Method and system for checking malware infection in macros configured in document files

Abstract

To provide a malware infection confirmation method and system for a macro constituted in a document file that actualizes a flexible security function by confirming malware embedded in a macro and letting a user know it and also selectively executing the macro.SOLUTION: An infection confirmation system includes a macro detection module, a first security processing module and a second security processing module. The macro detection module confirms a document file input to an input processor, and searches for a macro function embedded in the document file with malware information saved in a first code information storage part to detect the malware of the macro function. The first security processing module changes the macro function having the malware detected into a custom function. The second security processing module interrupts an execution event of the macro function to confirm a handling manner for the macro function, and interrupts execution of the macro function if the macro function is an object whose execution has been shut off to represent notice through an UI module.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a malware infection confirmation method and notification system for securing macros in documents infected with malware, and more particularly to a malware infection confirmation method and notification system for macros configured in document files that realizes flexible security functions by detecting malware installed in the macros, notifying the user, and selectively executing the macros. [Background technology]

[0002] A word processor is software used to create, edit, save, and print documents. Representative word processors include Hancom Office sold by Hangul Computer, Microsoft Office sold by Microsoft, Apache OpenOffice developed by the Apache Foundation, RTF (Rich Text Format) sold by Microsoft, and PDF (Portable Document Format) sold by Adobe.

[0003] On the other hand, a macro is a kind of record made by collecting a number of frequently used commands and inputting them with a single keystroke, and the word processor sets up a program to process the record.

[0004] Therefore, the troublesomeness of a worker repeatedly using a specific command for a specific procedure while working with a word processor can be minimized by utilizing the macro function.

[0005] However, because macros are often distributed externally for general business use, and word processors such as Excel are widely used in the fields of finance and accounting, or in the financial industry, hackers have often loaded malware into macros and used them maliciously.

[0006] To address these issues, security technologies have been proposed that detect malware contained in macros and block their execution.

[0007] However, conventional technology blocks all macro functions if malware is detected, so workers have to accept the situation where the macros they used while using a word processor do not work without knowing why, which is inconvenient. In addition, even macros that are not loaded with malware are blocked, so workers have to work in an inefficient work environment. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Korean Patent Registration No. 10-1745873 Summary of the Invention [Problem to be solved by the invention]

[0009] Therefore, the present invention is made to solve such problems, and has an object to provide a method and system for checking for malware infection in macros configured in document files, which can check for malware installed in macros, notify the user, and selectively execute the macros to realize flexible security functions. [Means for solving the problem]

[0010] In order to achieve the above object, the present invention provides a method for checking for malware infection of a macro configured in a document file, the method including: a first confirmation step in which a macro detection module linked to a computer OS checks a document file input to an input processor; an extraction step in which the macro detection module searches for and extracts a macro function configured in the document file using malware information stored in a code information storage unit; a detection step in which the macro detection module detects malware in the extracted macro function; and a function setting step in which a security processing module changes the macro function in which malware has been detected to a custom function.

[0011] In order to achieve the above-mentioned other technical objectives, the present invention provides a system for checking for malware infection of macros configured in document files, including a code information storage unit for storing malware information, a macro detection module for checking a document file input event of an input processor and extracting a macro function of the document file to detect malware, a security processing module for changing the macro function in which malware has been detected into a custom function and storing the custom function, and a UI module for displaying a notification function performed during the process of the macro detection module. Effect of the Invention

[0012] The present invention as described above can realize a flexible security function by detecting malware loaded in a macro and notifying the user, and selectively executing the macro. When a blocked macro is executed, the user is notified of the blocking to ensure the continuity of business processing, and normal business files including macros are permitted, thereby providing a safe and convenient business environment. [Brief description of the drawings]

[0013] [Figure 1] 1 is a block diagram showing one embodiment of an infection confirmation system according to the present invention. [Diagram 2] 1 is a flowchart illustrating a process of checking a document file to be secured and changing a corresponding macro function to a custom function according to an embodiment of a method for checking an infection according to the present invention. [Diagram 3] 4 is a flowchart showing a process of executing a document file to be secured in accordance with an embodiment of a method for confirming an infection according to the present invention; [Figure 4] 11 is an image showing an example of a notification UI displayed during the process of the infection confirmation method according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] The above-mentioned features and effects of the present invention will become apparent from the following detailed description based on the accompanying drawings, and therefore, those skilled in the art will be able to easily implement the technical concept of the present invention. The present invention can be modified in various ways and can have various forms, and specific embodiments are illustrated in the drawings and described in detail in the text. However, this is not intended to limit the present invention to the specific disclosed form, and it should be understood that all modifications, equivalents, or alternatives within the concept and technical scope of the present invention are included. The terms used in this application are used to describe specific embodiments, and are not intended to limit the present invention.

[0015] Generally, a word processor or document management system is implemented as a combination of hardware and software. The hardware includes a central processing unit (CPU), a memory unit, an input-output unit, a controller, an arithmetic logic unit (ALU), a digital signal processor, a field programmable gate array (FPGA), a programmable logic unit (PLU), or other processing units, and is implemented as one or more general-purpose or special-purpose computers. The processing units run an operating system (OS) or one or more applications executed on the operating system, and access, store, manipulate, process, and generate data in response to the execution of the software. Such processing units may be implemented as a single processing unit independently, or may include multiple processing elements and / or multiple types of processing elements. The software includes an operating system (OS), an input-output control program, and an application program, and operates the processing unit according to a combination of a series of instructions, etc. The software and / or data may be embodied permanently or temporarily in a physical device, a virtual device, a storage medium, or a signal wave transmitted by a processing device, and may be distributed and stored or executed in a distributed manner on computer systems connected by a network. The method and system for checking malware infection of macros configured in a document file according to the present invention based on such hardware and software can be realized, and detailed descriptions of the above-mentioned general techniques that are well known will be omitted for the convenience of explanation and understanding of the components and to avoid unnecessary duplication.

[0016] Hereinafter, the specific contents of the present invention will be described in detail with reference to the accompanying drawings.

[0017] FIG. 1 is a block diagram showing one embodiment of an infection confirmation system according to the present invention.

[0018] Referring to FIG. 1, the malware infection confirmation system 100 of this embodiment includes first and second code information storage units 110, 110' for storing a macro function response policy and malware information, a macro detection module 120 for checking a document file input event of the input processor 300 based on the malware stored in the first code information storage unit 110 of the security unit S and extracting a macro function from the document file to detect malware, a first security processing module 140 for changing a macro function in which malware has been detected into a custom function, a second security processing module 140' for searching for a macro function response policy and malware information in the second code information storage unit 110' of the execution unit P and determining whether to block the macro function based on the search results, and a UI module 130 for displaying a notification performed during the process of the macro detection module 120, the first security processing module 140, and the second security processing module 140'.

[0019] Here, the malware infection confirmation system 100 of this embodiment is separated into a security unit S and an execution unit P, and each unit S and P is processed independently. The security unit S is composed of a first code information storage unit 110, a macro detection module 120, a first security processing module 140, and a UI module 130, and the execution unit P is composed of a second code information storage unit 110', a second security processing module 140', and a UI module 130. Therefore, the security unit S and the execution unit P can be configured in a single terminal (computer or server) or can be configured separately in different terminals (first embodiment).

[0020] However, without being limited thereto, the malware infection confirmation system 100 of the present invention may be configured in such a manner that the security unit S and the execution unit P are integrated without any separation, and the first and second code information storage units 110, 110', the first and second security processing modules 140, 140', and the UI module 130 are each configured in the malware infection confirmation system 100 without any separation from each other (second embodiment).

[0021] In the claims below, the first and second code information storage units 110, 110', the first and second security processing modules 140, 140', and the UI module 130 are not divided into 'first' and 'second', nor are the security unit S and the execution unit P. However, the configuration of the claims below is not limited to the 'second embodiment', and the 'first embodiment' is also included in the claims.

[0022] To explain each component module in more detail, the first and second code information storage units 110 and 110' store security policy information set in the macro function and information on malware, and in particular, the security policy information includes information on whether the macro function is to be blocked from execution and, if so, the degree of blocking. In addition, the malware information stored in the first and second code information storage units 110 and 110' is continuously updated, allowing the macro detection module 120 to detect new malware that is constantly being generated and developed.

[0023] The macro detection module 120 checks an input event of a document file via the input processor 300 while communicating with the OS (Operating System) 200 of the computer, and extracts a macro function of the document file that is the target of the input event. The macro detection module 120 also detects the presence or absence of malware from the extracted macro function, and if malware is detected, sets a security policy for the macro function and stores it in the first code information storage unit 110. Here, the input processor 300 can be various hardware and software such as a CD drive, a USB drive, a web browser for online downloads, a PtP device, etc., and the OS 200 works in conjunction with the input processor 300 to transfer an input event of a document file to the macro detection module 120.

[0024] If malware is detected from a macro function, the first security processing module 140 of the security unit S changes the macro function to a custom function and classifies it. If the execution unit P subsequently attempts to execute the macro function, the second security processing module 140' can check the security target of the macro function and, if necessary, the security level of the macro function. If the security target and security level of the macro function are checked, it determines whether to block the macro function, and if the blocking level of the macro function is within a specified level range, it performs a subsequent process for blocking the execution according to the operator's selection.

[0025] The UI module 130 displays a guide comment about malware security in conjunction with the OS 200 and the word processor 400. In general, a notification window (see FIG. 4) can be displayed for visual notification, and an operator can be notified of the fact that a macro function is infected with malware by an alarm sound or other various methods.

[0026] FIG. 2 is a flow chart showing a process of checking a document file to be secured and changing a corresponding macro function to a custom function in accordance with an embodiment of the infection checking method according to the present invention.

[0027] The following description will be given with reference to FIG. 1 and FIG.

[0028] S10: Document file reception stage To work with document files, the worker can create a new document file or input the document file to be worked on from outside. When working with a new document file without macro settings, there is little or no possibility of malware infection of the macro function, so we will omit the explanation of macro security of the newly created document file.

[0029] The macro detection module 120 checks for an input event of a document file from the OS 200 via the input processor 300. The input event of the document file is checked to see if it is a document file based on the format and extension of the input file, and the macro detection module 120 performs a subsequent process to analyze the document file.

[0030] S11: Macro inclusion confirmation stage The macro detection module 120 analyzes the format, extension, header structure, etc. of the confirmed document file to confirm the structure of document file components, and determines whether the document file includes a macro.

[0031] If it is determined that the document file does not contain macros, the document file is set as a non-secure file and stored in the system (S111). This document file will not be processed for security when it is executed in the future.

[0032] S12: Macro function extraction stage The macro detection module 120 analyzes macros in a document file and extracts macro functions. The macro code encoded in a specified format can be decoded and expressed in the form of a function, and based on this, the macro detection module 120 extracts macros in the document file as macro functions.

[0033] S13: Malware detection stage The macro detection module 120 compares the extracted macro function with the malware information in the first code information storage unit 110 to determine whether a macro function that is mainly used for malicious acts is used in the macro function included in the document file. In more detail, a macro function infected with malware is transformed into a specific function form, so that even if it is the same macro function, a normal macro function and a malicious macro function have different function forms. Therefore, the macro detection module 120 checks for a macro function that has the same form as the macro function infected with malware to determine whether the document file is infected with a macro function.

[0034] For reference, since a macro function infected with malware is spread while maintaining a specific format, the first code information storage unit 110 stores the macro function of the corresponding format, and the macro detection module 120 compares the malicious macro function stored in the first code information storage unit 110 with the macro function of the document file to check whether the macro function is infected with malware.

[0035] If no malware is detected in the macro function of the document file, the document file is set as not to be secured and is stored in the system (S111). After that, the process for security is not performed when the document file is executed.

[0036] Meanwhile, the macro detection module 120 can rank malware detected from a macro function according to the degree of danger. For example, if the malware configured in the macro function is classified as primitive malware such as the Stoned virus or Jerusalem virus, or malware that does not have a significant impact on the system, the macro detection module 120 allows the operator to decide whether to execute the macro function, and in the case of ransomware or other malware that has a significant impact on the system, the macro detection module 120 enforces the execution restriction of the macro function regardless of the operator's decision. With this differentiation, the document file operator can decide whether to execute the macro function according to his or her current situation.

[0037] Here, the grading of the macro detection module 120 can also be performed at the execution time of the document file.

[0038] S14: Change to custom function Meanwhile, if malware is detected from the macro function of the document file, the first security processing module 140 of the security unit S sets the document file as a security target and changes the macro function of the document file to a custom function. The macro function changed to a custom function can be recognized by the second security processing module 140' when the document file and the macro function are executed by the execution unit P, and can directly control whether or not to execute the macro function.

[0039] As described above, the document file having the macro function processed by the above-mentioned procedure is stored and managed in the corresponding system.

[0040] FIG. 3 is a flowchart showing the process of executing a document file to be secured in one embodiment of the infection confirmation method according to the present invention, and FIG. 4 is an image showing an example of a notification UI displayed during the process of the infection confirmation method according to the present invention.

[0041] The following description will be given with reference to FIGS.

[0042] S15: Document file execution stage At execution unit P, an operator uses a word processor 400 to search and execute document files stored and managed in the system.

[0043] As described above, a document file having a macro function set as a security target has the macro function converted to a custom function and saved, so that the worker can then load the required document file via the associated word processor 400.

[0044] S151: Macro confirmation stage The second security processing module 140' checks whether the macro of the searched document file has been modified, and if it is confirmed that the macro has not been modified, the word processor 400 executes the document file without any subsequent procedures (S152).

[0045] S16: Specified macro confirmation stage If the second security processing module 140' determines that the macro in the searched document file is a modified macro, it checks the process of the word processor 400 in real time to check the execution event of the macro function. If the execution event of the macro function occurs as a result of the check, it interrupts the event and checks whether the macro function has been modified to a custom function.

[0046] If the macro function is a general macro function and not a custom function, the second security processing module 140' continues the execution of the macro function, but if the macro function is a custom function, the second security processing module 140' considers the macro function to be malicious and performs the subsequent process.

[0047] S17: Macro function support policy confirmation stage The second security processing module 140' analyzes the macro function that has been confirmed as malicious and changed to a custom function, and searches the second code information storage unit 110' or a self security policy.

[0048] To explain this in more detail with an example, the second security processing module 140' may recognize the macro function to be executed in the word processor 400 as malicious and change it to a custom function, but as a result of checking the second code information storage unit 110', it may be determined that the macro function is not subject to execution restriction. In this case, the second security processing module 140' determines that the macro function to be executed is normal and continues execution of the macro function. However, if the result of checking the second code information storage unit 110' indicates that the macro function is subject to execution restriction, the second security processing module 140' determines that the macro function to be executed is dangerous and continues the execution restriction of the macro function.

[0049] In addition, the security policy is set to rank the risk of malicious macro functions, and the second security processing module 140' can determine the risk level of the macro function changed to a custom function according to the security policy. In this embodiment, the risk levels of the macro functions are classified into a level for forcibly blocking the execution, a level for selectively blocking the execution by the operator, and a level for normal execution. Therefore, the second security processing module 140' checks and determines the risk level of the macro function to be executed according to the security policy.

[0050] The process of grading and classifying the risk level of malware infected with malicious macro functions as described above can be performed by the second security processing module 140' at this step (S17), but can also be performed by the macro detection module 120 of the security unit S at the malware detection step (S13) as described above.

[0051] S18: Blocking target confirmation stage If the second security processing module 140' determines that the risk level of the macro function to be executed is at a level that requires forcibly blocking the execution, the second security processing module 140' forcibly blocks the execution of the macro function, and the UI module (not shown) of the execution unit P pops up a notification window as shown in Figure 4(a) to notify the operator of the forced blocking and the reason for blocking (S191).

[0052] S19: Execution / non-execution selection stage As a result of the confirmation by the second security processing module 140', if the risk level of the macro function to be executed is determined to be at a level that selectively blocks the execution, the second security processing module 140' halts the execution of the macro function, and the UI module pops up a notification window as shown in Figure 4 (b) to ask the operator whether or not to execute the macro function.

[0053] If the operator selects to block the execution as a result of the inquiry, the second security processing module 140' suspends the execution of the macro function, and the UI module pops up a notification window as shown in FIG. 4(a) to inform the operator of the forced block and the reason for the block (S191).

[0054] S20: Macro function execution stage If the operator selects to permit execution as a result of the inquiry, the second security processing module 140' releases the suspension of the macro function, and the word processor 400 executes the macro function.

[0055] Thereafter, if the execution of the macro function is subsequently attempted during the continuous word processing process (S21), the second security processing module 140' repeatedly performs the macro execution step (S16).

[0056] The above detailed description of the present invention has been given with reference to preferred embodiments of the present invention. However, it should be understood that a person skilled in the art or having ordinary knowledge in the art may make various modifications and changes to the present invention without departing from the spirit and technical scope of the present invention as set forth in the claims below. [Explanation of symbols]

[0057] 110 First code information storage unit 110' Second code information storage unit 120 Macro Detection Module 130 UI Module 140 First Security Processing Module 140' Second Security Processing Module 300 Input Processor 400 Word Processor

Claims

1. a first verification step in which a macro detection module associated with the computer's operating system verifies a document file input to an input processor; an extraction step of the macro detection module searching and extracting a macro function configured in the document file based on malware information stored in a code information storage unit; a detection step in which a macro detection module detects malware in the extracted macro function; A function setting step in which the security processing module changes the macro function in which malware is detected to a custom function that can be identified as a macro function in which malware is not detected; a second confirmation step of checking whether the macro function has been changed to a custom function by interrupting a macro execution event in the process of executing the document file by the word processor, and continuing execution of the macro function if it is determined that the macro function has not been changed as a result of the check; a third confirmation step in which the security processing module confirms a corresponding policy of the macro function if it is confirmed that the macro function has been changed as a result of the check; a macro function blocking step in which, if the macro function is a target to be blocked as a result of checking the response policy, the security processing module stops the execution of the macro function and displays a notice through a UI module; A method for checking for malware infection of a macro configured in a document file, comprising:

2. The macro function response policy is graded according to the malware danger level, In the detection step, the macro detection module sets a risk level for the malware, or in the third confirmation step, the security processing module sets a risk level for the malware; A method for checking for malware infection of a macro configured in a document file according to claim 1.

3. The third confirmation step includes: If the macro function is of a designated level, the security processing module outputs a query window through the UI module to collect a selection value of an operator, and performs the blocking step or the execution of the macro function according to the selection value. A method for checking for malware infection of a macro configured in a document file according to claim 1.

4. A code information storage unit for storing malware information and a macro function response policy; a macro detection module that checks document file input events of the input processor and extracts macro functions from the document file to detect malware; a security processing module that changes a macro function in which malware is detected to a custom function that can be distinguished from a macro function in which malware is not detected, searches the code information storage unit for a macro function response policy and malware information, and determines whether to block the macro function according to a result of the search; a UI module having a function of displaying notifications made during the process of the security processing module; Including, The security processing module includes: During the execution of the document file by the word processor, the security processing module interrupts a macro execution event to check whether the macro function has been changed to a custom function, and if it is determined that the macro function has not been changed, continues to execute the macro function; If it is confirmed that the macro function has been changed as a result of the check, the security processing module checks the corresponding policy of the macro function; If the macro function is determined to be a target for blocking as a result of checking the response policy, the security processing module stops the execution of the macro function and displays a notification through the UI module. A malware infection confirmation system for a macro configured in a document file.

Images