KR101930293B1 - Apparatus and Method for Identifying Variety Malicious Code Using Static Analysis and Dynamic Analysis - Google Patents

Abstract

The malicious code identification method according to an embodiment of the present invention includes the steps of first classifying a plurality of incoming malicious codes into existing malicious codes or variant malicious codes through static analysis, Selecting at least one representative malicious code by dynamically analyzing the data of the first classified malicious code based on the first classified malicious code based on the first classified malicious code, And identifying the mutual relationship of the representative malicious code according to a predetermined reference value.

Description

TECHNICAL FIELD The present invention relates to an apparatus and method for identifying malicious codes using static analysis and dynamic analysis,

Technical field to which the embodiments of the present invention belong is an apparatus and method for identifying a malicious code, and more particularly, to an apparatus and method for identifying a malicious code using static analysis and static analysis.

Recently, as various services using computing have been provided to provide convenience of users, important information such as authorized certificates, card information, and login information have been frequently stored in computing devices, There is a growing interest and need for protection.

Malicious code (malicious code) is a generic term for all software that is designed to inflict damage on a computing device.

Conventional existing malicious code analysis techniques have been analyzed using dynamic analysis that identifies the malicious code's behavior by directly executing it in a static analysis or controllable virtual environment that uses code without actual execution of the malicious code.

However, static analysis or dynamic individual analysis has limitations depending on each method. Although the static analysis method has a low time cost, there are limitations to the variant malicious code and the dynamic analysis method is flexible to the variant malicious code, but the time cost is high.

Furthermore, as the malicious code identification technology evolves, the manufacturing technology of the malicious code maker becomes more sophisticated, so that there is a problem that it is difficult to identify the malicious code with the existing malicious code analysis technology.

Korean Patent Publication No. 10-2011-0124918 (published)

In order to solve the above problems, it is an object of the present invention to provide an apparatus and method for identifying malignant variant malicious codes of the present invention to identify origin of malignant variant malicious codes and to identify and identify malignant malignant codes faster and more accurately than conventional identification methods and methods using static or dynamic analysis. To be able to do so.

According to an aspect of the present invention, there is provided a method for identifying a malicious code, the method comprising: classifying a plurality of incoming malicious codes into an existing malicious code or a variant malicious code through static analysis; Classifying the existing malicious code classified in the primary classification on the basis of learning data learned in advance or selecting at least one representative malicious code through dynamic analysis of data on the primary classified malicious code, And distinguishing the existing classified malicious code and the representative malicious code from each other according to a predetermined reference value.

The method may further include merging the existing malicious code and the variant malicious code classified into the second group into a first group or creating a new second group according to the relationship identification result.

The method may further include updating the learning data by learning with the learning data for identifying the variant malicious code that is input using the integrated first group or the generated second group.

The step of identifying the relationship between the existing classified malicious code and the representative malicious code may further include identifying the relationship by calculating the similarity between the existing malicious code and the representative malicious code that are secondary classified according to a predetermined algorithm .

In addition, the step of integrating into the first group or generating the second group may be integrated into the first group or may be generated into the second group by comparing the calculated similarity and the reference value.

If the calculated similarity is greater than or equal to the reference value, the merging of the first group or the second group may include merging the existing classified malicious code and the variant malicious code into one group , And if the calculated similarity is smaller than the reference value, a new group for the representative malicious code can be generated.

The selecting of the at least one representative malicious code may include generating at least one variant clusters for clustering the first classified malicious codes according to a predetermined criterion, A representative malicious code can be selected.

In addition, the step of selecting the at least one representative malicious code may include selecting at least one centroid to generate the variant clusters, selecting center points for each of the selected variant clusters, Calculating a distance between the variant malicious codes, and selecting a variant code located at a distance closest to the center point according to the calculation result, as the representative malicious code.

The first sorting step may analyze the similarity between the plurality of incoming malicious codes and classify the malicious codes into existing malicious codes or malicious malicious codes according to the analysis result.

According to another embodiment of the present invention, there is provided an apparatus for discriminating malicious codes, comprising: a first classifying module for classifying a plurality of incoming malicious codes into existing malicious codes or variant malicious codes through static analysis; A secondary classification module for classifying the existing malicious code classified on the basis of previously learned learning data or selecting at least one representative malicious code through dynamic analysis of the data for the primary classified malicious code, And a relation distinguishing unit for calculating the similarity between the existing malicious code and the representative malicious code classified in the secondary classification according to a predetermined algorithm and identifying the mutual relationship based on the calculated similarity.

The apparatus may further include a group integration unit for merging the existing malicious code and the variant malicious code into a first group according to the relationship identification result, and a group generation unit for generating a new second group.

Further, the information processing apparatus may further include a map learning unit which learns, using the integrated first group or the generated second group, as the learning data for identifying the infected malicious code.

If the calculated degree of similarity is greater than or equal to the reference value, the group merging unit merges the existing malicious code and the variant malicious code, which are secondary classified, into one group, A new group for the representative malicious code can be generated.

In addition, the secondary classification module may generate at least one variant clusters for clustering data on the first-order variant malicious code according to a predetermined criterion, and generate representative malicious codes Can be selected.

The apparatus and method for identifying malicious codes according to the present invention can solve the problems according to the static and dynamic methods, and can further analyze malicious codes that are unknown to be introduced later by machine learning more accurately and flexibly There is an effect that can be.

1 is a block diagram schematically illustrating a configuration of a malicious code identification apparatus according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating a malicious code identification method according to an embodiment of the present invention, according to the flow of time.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. However, the present invention may be embodied in many different forms,

And the present invention is not limited to the illustrated embodiment. In order to clearly describe the present invention, parts that are not related to the description are omitted, and the same reference numerals in the drawings denote the same members.

Throughout the specification, when an element is referred to as "including" an element, it does not exclude other elements unless specifically stated to the contrary. The terms "part", "unit", "module", "block", and the like described in the specification mean units for processing at least one function or operation, And a combination of software.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

Hereinafter, the configuration of a malicious code identification apparatus according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. For example, the malicious code identification apparatus according to an embodiment of the present invention is preferably installed in an independent user device such as a computer. The malicious code identification apparatus of the present invention may be implemented in an application form installed in a user terminal.

1 is a block diagram schematically illustrating a configuration of a malicious code identification apparatus according to an embodiment of the present invention. 1, the malicious code identification apparatus of the present invention includes a primary classification module 110, a secondary classification module 120, a relationship identification unit 130, a group generation unit 141, a group integration unit 142, and a map learning unit 150. The malicious code identification device of the present invention further includes a download section for downloading a file from the outside or a web page source from a web server and a database for storing the executable file, And dynamically analyze and identify malicious code based on the analyzed data.

The present invention is a technology for detecting and identifying a case where an abnormal behavior occurs due to malicious intentional software (that is, malicious code) inside or outside an application program, This means that malicious code running outside of the application will access the unauthorized resources of the application in other code that is not related to the application.

The primary classification module 110 according to the embodiment of the present invention can classify a plurality of malicious codes flowing into the download section and the database into primary malicious code or malicious malicious code through static analysis. Here, the static analysis refers to analyzing computer software without performing any other operation. Generally, a method used for static analysis includes ssdeep for identifying a degree of similarity by hashing a binary on a block basis, packing used for malicious code a PeID for identifying whether or not the packet is packed, a commercial static analysis tool IDA Pro, and the like can be used. The malicious code identification device according to an embodiment of the present invention is a device for identifying a malicious code using ssdeep as a core, The method will be described.

The primary classification module 110 may analyze the similarity between the plurality of incoming malicious codes and classify the malicious codes into existing malicious codes or malicious malicious codes according to the analysis result. More specifically, it identifies the similarity between at least one malicious code that has been imported, and performs classification based on a preset threshold. For example, if the threshold value is 80% and the input ssdeep similarity degree between malicious code A and malicious code B is 81%, malicious code A and malicious code B can be classified into the same group.

However, in case of variant malicious code, obfuscation and packing are applied to existing malicious code, so it is difficult to classify malicious code into the same group as existing malicious code. That is, in case of variant malicious code, malicious code will form a single group containing only one. As described above, malicious codes forming a single group are determined as variant (new) malicious codes by performing primary classification through the primary classification module 110 of the present invention, and malicious codes not forming a single group are classified into a malicious code Code.

After classifying a plurality of malicious codes inputted from the primary classification module 110 into existing malicious code and variant malicious code, the secondary classification module 120 classifies the existing malicious code Code is classified into the second category, or at least one representative malicious code among the first classified malicious codes is selected through dynamic analysis.

As described above, the variant malicious code identification device of the present invention performs the primary classification using the static characteristics of the malicious codes inputted through the first classification module 110, thereby detecting the existing malicious code that can be identified and the non- Thereby minimizing the time cost that may occur in performing the dynamic analysis through the secondary classification module 120 by classifying the malicious code of variant.

The secondary classification module 120 according to an exemplary embodiment may further include a static analysis unit and a dynamic analysis unit, although it is not shown in the drawing. The static analysis unit performs a classification on the basis of learning data previously identified as a method of analyzing based on supervised learning. In the present invention, the static analysis unit classifies the classified data using the first classification module 110 Analysis is performed to label existing malicious codes that are first classified. In this case, the learning data refers to malicious code used as learning data, and a random forest and a decision tree can be used as classification algorithms used for static analysis.

The dynamic analysis unit is an analysis method based on unsupervised learning. The dynamic analysis unit performs analysis to classify the first-order classified malicious code through the first classification module 110. Unlike the existing malicious code, variant malicious code is obfuscated, so it is limited only by static features. Accordingly, the malicious code identified as the variant malicious code through the first classification module 110 is identified through the dynamic analysis of the dynamic analysis section.

More specifically, since the dynamic analysis unit according to the embodiment of the present invention is difficult to identify the learning data base based on the first-order classified malicious codes from the first classification module 110, the dynamic analysis unit may use the clustering algorithm Clusters the malicious codes of the first class. In one embodiment, the dynamic analysis unit generates k clusters based on random or prior knowledge, assigns the data to the clusters to minimize the variance of the distance difference from each cluster through the distance-based function, Clustering is repeated so that the degree of similarity within each of the generated clusters is maximized and the similarity between the different clusters is minimized.

More specifically, the dynamic analysis unit allocates the first-order variant malicious codes to the nearest center point among the k center points according to predetermined k center points. The dynamic analysis unit may assign the variant malicious codes to the respective center points, move each center point to the center of gravity of each of the clusters, and calculate a variant of the center point, Recalculate the distances to the malicious codes and assign each of the variant malicious codes to the closest cluster. At this time, the dynamic analysis unit does not perform this operation only once, but can be performed repeatedly until the form of the cluster does not change.

Next, in order to select a representative malicious code, the dynamic analysis unit extracts variant malicious codes that are closest to the center of each of the variant communities formed as described above. At this time, the representative malicious code may be selected as the variant malicious codes that are closest to the center point, and the representative malicious code selected in this way is used for identifying the relation with the existing malicious code classified by the static analysis unit. For example, a clustering algorithm is suitable for an algorithm used as a dynamic analysis unit, and for example, K-Means, Agglomerative Clustering, and the like can be utilized.

After classifying the existing malicious code and the variant malicious code through the static analysis unit and the dynamic analysis unit of the secondary classification module 120, the relation identification unit 130 according to the embodiment of the present invention classifies the malicious code and the malicious code according to a predetermined algorithm The mutual relationship can be identified by calculating the degree of similarity between the existing malicious code secondary classified from the secondary classification module 120 and the representative malicious code.

The relationship identifying unit 130 of the present invention utilizes both static and dynamic characteristics of malicious codes used as learning data to identify existing malicious code that has been imported, And the representative malicious code selected through the dynamic analysis unit. More specifically, the relationship identifying unit 130 according to an embodiment of the present invention identifies dynamic characteristics of existing malicious codes labeled through secondary classification through a static analysis unit using learning data. Accordingly, the degree of similarity between the existing malicious code classified in the secondary classified in which the dynamic characteristic is identified and the representative malicious code selected in the dynamic analysis unit is calculated. Here, the relation identifying unit 130 can identify the relationship by calculating the similarities between the two malicious codes using a clustering algorithm or a similarity comparison algorithm (e.g., cosine, correlation).

As described above, the variant malicious code identification apparatus according to the embodiment of the present invention can perform the static analysis using the pre-learned learning data of the first classification module 110 and classify the existing malicious code and the malicious code, The malicious code is recalculated through the static analysis unit and the dynamic analysis unit of the main classification module 120 and the relationship between the malicious codes finally classified through the relationship identification unit 130 is identified, It is possible to identify a group and to identify it faster and more accurately than a method using only a static analysis according to a conventional malicious code identification method or a method using only a dynamic analysis.

In accordance with the relationship identification result identified through the relation identifying unit 130, the group integrating unit 141 according to the embodiment of the present invention divides the existing classified malicious code and the variant malicious code into one 1 group, and the group generating unit 142 may generate a second group, which is a new group, in accordance with the relationship identification result.

In one embodiment, if the similarity calculated between the existing malicious code and the representative malicious code used as the relationship identification object through the relationship identification unit 130 is greater than or equal to a preset reference value, When the calculated similarity is smaller than the reference value, the group generating unit 142 generates a group of malicious codes by grouping the two malicious codes used for the relationship identification into one group by judging that the malicious code is derived from the existing malicious code. Generates a new group for the representative malicious code by considering the representative malicious code as a new malicious code distinguished from existing malicious codes and regards the representative malicious code as a new malicious code.

After the origins of the malicious codes flowing in accordance with the relationship identified through the relationship identifying unit 130 and the group integrating unit 141 and the group generating unit 142 are grasped, the map learning unit 150 according to the embodiment of the present invention ) Can use the information on the first group and the second group to be learned as learning data for identifying the variant malicious code that flows thereafter.

The map learning unit 150 of the present invention re-learns the labeled malicious code information including the static characteristic and the dynamic characteristic through the group integration unit 141 and the group generation unit 142, Data can be updated.

FIG. 2 is a flowchart illustrating a malicious code identification method according to an embodiment of the present invention, according to the flow of time.

Referring to FIG. 2, first, in step S200, the primary classification module 110 of the present invention performs a static analysis on a plurality of malicious codes into which the primary classification module 110 flows. More specifically, the first classification module 110 compares the incoming malicious codes with each other, calculates the similarities of at least two malicious codes that are compared and analyzed, and based on the calculated similarities, Classify malicious code into existing malicious code and variant malicious code. At this time, the primary classification module 110 determines that malicious code that can not be identified by the static analysis among the malicious codes that have been input is determined as a malicious code to which the mutation engine is applied so that it is difficult to identify the malicious code with the existing malicious code, Can be classified.

If the malicious codes inputted through the primary classification module 110 are subjected to the first classification with the existing malicious code and the variant malicious code in steps S200 and S201, (120) performs a static analysis based on supervised learning on the existing malicious codes classified in the first order and labels the malicious codes. More specifically, the secondary classification module 120 of the present invention identifies the existing classified primary malicious code by using the static characteristics of the learning data and the learning algorithm.

As another example, in step S230, malicious codes classified as malicious malicious codes through the first classification module 110 are subjected to dynamic analysis through the second classification module 120. FIG. In step S231, malicious codes classified as variant malicious codes are dynamically analyzed using at least one virtual machine, and identified using non-bad learning. That is, the first sorted malicious codes are clustered by forming k predetermined clusters according to the clustering algorithm through the adder machine (S232).

In step S233, the secondary classification module 120 of the present invention selects variant malicious codes representative of the respective clusters among the clustered malicious codes.

When the representative variant malicious code is selected, the relation identifying unit 130 according to the embodiment of the present invention loads the dynamic characteristic of the existing malicious code secondary classified from the secondary classification module using the learning data (S221).

Accordingly, in step S240, the relationship identifying unit 130 of the present invention identifies the relationship between the loaded primary classified malicious code and the selected representative malicious malicious code. That is, the relationship identifying unit 130 identifies the relationship between the existing malicious code and the representative malicious code (variant) by using the dynamic characteristics of the existing malicious code classified in the primary classification. In this case, The mutual relationship can be identified by calculating the degree of similarity between the existing malicious code secondary classified from the secondary classification module 120 and the representative malicious code.

The group integrating unit 142 of the present invention compares the calculated similarity with a preset reference value in order to calculate mutual similarity in S240, and if the similarity is greater than or equal to the reference value, The group generation unit 141 of the present invention compares the code (variant) and the existing malicious code into a first group as a group (S250). When the similarity is compared with the reference value and the calculated similarity is smaller than the reference value , It is determined that the representative malicious code (variant) is not a malicious code derived from the existing malicious code rotor, so that a second group, which is a new group for the representative malicious code, is generated (S251).

After the malicious codes are finally classified into groups through steps S250 and S251, the map learning unit 150 learns information of the first group and the second group in step S260, The learning data is updated so that it can be used to identify the malicious code that is entering.

When the steps S250 and S251 are completed, it is determined whether or not the malicious code identification analysis is to be continued. If the malicious code identification analysis is to proceed according to the determination result, the flow returns to step S200 in which a correction analysis is performed for the malicious code, If there is no malicious code, terminate it.

It is to be understood that the present invention is not limited to these embodiments, and all elements constituting the embodiment of the present invention described above are described as being combined or operated in one operation. That is, within the scope of the present invention, all of the components may be selectively coupled to one or more of them. In addition, although all of the components may be implemented as one independent hardware, some or all of the components may be selectively combined to perform a part or all of the functions in one or a plurality of hardware. As shown in FIG. In addition, such a computer program may be stored in a computer readable medium such as a USB memory, a CD disk, a flash memory, etc., and read and executed by a computer to implement an embodiment of the present invention. As the recording medium of the computer program, a magnetic recording medium, an optical recording medium, or the like can be included.

It will be apparent to those skilled in the art that various modifications, substitutions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims. will be. Therefore, the embodiments disclosed in the present invention and the accompanying drawings are intended to illustrate and not to limit the technical spirit of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments and the accompanying drawings . The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

Claims (15)

In a method for identifying a malicious code by a malicious code identification device,
Performing a static analysis on each of a plurality of malicious codes to be identified by the malicious code identification device, thereby classifying each malicious code into an existing malicious code or a variant malicious code;
Classifying the existing malicious code based on learning data previously learned for classification according to the static characteristics of the existing malicious code when each of the malicious codes is classified into the existing malicious code according to the primary classification, When each of the malicious codes is classified into the malicious codes according to the primary classification, the malicious codes classified into the malicious codes are clustering in consideration of the dynamic characteristics of the malicious codes classified as the malicious codes, ;
If at least one of the existing malicious code and malicious malicious code is secondary classified, the malicious code and the variant malicious code are classified into the secondary classified malicious code and the malicious code by considering the static characteristic and the dynamic characteristic of the secondary malicious code and the variant malicious code, Identifying a relationship between the secondary malicious code and the variant malicious code by comparing the calculated similarity with a preset reference value;
The malicious code identification method comprising: The method according to claim 1,
Integrating the secondarily sorted variant malicious code into the first group to which the existing malicious code belongs secondary belongs according to the relationship identification result or generating the second classified malicious code as a new second group Including more variant malware identification methods. 3. The method of claim 2,
By using the integrated first group or the generated second group to learn with the learning data for identifying the variant malicious code flowing into the first group or after the generation of the second group, Further comprising the step of updating the learning data. delete delete 3. The method of claim 2,
The step of integrating into the first group or creating the second group comprises:
If the calculated degree of similarity is greater than or equal to the reference value, integrating the existing malicious code and the variant malicious code into the first group,
And if the calculated degree of similarity is smaller than the reference value, generating the second group for the variant malicious code. The method according to claim 1,
The second classifying the variant malicious code includes:
Generating at least one variant cluster by performing clustering on malicious codes classified as the variant malicious code; And
Selecting a representative malicious code representative of the at least one variant community;
Further comprising the steps of: 8. The method of claim 7,
The step of selecting the representative malicious code includes:
Selecting a centroid of the at least one variant population;
Calculating a distance between a center point of the generated variant cluster and at least one variant malicious code belonging to the variant cluster; And
Selecting a variant code located at a distance closest to the center point as the representative malicious code according to the calculation result;
Further comprising the steps of: The method according to claim 1,
Wherein the primary classification comprises:
And analyzing the similarities among the plurality of malicious codes to be identified and classifying the malicious codes into existing malicious codes or malicious malicious codes according to the analysis result. A first classifying module for performing a static analysis on each of a plurality of malicious codes to be identified, thereby first classifying each of the malicious codes into an existing malicious code or a variant malicious code;
Classifying the existing malicious code based on learning data previously learned for classification according to the characteristics of the existing malicious code when each of the malicious codes is classified into the existing malicious code according to the primary classification, When each of the malicious codes is classified into the malicious code according to the first classification, the malicious code classified as the malicious code is clustering in consideration of the characteristics of the malicious code classified as the malicious code, Car classification module; And
If at least one of the existing malicious code and malicious malicious code is secondary classified, the malicious code and the variant malicious code are classified into the secondary classified malicious code and the malicious code by considering the static characteristic and the dynamic characteristic of the secondary malicious code and the variant malicious code, A relation distinguishing unit for calculating the similarity of the variant malicious code and comparing the calculated similarity with the preset reference value to identify the relationship between the existing classified malicious code and the variant malicious code;
The malicious code identification device comprising: 11. The method of claim 10,
A group merging unit for merging the secondarily sorted variant malicious code into the first group to which the existing malignant code belongs, according to the relationship identification result; and a second group And a group generating unit for generating the malicious code. 12. The method of claim 11,
A map for learning as the learning data for identifying the variant malicious code flowing into the first group or after the generation of the second group by using the integrated first group or the generated second group And further comprising a learning unit. 12. The method of claim 11,
If the calculated similarity degree is greater than or equal to the reference value, the group merging unit merges the existing malicious code and the variant malicious code classified in the secondary classification into the first group, Value, the second group for the variant malicious code is generated. 11. The apparatus of claim 10, wherein the secondary classification module comprises:
Generating at least one variant cluster by performing clustering on malicious codes classified as the variant malicious code, and selecting a representative malicious code representative of the at least one variant cluster. A computer program stored on a computer readable medium for causing a computer to carry out a method of identifying variant malicious codes according to any one of claims 1 to 3 and 6 to 9.

Images