SIGNATURE-BASED MALICIOUS APPLICATION DETECTION METHOD AND DEVICE

Abstract

To provide a signature-based malicious application detection method and device.SOLUTION: A signature-based malicious application detection method includes the steps of: determining a malicious application based on machine learning; updating malicious application information to a server database; collecting application information deleted from an OS market; updating the deleted application information to the server database; determining, when the deleted application is re-uploaded to the market, whether the application is malicious using the machine learning; and deleting, when the application is determined not to be malicious, the application from the server database.SELECTED DRAWING: Figure 11

Description

[Technical field]

[0001] The disclosed invention relates to a signature-based method and apparatus for detecting malicious applications. More specifically, the disclosed invention relates to a technique for more effectively detecting malicious applications that are not detected by existing verification methods by utilizing a machine learning-based threat detection module and a market crawling module. [Background technology]

[0002] In recent years, as the penetration rate of smartphones has gradually increased, malicious applications that attempt to steal users' personal and financial information have become more common.

[0003] Malicious applications can request various permissions from a user's smartphone without the user's knowledge, potentially allowing them to collect personal information or execute malicious code without the user's consent.

[0004] This has resulted in an increase in damage caused by phishing, spam, spyware, etc.

[0005] Although technology for detecting such malicious applications is improving day by day, the reality is that it is virtually impossible to detect malicious applications completely and effectively, because new types of malicious applications are produced with increasing frequency and malicious applications use various techniques to avoid detection.

[0006] For example, recent malicious applications use methods to avoid detection by imitating package names or application names, logos, etc. of trusted, well-known applications, or by obfuscating or packing the code of the malicious application.

[0007] Therefore, in the case of existing signature-based malicious application detection methods, since malicious code of malicious applications that match predefined patterns is detected, a problem arises in that a new signature must be added every time a new type of malicious application is found.

[0008] Therefore, the existing signature-based malicious application detection method has a limitation in that it is difficult to respond to malicious applications in real time because it takes a considerable amount of time from the time a malicious application is discovered to the time a signature pattern is added.

[0009] In addition, if an application is deemed malicious and removed from the app store, the removal from the app store is not reflected if the application is already installed on a user's smartphone, making it difficult to manage after installation. Summary of the Invention [Problem to be solved by the invention]

[0010] Therefore, a signature-based malicious application detection method and apparatus according to one embodiment is an invention created to solve the above-mentioned problems.

[0011] Specifically, the present invention aims to provide a signature-based method and apparatus for detecting malicious applications that can more effectively detect malicious applications by utilizing a threat detection module and a market crawling module to continuously update a signature database.

[0012] More specifically, the purpose of the signature-based malicious application detection method and apparatus according to the present invention is to provide a signature-based malicious application detection method and apparatus with enhanced error correction and performance by utilizing a code analysis model, a user analysis model, and a developer analysis model to collect vector values ​​output from each model and combine the results of the multiple analysis models. [Means for solving the problem]

[0013] The signature-based malicious application detection device according to the disclosed invention may include a pre-processing module including a code analysis model that inputs at least one of an API, permission information, code signature information, and hash information of an application stored in a user terminal as input information and outputs code analysis information as output information, an artificial neural network module that inputs the code analysis information as input information and outputs malicious information of the application that determines whether the application is malicious or not, and an update module that updates the malicious information of the application to a server database if the application is determined to be malicious based on the malicious information of the application.

[0014] The pre-processing module may further include a user analysis model that inputs at least one of the application usage time information, screen time information, battery consumption information, data usage information, and interaction pattern information as input information and outputs user analysis information as output information.

[0015] The pre-processing module may further include a developer analysis model that inputs at least one of the application's certificate validity period information, certificate issuing country information, annotation language information, and certificate management information as input information, and outputs developer analysis information as output information.

[0016] The code analysis model may utilize a random forest algorithm to analyze the application.

[0017] The user analysis model may utilize a DBSCAN algorithm to analyze the application.

[0018] The developer analysis model may utilize a gradient boosting algorithm to analyze the application.

[0019] The signature-based malicious application detection apparatus may further include a market crawling module that collects information regarding applications that have been removed from an app store, and the update module may update the removed application information to the server database.

[0020] The signature-based malicious application detection method according to the disclosed invention may include a step of inputting at least one of an application's API, permission information, code signature information, and hash information as input information and outputting code analysis information as output information, a step of inputting the code analysis information as input information and outputting malicious information of the application determining whether the application is malicious or not as output information, and a step of updating the malicious application information to a server database if the application is determined to be malicious based on the output information.

[0021] The signature-based method for detecting malicious applications may further include updating information about applications that have been removed from an app store to the server database. Effect of the Invention

[0022] SUMMARY OF THE DISCLOSURE A signature-based malicious application detection method and apparatus, according to one embodiment, provides a technical advantage in that it can quickly and accurately detect malicious applications through a variety of verification methods.

[0023] In addition, the signature-based malicious application detection method and apparatus according to one embodiment has the technical advantage of being able to quickly update the signature database with malicious applications that have been removed from the market by periodically crawling the publication history of vendor market apps.

[0024] In addition, the signature-based malicious application detection method and apparatus according to one embodiment has the technical advantage of being able to effectively protect users from malicious applications by utilizing developer characteristics and certificate characteristics of an application in machine learning and periodically updating the results output by the machine learning to a signature database. [Brief description of the drawings]

[0025] [Figure 1] FIG. 1 is a diagram illustrating a signature-based malicious application detection system according to one embodiment of the disclosed invention. [Diagram 2] FIG. 2 is a diagram showing the structure of a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Diagram 3] FIG. 3 is a diagram showing the structure of a threat detection module in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 4] FIG. 4 is a diagram illustrating an artificial neural network module that may be utilized in the threat detection module shown in FIG. [Diagram 5] FIG. 5 is a diagram showing input data of a code analysis model and vector values ​​resulting therefrom in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 6]FIG. 6 is a diagram showing a graph and an output vector value output by a code analysis model based on an algorithm in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 7] FIG. 7 is a diagram showing input data of a user analysis model and vector values ​​resulting therefrom in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 8] FIG. 8 is a diagram showing a graph and output values ​​output by a user analysis model based on an algorithm in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 9] FIG. 9 is a diagram showing input data of a developer analysis model and vector values ​​resulting therefrom in a signature-based malicious application detection device according to an embodiment of the disclosed invention. [Figure 10] FIG. 10 is a diagram showing a graph and output vector values ​​output by a developer analysis model through an algorithm in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention. [Figure 11] FIG. 11 is a flowchart illustrating a signature-based method for detecting malicious applications according to an embodiment of the disclosed invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. When assigning reference numerals to components in each drawing, it should be noted that the same components are assigned the same numerals as much as possible even if they are displayed in different drawings. In addition, when describing the embodiments of the present invention, detailed descriptions of related known configurations or functions are deemed to hinder understanding of the embodiments of the present invention, the detailed descriptions thereof will be omitted. In addition, although the embodiments of the present invention will be described below, the technical idea of ​​the present invention is not limited or restricted thereto, and may be modified and variously implemented by those skilled in the art.

[0027] In addition, the terms used in the present specification are used to describe the embodiments, and are not intended to limit and / or restrict the disclosed invention. The singular expression includes the plural expression unless otherwise clearly defined in the context.

[0028] As used herein, terms such as "comprise," "comprising," or "having" are intended to specify the presence of a specified feature, number, step, operation, component, part, or combination thereof, but do not preclude the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0029] Furthermore, throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "indirectly connected" through another element in between, and terms including ordinal numbers such as "first" and "second" used in this specification may be used to describe various components, but the components are not limited by said terms.

[0030] Hereinafter, the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. In order to clearly explain the present invention in the drawings, parts that are not relevant to the description will be omitted.

[0031] FIG. 1 is a diagram illustrating a signature-based malicious application detection system according to one embodiment of the disclosed invention.

[0032] Referring to FIG. 1, a signature-based malicious application detection system according to one embodiment may include a server (2) that determines whether an application is malicious and updates information about the malicious application in a server database (131), and a user terminal (1) that transmits installed application information to the server (2), receives malicious application information from the server (2), and stores the information in a signature database (11).

[0033] In the case of the server (2), it can be embodied as an embodiment of a malicious application detection device according to an embodiment of the disclosed invention.

[0034] In addition, the malicious application detection device of the disclosed invention can be embodied as a software program or software programming interface (Application Programming Interface, API) installed in the user terminal (1).

[0035] The server (2) in this invention means a normal server (2), which is computer hardware on which a program is executed, and which monitors or controls the entire network, such as printer control and file management, and can support connections with other networks via mainframes or public networks, and sharing of software resources such as data, programs, and files, and hardware resources such as modems, faxes, printer sharing, and other devices.

[0036] Furthermore, the user terminal (1) according to an embodiment of the disclosed invention may correspond to a computing device capable of transmitting and receiving data via a network and executing various software.

[0037] Here, the network refers to a connected structure that allows information exchange between each node, such as a plurality of terminals and a server (2).

[0038] Examples of such networks include a local area network (LAN), a wide area network (WAN), the Internet (WWW), wired and wireless data communication networks, telephone networks, and wired and wireless television communication networks.

[0039] Examples of wireless data communication networks include, but are not limited to, 3G, 4G, 5G, 3GPP (3rd Generation Partnership Project (registered trademark)), 5GPP (5th Generation Partnership Project), LTE (Long Term Evolution), WIMAX (World Interoperability for Microwave Access), Wi-Fi, the Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN (Personal Area Network), RF (Radio Frequency), Bluetooth (registered trademark) network, NFC (Near-Field Communication) network, satellite broadcasting network, analog broadcasting network, DMB (Digital Multimedia Broadcasting) network, etc.

[0040] The user terminal (1) may store an operating system program for starting and running the terminal.

[0041] For example, the operating system program may include Android OS, iPhone OS, Tizen OS, BlackBerry OS, Windows Phone OS, and the like.

[0042] However, in the case of the malicious application detection device according to the disclosed invention, it is intended to be used with an Android-based operating system.

[0043] Also, the user terminal (1) can be implemented with several terminal devices including a processor so that such algorithms can be implemented.

[0044] For example, the terminal device may be embodied as a computer, a smart pad, a notebook computer, a mobile terminal, or the like.

[0045] Here, the computer may include, for example, a notebook computer, a desktop computer, a laptop computer, a tablet PC, a slate PC, etc. equipped with a web browser.

[0046] The mobile terminal may include, for example, any kind of handheld-based wireless communication device such as a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular (PDC), a personal handy-phone system (PHS), a personal digital assistant (PDA), an international mobile telecommunication (IMT)-2000, a code division multiple access (CDMA)-2000, a W-code division multiple access (W-CDMA), a wireless broadband internet (WiBro) terminal, a smartphone, etc., as well as a wearable device such as a watch, a ring, a bracelet, an anklet, a necklace, glasses, a contact lens, or a head-mounted device (HMD), etc., as a wireless communication device that ensures portability and mobility.

[0047] On the other hand, although not shown in the drawing, the user terminal (1) and the server (2) may include a processor that digitizes and processes information, and a memory that stores information.

[0048] The processor and memory may be embodied in at least one of a storage medium that stores programs and data necessary for the operations described above in FIG.

[0049] Also, the processor and memory may be implemented on a single chip, or may be implemented on separate chips.

[0050] In addition, the user terminal (1) and the server (2) can transmit and receive information to each other through a communication module, which can include, for example, at least one of a short-range communication module, a wired communication module, and a wireless communication module.

[0051] The short-range communication module may include various short-range communication modules that transmit and receive signals using a wireless communication network over a short distance, such as a Bluetooth module, an infrared communication module, an RFID (Radio Frequency Identification) communication module, a WLAN (Wireless Local Access Network) communication module, an NFC communication module, and a Zigbee communication module.

[0052] The wired communication module may include various wired communication modules such as a Local Area Network (LAN) module, a Wide Area Network (WAN) module, or a Value Added Network (VAN) module, as well as various cable communication modules such as Universal Serial Bus (USB), High Definition Multimedia Interface (HDMI), Digital Visual Interface (DVI), recommended standard 232 (RS-232), power line communication, or plain old telephone service (POTS).

[0053] The wireless communication module may include a Wi-Fi module, a WiBro module, and other wireless communication modules that support various wireless communication methods such as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access (registered trademark)), UMTS (Universal mobile telecommunications system), TDMA (Time Division Multiple Access), and LTE (Long Term Evolution).

[0054] The following describes in detail the detailed configuration of a signature-based malicious application detection device according to an embodiment.

[0055] FIG. 2 is a diagram showing the structure of a signature-based malicious application detection device according to an embodiment of the disclosed invention.

[0056] Referring to FIG. 2, a user terminal (1) may include a signature detection module (10).

[0057] The signature detection module (10) can detect malicious applications based on patterns or characteristics of known malicious behavior.

[0058] Such a signature-based malicious application detection method can use a malicious code database or a signature database (11).

[0059] The signature detection module (10) according to the disclosed invention is capable of determining malicious applications based on a signature database (11).

[0060] Such a signature database (11) is a database that contains the characteristics, patterns, or hashes etc. of known malicious applications.

[0061] The signature database (11) can be periodically updated based on a server database (131) of the server (2) described below.

[0062] Through this, new malicious applications can be added to the signature database (11).

[0063] A signature-based malicious application detection scheme can compare the signature of the application to be detected with entries in a signature database (11) to determine whether the application in question has patterns or characteristics of known malicious behavior.

[0064] Therefore, the signature detection module (10) can detect the signature of a malicious application based on the signature database (11) and notify or display information about the malicious application to the user through the user terminal (1).

[0065] Existing signature-based malicious application detection methods have a high accuracy for known malicious applications, but have a drawback in that they cannot detect new or modified malicious applications.

[0066] Therefore, in the case of the disclosed invention, the threat detection module (110) and market crawling module (120) of the server (2) described below are used in combination to collect malicious application information and send the collected information to the signature database (11), thereby enabling signature-based malicious application detection with higher accuracy than before.

[0067] More details on this will be provided below.

[0068] The server (2) may include a threat detection module (110).

[0069] The threat detection module (110) can detect malicious applications through machine learning based learning and inference.

[0070] More specifically, the threat detection module (110) can detect malicious applications by analyzing whether an application is malicious or not through a code analysis model (1111), a user analysis model (1112), and a developer analysis model (1113).

[0071] More details regarding such a threat detection module (110) are provided below in the description of Figures 3 and 4.

[0072] The server (2) may also include a market crawling module (120).

[0073] The market crawling module 120 can check and crawl the application publication history and deletion history of the OS vendor market.

[0074] More specifically, the market crawling module (120) can collect information about applications that have been removed from app stores.

[0075] Crawling is an automated process of collecting information that can be used to collect large amounts of data and track changes to that data.

[0076] As an example of such market crawling module (120) operation, the market crawling module (120) can send HTTP or HTTPS requests to market web pages and retrieve the HTML content of those pages.

[0077] The market crawling module (120) then analyzes and parses the HTML code of the retrieved web pages to understand the structure and content of the web pages, and may use an HTML parser library to do so.

[0078] The server (2) may include an update module (130) that selectively allows for updates to the server database (131).

[0079] The update module (130) can integrate and classify information outputted through the threat detection module (110) and the market crawling module (120) and determine whether to update the server database (131).

[0080] If the application is determined to be malicious based on the output information output by the threat detection module (110), the update module (130) can update the malicious application information in the server database (131).

[0081] In addition, the update module (130) can receive deleted application information collected by the market crawling module (120) and update the deleted application information in the server database (131).

[0082] Therefore, the database update of the update module (130) by the threat detection module (110) and the database update of the update module (130) by the market crawling module (120) can be performed independently of each other.

[0083] Applications that are removed from the vendor market may be removed because they are deemed to be malicious or do not meet market regulations.

[0084] Therefore, in the case of the disclosed invention, if there is an application that has been removed from the vendor market, it can be classified as a malicious application and updated in the server database (131).

[0085] If an application that has been deleted from the vendor market is uploaded back to the vendor market, it may have been deleted due to non-compliance with simple regulations. In this case, the server (2) of the disclosed invention can again determine whether the application is malicious through the threat detection module (110).

[0086] More specifically, when there is an application that has been deleted from a vendor market and then re-uploaded, the malicious application detection device according to the disclosed invention can compare the machine learning-based determination result of the threat detection module (110) as to whether or not the application is a malicious application.

[0087] The update module (130) can refer to the detection result of the threat detection module (110) and, if it is determined that the application is not a malicious application, delete information about the application from the server database (131).

[0088] The disclosed invention has the technical effect of reducing the false positive rate in detecting malicious applications through a complementary contrast scheme between the market crawling module (120) and the threat detection module (110).

[0089] Therefore, the server database (131) can transmit update information of malicious applications according to the malicious application judgment results of the server (2) to the signature database (11) of the signature detection module (10) of the user terminal (1) to share it.

[0090] 3 is a diagram showing the structure of a threat detection module in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention, and FIG 4 is a diagram showing an artificial neural network module used in the threat detection module shown in FIG 3.

[0091] 3 and 4, the threat detection module (110) may include a pre-processing module (111) and an artificial neural network module (112) that inputs the result values ​​output by the pre-processing module (111) and performs learning and inference.

[0092] The pre-processing module (111) can be subdivided into a code analysis model (1111), a user analysis model (1112), and a developer analysis model (1113).

[0093] The code analysis model (1111) can analyze an application by learning various characteristics of the application's behavior and code.

[0094] Such a code analysis model (1111) can determine which characteristics are important for determining a malicious application, depending on the importance of the variables.

[0095] The user analysis model (1112) can analyze the application based on the user behavior information.

[0096] Such user analytics models (1112) can group user behavior data and identify anomalous behavior.

[0097] The developer analysis model (1113) can analyze the application based on the developer information and the certificate information.

[0098] Such a developer analysis model (1113) can predict and evaluate the trustworthiness of an application's developer.

[0099] Specific learning methods for the code analysis model (1111), the user analysis model (1112), and the developer analysis model (1113) will be described later with reference to FIGS.

[0100] The artificial neural network module (112) can classify malicious applications by inputting at least two or more result values ​​output from the code analysis model (1111), the user analysis model (1112), and the developer analysis model (1113).

[0101] More specifically, the artificial neural network module (112) of the disclosed invention can take as input the code analysis information output from the code analysis model (1111) and output information regarding whether an application is malicious or not.

[0102] Alternatively, the artificial neural network module (112) of the disclosed invention may take user analysis information output from the user analysis model (1112) as input information and may output information regarding whether an application is malicious or not.

[0103] Alternatively, the artificial neural network module (112) of the disclosed invention may take developer analysis information output from the developer analysis model (1113) as input information and may output information regarding whether an application is malicious.

[0104] Alternatively, the artificial neural network module (112) of the disclosed invention may receive pre-processed information of at least two of code analysis information, user analysis information, and developer analysis information as input information, and output information indicating whether an application is malicious or not.

[0105] In particular, the artificial neural network module (112) according to the present invention can be any of various types of known artificial neural networks, typically a Convolutional Neural Network (CNN).

[0106] As will be described later, the artificial neural network module (112) of the present invention can learn by comparing output information with reference data, but can also learn using different types of input information.

[0107] Thus, an artificial neural network module (112) according to the disclosed invention may include a training session, which outputs output information based on input information, and an inference session, which infers output information based on input information.

[0108] The artificial neural network module (112) according to the disclosed invention can perform learning based on output information and reference information.

[0109] Here, the reference information can be artificially generated reference data.

[0110] CNNs are deep learning models that specialize in detecting regional patterns and extracting complex features from input data, allowing them to perform vision tasks such as image classification, object detection, and segmentation.

[0111] CNNs can include a convolutional layer that applies filters to the input data to extract regional features, a pooling layer that reduces the spatial size of the feature maps extracted from the convolutional layer to reduce the amount of computation and maintain the abstracted features, an activation function that is used to calculate the output of each neuron, and a fully connected layer that is located at the end of the CNN and performs the final classification or prediction based on the extracted features.

[0112] The fully connected layer takes as input the output of the previous layer and outputs a score for each class, typically using a softmax function to obtain a probability distribution for each class.

[0113] Therefore, the artificial neural network module (112) of the disclosed invention is better at combining the results of multiple analytical models and correcting errors, thereby improving performance.

[0114] In addition, the artificial neural network module (112) according to the disclosed invention has excellent generalizability and scalability, and therefore has the advantage of being able to flexibly process information for various data types and sizes.

[0115] The following provides a detailed description of the input data and output data values ​​of the code analysis model (1111), user analysis model (1112), and developer analysis model (1113) in the threat detection module (110) of the disclosed invention, as well as the algorithms used therein.

[0116] Fig. 5 is a diagram showing input data of a code analysis model and vector values ​​corresponding thereto in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention. Fig. 6 is a diagram showing a chart and output vector values ​​output by a code analysis model based on an algorithm in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention.

[0117] Referring to Figures 5 and 6, the code analysis model (1111) of the threat detection module (110) according to the disclosed invention can input at least one of API information, permission information, code signature information, and hash information of an application stored in a user terminal and output code analysis information.

[0118] In addition, the code analysis model (1111) of the threat detection module (110) according to the disclosed invention can analyze an application by utilizing a random forest algorithm to utilize various characteristics obtained from the application's behavior and code.

[0119] The Random Forest algorithm is a machine learning classification algorithm that can be used to detect malicious apps through code-based analysis.

[0120] Random forest is an ensemble learning method based on decision trees.

[0121] The random forest algorithm is able to train several decision trees independently and then combine their results to perform the final prediction.

[0122] Through this, the random forest algorithm can build a more powerful predictive model by compensating for the bias and variance of individual trees.

[0123] Additionally, the random forest algorithm can introduce randomness into the training of each tree.

[0124] Such randomness can be applied to data sampling and feature selection.

[0125] Data sampling can be performed by using bootstrap sampling to provide each tree with different training data.

[0126] Feature selection allows each tree to be trained on a randomly selected set of features.

[0127] Such randomness can improve predictive performance by preventing overfitting and preserving diversity among different trees.

[0128] Additionally, the Random Forest algorithm can calculate and provide feature importance for each individual tree.

[0129] Importance indicates how much each feature influences the prediction, and can inform malicious app detection which features best explain malicious behavior.

[0130] Through this, the random forest algorithm can obtain useful information for feature selection and analyzing the characteristics of malicious behavior.

[0131] Therefore, when the random forest algorithm of the code analysis model (1111) according to the disclosed invention is applied to malicious application detection, the code analysis model (1111) can learn and make classification decisions based on the characteristics of each application.

[0132] For example, characteristics such as application permission requests, API calling patterns, and code structure can be used to distinguish malicious apps from legitimate apps.

[0133] Random forests can learn these features to classify new applications and identify apps that are predicted to be malicious.

[0134] Such random forest algorithms can be used in combination with other machine learning algorithms for malicious app detection, making it useful for building classification systems composed of an ensemble of different algorithms.

[0135] Therefore, the code analysis model (1111) according to the disclosed invention can learn specific APIs, unnecessary permission requests, dangerous permission requests, and malicious code patterns, enabling rapid detection and classification of malicious applications.

[0136] Additionally, the code analysis model (1111) of the disclosed invention determines malicious applications based on learned characteristics, and is therefore able to classify new malicious applications without relying on existing signature-based detection.

[0137] In addition, since the code analysis model (1111) according to the disclosed invention uses multiple decision trees, it has a technical effect of reducing overfitting and having noise-resistant characteristics, thereby reducing false positives.

[0138] 7 is a diagram showing input data of a user analysis model and a vector value corresponding thereto in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention. FIG. 8 is a diagram showing a chart and an output value outputted by a user analysis model based on an algorithm in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention.

[0139] Referring to Figures 7 and 8, the user analysis model (1112) of the threat detection module (110) according to the disclosed invention can input at least one of application usage time information, screen time information, battery consumption information, data usage information, interaction pattern information, and proximity sensor information, and output user analysis information.

[0140] In addition, the user analysis model (1112) of the threat detection module (110) according to the disclosed invention can utilize the DBSCAN (Density-Based Clustering of Applications with Noise) algorithm to obtain the average value of each cluster, calculate the difference between the variable value and the median value of the cluster, and analyze applications through the data.

[0141] In this case, the monitoring data of the user analysis model (1112) of the threat detection module (110) can be collected every seven days.

[0142] However, the collection cycle of the monitoring data is not limited to this, and may be formed at a cycle shorter or longer than 7 days.

[0143] The DBSCAN algorithm is a density-based clustering algorithm that can be used to form clusters based on the density of data points.

[0144] The DBSCAN algorithm has the advantage that it takes into account the distribution and density of the data to identify clusters and can automatically handle noisy data that are considered outliers.

[0145] The DBSCAN algorithm forms clusters based on the density of the data, making it sensitive to the distribution of the data.

[0146] For example, the DBSCAN algorithm can form dense clusters in areas where data is dense, and demarcate boundaries between clusters in sparse areas.

[0147] Such a DBSCAN algorithm does not require the number of clusters to be specified in advance, and is capable of identifying clusters of various types because it makes no assumptions about the shape and size of the clusters.

[0148] Thus, the user analysis model (1112) of the threat detection module (110) of the disclosed invention can group user behavioral data into clusters, through which anomalous behavior that differs from normal behavioral patterns can be identified.

[0149] Additionally, the user analytics model (1112) of the threat detection module (110) of the disclosed invention considers outliers as points that do not belong to a cluster and is useful for identifying users exhibiting anomalous behavior in a dataset.

[0150] 9 is a diagram showing input data of a developer analysis model and vector values ​​corresponding thereto in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention. FIG. 10 is a diagram showing a chart and output vector values ​​output by a developer analysis model through an algorithm in a signature-based malicious application detection apparatus according to an embodiment of the disclosed invention.

[0151] Referring to Figures 9 and 10, the developer analysis model (1113) of the threat detection module (110) according to the disclosed invention can input at least one of the application's certificate validity period information, certificate issuing country information, annotation language information, and certificate management information, and output developer analysis information.

[0152] Additionally, the developer analysis model (1113) of the threat detection module (110) of the disclosed invention can utilize a gradient boosting algorithm to analyze applications based on developer and certificate information.

[0153] More specifically, the developer analysis model (1113) can utilize the result values ​​that have undergone a boosting process using the gradient boosting algorithm XGBoost.

[0154] In addition, the developer analysis model (1113) of the threat detection module (110) according to the disclosed invention can be utilized as a supplementary means to the code analysis model (1111) and the user analysis model (1112).

[0155] XGBoost stands for eXtreme Gradient Boosting and is a gradient boosting algorithm.

[0156] XGBoost is specialized for dealing with large amounts of structured data and can be widely used to solve prediction problems in various domains.

[0157] XGBoost can essentially operate based on Gradient Boosting Trees.

[0158] Gradient boosting trees can construct an ensemble model by iteratively adding new trees that reduce the prediction error of previous trees.

[0159] Such an iterative process can be accomplished by computing gradients for the difference between predicted and actual values ​​(residuals) and training a new tree based on the gradients.

[0160] Thus, the developer analysis model (1113) of the threat detection module (110) of the disclosed invention can predict and assess the trustworthiness of an application developer by leveraging various intrinsic characteristics such as the application's certificate validity period, country of issue, and annotation language of the application.

[0161] In addition, the accuracy of such a developer analysis model (1113) can be improved by error correction.

[0162] That is, the artificial neural network module (112) of the disclosed invention can take vector values ​​collected by the pre-processing module (111), including the code analysis model (1111), the user analysis model (1112), and the developer analysis model (1113), as input information, determine malicious applications through a convolutional neural network algorithm, and output the determined information.

[0163] Therefore, the artificial neural network module (112) of the disclosed invention has the technical effect of being able to effectively identify the difference in patterns between malicious and normal applications by imaging and learning the vector values ​​extracted from each model.

[0164] Additionally, the artificial neural network module (112) of the disclosed invention is capable of detecting and classifying various patterns by learning specific patterns of malicious code in code-based analysis, identifying anomalous behavior in user-based analysis, and taking into account the identity of suspicious developers in certificate analysis.

[0165] Such an artificial neural network module (112) of the disclosed invention has the advantage of combining results, and can correct errors and improve performance by combining the results of multiple analytical models.

[0166] In addition, the artificial neural network module (112) according to the disclosed invention has the advantage of having excellent generalizability and scalability, thus performing flexible information processing according to various data types and sizes.

[0167] FIG. 11 is a flowchart illustrating a signature-based method for detecting malicious applications according to an embodiment of the disclosed invention.

[0168] Referring to FIG. 11, the signature-based method for detecting malicious applications according to the disclosed invention may include a step (S110) of determining whether an application is malicious based on machine learning.

[0169] More specifically, the step of determining whether the application is malicious based on machine learning (S110) may include a step of inputting at least one of the application's API, permission information, code signature information, and hash information, and outputting code analysis information.

[0170] In addition, the step of determining whether the application is malicious based on machine learning (S110) may include a step of inputting at least one of application usage time information, screen time information, battery consumption information, data usage information, and interaction pattern information, and outputting user analysis information.

[0171] In addition, the step of determining whether the application is malicious based on machine learning (S110) may include a step of inputting at least one of the application's certificate validity period information, certificate issuing country information, annotation language information, and certificate management information, and outputting developer analysis information.

[0172] Then, the step of determining whether the application is malicious based on machine learning (S110) may include inputting code analysis information and outputting information regarding whether the application is malicious.

[0173] In addition, the step of determining whether the application is malicious based on machine learning (S110) may include the step of inputting user analysis information and outputting information regarding whether the application is malicious.

[0174] In addition, the step of determining whether the application is malicious based on machine learning (S110) may include a step of inputting developer analysis information and outputting information regarding whether the application is malicious.

[0175] In addition, the step of determining whether the application is malicious based on machine learning (S110) may include a step of inputting at least two or more pieces of information among code analysis information, user analysis information, and developer analysis information, and outputting information regarding whether the application is malicious.

[0176] Thereafter, the signature-based malicious application detection method according to the disclosed invention may include a step of updating (S120) the malicious application information to a server database (131).

[0177] More specifically, the step (S120) of updating the malicious application information to the server database (131) may include a step of updating the server database (131) in such a way that the update module (130) stores information of the application in the server database (131) when the probability that the application is malicious is equal to or higher than a certain level according to the result detected by the threat detection module (110).

[0178] The signature-based malicious application detection method according to the disclosed invention may also include a step of collecting information on applications that have been removed from the OS market (S130).

[0179] More specifically, the step of collecting application information removed from the OS market (S130) may include crawling the publication and removal history of the OS market using the market crawling module (120).

[0180] Thereafter, the signature-based malicious application detection method according to the disclosed invention may include a step of updating (S140) the deleted application information in a server database (131).

[0181] More specifically, the step of updating the deleted application information in the server database (131) (S140) may include a step of updating the server database (131) in such a manner that, when it is confirmed that the application has been deleted from the market according to the crawling result of the market crawling module (120), the update module (130) stores the information of the application in the server database (131).

[0182] In addition, the signature-based malicious application detection method according to the disclosed invention may include a step of determining again whether a deleted application is malicious or not by machine learning when the application is re-uploaded to the market (S150).

[0183] More specifically, the step of re-determining whether an application is malicious using machine learning (S150) may include a step of re-determining whether the application is malicious using a threat detection module, since if an application that was removed from the vendor market is uploaded back to the vendor market, it may have been removed simply for non-compliance with regulations.

[0184] More specifically, when a deleted application is re-uploaded to the market, the step of re-determining whether the application is malicious or not using machine learning (S150) may include, when there is an application that was deleted from the vendor market but re-uploaded, checking the machine learning-based determination result of the threat detection module (110) as to whether the application is a malicious application or not.

[0185] Furthermore, the signature-based method for detecting malicious applications according to the disclosed invention may include a step of deleting (S160) the application from the server database (131) if the application is determined to be non-malicious.

[0186] More specifically, if the application is determined to be non-malicious, the step of deleting (S160) from the server database (131) may include a step of referring to the detection result of the threat detection module (110), and if the application is determined to be non-malicious, the update module (130) deleting information regarding the application from the server database (131).

[0187] As a result, the disclosed invention has the technical effect of reducing the false positive rate in detecting malicious applications through complementary contrast between the market crawling module (120) and the threat detection module (110).

[0188] SUMMARY OF THE DISCLOSURE A signature-based malicious application detection method and apparatus, according to one embodiment, provides a technical advantage in that it can quickly and accurately detect malicious applications through a variety of verification methods.

[0189] In addition, the signature-based malicious application detection method and apparatus according to one embodiment has the technical advantage of being able to quickly update the signature database with malicious applications that have been removed from the market by periodically crawling the publication history of vendor market apps.

[0190] In addition, the signature-based malicious application detection method and apparatus according to one embodiment has the technical advantage of being able to effectively protect users from malicious applications by utilizing developer characteristics and certificate characteristics of an application in machine learning and periodically updating the results output by the machine learning to a signature database.

[0191] Although the present invention has been described above with reference to preferred embodiments thereof, it will be understood that a person skilled in the art or having ordinary knowledge in the art can modify and change the present invention in various ways without departing from the spirit and technical scope of the present invention as described in the claims below.

Claims

1. a threat determination module including: a pre-processing module including a code analysis model that receives as input information at least one of API, permission information, code signature information, and hash information of an application stored in a user terminal, and outputs as output information code analysis information; and an artificial neural network module that receives as input information the code analysis information output by the pre-processing module, and outputs as output information application malignancy information that determines whether the application is malicious; an update module for classifying the application as a malicious application and storing it in a server database, and updating the application maliciousness information in the server database, if the application is determined to be malicious based on the application maliciousness information output by the artificial neural network module; and a market crawling module that collects information about published and removed applications in an app store; The update module classifies the deleted application as a malicious application based on the information about the deleted application collected by the market crawling module, and updates the application maliciousness information in the server database; When the market crawling module determines that the deleted application has been re-uploaded to the app store by collecting information on applications published in the app store, the threat determination module determines again whether the re-uploaded application is malicious, and when the re-uploaded application is determined to be not malicious, the update module deletes the re-uploaded application from the application maliciousness information in the server database. A signature-based malicious application detector.

2. The pre-processing module A user analysis model that inputs at least one of the application usage time information, screen time information, battery consumption information, data usage information, and interaction pattern information as input information and outputs user analysis information as output information. The signature-based malicious application detection apparatus of claim 1 .

3. The pre-processing module A developer analysis model that inputs at least one of the certificate validity period information, the certificate issuing country information, the annotation language information, and the certificate management information of the application as input information and outputs developer analysis information as output information. The signature-based malicious application detection apparatus of claim 1 .

4. The code analysis model The application is analyzed using a random forest algorithm. The signature-based malicious application detection apparatus of claim 1 .

5. The user analysis model The application is analyzed using a DBSCAN algorithm. The signature-based malicious application detection apparatus according to claim 2 .

6. The developer analysis model The application is analyzed using a gradient boosting algorithm. The signature-based malicious application detection apparatus according to claim 3 .

7. A step of inputting at least one of API, permission information, code signature information, and hash information of the application as input information and outputting code analysis information as output information by a pre-processing module included in the threat determination module; receiving the code analysis information as input information through an artificial neural network module included in a threat determination module, and outputting application maliciousness information as output information by the artificial neural network module, the application maliciousness information being determined by the artificial neural network module as to whether the application is malicious; classifying the application as a malicious application and storing it in a server database by an update module when the application is determined to be malicious based on the application maliciousness information output by the artificial neural network module, and updating the application maliciousness information in the server database; collecting information about published and removed applications in the app store by a market crawling module; classifying the deleted application as a malicious application based on information about the deleted application collected by the market crawling module, storing the classified application in the server database, and updating the server database; and by collecting information on applications published in the app store, when the market crawling module determines that the deleted application has been re-uploaded to the app store, determining again whether the re-uploaded application is malicious through a threat determination module, and when it is determined that the re-uploaded application is not malicious, deleting the re-uploaded application from the application maliciousness information in the server database. A signature-based method for detecting malicious applications.

Images