KR101092342B1 - File summary information generating, signature generating apparatus and signature pattern inspecting apparatus and method - Google Patents

Abstract

The present invention divides the original file into a plurality of blocks having a predetermined size and then calculates a block value verification value and a representative value, and the original file using the block value verification value and the representative value calculated by the file processor. It provides a file shortening information generating device including a short information generating unit for generating the file shortening information for and stores it in the original file database, and generates a signature pattern using the file shortening information of the original file generated through this In addition, the generated signature pattern can be verified.

As described above, the present invention divides the original file by blocks of a predetermined size, calculates a representative value and a verification value of each block, and generates file abbreviation information that cannot be traced back using the calculated representative value and the verification value. File security has the effect of obtaining the original files from the enterprise.

Source file, verification, error, signature, virus, malware

Description

File abbreviation information generation, signature generation and signature pattern verification apparatus and method {FILE SUMMARY INFORMATION GENERATING, SIGNATURE GENERATING APPARATUS AND SIGNATURE PATTERN INSPECTING APPARATUS AND METHOD}

The present invention relates to a signature pattern for detecting malicious code. More specifically, in the case of a confidential file, it cannot be inferred to overcome the fact that it is difficult to export externally and thus cannot be used to verify the signature pattern for the file. The present invention relates to an apparatus and a method for generating file shortening information information and generating signatures using the same, as well as verifying signature patterns.

While the widespread use of the Internet is being made, the path of transmission of malicious software or malicious code through a communication network is diversified, and the damage caused by this is increasing every year. Malware is software that is intentionally designed to perform malicious activities, such as destroying the system or leaking information, contrary to the user's intentions and interests. These malicious codes include hacking tools such as viruses, worms, trojans, backdoors, logic bombs, and trap doors, and malicious spywares. spyware and ad-ware. Through self-replicating or automatic propagation functions, they can leak personal information such as user IDs and passwords, control target systems, change / delete files, destroy systems, refuse applications / systems, leak critical data, and install other hacking programs. It is causing the damage is also very diverse and serious.

Such an antivirus program for blocking malicious code includes a database in which signature patterns related to malicious code files are stored, and the signature pattern stored in the database is produced and distributed by a company producing an antivirus program.

In order to extract the signature pattern associated with a file, a diagnosis value for all or part of a file is used. When using diagnostic values for all files, there are methods using file size, hash verification values such as Message-Digest algorithm (MD5) and Secure Hash Algorithm (SHA-1), which are slow and use a lot of data. The disadvantage is that it is very difficult. For this reason, the method of diagnosing a part of a file as diagnostic information is widely used.

However, the method of diagnosing malicious code using the diagnostic value of a part of the file also has a possibility of misdiagnosing a normal normal file as malicious code instead of malicious code.

For this reason, the signature is generated and then verified through a verification process. The verification is performed by diagnosing all normal files that are subject to verification before signature distribution.

However, since the conventional method for verifying the error of the signature takes the form of diagnosing the normal files, it is almost impossible to collect all the normal files.

In particular, companies that use anti-virus programs do not provide normal files within the company for security reasons, which makes it difficult to verify the error.

The present invention is invented to solve the above problems, after dividing the original file for each block of a predetermined size to calculate the representative value and the verification value of each block, based on the calculated representative value and the verification value is impossible to trace back An apparatus and method for generating file shortening information are provided.

The present invention also provides an apparatus and method for generating a signature pattern by comparing the representative value and the verification value of each block of the original file and the infected file to increase the accuracy of the signature pattern.

The present invention provides an apparatus and method for minimizing the possibility of misunderstanding due to an incorrect signature pattern by verifying an existing signature pattern by comparing between a representative value and a verification value for each block of an original file and an infected file.

The object of the present invention is not limited to the above-mentioned object, and other objects which are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the apparatus for generating file abbreviation information according to the present invention divides an original file into a plurality of blocks having a predetermined size and then calculates a verification value and a representative value for each block, and calculates an entropy value for each block. A file processor for generating the representative value for each block, and the shortened information for generating file abbreviation information for the original file using the verification value and the representative value for each block calculated by the file processor and storing the file abbreviation information for the original file database. It includes a generation unit.

In another aspect, the signature generation apparatus according to the present invention includes a file processing unit for dividing an infected file and an original file into a plurality of blocks having a predetermined size, and calculating a verification value and a representative value for each block; A contraction information generation unit for generating file contraction information by using the block-specific verification value and the representative value of the original file and storing the contract information in the original file database, and corresponding to the infected file by searching the original file database And a signature generation unit for extracting file shortening information of an original file and generating a signature pattern by comparing the extracted file shortening information with the block-specific verification value and representative value of the infected file.

In another aspect, the signature verification apparatus according to the present invention includes a signature database in which signature patterns for a plurality of files are stored, a signature verification file, and a signature verification file and an original file are divided into a plurality of blocks having a predetermined size, and then verified for each block. A file processing unit for calculating a value and a representative value, respectively, and a shortening information for generating file contraction information using the block-specific verification value and the representative value of the original file calculated by the file processing unit, and then storing the file contraction information in the original file database. A generator and a signature pattern corresponding to the signature verification file are searched in the signature database, and the file abbreviation information of the original file corresponding to the signature check file is extracted through the search of the original file database, and then extracted. File abbreviation information and the signature sword Estimating a signature located by a comparison between the block-by-block verification value and the representative value for the for the file, and includes a comparison and analysis to verify the retrieved signature pattern through a comparison between the estimated signature position and the detected signature pattern.

The method of generating file reduction information according to the present invention includes the steps of: receiving an original file, dividing the original file into a plurality of blocks having a predetermined size, calculating a verification value and a representative value for each block, and calculating the calculated block. Generating file abbreviation information for the original file by using the verification value and the representative value of each and storing the same in the original file database.

The present invention is a method for generating a signature pattern using the original file database, which stores the file contraction information generated by the block-specific verification value and the representative value of the original file composed of blocks having a predetermined size. And dividing the infected file into a plurality of blocks having a predetermined size and calculating a verification value and a representative value for each block, and file abbreviation information of the original file corresponding to the infected file by searching the original file database. And generating a signature pattern by comparing the extracted file contraction information with the block-specific verification value and the representative value of the infected file.

The present invention uses a signature database in which signature patterns for a plurality of files are stored, and an original file database storing file abbreviation information generated through block-specific verification values and representative values for an original file composed of blocks having a predetermined size. A method of verifying a signature pattern, comprising: dividing the signature verification file into a plurality of blocks having a predetermined size as a signature verification file is input, and then calculating a verification value and a representative value for each block, respectively, and verifying the signature verification. Retrieving a signature pattern corresponding to a signature file from the signature database; extracting file abbreviation information of an original file corresponding to the signature verification file by searching the original file database; and extracting the extracted file. Information and the signature verification And estimating a position from the comparison of the signature block by the verification value and the representative value for the file, and a step of verifying the detected signature pattern with a signature comparison between the estimated position and the detected signature pattern.

Specific details of other embodiments are included in the detailed description and drawings.

The present invention divides the original file by blocks of a predetermined size, calculates a representative value and a verification value of each block, and generates file abbreviation information that cannot be traced back using the calculated representative value and the verification value. Through this, the original file can be obtained from the enterprise.

In addition, the present invention has the effect of minimizing the misunderstanding caused by the signature pattern by generating a signature pattern through comparison between the representative value and the verification value for each block of the original file and the infected file.

According to the present invention, since the existing signature pattern can be verified by comparing the representative value and the verification value for each block of the original file and the infected file, there is an effect of minimizing the possibility of misunderstanding due to an incorrect signature pattern.

The effects of the present invention are not limited to those mentioned above, and other effects that are not mentioned will be clearly understood by those skilled in the art from the following description.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

The present invention can be embodied as computer-readable codes on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CO-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which may also be implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to an embodiment of the present invention, after dividing an original file by blocks of a predetermined size, a representative value and a verification value of each block are calculated, and file abbreviation information that cannot be traced back can be generated using the calculated representative value and the verification value. An apparatus and a method are demonstrated.

In addition, an embodiment of the present invention will be described an apparatus and method for generating a signature pattern by comparing the representative value and the verification value for each block of the original file and the infected file.

In the embodiment of the present invention, since the existing signature pattern can be verified by comparing the representative value and the verification value of each block of the original file and the infected file, the present invention relates to an apparatus and method for verifying a misunderstanding caused by an incorrect signature pattern. Explain.

1 is a block diagram illustrating an apparatus for generating file reduction information according to an exemplary embodiment of the present invention, which includes a file processing unit 100, a reduction information generation unit 110, and an original file database 120.

The file processing unit 100 is a means for processing the original file as an input. The file processing unit 100 divides the original file into blocks having a predetermined size and calculates a verification value and a representative value for each block. Here, the size of the block inside the file may be an extraction unit of the signature, for example, 128 bytes or more. Considering the size of the malicious code, the block may be divided into 1-10KB units larger than 128 bytes.

That is, the file processing unit 100 divides the original file into blocks having a size of 1-10 KB, and then calculates a verification value and a representative value for the corresponding block, where the verification value is referred to as a cyclic redundancy check (CRC). ) Or a hash value to check whether the comparison block is the same or different when comparing it with the internal block of another file. The representative value is calculated using an entropy value that can represent a change in the content of the information.

For example, when the file processing unit 100 processes a 100 KB original file, first, the 100 KB original file is divided into 100 KB blocks in 1 KB units, and then 100 block representative values and verification values are calculated. .

The shortened information generator 110 generates file shortened information using basic information of the original file, for example, a file name, a file size, a file creation date, and the like, and a block value verification value and a representative value calculated by the file processor 100. This is stored in the original file database 120. Here, the file name may be represented by the size of 250 bytes, the file size by the size of 4 bytes, and the file creation date may be represented by the size of 4 bytes. In addition, the verification value and the representative value of the block may be represented by a size of 8 bytes. That is, if the original file of 100 KB is divided into 1 KB units, the file abbreviation information may be represented by a total of 1858 bytes because the total information of the file is composed of 1858 bytes, that is, 258 bytes of basic information, 1600 bytes of representative values, and verification values.

According to an embodiment of the present invention, after dividing an original file by blocks of a predetermined size, a representative value and a validation value of each block are calculated, and file abbreviation information that cannot be traced back is generated by using the calculated representative value and the validation value. With source file security, you can get the source file from the enterprise.

In an embodiment of the present invention, the file processing unit 100 and the abbreviation information generating unit 110 have been described as generating file abbreviation information for the original file. For example, the signature pattern for detecting malicious code is generated using the file processing unit 100 and the abbreviation information generating unit 110. Can also be used to The description thereof will be described with reference to FIG. 2.

FIG. 2 is a block diagram illustrating an apparatus for generating a signature pattern according to an exemplary embodiment of the present invention, wherein the file processor 100, the reduced information generator 110, and the original file database which are components of the file reduced information generator of FIG. 1 are illustrated. Further, the signature generator 200 and the signature database 210 are further included in the reference numeral 120.

As described with reference to FIG. 1, the file processing unit 100 not only calculates a representative value and a verification value for each block of the original file, but also blocks the infected file, that is, a file used to form a signature pattern in the same manner as the original file. Calculate the star verification value and the representative value. The verification value and the representative value for the infected file thus calculated are provided to the signature generator 200.

As described above with reference to FIG. 1, the reduced information generator 110 generates file reduced information based on a representative value and a verification value for each block of the original file and stores the file reduced information in the original file database 120.

The signature generator 200 extracts file abbreviation information of the original file corresponding to the infected file through a search of the original file database 120, and verifies the extracted file abbreviation information and the infected file provided from the file processor 100. The signature pattern is generated by comparing the value with the representative value and then stored in the signature database 210. For example, the signature generation unit when the original file has a verification value and a representative value for each block as shown in FIG. 3A, and the infected file has a verification value and a representative value for each block as shown in FIG. 3B. In operation 200, the block of the original file and the block of the infected file are respectively found to find the wrong block, and the block 200 determines that the wrong block, that is, the fifth block contains malicious code, generates a signature pattern in which the fifth block is displayed. As such, the generated signature pattern is stored in the signature database 210.

In other words, the signature generator 200 searches the original file database 120 for an original file having C1 = 0x1234568, C2 = 0x2234568, and C3 = 0x3234568, which are representative values of the infected file provided from the file processor 100, After comparing the representative value of the original file and the representative value of the infected file block by block, the comparison finds the fifth block, which is the block part that does not match each other, and determines that the found block contains malicious code and locates the signature in the fifth block. Create your signature pattern. When anti-virus program checks the malicious code of the file, the signature pattern is used to check only the location of the signature in the file, that is, the fifth block.

According to an embodiment of the present invention, by generating a signature pattern by comparing the representative value and the verification value of each block of the original file and the infected file, it is possible to minimize the misunderstanding caused by the signature pattern.

In the above description, the file processing unit 100 and the abbreviation information generating unit 110 are used to generate file abbreviation information for the original file and the infected file or to generate a signature pattern. It can also be used for error verification. The description thereof will be described with reference to FIG. 4.

4 is a block diagram illustrating an apparatus for verifying a signature of a signature pattern according to the present invention. The file processor 100, the abbreviated information generator 110, the original file database 120, the signature database 210, and comparison and analysis are shown. The unit 300 is included.

The file processing unit 100 and the abbreviation information generating unit 110 receive the original file, generate file abbreviation information for the original file, and store it in the original file database 120.

The file processor 100 according to an embodiment of the present invention calculates a representative value and a verification value for a signature verification file in which a signature pattern having a signature at a predetermined position is defined, and provides the same to the comparison and analysis unit 300. .

The signature database 210 stores a signature pattern that is already distributed in an antivirus program or arbitrarily created by a person in charge.

In the error verification apparatus of the signature pattern, the representative value and the verification value for the signature verification file having the signature at a predetermined position are calculated using the file processing unit 100, and the representative value and the verification value of the calculated signature verification file are calculated. It provides to the comparison and analysis unit 300.

The comparison and analysis unit 300 searches for the signature pattern for the signature verification file in the signature database 210 and recognizes in which block a signature exists based on the retrieved signature pattern.

In addition, the comparison and analysis unit 300 searches for a source file corresponding to the signature verification file in the original file database 120 for the test of the error, and then compares the representative values for each block between the retrieved original file and the signature verification file. The signature pattern for the signature verification file is verified through a comparison between the estimated infection location and the signature pattern of the signature verification file. That is, the original file having the representative values C1 = 0x1234568, C2 = 0x2234568, and C3 = 0x3234568, which are representative values of the signature verification file, is searched for in the original file database 120, and the signature verification file retrieved from the signature database 210 is tested. In the signature pattern corresponding to, the representative value of the block where the signature is located, for example, the first file and the fourth block, and the representative value of the signature verification file are compared with the verification value. As a result of the comparison, the representative of the original file and the signature verification file are compared. If both the value and the verification value match, the comparison and analysis unit 300 informs the signature pattern of misdiagnosis, and if not, informs the completion of the verification of the signature pattern. In other words, matching both the representative and verification values for the original file and the signature verification file means that the first and fourth blocks are not the location of the infection, so that the signature verification file by the signature pattern is checked for malware. There may be a time error, that is, a mistake that recognizes the signature verification file as a normal file, and if it does not match, it means that the signature pattern is normal.

According to an exemplary embodiment of the present invention, the existing signature pattern may be verified by comparing the representative value and the verification value of each block of the original file and the signature verification file, thereby minimizing the possibility of misunderstanding due to an incorrect signature pattern. .

The present invention has been described above with reference to specific embodiments of the present invention, but this is only illustrative and does not limit the scope of the present invention. Those skilled in the art can change or modify the described embodiments without departing from the scope of the present invention. Each of the functional blocks or means described in the present specification may be implemented in a program form, and may be implemented separately, or two or more may be integrated into one. Components such as modules described as separate in the specification and claims may be merely functionally distinct and may be physically implemented by one means, and components such as means described as a single element may be divided into several components. It can be made in combination. In addition, each method step described herein may be changed in order without departing from the scope of the present invention, and other steps may be added. In addition, the various embodiments described herein may be implemented independently as well as each other as appropriate. Therefore, the scope of the invention should be defined by the appended claims and their equivalents, rather than by the described embodiments.

1 is a block diagram showing an apparatus for generating file contraction information according to the present invention;

2 is a block diagram showing a signature pattern generating device according to the present invention;

3A to 3B are diagrams illustrating representative values and verification values for each block of an original file and an infected file.

4 is a block diagram illustrating an apparatus for verifying a signature pattern according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: file processing unit 110: abbreviation information generation unit

120: source file database 200: signature generator

210: signature database 300: comparison and analysis unit

Claims (29)

After dividing the original file into a plurality of blocks having a predetermined size to calculate the block-specific verification value and the representative value, the file processing unit for generating the representative value for each block by calculating the entropy value for each block, An abbreviation information generation unit generating file abbreviation information on the original file by using the verification value and the representative value for each block calculated by the file processing unit and storing it in an original file database. File abbreviation information generating device comprising a. The method of claim 1, The file processing unit divides the original file into blocks of 1-10 KB units. File abbreviation information device. The method of claim 1, The file processing unit generates a verification value for each block by calculating a hash value or a CRC value for each block. File abbreviation information generator. delete The method of claim 1, The shortening information generating unit may generate the file shortening information by including at least one or more of a name, a file size, and a file creation date of the original file in the representative value and the verification value for each block. File abbreviation information generator. A file processing unit for dividing the infected file and the original file into a plurality of blocks having a predetermined size, and calculating a verification value and a representative value for each block; A condensation information generation unit for generating file condensation information by using the block-specific verification value and the representative value of the original file calculated by the file processing unit and storing the condensation information in the original file database; Extract the file abbreviation information of the original file corresponding to the infected file through the search of the source file database, and compare the signature file with the signature value and the representative value of each block for the infected file and the infected file. Signature generator to generate Signature pattern generation device comprising a. The method of claim 6, The file processing unit divides the original file or the infected file into blocks of 1-10KB units. Signature pattern generator. The method of claim 6, The file processing unit generates a verification value for each block by calculating a hash value or a CRC value for each block. Signature pattern generator. The method of claim 6, The file processor is configured to generate a representative value for each block by calculating an entropy value for each block. Signature pattern generator. The method of claim 6, The shortening information generating unit may generate the file shortening information by including at least one or more of a name, a file size, and a file creation date of the original file in the representative value and the verification value for each block. Signature pattern generator. The method of claim 6, The signature generation unit, Searching for an inconsistent part by comparing the representative value of each block for the infected file with the representative value of each block in the extracted file abbreviation information, and generating a signature pattern using the retrieved part as an infected part; Signature pattern generator. A signature database that stores signature patterns for multiple files, A file processing unit for dividing the signature verification file and the original file into a plurality of blocks having a predetermined size, and then calculating a verification value and a representative value for each block; A condensation information generation unit for generating file condensation information by using the block-specific verification value and the representative value of the original file calculated by the file processing unit and storing the condensation information in the original file database; Search for the signature pattern corresponding to the signature verification file in the signature database, extract file abbreviation information of the original file corresponding to the signature verification file through a search of the original file database, and then extract the file contraction information A comparison and analysis unit estimating a signature position by comparing the verification value and a representative value of each block with respect to the signature verification file, and verifying the retrieved signature pattern by comparing the estimated signature position with the retrieved signature pattern Signature pattern verification apparatus comprising a. 13. The method of claim 12, The file processing unit divides the original file or the signature inspection file into blocks of 1-10KB units. Signature pattern verification device. 13. The method of claim 12, The file processing unit generates a verification value for each block by calculating a hash value or a CRC value for each block. Signature pattern verification device. 13. The method of claim 12, The file processor is configured to generate a representative value for each block by calculating an entropy value for each block. Signature pattern verification device. 13. The method of claim 12, The shortening information generating unit may generate the file shortening information by including at least one or more of a name, a file size, and a file creation date of the original file in the representative value and the verification value for each block. Signature pattern verification device. 13. The method of claim 12, The comparison and analysis unit may determine the signature position of the signature verification file by extracting blocks that do not coincide with each other by comparing the extracted file contraction information and the verification value and the representative value of each block with respect to the signature verification file. Estimating and verifying the retrieved signature pattern through a match between the estimated position and a signature position in the found signature pattern. Signature pattern verification device. Receiving the original file, Calculating a verification value and a representative value for each block after dividing the original file into a plurality of blocks having a predetermined size; Generating file abbreviation information for the original file by using the calculated block-by-block verification value and the representative value, and storing the abbreviation information for the original file in the original file database; File abbreviation information generation method comprising a. The method of claim 18, The calculating may include dividing the original file into blocks having a unit of 1-10KB to calculate a verification value and a representative value for each block. How to generate file short information. The method of claim 18 or 19, The calculating may include calculating a verification value for each block by calculating a hash value or a CRC value for each block. How to generate file short information. 20. The method according to claim 18 or 19, The calculating may include calculating a representative value for each block by calculating an entropy value for each block. How to generate file short information. The method of claim 18, The storing may include generating the file abbreviation information by including at least one or more of a name, a file size, and a file creation date of the original file in the representative value and the verification value for each block, and storing the file abbreviation information in the original file database. How to generate file short information. A method of generating a signature pattern using a source file database storing file contraction information generated by verification values and representative values of a block of a source file composed of blocks having a predetermined size, Dividing the infected file into a plurality of blocks having a predetermined size as input of an infected file, and calculating a verification value and a representative value for each block, respectively; Extracting file abbreviation information of an original file corresponding to the infected file by searching the original file database; Generating a signature pattern through comparison between the extracted file contraction information and the block-specific verification value and the representative value of the infected file; Signature pattern generation method comprising a. The method of claim 23, wherein The verification value for each block is a hash value or a CRC value. How to create a signature pattern. The method of claim 23, wherein The representative value for each block is an entropy value. How to create a signature pattern. The method of claim 23, wherein The generating of the signature pattern may include searching for an inconsistent part by comparing a representative value for each infected file with respect to the infected file and a representative value for each block in the extracted file contraction information, and using the searched portion as an infected part. To generate a signature pattern How to create a signature pattern. Signature pattern using signature database that stores signature patterns for multiple files, and file abbreviation information generated through block-specific verification and representative values for the original file composed of blocks having a predetermined size. As a way to verify Dividing the signature verification file into a plurality of blocks having a predetermined size as a signature verification file is input, and calculating a verification value and a representative value for each block, respectively; Retrieving a signature pattern corresponding to the signature verification file from the signature database; Extracting file abbreviation information of an original file corresponding to the signature verification file by searching the original file database; Estimating a signature location through comparison between the extracted file contraction information and the block-specific verification value and the representative value for the signature verification file; Verifying the retrieved signature pattern by comparing the estimated signature location with the retrieved signature pattern Signature pattern verification method comprising a. 28. The method of claim 27, The verification value for each block is a hash value or a CRC value. Signature pattern verification method. 28. The method of claim 27, The representative value for each block is an entropy value. Signature pattern verification method.

Images