Abstract:
There is provided a system and method for detecting unknown malicious code by analyzing kernel based system actions. More particularly, the system and method provides an advantage of actively countering unknown malicious code or viruses by monitoring kernel based system events in real time, organizing action data based on the collected event data, determining whether the action data corresponds to predetermined malicious actions, backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action, and processing the malicious action.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims the priority of Korean Patent Application No. 10-2008-0136230 filed on Dec. 30, 2008, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein by reference. 
       BACKGROUND OF THE INVENTION 
       [0002]    1. Field of the Invention 
         [0003]    The present invention relates to a system and method for detecting unknown malicious code by analyzing kernel based system actions, and more particularly, to a system and method for actively countering unknown malicious code or viruses by monitoring kernel based system events in real time, organizing action data based on the collected event data, determining whether the action data corresponds to predetermined malicious actions, backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action, and processing the malicious action. 
         [0004]    2. Description of the Related Art 
         [0005]    The detection of malicious code or viruses has usually been performed based on files. According to the related art, the extraction of the characteristics of all known malicious code files, such as patterns or hash values, and their storage in a malicious code database have been required in order to detect malicious code. After extracting the characteristics of all files present in a system, the extracted characteristics of those files have been compared with malicious action data stored in the malicious code database. If the characteristics of files present in the system correspond with those stored in the malicious code database, these corresponding system files have been determined to be malicious code. 
         [0006]    According to the related art as above, there is an advantage in that when the characteristics of malicious code files are stored in the malicious code database, corresponding malicious code can be detected rapidly and accurately. However, when the characteristics of malicious code files are not stored in the malicious code database, that is, in a case of unknown malicious code, it is impossible to detect the unknown malicious code. Although malicious code may have been identified, when the known malicious code is mutated, even though it may cause the same detrimental effects, it is difficult to detect it. 
         [0007]    Also, according to the related art, since the individual inspection of all files present in the system has been required to detect malicious code, the time taken to detect malicious code is lengthened. 
         [0008]    Particularly, in the case of malicious code, such as bots, which may produce 4000 or more mutative codes in a single day, the collection of samples of all mutative malicious code files and the individual extraction of the characteristics of these malicious code files from the samples are required. Therefore, memory efficiency and detection rates deteriorate. 
       SUMMARY OF THE INVENTION 
       [0009]    An aspect of the present invention provides a system and method for actively countering unknown malicious code or viruses, by monitoring kernel based system events in real time, organizing action data based on the collected event data, determining whether the action data corresponds to predetermined malicious actions, backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action, and processing the malicious action. 
         [0010]    According to an aspect of the present invention, there is provided a system for detecting unknown malicious code by analyzing kernel based system actions, the system including: a monitoring driver installed at a kernel level, monitoring kernel based system events in real time, and collecting event data; and a malicious code detecting and processing unit organizing action data based on the event data collected by the monitoring driver, determining whether the action data corresponds to predetermined malicious actions, backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action, and processing the malicious action. 
         [0011]    The monitoring driver may include at least one of a process monitoring driver monitoring process-related events, a file monitoring driver monitoring file-related events, a registry monitoring driver monitoring registry-related events, a network monitoring driver monitoring network-related events, and a system monitoring driver monitoring system-related events other than process, file, registry and network-related events. 
         [0012]    The system monitoring driver may monitor a ReadVirtualMemory or WriteVirtualMemory system call event. 
         [0013]    The system for detecting unknown malicious code by analyzing kernel based system actions may further include a malicious action database having predetermined malicious action data stored therein. 
         [0014]    The malicious code detecting and processing unit may include an action data organizing module organizing action data based on the event data collected by the monitoring driver, a malicious action determining module comparing the action data with malicious action data stored in the malicious action database and determining whether the action data corresponds to malicious actions, and a malicious action processing module backtracking a subject of a malicious action that is determined by the malicious action determining module and processing the malicious action. 
         [0015]    The malicious action processing module may perform at least one of a blocking of the malicious action, a forced termination of the subject of the malicious action, a deletion of a file causing the malicious action, and a notification of a user. 
         [0016]    According to another aspect of the present invention, there is provided a method of detecting unknown malicious code by analyzing kernel based system actions, the method including: monitoring kernel based system events in real time; organizing action data based on the collected event data; determining whether the action data corresponds to predetermined malicious actions; backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action; and processing the malicious action. 
         [0017]    The monitoring of the kernel-based system events may be performed for at least one of process-related events, file-related events, registry-related events, network-related events, and system-related events other than process, file, registry and network-related events. 
         [0018]    The processing of the malicious action may include performing at least one of a blocking of the malicious action, a forced termination of the subject of the malicious action, a deletion of a file causing the malicious action, and a notification of a user. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0019]    The above and other aspects, features and other advantages of the present invention will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings, in which: 
           [0020]      FIG. 1  is a block diagram illustrating a system for detecting unknown malicious code by analyzing kernel based system actions according to an exemplary embodiment of the present invention; and 
           [0021]      FIG. 2  is a flowchart illustrating the detection process of unknown malicious code by analyzing kernel based system actions according to another exemplary embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0022]    Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. However, detailed descriptions related to well-known functions or configurations will be ruled out in order not to unnecessarily obscure subject matters of the present invention. Also, the same reference numerals will be used throughout the drawings to refer to the same or like parts. 
         [0023]    Moreover, throughout the specification, when one part is specified as being connected to another part, this includes not only a “direct connection,” but also an “indirect connection,” that is, they may be indirectly connected, with an intervening part therebetween. In addition, unless explicitly described to the contrary, the word “include” and variations such as “includes” or “including,” will be understood to imply the inclusion of stated elements but not the exclusion of any other elements. 
         [0024]    Furthermore, the term “module” defines a unit that performs a particular function or operation, and this can be realized by hardware components, software components, or the combination of hardware and software components. 
         [0025]      FIG. 1  is a block diagram illustrating a system for detecting unknown malicious code by analyzing kernel based system actions according to an exemplary embodiment of the present invention. The system for detecting the unknown malicious code includes a monitoring driver  10 , a malicious code detecting and processing unit  20 , and a malicious action database  30 . 
         [0026]    The monitoring driver  10  is installed at a kernel level, collects event data by monitoring various events occurring in a system in real time, and transfers the collected event data to the malicious code detecting and processing unit  20 . 
         [0027]    The monitoring driver  10  may include at least one of a process monitoring driver  11  monitoring process-related events, a file monitoring driver  12  monitoring file-related events, a registry monitoring driver  13  monitoring registry-related events, a network monitoring driver  14  monitoring network-related events, and a system monitoring driver  15  monitoring system-related events other than process, file, registry and network-related events. Here, these respective drivers operate independently of one another. 
         [0028]    Specifically, the system monitoring driver  15  may be configured to monitor system call events which are performed inside a kernel for operating a computer system. For example, ReadVirtualMemory is a system call used when one process A tries to read the memory of another process B. Since ReadVirtualMemory is a system internal function that is called when malicious code tries to discover the operating state of other anti-virus solutions, it may be an object to be monitored. Also, WriteVirtualMemory is a system call used when one process A tries to write in the memory of another process B. Since WriteVirtualMemory is a system internal function that is called when trying to record desired values in the memory of another process that malicious code tries to attack, it may be an object to be monitored. 
         [0029]    The malicious code detecting and processing unit  20  receives the event data collected by the monitoring driver  10 , organizes action data based on the received event data, determines whether the action data corresponds to predetermined malicious actions, backtracks the subject of a malicious action when the action data is determined to correspond to the malicious action, and processes the malicious action. The malicious code detecting and processing unit  20  may include an action data organizing module  21 , a malicious action determining module  22 , and a malicious action processing module  23 . 
         [0030]    The action data organizing module  21  organizes action data based on the event data received from the monitoring driver  10 . Here, the action data may include event types, event contents, and data. The following Tables 1 to 5 represent concrete examples of action data organized based on process-related events, file-related events, registry-related events, network-related events, and system-related events other than process, file, registry and network-related events, respectively. 
         [0000]    
       
         
               
               
               
               
             
           
               
                   
                 TABLE 1 
               
               
                   
                   
               
               
                   
                 Event Type 
                 Event Contents 
                 Data 
               
               
                   
                   
               
             
             
               
                   
                 Process 
                 Creation 
                 Process Route Information 
               
               
                   
                 Process 
                 Termination 
                 Process Route Information 
               
               
                   
                   
               
             
          
         
       
     
         [0000]    
       
         
               
               
               
               
             
           
               
                   
                 TABLE 2 
               
               
                   
                   
               
               
                   
                 Event Type 
                 Event Contents 
                 Data 
               
               
                   
                   
               
             
             
               
                   
                 File 
                 Creation 
                 File Path Information 
               
               
                   
                 File 
                 Writing 
                 File Path Information 
               
               
                   
                 File 
                 Deletion 
                 File Path Information 
               
               
                   
                 File 
                 Revision 
                 File Path Information 
               
               
                   
                   
               
             
          
         
       
     
         [0000]    
       
         
               
               
               
               
             
           
               
                   
                 TABLE 3 
               
               
                   
                   
               
               
                   
                 Event Type 
                 Event Contents 
                 Data 
               
               
                   
                   
               
             
             
               
                   
                 Registry 
                 Key Creation 
                 Registry Key Path 
               
               
                   
                   
                   
                 Information 
               
               
                   
                 Registry 
                 Key Deletion 
                 Registry Key Path 
               
               
                   
                   
                   
                 Information 
               
               
                   
                 Registry 
                 Key Value 
                 Registry Key value 
               
               
                   
                   
                 Creation 
                 Information 
               
               
                   
                 Registry 
                 Key value 
                 Registry Key value 
               
               
                   
                   
                 Deletion 
                 Information 
               
               
                   
                   
               
             
          
         
       
     
         [0000]    
       
         
               
               
               
             
           
               
                 TABLE 4 
               
               
                   
               
               
                 Event Type 
                 Event Contents 
                 Data 
               
               
                   
               
             
             
               
                 Network 
                 DNS 
                 DNS Request Information (DNS 
               
               
                   
                   
                 Address) 
               
               
                 Network 
                 HTTP 
                 HTTP Request Information 
               
               
                   
                   
                 (Web Server Address, Request 
               
               
                   
                   
                 Data) 
               
               
                 Network 
                 Socket 
                 Socket Creation Information 
               
               
                   
                   
                 (Protocol, IP, Port) 
               
               
                   
               
             
          
         
       
     
         [0000]    
       
         
               
               
               
             
           
               
                 TABLE 5 
               
               
                   
               
               
                 Event Type 
                 Event Contents 
                 Data 
               
               
                   
               
             
             
               
                 ReadVirtualMemory 
                 System Call Calling 
                 Respective Function 
               
               
                   
                   
                 Calling Information 
               
               
                 WriteVirtualMemory 
                 System Call Calling 
                 Respective Function 
               
               
                   
                   
                 Calling Information 
               
               
                 LoadLibrary 
                 System Call Calling 
                 Respective Function 
               
               
                   
                   
                 Calling Information 
               
               
                   
               
             
          
         
       
     
         [0031]    The action data organized as shown in Tables 1 to 5 by the action data organizing module  21  may be stored in a kernel memory and deleted as soon as the analysis of the malicious action determining module  22  is completed. 
         [0032]    The malicious action determining module  22  determines whether the action data formed by the action data organizing module  21  corresponds to predetermined malicious actions, that is, malicious actions predetermined in the malicious action database  30 . For this, the malicious action determining module  22  reads malicious action data which is stored in the malicious action database  30  and determines whether the action data includes data corresponding to the malicious action data. 
         [0033]    When it is determined by the malicious action determining module  22  that the action data corresponds to a malicious action, the malicious action processing module  23  backtracks the subject of the determined malicious action and processes the determined malicious action. 
         [0034]    Specifically, the malicious action processing module  23  is able to detect the subject of the malicious action from a process ID included in the action data. When the subject of the malicious action is detected, the malicious action processing module  23  is able to properly respond to the detection of malicious code by countermeasures such as the blocking of the malicious action, the forced termination of the subject (for example, a process or operating module) of the malicious action, the deletion of a corresponding file causing the malicious action, and the notification of a user. 
         [0035]    The malicious action database  30  has predetermined malicious action data stored therein. Here, malicious actions are defined by standardizing actions that various malicious code or viruses commonly undertake, and the malicious action data is written based on kernel-based system events which occur when malicious code or viruses are actually running. Therefore, the malicious action data may have the same organization as the action data presented in Tables 1 to 5. Also, the malicious action data may be encoded so as to have a form which is not recognized by common users. 
         [0036]      FIG. 2  is a flowchart illustrating the detection process of unknown malicious code by analyzing kernel-based system actions according to another exemplary embodiment of the present invention. 
         [0037]    First of all, various events occurring at a kernel level of a system are monitored in real time in operation S 10 . At this time, such monitoring is performed for at least one of process-related events, file-related events, registry-related events, network-related events, and system-related events other than process, file, registry and network-related events. 
         [0038]    When an event occurs in operation S 20 , event data is collected in operation S 30  and action data is organized based on the collected event data in operation  40 . At this time, the organization of the action data is same as described above, so a detailed description thereof will be omitted. 
         [0039]    Then, it is determined whether the action data organized based on the event data corresponds to predetermined malicious actions in operation S 50 . When it is determined that the action data corresponds to a malicious action, the subject of the determined malicious action is backtracked and processed in operation S 60 . 
         [0040]    Specifically, the subject of the malicious action is detected by using a process ID included in the action data. When the subject of the malicious action is detected, it is able to properly cope with the detection of malicious code by taking countermeasures such as the blocking of the malicious action, the forced termination of the subject (for example, a process or operating module) of the malicious action, the deletion of a corresponding file causing the malicious action, and the notification of a user. 
         [0041]    As set forth above, according to exemplary embodiments of the present invention, a process or module causing malicious actions can be detected by organizing the action data based on the event data collected by monitoring the system events at the kernel level in real time, and then determining whether the action data corresponds to the predetermined malicious actions. 
         [0042]    Therefore, if malicious actions are predetermined in detail, even though the characteristics of individual malicious code files, such as patterns or hash values, are not stored, malicious code causing malicious actions can be detected. This then ensures that neither the collection of samples of individual mutative malicious code files whenever mutative malicious code is generated nor the extraction of the characteristics of those malicious code files from the samples are required, whereby unknown malicious code or viruses can be actively countered. 
         [0043]    While the present invention has been shown and described in connection with the exemplary embodiments, it will be apparent to those skilled in the art that modifications and variations can be made without departing from the spirit and scope of the invention as defined by the appended claims.