in the file access program information list of the retrieved element , It is determined that the program / process corresponding to the notified access trial program / process information can not access the access target file.

The access manager notifies the file detector of the determination result related to the permission or prohibition of access to the access target file of the access attempt program / process.

In step 4, when the file monitor receives notification from the access manager that the access attempt program / process can not access the file to be accessed, the I / O manager '.

If the file monitor receives notification of the result of the determination that the access target program / process can not access the access target file, the file monitor notifies the 'process manager' of the computer system to deny access to the access target file of the program / process .

When the File Watcher is informed of the result of the determination that the access attempt program / process can access the access target file from the access manager, the file monitor notifies the file system manager of the computer system to deny access to the access target file of the program / process .

According to the real-time detection and blocking method and apparatus for the Ransomware behavior of the computer system of the present invention, the following effects can be obtained.

First, Ransomware can effectively block the attempt to change the file to encrypt the attack target file in real time.

Second, detection and blocking of variant RANMSWARE and new RANMSWARE are possible as well as existing Ransomware behavior.

Third, it is possible to classify the programs that can access the files stored in the computer system and limit the access of the programs to the files by using the data inputted by the user or the configuration and operation setting information of the computer system. Therefore, Files can be managed easily and safely.

1 is a conceptual diagram illustrating a procedure for accessing a file in a computer system.
FIG. 2 is a block diagram of a real-time detection and blocking device of a computer system according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating a basic operation flow of access control list generation for real-time detection and blocking of a Ransomware behavior of a computer system according to an embodiment of the present invention.
FIG. 4 is a diagram illustrating a flow of a real-time file access detection operation for real-time detection and blocking of an Ransomware act in a computer system according to an embodiment of the present invention.
FIG. 5 is a diagram illustrating a flow of a real-time file access control operation for real-time detection and blocking of an Ransomware act of a computer system according to an embodiment of the present invention.
FIG. 6 is a flowchart illustrating a detailed operation flow for real-time detection and blocking of a Ransomware behavior of a computer system according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and are herein described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, elements, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Although the present invention has been practiced and implemented in a Windows operating system, the concept itself can be universally used on all platforms.

1. Overview

Ransomware is a program that takes a monetary gain in return for encrypting important files of a computer system. To this end, Ransomware requests the computer system to access the files of the computer system.

In general, the files of the computer system are assigned to the computer system according to the type of the file. For example, in the case of a Hangul file whose file extension is hwp, it is usually assigned to the computer system to be accessed using a Hangul word processing program. Depending on the file type, there may be several programs to be used, but in general, the number of types of files used by individuals or groups is limited, and the number of programs designated for use is limited depending on the type of each file .

The present invention is based on a general situation of using a file in a computer system, and a list of programs designated for access according to a specific file type is created in advance, and then a corresponding type of program When the computer system is requested to access the file, it is invented to prevent the Ransomware by detecting it and blocking access.

2. Example

Figure 1 shows a flow diagram of a process in which when a generic user / system program / process 100 operating in a computer system requests access to a computer system to access a file 105 stored on the computer system, . When the I / O manager 101 of the computer system receives the file access request, it transfers the access attempt program information and the access target file information to the file system kernel 102 of the computer system to process the file access request.

FIG. 2 is a block diagram of a real-time detection and blocking device of a computerized system. FIG. The dashed-line configuration refers to the components (101, 102) of the computer system itself and the files (105) to be accessed by the user / system program / process (100), not the components of the present invention. The components of the present invention include an access control list manager 400 for creating and managing a file access control list, an internal / external storage 500 for storing an access control list, an access manager 300 And a file monitor 200 for detecting file access of the program.

3 is an exemplary diagram of a basic operation flow for creating and managing an access control list for real-time detection and blocking of the Ransomware act of a computer system. The access control list is made up of elements constituted by a pair of programs / processes that are allowed to access the file type and the file type. The access control list manager 400 receives the information of the program to allow access according to the type of the file from the user 104 or acquires the information of the program to be permitted according to the file type from the configuration and operation information of the computer system 103 )can do. The access control list manager 400 stores and manages a list of programs to be accessed according to the type of the input / acquired file in the internal / external storage 500. The access control list manager 400 may modify the list of programs to be allowed to access according to the types of files stored in the internal / external storage 500, as needed. The access control list manager 400 reads an access control list 401 constituted by reading a program list to permit access according to the file type in the internal / external storage 500 according to a request of the access manager 300, 300).

FIG. 4 is an exemplary view of a real-time file access detection operation flow for real-time detection and blocking of a Ransomware act of a computer system. When a program / process 100 operating in a computer system requests access to a specific file 105 to read a particular file 105 or change the contents of a particular file 105, the I / O manager 101 transfers the information of the access attempt program / process 100 and the access target file 105 to the kernel of the computer system (201). The file monitor 200 receives the information 201 of the access attempt program / process 100 and the access target file 105 transmitted by the I / O manager 101 before the file system kernel 102 of the computer system . The file monitor 200 delivers the information 202 of the access attempt program / process 100 and the access target file 105 to the access manager 300. [ The access manager 300 retrieves a record of the access control list 401 provided from the access control list manager 400 in FIG. 3 and displays a list of programs / processes that can access the file of the same kind as the access target file 105 Process program (100) is included in the program. As a result of retrieving the record of the access control list 401 provided from the access control list manager 400 in FIG. 3, the access attempt list 401 is accessed to the program / process list which can access the file of the same kind as the access target file 105 / Process 100 is included, the access manager 300 forwards the file access permission message 203 to the file monitor 200. [ The file monitor 200 transfers the information 201 of the access attempt program / process 100 and the access target file 105 received from the I / O manager 101 to the file system kernel 102 of the computer system, So that the trial program / process 100 can use the access target file 105 normally.

FIG. 5 is a diagram illustrating a flow of a real-time file access control operation for real-time detection and blocking of a Ransomware act of a computer system. When the access attempt program / process 100 operating in the computer system accesses the access target file 105 or changes its contents, the I / O manager 101 of the computer system accesses the access attempt program / 100 and the information 201 of the access target file 105 to the kernel of the computer system. The file monitor 200 receives the information 201 of the access attempt program / process 100 and the access target file 105 transmitted by the I / O manager 101 before the file system kernel 102 of the computer system . The file monitor 200 delivers the information 202 of the access attempt program / process 100 and the access target file 105 to the access manager 300. [ The access manager 300 retrieves the record of the access control list 401 provided from the access control list manager 400 in FIG. 3 and stores it in a list of programs / processes accessible to the file of the same kind as the access target file 105 It is checked whether the access attempt program / process 100 to use the access target file 105 is included. As a result of retrieving the record of the access control list 401 provided from the access control list manager 400 in FIG. 3, the access attempt list 401 is accessed to the program / process list which can access the file of the same kind as the access target file 105 / Process 100 is not included, the access manager 300 forwards the file access denial message 204 to the file monitor 200. The file monitor 200 transfers the access denied message 205 to the access target file 105 of the access attempt program / process 100 to the I / O manager 101 to access the access attempt program / So that the target file 105 can not be accessed.

5 is an example of a flow of a real-time file access control operation for real-time detection and blocking of a ransomware behavior of a computer system. Another example is that when the file monitor 200 receives a file access denied message 204 from the access manager 300, it requests the process management kernel of the computer system to terminate the access attempt program / process 100, So that the access object file 105 of the process 100 can not be accessed.

FIG. 6 illustrates this basic operation flow in more detail.

First, the access control list management apparatus for creating and managing an access control list is operated (S100).

The access control list consists of a list of programs / processes that are allowed to access the file type and the file type. The access control list is created by using the data directly input by the user or by analyzing the configuration and operation information of the computer system (S200, S300). The access control list may be modified as needed (S200, S300). The generated / modified access control list is stored in the internal / external storage 500 (S400).

The access manager apparatus is operated (S1600).

If the access target file and the access attempt program / process information are received from the file monitor (S1700), the access manager apparatus searches the access control list provided from the access control list manager with the received file and program information (S1800, S1900) . If there is no record of the type of access target file received in the access control list (S2000), the file monitor informs the file monitor that the access attempt program can normally access the file to be accessed (S2200). If there is a record of the type of the access target file received in the access control list (S2000), the list of the programs permitted to access the file of the corresponding file type is analyzed, and the access attempt program / Check if it is included. If the access attempt program / process is included in the access permitted program list, the file accessor is notified that the access attempt program / process can normally access the access target file (S2200). If the access attempt program / process is not included in the access permitted program list, the file access monitor notifies the file monitor that the access attempt program / process can not access the access target file (S2300).

The file monitor apparatus for detecting a file access attempt of the program / process is operated (S500). The file watcher module continuously monitors access attempts of programs / processes for files stored in the computer system (S600). This step is implemented by monitoring the system messages sent by the I / O manager of the computer system to the kernel of the computer system. When the I / O manager of the computer system sends a system message related to file access to the kernel of the computer system, the file watcher receives the message before the file system kernel of the computer system, Information of a file to be accessed is acquired and stored (S700, S800). The file monitor transmits the stored program and file information to the access manager, and then waits for the analysis result (S900, S1000). If the file access permission notification is received from the access manager, the program attempts to access the file system kernel of the computer system and the information of the file to be accessed, so that the program can use the file normally (S1200) The information about the file and the program that the file monitor internally stores (S800) is deleted (S1300). If the file manager receives the file access denial notice from the access manager (S1100), the file monitor requests the program that has attempted to access the I / O manager of the computer system or the process manager of the computer system not to access the file to be accessed S1400, and S1500) and deletes the information about the file and the program that the file monitor internally stores (S800) (S1300).

Although the present invention has been described by way of specific embodiments, it is not limited thereto. The real-time detection and blocking order of the Ransomware behavior under the basic concept of the present invention can be changed and modified within the scope of the technical idea of the present invention.

Claims (6)

A first step of creating / modifying / managing an access control list including elements constituted by pairs {file type information, file access program information list}; A second step of monitoring a program / process operating in the computer system attempting to access / change the file stored in the computer system; A third step of referring to the access control list when the program / process operating in the computer system attempts to access / change the file, and determines whether the file is allowed to be accessed / changed; And a fourth step of blocking file access / modification of the corresponding program / process to the file when the access / change of the specific file of the program / process operating in the computer system is not permitted. Real - time detection and prevention of software. 1, when creating or modifying an access control list composed of {file type information, file access program information list} pairs, it is possible to generate and modify an access control list by receiving data from a user, How to create / modify access control list using. In Section 1, when an attempt is made to access / modify a file to be accessed, a device is installed and operated at the kernel end of the computer system to monitor the access status of the file, How to detect and process it first. If the access control list contains information about the type of file to be accessed when checking the access control list data to determine whether or not the access attempt program / process is permitted to access the file to be accessed, When the program / process is not included in the list of programs allowed to access for the same type of file as the target file, the access attempt program / process does not access or read the file to be accessed. How to. In Section 4, when the access attempt program accesses the access target file and prohibits the reading or modification of the access target file, it requests the I / O manager of the computer system not to access the access target file. In Section 4, when the access attempt program accesses the access target file and prohibits reading or changing the access target file, it requests the process manager of the computer system to suspend execution of the access attempt program. If the access control list data is checked in order to determine whether the access attempt program for the access target file is permitted in step 4, the access target file is accessed by all the access attempt programs except for the case of step 5, How to allow to read or change.

Images