Malware detection method, electronic computer, program, and recording medium thereof

Abstract

To provide a malware detection method capable of detecting malware executed indirectly in an electronic computer, the electronic computer, a program, and its recording medium.SOLUTION: In a malware monitoring system, a detection method detects a process for executing macros or scripts included in an attachment file, and its member process when a client terminal opens or executes the attachment file of a mail, and stops or temporarily stops a communication function of the client terminal when a detection process is a process for accessing a web server via a shell of an operating system. Access to the web server is reported to security means or a display. Especially, access to the web server is a request for downloading an execution film, a communication function of the client terminal is stopped or stopped temporarily.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a malware detection method, an electronic computer, a program, and a recording medium thereof that can detect computer viruses such as malware executed on an electronic computer. More specifically, the present invention relates to a malware detection method, an electronic computer, a program, and a recording medium thereof that can detect malware caused by malicious code included in an electronic file. [Background technology]

[0002] Computers operate under the control of an operating system. Computer viruses can invade and operate on computers, causing them to perform malicious actions. A computer virus, broadly defined, is an executable file that invades a computer and is executed, or a macro, script, or other code that has invaded a computer and is executed. For example, the execution of an executable file or code can leak electronic data stored on the computer to the outside, cause problems with application programs that are running, or send emails without permission. Computer viruses operate through security holes in the operating system or through careless user actions.

[0003] Conventionally, antivirus software has been used to detect and stop computer viruses, but new computer viruses using new technologies have appeared, and countermeasures have been implemented accordingly. In recent years, a malware called "emotet" has caused serious damage. Application programs such as Microsoft Word (registered trademark) have a macro function that runs when a user file is opened.

[0004] When executing a macro function, a new process may be launched and access the operating system's shell, particularly PowerShell. A shell provides an interface to access the operating system's kernel, such as a program that provides an interface between the kernel and application programs, and is also known as a command interpreter. Typical shells include csh, bash, and ksh.

[0005] PowerShell is a scripting language and character user interface (CUI) developed by Microsoft (USA), and is a shell environment that integrates an interactive shell and a scripting execution environment. PowerShell allows you to send command instructions directly to the Windows (registered trademark) operating system using text. For example, the CUI can launch a specified program using text. Specific commands can be executed by outputting text messages from a running program to the PowerShell CUI without using a command prompt or mouse.

[0006] By using cmdlets, which consist of commands to be executed by the shell, users can perform almost all operations that were previously performed using a mouse, etc. PowerShell allows for advanced operation and processing of Windows by using scripts that combine multiple commands. It can perform complex commands and processes and operate application programs such as Excel and Word. Of course, PowerShell can also be used to run external programs or access the network to download data (files).

[0007] Malware starts from macros, scripts, etc. contained in electronic files, accesses PowerShell, and uses PowerShell's execution functions to operate computers. Emotet is a type of such malware, and uses PowerShell functions to access external servers, download and run malicious executable files. To hide and make its behavior difficult to understand, Emotet starts child and grandchild processes from processes derived from macros, scripts, etc., and these child and grandchild processes access external servers.

[0008] The external server that receives the request from PowerShell in this way sends a malicious executable file (binary file) to the computer. When the malicious executable file is executed on the computer, it takes over the computer, sends user files stored on the computer to an external location, and manipulates other computers connected to the computer. Macros, scripts, etc. that serve as the starting point for Emotet malware are often sent to users via email. They may also be contained in electronic files stored on memory sticks that users bring with them and connect to their computers.

[0009] When a user receives an email in an email application program or web browser and opens the attached file, the macro contained in the attachment is executed on the computer. For this reason, it is important to monitor whether the macro contained in the attachment is malware or a legitimate macro. Emails containing such malware are becoming more sophisticated every year, reaching a level that makes it difficult for users to determine whether they are legitimate or not. In particular, the content of the email body and the attached files is becoming more sophisticated, and the techniques used to trick users into executing (opening) the attached file are becoming more sophisticated.

[0010] Macros included in email attachments are often written in complex ways to make them difficult to read, making them difficult to counter with traditional antivirus methods. Even if the emotet introduction part can be identified and the pattern registered in the antivirus product's database, there are an infinite number of obfuscation patterns, so it is possible to continue creating emotet variants forever, making it difficult to counter. Emotet is included in attachments in file formats that can execute macros, scripts, etc.

[0011] When this macro or script is executed, it is possible to download and execute any malware, and then the malware itself is executed in a two-step process. In other words, the malware itself is executed indirectly by infiltrating a computer from the outside, starting with an emote introduction part such as a macro or script contained in an electronic file. When an electronic file such as a Word file stored in the secondary storage device of a computer is executed or viewed, the macro or script contained in it is executed, allowing access to PowerShell and sometimes becoming an emote introduction part.

[0012] When an email is viewed in a web browser, the attached file is stored in the computer's secondary storage before being opened. At this time, the macros or scripts contained in the file may be executed, which can access PowerShell and act as an emotet introduction. Electronic files stored on memory sticks that users bring with them and connect to their computers may also contain macros or scripts that act as emote introductions.

[0013] As a malware detection system that analyzes email attachments to detect malware, for example, a malware detection system that analyzes malware in the same environment as the user environment has been proposed (Patent Document 1). When this system receives an email addressed to a client terminal and including an attachment, it analyzes the received attachment by executing it in a clone sandbox environment built using the client terminal's environment or in a standard sandbox environment built without using the client terminal's environment.

[0014] Furthermore, a communication system has been proposed that reduces the risk that an internal terminal infected with malware will spread the infection to other internal terminals (Patent Document 2). In this communication system, if an email to a terminal has an attachment, the mail server transfers the attachment to a sandbox and sends a notification to the controller to start inspection of the file containing the identification information of the terminal.

[0015] The controller, upon receiving this inspection start notification, identifies the port of the switch connected to the terminal indicated in the inspection start notification, and sets the sampling rate of packets sent and received by the terminal for the identified port of the switch to be higher than that before receiving the inspection start notification. If the file is determined to be not malicious as a result of file inspection by the analysis device, the controller cancels the enhanced packet monitoring. [Prior art documents] [Patent documents]

[0016] [Patent Document 1] Japanese Patent Application Publication No. 2019-125243 [Patent Document 2] Japanese Patent Application Publication No. 2018-22944 Summary of the Invention [Problem to be solved by the invention]

[0017] However, antivirus software does not adequately detect processes executed indirectly. When detecting viruses on computers, antivirus software detects them using pattern matching and analysis of program behavior, but it is unable to detect malware with complex behavior that involves processes and the child processes derived from them. Attachment analysis using conventional sandboxes is performed every time an email contains an attachment, placing a heavy burden on computer resources. Therefore, there is a need for a method to detect malware with complex behavior that uses processes and child processes, such as emotet.

[0018] The present invention has been made in light of the above-mentioned technical background, and achieves the following objects. An object of the present invention is to provide a malware detection method, an electronic computer, a program, and a recording medium therefor that are capable of detecting malware that is indirectly executed on an electronic computer.

[0019] Another object of the present invention is to provide a malware detection method, an electronic computer, a program, and a recording medium thereof that can detect malware that uses processes and child processes in an electronic computer, downloads executable files from outside, and performs complex processing. [Means for solving the problem]

[0020] In order to achieve the above object, the present invention employs the following means. The present invention relates to a malware detection method, an electronic computer, a program, and a recording medium therefor.

[0021] The malware detection method of the present invention 1 includes: A malware detection method for an electronic computer, which is provided with a communication control function for controlling a communication function of an electronic computer that operates under the control of an operating system, and a process monitoring function for monitoring execution processes executed on the electronic computer, for monitoring files accessible by the electronic computer and detecting malware, comprising: the electronic computer comprises a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, and between application programs and the device drivers, and between the operating system and the device drivers; The control program When the file is opened or executed, the process executed by the macro or script contained in the file, and the child processes derived from the process, The aforementioned Detected by a process detection means operating in kernel mode, When the process or the child process accesses an external server via a shell environment of the operating system, the communication function of the computer is The aforementioned Stopping or pausing the communication by a communication stopping means operating in kernel mode, and The access to the external server is notified to a security means or a display.

[0022] A malware detection method according to Invention 2 of the present invention is characterized in that, in Invention 1, the shell environment comprises an interactive shell, which is a user interface, and a scripting execution environment.

[0023] The malware detection method of Invention 3 of the present invention is characterized in that, in Invention 1 or 2, the file is one or more selected from the group consisting of an attachment attached to an email or instant message, the attachment stored in an auxiliary storage means of the electronic computer, a first electronic file stored in an auxiliary storage means of the electronic computer, and a second electronic file stored in an auxiliary storage means detachable from the electronic computer.

[0024] The malware detection method of invention 4 of the present invention is characterized in that in inventions 1 to 3, the access to the external server is a request to download an executable file or a data file containing the executable file, or receiving a message or control data from the external server.

[0025] The malware detection computer of the present invention 5 is a communication control means for controlling the communication functions of a computer that operates under the control of an operating system; a process monitoring means for monitoring an execution process executed on the computer; and A malware detection computer comprising a malware monitoring means for monitoring files accessible by the computer and detecting malware, the electronic computer comprises a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, and between application programs and the device drivers, and between the operating system and the device drivers; The control program When the file is opened or executed, the process executed by the macro or script contained in the file and the child processes spawned from the process are detected. The aforementioned A process detector that runs in kernel mode, When the process or the child process accesses an external server via the shell environment of the operating system, the communication function of the computer is stopped or temporarily stopped. The aforementioned a communication stopping means operating in kernel mode; and The access control system is characterized in that it comprises a security means or a notification means for notifying a display of the access to the external server.

[0026] The malware detection computer of invention 6 of the present invention is characterized in that in invention 5, the shell environment comprises an interactive shell which is a user interface and a scripting execution environment.

[0027] The malware detection computer of Invention 7 of the present invention is characterized in that, in Inventions 5 or 6, the file is one or more selected from the group consisting of an attachment attached to an email or instant message, the attachment stored in an auxiliary storage means of the electronic computer, a first electronic file stored in an auxiliary storage means of the electronic computer, and a second electronic file stored in an auxiliary storage means detachable from the electronic computer.

[0028] The malware detection computer of invention 8 of the present invention is characterized in that, in inventions 5 to 7, the access to the external server is a request to download an executable file or a data file including the executable file, or receiving a message or control data from the external server.

[0029] The malware detection program of the present invention 9 is A malware detection program for causing an electronic computer to operate a communication control function that controls a communication function of the electronic computer, which is controlled by an operating system, and a process monitoring function that monitors processes executed by the electronic computer, and for monitoring files accessible by the electronic computer and detecting malware, comprising: the computer comprises a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, and between application programs and the device drivers, and between the operating system and the device drivers; of the control program The operation is When the file is opened or executed, the process executed by the macro or script contained in the file, or any child process that spawns the process, The aforementioned Detecting in kernel mode, When the process or the child process accesses an external server via a shell environment of the operating system, the communication function of the computer is The aforementioned stopping or pausing in kernel mode; and The method further comprises a step of notifying a security means or a display of the access to the external server.

[0030] The malware detection program of invention 10 of the present invention is characterized in that, in invention 9, the shell environment comprises an interactive shell which is a user interface and a scripting execution environment.

[0031] The malware detection program of invention 11 of the present invention is characterized in that, in invention 9 or 10, the file is one or more types of electronic file selected from the group consisting of an attachment attached to an email or instant message, an attachment stored in an auxiliary storage means of the electronic computer, an electronic file stored in an auxiliary storage means of the electronic computer, and an electronic file stored in an auxiliary storage means detachable from the electronic computer.

[0032] The malware detection program of invention 12 of the present invention is characterized in that, in inventions 9 to 11, the access to the external server is a request to download an executable file or a data file containing the executable file, or receiving a message or control data from the external server.

[0033] A malware detection program recording medium according to invention 13 of the present invention records a malware detection program according to any one of inventions 9 to 12. [Effects of the Invention]

[0034] The present invention provides the following effects. According to the present invention, it is now possible to detect malware that downloads malicious executable files from outside using malicious code contained in a file attached to an email. According to the present invention, it is possible to detect malware by monitoring processes that are executed indirectly. [Brief explanation of the drawings]

[0035] [Figure 1] FIG. 1 is a conceptual diagram illustrating an overview of a malware monitoring system 1 according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a conceptual diagram illustrating an overview of the client terminal 2 of the malware monitoring system 1 according to the first embodiment of the present invention. [Figure 3]FIG. 3 is a flowchart showing an example of the flow of operations of the malware monitoring system 1 according to the first embodiment of the present invention. [Figure 4] FIG. 4 is a block diagram showing an example of the configuration of the control program 50 of the malware monitoring system 1 according to the first embodiment of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION

[0036] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [First embodiment of the present invention] A malware monitoring system 1 according to a first embodiment of the present invention will now be described with reference to the drawings. Fig. 1 is a block diagram showing an overview of the malware monitoring system 1 according to the first embodiment of the present invention, Fig. 2 is a block diagram showing an overview of a client terminal 2 of the malware monitoring system 1, and Fig. 3 is a flowchart showing an overview of the operation of the malware monitoring system 1.

[0037] The malware monitoring system 1 according to the first embodiment of the present invention comprises a client terminal 2, a network, a mail server 4, a web server 5, a web server 7, etc. In this embodiment, the network is exemplified by the Internet 3. The malware monitoring system 1 according to the first embodiment of the present invention is a system for monitoring malware that manipulates the client terminal 2 in an unauthorized manner to cause it to operate in an unauthorized manner.

[0038] In particular, it is intended to monitor, detect, and report malware that infects client terminals 2 by being attached to emails or the like and attempts to connect to web servers 7 or the like to obtain malicious program code or malicious executable programs. In this specification, malware refers to executable programs, add-ons, modules, macros, scripts, and various program codes for these purposes that cause a computer to perform operations that the user does not intend and leak user data stored in the computer.

[0039] Furthermore, malware refers to executable programs, add-ons, modules, and program code therefor that run on a computer and have functions such as connecting the computer to external sites unintended by the user, downloading malicious programs, data, etc. from external sites, hijacking the computer, and operating the computer fraudulently. In particular, as explained below, we will use emotet as an example of malware. A malware monitoring system 1 according to a first embodiment of the present invention detects malware contained in electronic files and their operations in a client terminal 2, and blocks (prevents) the execution of the malware.

[0040] In more detail, when an attachment file in an email or an electronic file stored in the client terminal 2 is opened by a specific application program, the malware code included in the attachment file is executed, running a process on the client terminal 2, and this process or a child process derived from this process is detected and reported to have accessed the Internet 3. At this time, the malware monitoring system 1 stops or temporarily suspends the communication means for accessing the Internet 3 from the client terminal 2.

[0041] The electronic files stored in the client terminal 2 refer to files that are attached to e-mails and temporarily stored in the client terminal 2, electronic files that are stored in a memory stick connected to the client terminal 2, and electronic files that are stored in an internal or external auxiliary storage means (including the aforementioned memory stick) of the client terminal 2. In other words, the electronic files stored in the client terminal 2 are electronic files that are stored in any auxiliary storage means, such as the internal auxiliary storage means, external auxiliary storage means, network drive, virtual auxiliary storage means, etc. of the client terminal 2.

[0042] The electronic files stored in the client terminal 2 are actually stored in network storage or the like, and include electronic files that can be accessed via a network drive of the client terminal 2. The communication means referred to here means a network card such as a LAN card for connecting the client terminal 2 to a network, a wireless communication means such as Wi-Fi (registered trademark), a specific communication port, etc. The client terminal 2 is a general-purpose electronic computer equipped with a central processing unit (CPU), main memory means, input means, output means, a data bus, etc. The block diagram in Figure 2 illustrates an example of the configuration of the client terminal 2, which will be described in detail later.

[0043] The Internet 3 is a communication network. In this embodiment, the communication network will be described using the Internet 3 as an example. Any communication network can be used instead of the Internet 3, such as a mobile communication network, LAN, WAN, etc., as long as the client terminal 2 can receive emails via the network and can access servers on the network. The client terminal 2 connects to the Internet 3 directly or via a communication relay means 10 such as a gateway, a router, a wireless gateway, a proxy server, or a wireless access point.

[0044] A client terminal 2 can connect to and communicate data with other client terminals 2 via a communication network such as a LAN 11. For example, client terminal 2a is connected to client terminals 2b and 2c via the LAN 11. Although not shown, LAN 11 can be connected to the Internet 3 via a relay such as a gateway, or can be a standalone closed network.

[0045] The client terminal 2 can be connected to a communication network such as the Internet 3 or LAN 11 using a wired connection means such as a LAN cable, or a wireless connection means such as Wi-Fi. The client terminal 2 is equipped with both connection means, but is not limited to these, and can select the appropriate connection means depending on the situation to connect to the communication network.

[0046] Data communication between the client terminal 2 and the communication network involves encrypting the electronic data to be communicated and transmitting and receiving it according to a predetermined communication protocol. Any communication protocol can be used, but a protocol conforming to the ISO reference model, particularly a protocol commonly used on the Internet such as TCP / IP, is preferred. In this embodiment, the method and means for connecting the client terminal 2 to the communication network are not the gist of the invention, so a detailed description thereof will be omitted.

[0047] The mail server 4 is a server for providing e-mail services to users, and users access it using their own account address, password, etc., to receive e-mails on the client terminal 2. A mail program 61 (see FIG. 2) is installed and running on the client terminal 2, and users use the mail program 61 by setting account information for their mail account, mail server 4, etc.

[0048] When the mail program 61 is launched, it basically connects to the mail server 4 based on set rules, performs authentication, and receives and displays the user's mail. A file may be attached to the mail, which is referred to as an attachment in this embodiment. An attachment can be any file, such as a text data file, a document file in a specific format, or an executable program. The user can open the attachment using an appropriate application program and view its contents, or, if it is an executable file, run it.

[0049] Furthermore, the electronic files stored in the auxiliary storage means of the client terminal 2 can be any file, such as a text data file, a document file in a specific format, an executable program, etc. The user can open the electronic file using an appropriate application program and view the contents, or run the file if it is in executable format.

[0050] Here, web server 5 and web server 7 on the Internet 3 are shown as examples. Web server 5 is a server that stores general-purpose web data in an internal web database 6 or the like and provides web services. A user accesses web server 5 and obtains data by entering the address of web server 5 or the address of a service provided by web server 5 into a browser or the like on client terminal 2. Client terminal 2 issues commands to a shell such as PowerShell to access web server 5 and send and receive data.

[0051] 1, the connections between client terminal 2 and servers (web server 5, web server 7, etc.) are stylized by dashed lines 9 (hereinafter referred to as connections 9). Here, client terminal 2 is connected to and communicates with mail server 4 via connection 9a, web server 5 via connection 9b, and web server 7 via connection 9c.

[0052] The data acquired from the web server 5 is displayed and processed on the browser of the client terminal 2. At this time, the data acquired from the web server 5 is displayed on the browser, or a predetermined process is performed according to the code of the data. For example, according to the code of the data, another web server can be accessed (connection 9b), and various data including image data can be acquired on the client terminal 2 and processed.

[0053] In this way, web server 5, which provides normal data, can also be said to be a normal (good) web server. In contrast to this, there are web servers that provide malicious code, such as web server 7. Web server 7 masquerades as web server 5, provides malicious code that takes over client terminal 2, or sends code or executable files to client terminal 2 that induce users to perform fraudulent actions. Client terminal 2 accesses web server 7 to download executable files, download data files that include executable files, receive messages containing malicious code from web server 7, receive control data containing malicious code from web server 7, and so on.

[0054] In other words, if such malicious code is contained in an email or its attachment received by a user, the user will access web server 7 (connection 9c). Web server 7, like web server 5, has web database 8. The present invention prevents or stops client terminal 2 from accessing web server 7 (connection 9c). Specifically, the present invention prevents or stops client terminal 2 from accessing web server 7 and downloading executable files, downloading data files including executable files, receiving messages including malicious code from web server 7, receiving control data including malicious code from web server 7, and so on. However, when client terminal 2 attempts to access an external server, it is difficult to easily determine whether the server it is connecting to is malicious or a normal (good) server. Therefore, if there is suspicion, the entire external connection 9 may be disconnected.

[0055] In the malware monitoring system 1, as will be described later, when an attempt is made to access the web server 7 from the client terminal 2 or when such an attempt is suspected, such access is stopped by a control means that controls the client terminal 2 and a monitoring means that monitors the client terminal 2. In this regard, as shown in Figure 2 below, an outline of the hardware and software of the client terminal 2 will be explained, and then the flow of operation will be explained with reference to Figure 3.

[0056] When code suspected of being malware is executed in the client terminal 2 and accesses the web server, it is extremely difficult to determine whether this is a normal web server 5 or a malicious web server 7, so such access is stopped entirely or partially to deal with the malware. For example, the client terminal 2 reports the detected malware to the security software, reports it to the administrator, displays a warning on the display, and waits for instructions from the antivirus software, the administrator, the user, etc.

[0057] [Client terminal 2] FIG. 2 shows an overview of the hardware and software of the client terminal 2. The client terminal 2 is made up of software such as an operating system 20, a control program 50, a device driver 21, and an application program 60, and hardware such as a device 22. The client terminal 2 operates under the control of the operating system 20.

[0058] The program code of the operating system 20 is stored in auxiliary storage means such as HDD 41 of the client terminal 2, and is read, expanded into RAM, and executed. Software such as application programs 60 runs on a platform provided by the operating system 20. The operating system 20 has two operating modes: kernel mode 25, which allows all commands to be executed, and user mode 24, which restricts the execution of some commands.

[0059] The application program 60 basically runs in user mode 24 and uses the input / output functions of the operating system 20 to send data to the device 22 via the device driver 21 and retrieve data from the device 22. The control program 50 runs in kernel mode 25 of the operating system 20. The control program 50 controls the device driver 21 in kernel mode 25 and realizes communication between the device drivers 21 in kernel mode 25.

[0060] Although the monitoring program 51 is a type of application program 60, it is a component of the present invention and is therefore illustrated separately in Fig. 2. The monitoring program 51 is an application program that runs in user mode 24, and has functions such as making settings to detect malware and reporting detected malware and related data to the application program 60, etc.

[0061] 2, the devices 22 include input devices such as a mouse, keyboard, touch panel, touch display, etc., display devices such as a display, audio output devices such as a speaker, auxiliary storage devices such as an HDD 41, main storage devices (RAM), network cards (LAN cards, Wi-Fi adapters), graphics cards, etc. Since the present invention is not an invention of hardware that constitutes a computer, detailed explanation will be omitted, and only parts directly related to the present invention will be illustrated and explained.

[0062] Each device 22 is controlled by its respective device driver 21. Specifically, the network card 40 is controlled by a network driver 30, and the HDD 41 is controlled by a disk driver 32 and a file system driver 31. The file system driver 31 acts as a gateway for the input / output functions (I / O functions) of the operating system 20 for the HDD 41, controls it, and mediates and controls data communication with the operating system 20, application programs 60, etc.

[0063] The operating system 20 originally controls devices 22 via its input / output functions (I / O functions) using device drivers 21. Some application programs 60 run in kernel mode 25, but this is limited to special programs that directly access system resources. General-purpose application programs, especially object-oriented application programs, basically run in user mode 24, and when accessing kernel mode 25, they use functions such as input / output functions provided by the operating system 20.

[0064] In the present invention, a control program 50 positioned between the operating system 20 and the device driver 21 controls the input / output functions of the operating system 20 and the device driver 21. The configuration and functions of the control program 50 will be described in detail later. In this embodiment, user data is an application program 60 or electronic data used by a user.

[0065] User data includes, but is not limited to, text files, still image files, video files, audio files, document files of various formats (Word, PDF, etc.), computer program code files, executable files (.exe files), communication history, operation history of application programs, backup files of operating systems or application programs, various temporary files, memory contents, and other files of any format, as well as backup files of these.

[0066] Furthermore, user data is broadly interpreted to include data that requires data management, such as secret sharing codes, their recovery codes, encryption codes, decryption codes, identification numbers, PIN numbers, personal information, customer data, business know-how, information related to confidential data, documents thereof, etc. The device driver 21 is located between the operating system 20 and the device 22, and transmits and receives data between them. Although not shown, the client terminal 2 is equipped with a hardware abstraction layer (HAL) located between the software and hardware.

[0067] Although not shown, the client terminal 2 has a connector for connecting to peripheral devices, and the connector is preferably a serial port such as SATA, RS-232C, IrDA, USB, or IEEE1394, or a parallel port such as IEEE1284, SCSI, or IDE. The client terminal 2 also communicates with other devices via these connectors using a communication standard such as Bluetooth (registered trademark). The application program 60 is, for example, software for creating and editing documents such as word processing software or a text editor, or software for viewing, creating, and editing files in a specific format such as PDF files.

[0068] The operating system 20 is software that provides basic functions such as input / output functions from input / output devices such as keyboard input, mouse input, and screen output, as well as management of storage devices and memory, and operates and manages the entire client terminal 2. The operating system 20 is also called basic software. The operating system 20 is composed of a number of executable programs to realize the functions it provides.

[0069] Here, we will provide an overview of representative components of the operating system 20. The operating system 20 is composed of a kernel, an executive, subsystems, device drivers 21, HAL, etc. The subsystems are services provided in the user mode 24 of the operating system 20. The executive provides basic services of the operating system 20, such as memory management, process and thread management, security, I / O (input / output), networking, and inter-process communication.

[0070] The kernel provides low-level functions such as thread scheduling, interrupts, exception notification, and multiprocessor synchronization. The kernel also provides a routine set and basic objects used within the executive. A device driver 21 is usually created for each piece of hardware connected to the client terminal 2, and directly controls the device 22 via the HAL. The device driver 21 provides a service that converts input / output function requests (I / O call requests) from the application program 60 or the operating system 20 into input / output function requests (I / O requests) for a specific device 22, and system services such as a file system and network driver.

[0071] The HAL is a code layer that separates and abstracts the kernel, device drivers 21, and executive from platform-specific hardware functions. The HAL absorbs differences due to the model and type of hardware, such as built-in devices of the client terminal 2 and external devices connected to the client terminal 2, and provides abstracted services to each service of the operating system 20.

[0072] This allows the various services that make up the operating system 20 to access hardware without being aware of differences in hardware model or type. The operating system 20 has a built-in shell environment for the user interface. For example, PowerShell is a scripting language and character user interface (CUI) developed by Microsoft, and is a shell environment that integrates an interactive shell and a scripting execution environment, and is included as standard in Windows.

[0073] PowerShell can use text to send commands directly to the Windows OS and control computers. Specific commands can be executed by outputting text messages from a running program to the PowerShell CUI, without using the command prompt or a mouse. It is possible to run macros and scripts from application programs such as Excel and Word, access PowerShell, control computers, run external programs, access networks, and download data.

[0074] As described above, the typical configuration and functions of the operating system 20 have been described, but detailed explanations will be omitted and refer to related books, web sources, etc. Detailed explanations of the Windows-based operating system used in the embodiment of the present invention, including explanations of PowerShell, will be omitted and refer to specialized books and operating system instruction manuals.

[0075] [Surveillance Program] The monitoring program 51 (see FIG. 4) is application software that runs in the user mode 24 of the operating system 20. The monitoring program 51 is located between the application program 60 and the operating system 20, and is an application program that mediates and controls the sending and receiving of commands and data between them. The monitoring program 51 has the function of monitoring the startup of the application program 60 and the startup of the processes that accompany it, and acquiring attribute information about these.

[0076] The monitoring program 51 provides a user interface for accessing the file system from the operating system 20. The monitoring program 51 operates in cooperation with the control program 50, transmits communication data acquired in the user mode 24 to the control program 50, and controls the application program 60 and the operating system 20 according to instructions from the control program 50.

[0077] 3 is a flowchart illustrating an example of the operation flow of the malware monitoring system 1 according to the first embodiment of the present invention. When the client terminal 2 starts up, various initial settings are performed, the system starts up, and the user logs in and is authenticated (steps 1 and 2). The monitoring program 51 performs settings for monitoring malware, and the control program 50 starts monitoring malware (step 3).

[0078] In the monitoring program 51, the contents to be initially set can be built into the monitoring program 51, but it is preferable to read a preset setting file and perform the initial setting described therein. The setting file is set by an administrator of the client terminal 2 or a system administrator and stored in the client terminal 2. The setting file includes monitoring conditions such as, but not limited to, application programs, macros, executable files, names of the files to be monitored (including extensions), storage locations, etc.

[0079] The configuration file can include, but is not limited to, application programs, macros, and executable files that should not be monitored, as well as the names (including extensions) and storage locations of the files to be monitored. Furthermore, the configuration file can specify, as a whitelist, server addresses, URLs, port numbers, etc. that should not be monitored, in other words, server addresses that should not be disconnected. Furthermore, the configuration file can specify the method and destination for notifying related data when malware is detected.

[0080] For example, the notification destination can be set to whether to notify an application program 60 such as an antivirus program 63 running on the client terminal 2, and whether to display the notification on the screen. The setting file is stored encrypted or unencrypted in a folder designated by the monitoring program 51. For example, it is stored in the folder of the monitoring program 51, the control program 50, or a subfolder thereof. The monitoring program 51 can specify and initially set a location where a monitoring process list indicating processes being monitored by the control program 50 is saved.

[0081] In this case, when the control program 50 starts monitoring a process, it adds a process identification number (PID) to the monitored process list. The monitored process list is stored in a folder designated by the monitoring program 51, either encrypted or unencrypted. The monitored process list, as shown in Table 1 below, for example, is made up of data such as "No." indicating the list number, "PID" indicating the process identification number of the monitored process, child "PID" indicating the PID of a child process derived from this process, "grandchild PID" (not shown) indicating the PID of a grandchild process, "application program" indicating the application program of the monitored process, and "file" indicating the file to be used. [Table 1]

[0082] The client terminal 2 connects to the mail server 4 from the mail program 61 and receives the mail (step 4). The user opens the received mail with the mail program 61 and opens the attached file (step 5). The attached file is opened with an application program 60 that corresponds (suitable) to the type (extension) of the attached file. In other words, the attached file is passed to an application program 60 that corresponds (suitable) to the type of the attached file, and the attached file is opened by the application program 60.

[0083] For example, if the file has an extension such as docx, the attached file is opened in an office application program 62. An example of the office application program 62 is Microsoft Word. The attached file is displayed on the screen, edited, and specific processing is performed by the office application program 62. In some cases, the code of a macro 64 included in the attached file causes the office application program 62 to execute a macro, or the office application program 62 issues instructions to an external program or retrieves data from the external program.

[0084] When the attached file is opened by the office application program 62, the monitoring program 51 detects this action and determines whether to monitor the behavior of the attached file and the office application program 62 (step 6). In other words, it determines whether the attached file and the office application program 62 are the first monitoring targets. If the behavior of the attached file and the office application program 62 indicates that they are not the monitoring targets (first monitoring targets), the monitoring process proceeds to the next step (step 6 → step 10).

[0085] In this case, if the attached file and the office application program 62 have been registered in advance on the whitelist, it is determined that the file is not a monitoring target (first monitoring target). If it cannot be determined based on the execution of the office application program 62 alone, monitoring continues (step 6 → step 7). The office application program 62 is executed, and may execute a macro 64 (step 7).

[0086] When macro 64 is executed, process 71 or process 72 of macro 64 is newly started and operates (step 8). Control program 50 detects newly started process 71 or process 72, begins monitoring it (second monitoring target), and analyzes it (step 9). The monitored process 71 or 72 may start a child process (third monitoring target), access PowerShell 23, use a communication service, and access an external server (e.g., web server 5 or web server 7) (steps 11 to 14).

[0087] At this time, it is confirmed whether a data download request has been issued to the external server (step 14). If a data download request has been issued, the control program 50 cuts off communication (steps 15 and 16). The operation after communication is cut off will be described later. In step 9, if the monitored process does not start a child process (third monitored object) and does not access PowerShell 23, the process proceeds to the next step (steps 10 and 20).

[0088] In step 9, if the monitored process launches a child process (third monitored target) and this is a process that is not a monitored target, in other words, if it does not access PowerShell 23, the process proceeds to the next step (step 12 → step 10, step 20).In step 11, if child process 73 (third monitored target) is started, it is registered in the monitored process list as a monitored target process, and monitoring begins (step 12, step 13 → step 10).

[0089] If process 72 is registered as a target for monitoring in the monitored process list, child process 73 started by this process 72 is automatically flagged and registered as a target for monitoring in the managed process list. If the child process does not start, the process moves to the next step (step 9 → step 10). If the monitored processes 71 and 72 access PowerShell 23 but do not use a communication service or issue a data download request, the process moves to the next step (step 15 → step 10).

[0090] When a download request is made and communication is blocked, the process 71-73 that issued the download request is identified, and the original file of the process 71-73 is identified (step 17). The process 71-73 checks the process 70 that started it, the parent process, the application program 60, and the original file, and ultimately identifies the original file (step 17). At this time, it is possible to identify the email to which the original file is attached, the USB storage from which the original file was read, the web address from which the file was downloaded, etc.

[0091] The control program 50 checks the communication process log included in the download request and obtains the address of the access destination, etc. (step 18). The control program 50 notifies the monitoring program 51 of the detected data, such as the identified download request, the process 71-73 that issued the request, the parent process of this process, the application program 60, the original file, etc. The monitoring program 51 notifies security software, such as the antivirus program 63, of the detected data received from the control program 50 (step 19).

[0092] An example of this notification report is shown below. [Table 2]

[0093] The security software receives the detected data from the monitoring program 51, analyzes it, and takes countermeasures. The control program 50 blocks communication from the client terminal 2 to the outside, and performs the following operations in accordance with instructions from the antivirus program 63. Then, the process moves to the next step (step 20).

[0094] (Detailed operation) The control program 50 implements process monitoring using the CreateToolhelp32Snapshot function, Windows Filtering Platform, etc. The CreateToolhelp32Snapshot function (tlhelp32.h) is a function included in the operating system 20 that creates a snapshot of a specific process (the heap, module, and thread used by it). When executed, the type of information specified by Flags is created and its handle is returned. The CreateToolhelp32Snapshot function is declared as follows:

[0095] Here, the argument Flags is a flag that specifies the type of snapshot to be created, and the argument ProcessID is the process identification number (ID) that specifies the process for which a snapshot is to be created if TH32CS_SNAPHEAPLIST or TH32_CS_SNAPMODULE is specified in Flags; if any other flag is specified, this argument is ignored.

[0096] The CreateToolhelp32Snapshot function is declared as "HANDLE Toolhelp32Snapshot(DWORD Flags, DWORD ProcessID)" in C, and as "Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal Flags As Long, ByVal ProcessID As Long) As Long" in VB. The Windows Filtering Platform (WFP) is an architecture introduced in Windows Vista and later that enables network traffic filtering. The network driver control unit 58 operates on this Windows Filtering Platform, enabling data exchange with the application program 60.

[0097] By using this, it is possible to stop specific functions of the Windows firewall as needed when accessing the network (Internet 3) from the client terminal 2. CreateProcessNotifyEx is used to monitor whether a process has started or is running, and CreateProcessNotifyEx notifies this notification to the device driver, etc. [Table 3]

[0098] 4 shows the configuration of the control program 50. The control program 50 is used to realize data transmission and reception between device drivers 21, and communication between application programs 60 and device drivers 21, and between the operating system 20 and device drivers 21 in kernel mode 25. The control program 50 includes a control unit 52, an interface unit 53, an encryption unit 54, a decryption unit 55, a log acquisition unit 56, a device driver control unit 57 (a network driver control unit 58, a file system control unit 59), and the like.

[0099] The device drivers 21 utilize the input / output functions of the operating system 20 to communicate with each other and with the application program 60. A control program 50 is provided between the device drivers 21 and the operating system 20. When transferring data between the device drivers 21 in kernel mode 25, the control program 50 can perform high-speed data transfer and, since it operates in kernel mode 25, can monitor the operation of the operating system 20, thereby ensuring data security.

[0100] Therefore, the control program 50 has the advantage of being able to transfer large volumes of data at high speed in a short period of time, and can also achieve a high level of security by monitoring the operation of the operating system 20, particularly the process 70, in kernel mode 25. The control program 50 provides a common interface when an application program 60 accesses the device driver 21, and when the device driver 21 sends data to the application program 60.

[0101] The interface unit 53 is for receiving commands and data from the application program 60 and transmitting data to the application program 60. In other words, the interface unit 53 is for receiving commands and / or data output from the application program 60 and transmitting the execution results of these commands and / or received data received from the device driver 21 to the application program 60.

[0102] The log acquisition unit 56 is for acquiring the operation history of the control program 50. The encryption unit 54 is for encrypting data to be communicated, and the decryption unit 55 is for decrypting the encrypted data. The device driver control unit 57 is for sending these commands and / or data to the device driver 21 and receiving the execution results of the commands and / or received data from the device driver 21. The control unit 52 is for processing these commands and / or data, generating output data, and controlling the data.

[0103] In other words, the control unit 52 is a core part of the control program 50, and serves to control and monitor other parts of the control program 50, such as the device driver control unit 57 that controls each device driver 21, the interface unit 53, the log acquisition unit 66, the encryption unit 54, and the decryption unit 55. The device driver control unit 57 is made up of each control unit 57 for controlling each device driver 21.

[0104] For example, it comprises a network control unit 58 for controlling the network driver 30, a file system control unit 59 for controlling the file system driver 31, etc. The device driver 21 may be provided as an attachment to the operating system 20, or may be created as needed by a device provider or the like and installed in the client terminal 2.

[0105] The device driver control unit 57 receives data as a result of executing the above-mentioned command from the device driver 21 and transmits it to the control unit 52. In this way, the control program 50 is a core unit that controls the client terminal 2, particularly the operation of each device in the client terminal 2. When the control program 50 stops the communication function, it directly controls the device driver that is communicating, such as the network driver 30.

[0106] [Second embodiment of the present invention] The malware monitoring system 1 according to the second embodiment of the present invention will be described below. The malware monitoring system 1 according to the second embodiment of the present invention is basically the same as the malware monitoring system 1 according to the first embodiment described above, and only the differences will be described. In the malware monitoring system 1 according to the first embodiment described above, monitoring of attachments received by the mail program 61 has been described.

[0107] In this embodiment, monitoring of electronic files stored in the client terminal 2 will be described. In the malware monitoring system 1 of the first embodiment described above, when the email program 61 is opened and a file attached to the email is saved in the HDD 41, a mark is added to the saved file (hereinafter referred to as the saved file) and the file is monitored. The saved file is registered in a monitoring process list or the like and monitored. At this time, the control program 50 holds data associating the saved file with the email to which the saved file is attached.

[0108] When a request to open a saved file is made by a user or from an office application program 62, this request is sent to the file system driver 31 and disk driver 32 via the control program 50. The control program 50 monitors saved files, and therefore monitors the process 70 that opens and operates on the saved file. When this process 70 accesses the Internet via PowerShell 23, access to the Internet is blocked, and the monitoring program 51 notifies an appropriate program of a report about the saved file.

[0109] When email is sent using a web browser and a cloud service is used, the file attached to the email is saved to a local temporary directory, a user folder on the HDD 41, or the like. During this saving operation, the control program 50 stores data associating the saved file with the email to which it is attached. For example, when a file is downloaded using a web browser, the file is marked using a function called Alternate Data Streams in NTFS.

[0110] When a request to open a saved file is made by a user or from an office application program 62, this request is sent to the file system driver 31 and disk driver 32 via the control program 50. The control program 50 monitors saved files, and therefore monitors the process 70 that opens and runs the saved file. When this process 70 accesses the Internet 3 via PowerShell 23, the access to the Internet 3 is blocked, and the monitoring program 51 notifies an appropriate program (such as an antivirus program 63) of a report about the saved file.

[0111] As described above, whether using the email program 61 or the email cloud service of a web browser, the control program 50 can monitor the behavior of email attachments, and when malicious access to the Internet is suspected, it can block the access and notify the antivirus program 63. In particular, when an attachment is saved to an auxiliary storage device such as the HDD 41, or when a saved attachment is copied, it can be tracked and monitored.

[0112] [Third embodiment of the present invention] The malware monitoring system 1 according to the third embodiment of the present invention will be described below. The malware monitoring system 1 according to the third embodiment of the present invention is basically the same as the malware monitoring system 1 according to the first or second embodiment described above, and only the differences will be described. In this embodiment, monitoring of electronic files stored in a client terminal 2 will be described.

[0113] When a user instructs the control program 50 to open a saved file stored in the HDD 41, or when an office application program 62 requests to open a saved file, this request is sent to the file system driver 31 and the disk driver 32 via the control program 50. The control program 50 monitors saved files called from the HDD 41, and therefore monitors the process 70 that opens and operates the saved file. When this process 70 accesses the Internet 3 via PowerShell 23, the control program 50 blocks access to the Internet 3, and the monitoring program 51 notifies an appropriate program of a report about the saved file.

[0114] Specifically, the control program 50 monitors the process 70 that opens and runs a saved file, and when this process 70 accesses the Internet 3 via PowerShell 23, it blocks access to the Internet and notifies an appropriate program (antivirus program 63) of a report about the saved file. As described above, even when a saved file stored in the client terminal 2 is used, the control program 50 can monitor the behavior of the saved file. When the control program 50 suspects malicious access to the Internet 3 from the saved file, it can block the access and notify the antivirus program 63.

[0115] [Fourth embodiment of the present invention] The malware monitoring system 1 according to the fourth embodiment of the present invention will be described below. The malware monitoring system 1 according to the fourth embodiment of the present invention is basically the same as the malware monitoring systems 1 according to the first to third embodiments described above, and only the differences will be described. In this embodiment, monitoring of electronic files stored on a memory stick connected to a client terminal 2 will be described.

[0116] An example of an electronic file brought into the client terminal 2 from outside is an electronic file stored in an auxiliary storage device such as a memory stick. A memory stick is a portable non-volatile auxiliary storage device such as a USB memory. When an auxiliary storage device such as a memory stick is connected to the client terminal 2, or when an electronic file therein is accessed from the client terminal 2, the control program 50 begins to monitor the electronic file, in other words, the saved file.

[0117] This access request is sent from application program 60 to file system driver 31 and disk driver 32, via control program 50. Control program 50 monitors saved files called from the memory stick, and therefore monitors process 70 that opens and runs the saved file. When this process 70 (child process, grandchild process) accesses the Internet 3 via PowerShell 23, access to the Internet 3 is blocked, and monitoring program 51 notifies an appropriate program of a report about the saved file.

[0118] Specifically, the control program 50 monitors the process 70 that opens and operates on a saved file, and when this process 70 accesses the Internet 3 via PowerShell 23, it blocks access to the Internet 3 and notifies an appropriate program (such as an antivirus program 63) of a report about the saved file.

[0119] As described above, even when using a saved file stored on a memory stick connected to the client terminal 2, the control program 50 can monitor the behavior of the saved file. If the control program 50 suspects malicious access to the Internet from the saved file, it can block the access and notify the antivirus program 63.

[0120] Fifth embodiment of the present invention A malware monitoring system 1 according to a fifth embodiment of the present invention will be described below. The malware monitoring system 1 according to the fifth embodiment of the present invention is basically the same as the malware monitoring systems 1 according to the first to fourth embodiments described above, and only differences will be described. In this embodiment, monitoring of attachments received by a messenger program will be described.

[0121] A messenger program is an application program for sending and receiving instant messages consisting of text, image data, etc. over a network such as the Internet 3, and is sometimes called an instant messenger. With a messenger program, multiple users connected via the Internet 3 can send and receive messages (instant messages) in real time using their respective client terminals 2.

[0122] Users use a messenger program running on their client terminal 2 to send and receive instant messages consisting of text, image data, user files, etc. with other users. Messenger programs are independent application programs that are installed and run on the client terminal 2, add-on programs that run on a web browser, etc., and online programs that run entirely on a web browser, and are basically used to send and receive messages.

[0123] Examples of messenger programs include Facebook Messenger (registered trademark), WhatsApp (registered trademark), WeChat (registered trademark), LINE (registered trademark), Skype (registered trademark), and Viber (registered trademark). Here, a messenger program refers to any application program that can send and receive text, image data, user files, etc. A messenger program can send user files such as Word files as instant messages.

[0124] In this case, the user passes the user file sent by the messenger program to an appropriate application program to open and view it, or saves it in an auxiliary storage device such as the HDD 41 of the client terminal 2. Saving a user file in an auxiliary storage device includes saving it in any folder in the client terminal 2, such as the messenger program's temporary folder or the user's My Documents folder. User files saved in the auxiliary storage device are opened and viewed using the office application program 62, etc. When a request is made to open a saved user file, this request is sent to the file system driver 31 and disk driver 32 via the control program 50.

[0125] The control program 50 monitors user files, and therefore monitors the process 70 that opens and runs the user file, and when this process 70 accesses the Internet via PowerShell 23, it blocks access to the Internet, and the monitoring program 51 notifies an appropriate program of a report about the user file. As described above, when a user file is downloaded and saved from a messenger program, the control program 50 marks the user file using an NTFS function called Alternate Data Streams and monitors it.

[0126] As described above, even when a messenger program is used to receive a user file, the control program 50 can monitor the behavior of the transmitted user file, and if the access is suspected to be malicious access to the Internet, the access can be blocked and a notification can be sent to the antivirus program 63. When a user file is saved in an auxiliary storage device such as the HDD 41, or when a saved user file is copied, it can be tracked and monitored.

[0127] [Sixth embodiment of the present invention] Below, we will explain a malware monitoring system 1 according to a sixth embodiment of the present invention. The malware monitoring system 1 according to the sixth embodiment of the present invention is basically the same as the malware monitoring systems 1 according to the first to fifth embodiments described above, and we will only explain the differences. In this embodiment, we will explain the procedure for monitoring malware that operates via Windows Management Instrumentation (hereinafter referred to as WMI) objects.

[0128] WMI, along with the Windows (Native) Application Programming Interface (API), is used to manage Windows and is composed of objects. WMI is used to manage both local and remote computers and to perform routine management tasks using programming languages ​​and scripting languages. For example, when malware such as emotet is executed, it obtains a WMI object such as Win32_Process, calls the Create method to operate, and starts a child process (second process).

[0129] This behavior is performed via a Windows COM (Component Object Model) object. More specifically, the malware calls the Create method to access the Windows COM object and then accesses the Windows Management Instrumentation Provider Service (WmiPrvSE.exe). The Windows COM object is a Windows mechanism (technical specification) that allows application program functions to be called and used externally, and is used by the Windows operating system and the software that runs on it.

[0130] When malware accesses the Windows Management Instrumentation Provider Service (WmiPrvSE.exe), WmiPrvSE.exe, which runs as a separate process from the malware, calls CreateProcess, which accesses the Windows API and starts a child process. Specifically, the called CreateProcess uses the Windows API to start a child process. This child process accesses the Internet and performs tasks such as downloading and executing malicious programs.

[0131] In the above-described embodiment, malware such as emotet starts a child process by directly accessing the Windows API, without going through a Windows COM Object. In this embodiment, the launching of a child process via a Windows COM Object is tracked and monitored. More specifically, when an application program such as Word (hereinafter, Word will be used as an example) is launched, the system begins monitoring the process. As described in the above-described embodiment, when Word is launched, the malware monitoring system 1 registers the process in a monitored process list (see, for example, Table 1) and begins monitoring it.

[0132] Word starts, accesses a Windows COM Object, launches WmiPrvSE.exe, accesses the Windows API, and launches a child process. When WmiPrvSE.exe starts, malware monitoring system 1 registers WmiPrvSE.exe and Word in the monitored process list. It then tracks the process names of running application programs obtained from the command line by comparing them with the process names launched from WmiPrvSE.exe. The process names of application programs are obtained from the command line using API hooking and vTable (virtual function table) patching.

[0133] The control program 50 obtains the process names of processes launched from WmiPrvSE.exe by registering a callback function of type PCREATE_PROCESS_NOTIFY_ROUTINE_EX using PsSetCreateProcessNotifyRoutineEx. The process names obtained in this way are compared, and those that match are registered in the process control list as processes to be tracked. This means that if a process is launched from WmiPrvSE.exe while Word is running, that process will be monitored.

[0134] Tracking is possible if the application program name (exe file name) and arguments obtained from the command line can be identified. When a child process is started from the Windows API and accesses the network, the control program 50 detects this and controls the communication. The communication control process involves control processes such as blocking and pausing communication as explained in the first to fifth embodiments. [Industrial Applicability]

[0135] The present invention is suitable for use in the field of electronic data security, where computer viruses, malware, and the like are detected or neutralized. [Explanation of symbols]

[0136] 1. Malware monitoring system 2, 2a, 2b, 2c...Client terminal 3. Internet 4. Mail server 5,7...Web server 6,8…Web database 10...Communication relay means 11...LAN 20...Operating System 20 21...Device driver 22...Device 23…PowerShell 24...User mode 25...Kernel mode 30...Network driver 31...File system driver 32...Disk driver 40...Network card 41...HDD 50...Control program 51...Surveillance Program 52...Control unit 53...Interface section 54...Encryption section 55...Decoding section 56...Log acquisition section 57...Device driver control unit 58...Network driver control unit 59...File system control unit 60...Application Program 61...Email program 62...Office application program 63...Antivirus program 64...Macro 70, 71, 72, 73…Process

Claims

1. A malware detection method for an electronic computer, which is provided with a communication control function for controlling a communication function of an electronic computer that operates under the control of an operating system, and a process monitoring function for monitoring execution processes executed on the electronic computer, for monitoring files accessible by the electronic computer and detecting malware, comprising: the computer includes a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, and between application programs and the device drivers, and between the operating system and the device drivers; The control program When the file is opened or executed, a process executed by a macro or script included in the file and a child process derived from the process are detected by the process detection means operating in kernel mode; When the process or the child process accesses an external server via a shell environment of the operating system, the communication function of the computer is stopped or temporarily suspended by the communication stopping means operating in the kernel mode; and notifying a security means or a display of said access to said external server; A malware detection method comprising:

2. The malware detection method according to claim 1, The shell environment consists of an interactive shell, which is a user interface, and a scripting execution environment. A malware detection method comprising:

3. 3. The malware detection method according to claim 1, The file is one or more selected from the group consisting of an attachment attached to an email or an instant message, the attachment stored in an auxiliary storage means of the electronic computer, a first electronic file stored in an auxiliary storage means of the electronic computer, and a second electronic file stored in an auxiliary storage means detachable from the electronic computer. A malware detection method comprising:

4. 3. The malware detection method according to claim 1, The access to the external server is a request to download an executable file or a data file including the executable file, or a reception of a message or control data from the external server. A malware detection method comprising:

5. a communication control means for controlling the communication functions of a computer that operates under the control of an operating system; a process monitoring means for monitoring an execution process executed on the computer; and A malware detection computer comprising a malware monitoring means for monitoring files accessible by the computer and detecting malware, the computer includes a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, between application programs and the device drivers, and between the operating system and the device drivers; The control program a process detection means, operating in kernel mode, for detecting a process executed by a macro or script included in the file when the file is opened or executed, and a child process derived from the process; a communication stopping means that operates in the kernel mode and that stops or suspends the communication function of the computer when the process or the child process accesses an external server via a shell environment of the operating system; and a notification means for notifying a security means or a display of the access to the external server; A malware detection computer comprising:

6. 6. The malware detection computer according to claim 5, The shell environment consists of an interactive shell, which is a user interface, and a scripting execution environment. A malware detection computer characterized by:

7. 7. The malware detection computer according to claim 5, The file is one or more selected from the group consisting of an attachment attached to an email or an instant message, the attachment stored in an auxiliary storage means of the electronic computer, a first electronic file stored in an auxiliary storage means of the electronic computer, and a second electronic file stored in an auxiliary storage means detachable from the electronic computer. A malware detection computer characterized by:

8. 7. The malware detection computer according to claim 5, The access to the external server is a request to download an executable file or a data file including the executable file, or a reception of a message or control data from the external server. A malware detection computer characterized by:

9. A malware detection program for causing an electronic computer to operate a communication control function that controls a communication function of the electronic computer, which is controlled by an operating system, and a process monitoring function that monitors processes executed by the electronic computer, and for monitoring files accessible by the electronic computer and detecting malware, comprising: the computer includes a control program that operates in a kernel mode of the operating system to transmit and receive data between device drivers, and between application programs and the device drivers, and between the operating system and the device drivers; The operation of the control program is detecting in the kernel mode, when the file is opened or executed, a process executed by a macro or script contained in the file, or a child process that spawns the process; When the process or the child process accesses an external server via a shell environment of the operating system, stopping or suspending the communication function of the computer in the kernel mode; and notifying a security means or a display of said access to said external server. A malware detection program comprising:

10. 10. The malware detection program according to claim 9, The shell environment consists of an interactive shell, which is a user interface, and a scripting execution environment. A malware detection program.

11. 11. The malware detection program according to claim 9, The file is one or more types of electronic file selected from the group consisting of an attachment attached to an email or an instant message, an attachment stored in an auxiliary storage means of the electronic computer, an electronic file stored in an auxiliary storage means of the electronic computer, and an electronic file stored in an auxiliary storage means detachable from the electronic computer. A malware detection program.

12. 11. The malware detection program according to claim 9, The access to the external server is a request to download an executable file or a data file including the executable file, or a reception of a message or control data from the external server. A malware detection program.

13. A malware detection program recording medium on which the malware detection program according to claim 9 or 10 is recorded.

Images