Apparatus and method for detecting malicious process

[0001] This application claims priority to and the benefit of Korean Patent Application No. 2007-0090906, filed Sep. 7, 2007, the disclosure of which is incorporated herein by reference in its entirety.

[0002] 1. Field of the Invention

[0003] The present invention relates to an apparatus and method for detecting a malicious process and, more particularly, to an apparatus and method for detecting a malicious process which can monitor not only a target process but also child processes generated by the target process so as to detect malicious behavior generating a malicious process from a normal process.

[0004] 2. Discussion of Related Art

[0005] In recent years, programs such as MS Office Word, MS Office PowerPoint, MS Office Excel, Hangul, and MS Windows Media Player, which support specific extensions frequently used in the computing environment, have frequently been attacked by executing arbitrary codes hidden in files using weak points of the programs. In this technique, when a file in which a malicious code is hidden is propagated via an e-mail or messenger, a user has only to execute the file using the corresponding program to execute the malicious program. Therefore, it is hard for a common user to become aware of an attack against the program, and the attack detrimentally affects the corresponding system.

[0006] Although many conventional methods have been tried in attempts to prevent the execution of malicious processes, most of them may only be effective when the malicious processes are executed by supporting specific macro modes.

[0007] The present invention is directed to a method and apparatus for detecting a malicious process.

[0008] Also, the present invention is directed to an apparatus and method for detecting a malicious process in which malicious behavior to generate a malicious process is detected from a normal process on the basis of a time required for generating file of child process which is generated by target process

[0009] One aspect of the present invention provides an apparatus for detecting a malicious process. The apparatus includes: a process monitoring unit for monitoring a process generated in a computing environment; a target process setting unit for previously setting a test target process among the processes confirmed by the process monitoring unit; a file generation time change monitoring unit for monitoring if the target process set by the target process setting unit requests to change a file generation time; a file generation time change preventing unit for preventing a change in the file generation time of the target process when the target process requests to change the file generation time; and a malicious process detecting unit for determining that a child process of the target process set by the target process setting unit is a malicious process if the child process generates a file within a predetermined reference time.

[0010] The apparatus may further include: a forced termination unit for forcibly terminating the child process determined as the malicious process by the malicious process detecting unit; and a result output unit for outputting a determination result of the malicious process detecting unit. The target process set by the target process setting unit executes a previously monitored target file. The file generation time change monitoring unit monitors if the target process calls an Application Program Interface (API) required for changing the file generation time. The file generation time change preventing unit provides a substitution function stored therein instead of the API called by the target process to prevent the change in the file generation time of the target process. The child process is generated by the target process set by the target process setting unit. When the malicious process detecting unit determines that the child process is not a malicious process, the target process setting unit sets the child process as a target process.

[0011] Another aspect of the present invention provides a method for detecting a malicious process. The method includes: Monitoring if a process generated in a computing environment is a child process of a preset target process; and recognizing the generated process as a malicious process when the process monitored to be the child process generates a file within a predetermined reference time.

[0012] The method may further include: The preset target process executes a previously monitored targeted file. The child process is generated by the preset target process. Monitoring if the generated process calls an Application Program Interface (API) required for changing a file generation time and providing a substitution function instead of the API when the generated process is the preset target process. Registering the generated process as a target process when the process monitored to be the child process generates the file longer than the predetermined reference file Forcibly terminating the process recognized as the malicious process.

[0019] Hereinafter, exemplary embodiments of the present invention will be described in detail. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms. The following embodiments are described in order to enable those of ordinary skill in the art to embody and practice the present invention.

[0020] FIG. 1 is a schematic diagram showing a difference between a conventional method for detecting a malicious process and a method for detecting a malicious process according to an exemplary embodiment of the present invention.

[0021] Referring to FIG. 1, reference numerals 101 and 103 are used to describe a conventional method for detecting a malicious process.

[0022] Referring to FIG. 1, assuming that there is a test target process 101, a conventional method for detecting a malicious process is aimed at searching for only a malicious process from the target process 101 and removing the same. Thus, when the test target process 101 is normally executed to generate a child process and the child process is executed to generate subordinate child processes 103 again, the child processes 103 are not tested. In particular, when a target process is a specific general-use program, for example, MS Office Word or Haansoft Hangul, there is a conventional method for detecting a child process executed using macros included in the specific program. However, there is no way to detect malicious processes from subordinate child processes generated in nonspecific ways.

[0023] By comparison, according to the present invention, assuming that there is a test target process 111, it is possible to test all generated child processes 113 during normal execution of the target process 111.

[0024] In the present invention, when the child process 113 is generated, it is determined if the child process 113 is normal. Also, when the child process 113 is determined to be normal, the child process 113 is also set as a target process (refer to 115) so that subordinate child processes generated by executing the child process 113 can be tested.

[0025] Therefore, when the target process 111 is executed to generate the child process 113 and the child process 113 is executed to generate subordinate child processes, even if any malicious process is generated, the method according to the present invention can deal with the malicious process.

[0026] FIG. 2 is a block diagram of an apparatus for detecting a malicious process according to an exemplary embodiment of the present invention.

[0027] Referring to FIG. 2, the apparatus for detecting the malicious process includes a user interface 201 and a malicious process detector 210. The malicious process detector 210 includes a target process setting unit 211, a process monitoring unit 213, a file generation time change monitoring unit 215, a file generation time change preventing unit 217, a malicious process detecting unit 219, a result output unit 221, and a forced termination unit 223.

[0028] When a user tries detecting a malicious process using a method or apparatus according to the present invention in the computing environment, the user interface 201 functions to easily describe or express the method or apparatus to offer convenience to the user. Thus, the user interface 201 allows the user to properly use the method or apparatus according to the present invention using a graphic user interface or other environments.

[0029] The malicious process detector 210, which is an essential component in the apparatus according to the present invention, receives a command from the user in the user interface 201, actually detects a malicious process, and removes the malicious process.

[0030] The target process setting unit 211 stores a target process, which is set by the user or a manufacturer to be likely to include a malicious process, and sets added target process during a process of detecting a malicious process according to the present invention. The target process setting unit 211 sets a process of processing test target files as a target process in order to set the test target files and execute the set test target files. For example, when MS Office Excel is set as a target process, files with extension .xls are set, and a process of processing the Excel files is set as a target process.

[0031] Also, when the target process generated a child process, even the child process may be set as a target process if specific requirements are fulfilled. The specific requirements will be described in detail with reference to the drawings later.

[0032] The process monitoring unit 213 monitors a process executed in the computing environment to which the present invention is applied. The process monitoring unit 213 monitors a process executed in the corresponding environment to monitor if the process set by the target process setting unit 211 is generated and executed.

[0033] When the target process set by the target process setting unit 211 is executed among processes monitored by the process monitoring unit 213, the file generation time change monitoring unit 215 monitors if the executed process attempts to change an execution time thereof.

[0034] The file generation time change monitoring unit 215 senses the attempt of the target process to change the generation time in response to a call signal when the target process calls a related Application Program Interface (API) to change the generation time.

[0035] The file generation time change preventing unit 217 is enabled when the file generation time change monitoring unit 215 senses the attempt of the target process to change the generation time. Specifically, when the target process tries calling the related API to change the generation time, the file generation time change preventing unit 217 provides a substitution function stored therein instead of the API to cripple the attempt of the target process to change the generation time.

[0036] When a process detected by the process monitoring unit 213 is a child process of the target process set by the target process setting unit 211, the malicious process detecting unit 219 determines if the child process is a malicious process, based on the file generation time of the child process. Since the malicious process detecting unit 219 makes a decision based on the file generation time, when the malicious process changes its generation time, it is difficult to detect the malicious process. Accordingly, the above-described file generation time change monitoring unit 215 and file generation time change prevention unit 217 are required to prevent the process from changing its generation time.

[0037] The forced termination unit 223 forcibly terminates the execution of the child process that is determined as the malicious process by the malicious process detecting unit 219. Thus, the forced termination unit 223 substantially inhibits the execution of the malicious process.

[0038] The result output unit 221 displays the result of the processing of the malicious process via the user interface 201 to allow a user to confirm the result.

[0039] FIG. 3 is a flowchart illustrating a method for determining a target process for detecting a malicious process according to the present invention.

[0040] Referring to FIG. 3, a malicious process detection program according to the present invention is executed in step 301. Then, a target process that is preset by the program is loaded and set in step 303, and the target process is monitored in a computing apparatus in step 305.

[0041] In this case, when it is detected that a child process of the set target process is generated in step 307, it is determined if the generated child process is a malicious process. Thus, when it is determined that the child process is not the malicious process, the child process is automatically set as a monitoring target process in step 309.

[0042] In the method shown in FIG. 3, the child process of the target process is automatically set during the detection of the malicious process. Thus, even if the generation of subordinate child processes of the target process is repeated several times, it is still possible to monitor all the subordinate child processes.

[0043] However, the target process itself may be designated by a user before execution or set by a manufacturer during the manufacturing process. Of course, a list of target processes may be periodically updated via the Internet in the same manner as ordinary vaccine programs.

[0044] FIG. 4 is a flowchart illustrating a method for determining a malicious process according to the present invention.

[0045] Referring to FIG. 4, a program according to the present invention is executed in step 401. Then, as described with reference to FIG. 3, a target process is set, the monitoring of the target process is started among processes executed in the computing environment in step 403. In this case, a target process is generated in step 407. When the target process attempts to change its file generation time, a substitution function is called instead of API in order to prevent a change in the file generation time in step 411.

[0046] When a child process of the target process is generated in step 405, it is determined if the child process is a malicious process based on a generation of a file of the child process in step 409. In this case, the file generation time of the file of the child process by which the malicious process is determined may be variously set. In the current embodiment of the present invention, it is assumed that when 1 minute is taken to generate the file of the child process, the child process is determined as a malicious process.

[0047] Thereafter, when the generated child process is determined as the malicious process, the child process is forcibly terminated in step 413 to preclude the execution of the malicious process.

[0048] FIG. 5 is a flowchart illustrating a method for detecting a malicious process according to an exemplary embodiment of the present invention.

[0049] Referring to FIG. 5, an apparatus for detecting a malicious process according to the present invention starts to operate in step 501.

[0050] Then, a preset target process is registered as a monitoring target process in step 503. The apparatus according to the present invention continues to monitor the monitoring target process to see if new processes are generated or not.

[0051] In this case, when generation of a new process is sensed during the execution of the apparatus according to the present invention in step 505, it is determined if the generated process is the preset target process in step 507. However, when any new process is not generated, the apparatus according to the present invention continues to monitor if a new process is generated.

[0052] When it is determined that the generated process is the preset target process, it is determined if the target process attempts to change a file generation time in step 509. When it is determined that the target process attempts to change the file generation time, a substitution function included in the apparatus according to the present invention is called instead of API required for changing the file generation time in step 511. When the target process does not attempt to change the file generation time, the apparatus according to the present invention continues to monitor the target process.

[0053] Meanwhile, when a newly generated process is a child process of the preset target process in step 513, it is determined if a file generation time of the child process is within a reference time in step 515. When the file generation time of the child process is within the reference time, the child process is determined as a malicious process in step 517, and forcibly terminated in step 519.

[0054] When the file generation time of the child process is longer than the reference time, it is determined that the child process is not a malicious process, and the child process is set as a new target process in step 512.

[0055] In the above-described process, even if the generation of subordinate child processes of the target process is repeated several times, it is still possible to monitor all the subordinate child processes.

[0056] As described above, the present invention provides a method and apparatus for detecting a malicious process. Also, malicious behavior to generate a malicious process can be detected from a normal process based on a time required for executing a child process of a target process.

[0057] In the drawings and specification, there have been disclosed typical preferred embodiments of the invention and, although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation. As for the scope of the invention, it is to be set forth in the following claims. Therefore, it will be understood by those of ordinary skill in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.