Apparatus, system and method for detecting malicious code

• US 8,955,124 B2
• Filed: 01/05/2011
• Issued: 02/10/2015
• Est. Priority Date: 04/28/2010
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Yo Sik, Noh, Sang Kyun, Chung, Yoon Jung, Kim, Dong Soo, Kim, Won Ho, Han, Yu Jung, Yun, Young Tae, Sohn, Ki Wook, Lee, Cheol Won
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): TURCHEN, JAMES R
• Application Number:
  US12/985,252
• Publication Number:
  US 20110271343A1
• Time in Patent Office: 1,497 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Provided are an apparatus, system and method for detecting malicious code inserted into a normal process in disguise. The apparatus includes a malicious code detection module for extracting information on a thread generated by a process running on a computer system to identify code related to the thread, preliminarily determining whether or not the identified code is malicious and extracting the code preliminarily determined to be malicious; and a forcible malicious code termination module for finally determining the code as malicious code based on an analysis result of behavior of the extracted code executed in a virtual environment and forcibly terminating execution of the code.

Claims

1. An apparatus executed on one or more hardware processors for detecting malicious code, comprising:

a malicious code detection module loaded on said one or more hardware processors for extracting information on a thread generated by a process running on a computer system to identify code related to the thread, preliminarily determining whether or not the identified code is malicious and extracting the code preliminarily determined to be malicious, wherein the malicious code detection module checks whether a string of a file name corresponding to the code related to the thread is present in a virtual memory of the process having generated the thread, and preliminarily determines the code to be malicious when the string is present; and

a forcible malicious code termination module loaded on said one or more hardware processors for finally determining the code as malicious code based on an analysis result of behavior of the extracted code executed in a virtual environment and forcibly terminating execution of the code;

wherein when no code related to the thread is identified, the malicious code detection module traces a thread stack to obtain a list of dynamic link libraries (DLLs) being used by the thread, and examines a portable executable (PE) feature of the DLLs to preliminarily determine whether or not the DLLs are malicious.

2. The apparatus of claim 1, wherein the code related to the thread is an execution file or a dynamic link library (DLL).

3. The apparatus of claim 1, wherein the malicious code detection module preliminarily determines whether or not the identified code is malicious by checking at least one of a virtual memory of the process, a portable executable (PE) feature of the identified code, a service attribute of the identified code, and a thread stack.

4. The apparatus of claim 1, wherein the malicious code detection module extracts a list of processes running on the computer system and information, on threads generated by the respective processes to extract the thread information.

5. The apparatus of claim 1, wherein the malicious code detection portable executable (PE) feature of the identified code, and preliminarily determines the code to be malicious when an unknown section is present.

6. The apparatus of claim 1, wherein the malicious code detection module examines a portable executable (PE) feature of the identified code, and preliminarily determines the code to be malicious when a checksum is not correct, or a file size in the PE feature is different from a file size shown in an explorer.

7. The apparatus of claim 1, wherein the malicious code detection module examines an attribute of a service performed by the identified code, and preliminarily determines the code to be malicious when the service has neither a relationship with nor dependency on another service, or automatic start is set for the service.

8. The apparatus of claim 1, wherein when the analysis result of behavior corresponds to one of behavior of disabling an operating system (OS) firewall or vaccine, a virtual environment recognition behavior, and behavior of generating or modifying a file or registry, the forcible malicious code termination module finally determines the code as malicious code.

9. A system including one or more hardware processors for detecting malicious code, comprising:

a malicious code detection apparatus comprising a malicious code detection module loaded on said one or more hardware processors for extracting information on a thread generated by a process running on a computer system to identify code related to the thread, preliminarily determining whether or not the identified code is malicious and extracting code preliminarily determined to be malicious, wherein the malicious code detection module checks whether a string of a file name corresponding to the code related to the thread is present in a virtual memory of the process having generated the thread, and preliminarily determines the code to be malicious when the string is present; and

a forcible malicious code termination module loaded on said one or more hardware processors for finally determining the code as malicious based on an analysis result of behavior of the extracted code executed in a virtual environment and forcibly terminating execution of the code; and

a virtual environment malicious code behavior analysis apparatus having a tog generation module for executing the code extracted by the malicious code detection module in a virtual environment to generate a behavior log for the code, and a malicious behavior analysis module for analyzing whether the behavior of the code corresponds to one of behavior of disabling an operating system (OS) firewall or vaccine, a virtual environment recognition behavior, and behavior of generating or modifying a file or registry using the log and transferring the analysis result to the forcible malicious code termination module;

wherein when no code related to the thread is identified, the malicious code detection module traces a thread stack to obtain a list of dynamic link libraries (DLLs) being used by the thread, and examines a portable executable (PE) feature of the DLLs to preliminarily determine whether or not the DLLs are malicious.

10. The system according to claim 9, wherein the malicious code detection apparatus operates in a client, and the virtual environment malicious code behavior analysis apparatus operates in a server.

11. The system according to claim 10, wherein the malicious code detection module requests the virtual environment malicious code behavior analysis apparatus to analyze behavior of the extracted code in the virtual environment.

12. A method of detecting malicious code, comprising:

extracting a list of processes running on a computer system and information on a thread subordinate to each process;

identifying code related to the thread, and preliminarily determining whether or not the identified code is malicious by examining at least one of a virtual memory of the process, a portable executable (PE) feature of the code, a relationship between the code and a service process, and a thread stack, wherein the malicious code detection module checks whether a string of a file name corresponding to the code related to the thread is present in a virtual memory of the process having generated the thread, and preliminarily determines the code to be malicious when the string is present;

calculating a degree of malicious threat of the code preliminarily determined to be malicious;

extracting code whose calculated degree of malicious threat is a threshold value or more, and requesting a virtual environment malicious code behavior analysis apparatus to analyze the code;

finally determining the code as malicious code on the basis of an analysis result received from the virtual environment malicious code behavior analysis apparatus; and

forcibly terminating execution of the code finally determined to be malicious code;

wherein when no code related to the thread is identified, tracing a thread stack to obtain a list of dynamic link libraries (DLLs) being used by the thread, and examining a portable executable (PE) feature of the DLLs to preliminarily determine whether or not the DLLs are malicious.

13. The method of claim 12, wherein finally determining the code as malicious code includes determining the code as malicious code when the analysis result of the virtual environment malicious code behavior analysis apparatus corresponds to one of behavior if disabling an operating system (OS) firewall or vaccine, a virtual environment recognition behavior, and behavior of generating or modifying a file or registry.