Method and apparatus for defending against tampering attacks on malicious file classifier

Abstract

Disclosed is a method, executed by one or more processors, for defending against tampering attacks on malicious files, the method comprising the steps of: generating a first malicious file hash value and one or more first tampered malicious file hash values for a first malicious file and one or more first tampered malicious files altered from the first malicious file; determining a first tampering threshold distance for the first malicious file; generating a hash value of a file to be inspected; and determining whether the file to be inspected is a malicious file, wherein the first malicious file hash value, the first tampered malicious file hash values, and the hash value of the file to be inspected are generated using a locality-sensitive hashing technique.

Description

Method and device for defending against tampering attacks on malicious file classifiers

[0001] The present disclosure relates to a method for defending against tampering attacks on a malicious file classifier, and more specifically, to a method for defending against tampering attacks by utilizing hashing.

[0002] The present invention is derived from research conducted as part of the Ministry of Science and ICT's Core Source Technology Development (R&D) for Information Security (Project Unique Number: 2710008252, Project Number: 00398353, Project Management Agency: Korea Institute of Information & Communication Technology Planning & Evaluation, Research Project Title: Development of Generative AI Security Threat Response Technology, Project Executing Agency: Soongsil University Industry-Academic Cooperation Foundation, Research Period: April 1, 2024 – December 31, 2024). Meanwhile, the Korean government, as the provider of the project, has no property interest in any aspect of the present invention.

[0003] Currently, deep learning models are being utilized in the security field to detect malicious files and applications. As these deep learning-based models become widely used, malicious attack methods, including adversarial attack methods to evade them, are evolving.

[0004] Existing deep learning-based models have responded to these malicious attack methods by using models trained on adversarial samples; however, due to the problem of having to train the model directly, the consumption of computing resources and training time are significant. Therefore, there is a demand in the industry for techniques to build malicious file classifiers that can defend against tampering attacks more efficiently.

[0005] The present disclosure aims to provide a malicious file classifier that is robust against tampering attacks.

[0006] The problems that this disclosure aims to solve are not limited to those described above, and other unmentioned problems will be clearly understood by a person skilled in the art from the description below.

[0007] A method for defending against tampering attacks on a malicious file executed by one or more processors according to one embodiment of the present disclosure comprises: a step of generating a first malicious file hash value and one or more first tampering malicious file hash values ​​for a first malicious file and one or more first tampering malicious files modified from the first malicious file; a step of determining a first tampering threshold distance for the first malicious file based on the first malicious file hash value and the one or more first tampering malicious file hash values; a step of generating a file hash value to be examined; and a step of determining whether the file to be examined is a malicious file based on the file hash value to be examined, the first malicious file hash value, or the one or more first tampering malicious file hash values ​​to be examined; wherein the first malicious file hash value, the first tampering malicious file hash value, and the file to be examined hash value may be generated using a locality-sensitive hashing technique.

[0008] In one embodiment, the step of determining a first modulation threshold distance for the first malicious file may be characterized by including: a step of calculating one or more first modulation distance values ​​based on the first malicious file hash value and one or more first modulation malicious file hash values; and a step of determining the first modulation threshold distance based on a statistical value of the one or more first modulation distance values.

[0009] In one embodiment, the statistical value of the one or more first modulation distance values ​​may be characterized by including any one of an average value, a maximum value, a minimum value, a quantile value, or a median value.

[0010] In one embodiment, the one or more first modulation distance values ​​may be characterized as being determined based on the similarity between the first malicious file hash value and the one or more first modulation malicious file hash values.

[0011] In one embodiment, the similarity may be characterized by using similarity between strings.

[0012] In one embodiment, the similarity between the strings may be characterized by using the edit distance.

[0013] In one embodiment, the step of determining a first modification threshold distance for the first malicious file may be characterized by including the step of storing the first malicious file hash value, the one or more first modification malicious file hash values, and the first modification threshold distance in a cache memory.

[0014] In one embodiment, the step of determining whether the file to be examined is a malicious file may be characterized by including: a step of determining a first detection distance between the hash value of the file to be examined and the first malicious file hash value; and a step of determining whether the file to be examined is a malicious file by comparing the first detection distance value with the first tampering threshold distance.

[0015] In one embodiment, the step of determining whether the file to be examined is a malicious file may include: a step of determining a second detection distance value based on the hash value of the file to be examined, the first malicious file hash value, and the one or more first modified malicious file hash values; and a step of determining whether the file to be examined is a malicious file by comparing the second detection distance value with the first modification threshold distance.

[0016] In one embodiment, the step of determining the second detection distance value may be characterized by comprising: a step of calculating a hash value distance between a file to be examined and a first malicious file based on the hash value of the file to be examined and the hash value of the first malicious file; a step of calculating a hash value distance between one or more files to be examined and a first modified malicious file based on the hash value of the file to be examined and the hash value of one or more first modified malicious files; and a step of determining the second detection distance value using a statistical value of the hash value distance between the file to be examined and the first malicious file and the hash value distance between one or more files to be examined and the first modified malicious file.

[0017] The tamper attack defense method according to the present disclosure can build a malicious file classifier that is robust against tamper attacks in a resource-efficient manner.

[0018] The effects according to the present disclosure are not limited to those described above, and other unmentioned effects will be clearly understood by a person skilled in the art from the description below.

[0019] FIG. 1 is a conceptual diagram illustrating a method for defending against tampering attacks according to some embodiments of the present disclosure.

[0020] FIG. 2 is a block diagram showing the configuration of a modulation attack defense device according to some embodiments of the present disclosure.

[0021] FIG. 3 is a flowchart illustrating the process of a tamper-proof attack defense device generating malicious information according to some embodiments of the present disclosure.

[0022] FIG. 4 is a flowchart illustrating the process of a tamper attack defense device classifying malicious files according to some embodiments of the present disclosure.

[0023] FIG. 5 is a flowchart illustrating the process of a tamper attack defense device classifying malicious files according to some other embodiments of the present disclosure.

[0024] FIG. 6 is a graph showing the performance of a modulation attack defense device according to some embodiments of the present disclosure.

[0025] FIG. 7 is a block diagram showing the configuration of a modulation attack defense device of the present disclosure.

[0026] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the contents described in the attached drawings. However, the present invention is not limited or restricted by exemplary embodiments. Unless otherwise defined, all terms used in this specification (including technical and scientific terms) shall be used in a meaning that is commonly understood by those skilled in the art to which this disclosure belongs, but this may vary depending on the intent of those skilled in the art, case law, the emergence of new technology, etc.

[0027] Furthermore, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise. In certain cases, terms have been selected at the applicant's discretion, and in such cases, their meanings will be described in detail in the relevant explanatory sections. Accordingly, terms used in this disclosure should be defined not merely by their names, but based on their meanings and the content throughout this disclosure.

[0028] Throughout this specification, when a part is described as "comprising" a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components. Furthermore, the singular form used in this specification includes the plural form unless specifically stated otherwise. Additionally, the expression "at least one of a, b, and / or c" as used throughout this specification may encompass 'a alone', 'b alone', 'c alone', 'a and b', 'a and c', 'b and c', or 'a, b, and c all'.

[0029] Meanwhile, terms such as "first and / or second" used in this specification may be used to describe various components, but they are used solely for the purpose of distinguishing one component from another and are not intended to limit the scope to the components referred to by such terms. For example, without departing from the scope of the present invention, the first component may be named the second component, and the second component may also be named the first component.

[0030] Additionally, terms such as “…part,” “…module,” etc., as described in this specification refer to a unit that processes at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software. Furthermore, embodiments of this disclosure may be represented in this specification by functional block configurations and various processing steps. These functional blocks may be implemented by various numbers of hardware and / or software configurations that execute specific functions. For example, embodiments of this disclosure may employ integrated circuit configurations such as memory, processing, logic, look-up tables, etc., which can execute various functions under the control of one or more microprocessors or other control devices.

[0031] Similar to how the components disclosed herein may be executed as software programs or software elements, embodiments of the present disclosure may be implemented in programming or scripting languages ​​such as C, C++, Java, assembler, etc., including various algorithms implemented as combinations of data structures, processes, routines, or other programming configurations. Functional aspects may be implemented as algorithms executed on one or more processors. Additionally, the present embodiments may employ prior art for at least one of electronic configuration, signal processing, and data processing. Terms such as “mechanism,” “element,” “means,” and “configuration” may be used broadly and are not limited to mechanical and physical configurations. The above terms may include the meaning of a series of software processes (routines) in conjunction with a processor, etc.

[0032] Each block of the process flow diagrams attached to this specification and combinations of the flow diagrams may be executed by computer program instructions. Since these computer program instructions may be loaded into the processor of a general-purpose computer, a computer for special purposes, or other programmable data processing equipment, the instructions executed through the processor of the computer or other programmable data processing equipment create means for performing the functions described in the flow diagram block(s).

[0033] These computer program instructions may be stored in computer-available or computer-readable memory that can be directed toward a computer or other programmable data processing equipment to implement a function in a specific way, and the instructions stored in said computer-available or computer-readable memory may also produce a manufactured item containing instruction means that performs the function described in the flowchart block(s).

[0034] Since computer program instructions can be loaded onto a computer or other programmable data processing equipment, instructions that perform a series of operation steps on the computer or other programmable data processing equipment to create a process executed by the computer can also provide steps for executing the functions described in the flowchart block(s).

[0035] Additionally, each block may represent a module, segment, or part of code containing one or more executable instructions for executing a specified logical function(s). Furthermore, in some alternative execution examples, the functions mentioned in the blocks may occur out of order. For instance, two blocks described in succession may actually be executed substantially simultaneously, or the blocks may be executed in reverse order according to their corresponding functions.

[0036] The “electronic device” or “terminal” mentioned in this specification may be implemented as a computer or portable terminal capable of connecting to a server or other terminal via a network. Here, the computer includes, for example, a notebook, desktop, or laptop equipped with a web browser, and the portable terminal may include, for example, any type of handheld wireless communication device that ensures portability and mobility, such as a communication-based terminal like IMT (International Mobile Telecommunication), CDMA (Code Division Multiple Access), W-CDMA (W-Code Division Multiple Access), or LTE (Long Term Evolution), as well as a smartphone or tablet PC. Additionally, the “electronic device” or “terminal” mentioned in this specification may also include a processor, memory for storing and executing program data, permanent storage such as a disk drive, a communication port for communicating with an external device, and user interface devices such as a touch panel, a key, or a button.

[0037] In the present disclosure, methods implemented as software modules or algorithms may be stored on a computer-readable recording medium as computer-readable code or program instructions executable on a processor. The computer-readable recording medium may include magnetic storage media (e.g., ROM (read-only memory), RAM (random-access memory), floppy disks, hard disks, etc.) and optical reading media (e.g., CD-ROM, DVD: Digital Versatile Disc). The computer-readable recording medium may be distributed and executed across networked computer systems.

[0038] Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In describing the embodiments, technical details that are well known in the art to which the present invention pertains and are not directly related to the present invention will be omitted. This is to ensure that the essence of the present invention is conveyed more clearly without obscuring it by omitting unnecessary explanations. For the same reason, some components in the accompanying drawings may be exaggerated, omitted, or schematically depicted. Furthermore, the size of each component does not entirely reflect its actual size. Throughout this specification, the same reference numerals may refer to the same or corresponding components.

[0039]

[0040] FIG. 1 is a conceptual diagram illustrating a method for defending against tampering attacks according to some embodiments of the present disclosure.

[0041] Referring to FIG. 1, a method for defending against tampering attacks according to some embodiments of the present disclosure can be implemented by, when a file to be examined for maliciousness is input, a file hashing unit stored in a server generates a hash value of the file to be examined and compares it with a hash value of a malicious file stored previously and / or hash values ​​of tampered malicious files to determine whether the file to be examined is malicious.

[0042] At this time, the comparison between the hash value of the file to be examined and the hash value of the malicious file and / or the hash value of the tampered malicious file may involve calculating the distance between the two hash values. At this time, calculating the distance between the two hash values ​​may be performed using an algorithm to determine the similarity between two strings. For example, the distance between the two hash values ​​may be calculated using edit distance, n-gram, Jaccard Similarity, and / or LCS (Longest Common Subsequence) algorithms.

[0043] At this time, if the distance between the hash value of the file to be inspected and the hash value of the malicious file and / or the hash value of the modified malicious file is less than or equal to a preset modification threshold distance value, the file to be inspected can be determined to be a malicious file.

[0044] In one embodiment, the hash value of the file to be examined, the hash value of the malicious file, and / or the hash value of the tampered malicious file may be calculated using a locality-sensitive hashing (LSH) technique. In some embodiments, a Trend Micro Locality Sensitive Hash (TLSH) technique may be used to calculate the hash value of the file to be examined, the hash value of the malicious file, and / or the hash value of the tampered malicious file.

[0045] In some embodiments, the malicious file hash value, the tampered malicious file hash value, and / or the distance data between the malicious file hash value and the tampered malicious file hash value may be stored in the memory of the tampering attack defense device. Preferably, the malicious file hash value, the tampered malicious file hash value, and / or the distance data between the malicious file hash value and the tampered malicious file hash value may be stored in the cache memory of the tampering attack defense device.

[0046] In this case, by utilizing data related to malicious files and information about files to be scanned through cache memory, robustness against attacks using padding (e.g., adding infinite padding) can be secured.

[0047]

[0048] FIG. 2 is a block diagram showing the configuration of a modulation attack defense device according to some embodiments of the present disclosure.

[0049] Referring to FIG. 2, a tamper attack defense device according to some embodiments of the present disclosure may include a file hashing unit (110).

[0050] In some embodiments, the file hashing unit (110) may be a module implemented in software, hardware, and / or a combination thereof for generating a hash value for any file. In some embodiments, the file hashed by the file hashing unit (110) may include a malicious file, a modified malicious file, and / or a file to be inspected.

[0051] In some embodiments, the file hashing unit (110) may be implemented to execute a locality-sensitive hashing technique. In some embodiments, the hashing technique implemented by the file hashing unit (110) may be Trend Micro Locality-Sensitive Hashing (TLSH).

[0052] Referring again to FIG. 2, a modulation attack defense device according to some embodiments of the present disclosure may include a distance determining unit (120).

[0053] In some embodiments, the distance determining unit (120) may be a module implemented in software, hardware and / or a combination thereof for determining the distance between file hash values ​​generated by the file hashing unit (110).

[0054] In some embodiments, the distance determining unit (120) may determine the distance between the hash values ​​of each of the malicious file, the modified malicious file, and / or the file to be examined. In some embodiments, the distance determining unit (120) may calculate the distance between the hash values ​​of the malicious file, the modified malicious file, and / or the file to be examined based on an algorithm for calculating similarity between strings and / or documents. In one embodiment, the distance determining unit (120) may calculate the distance between file hash values ​​by being configured to perform an edit distance, n-gram, Jaccard Similarity, and / or LCS (Longest Common Subsequence) algorithm.

[0055] Referring again to FIG. 2, a tamper attack defense device (100) according to some embodiments of the present disclosure may include a malicious information storage unit (130).

[0056] In some embodiments of the present disclosure, the malicious information storage unit (130) may be configured using a disk, non-volatile memory and / or volatile memory. Preferably, the malicious information storage unit (130) may be configured using a cache memory.

[0057] In some embodiments, the information stored in the malicious information storage unit (130) may include a malicious file hash value, a modified malicious file hash value, a hash distance value between the malicious file hash value and the modified malicious file hash value, and / or a modification threshold distance value for determining whether it is a malicious file. In some embodiments, the malicious information storage unit (130) may store a plurality of malicious file hash values ​​and a plurality of modified malicious file hash values. Accordingly, there may also be a plurality of hash distance values ​​and / or modification threshold distance values. For example, the malicious information storage unit (130) may store a first malicious file and a plurality of modified malicious files for the first malicious file, a second malicious file and a plurality of modified malicious files for the second malicious file, and all distance values ​​between the hash values ​​of the malicious file and the modified malicious files. Additionally, the malicious information storage unit (130) may store both a first modification threshold distance value for the first malicious file and a second modification threshold distance value for the second malicious file.

[0058] Referring again to FIG. 2, a tamper attack defense device (100) according to some embodiments of the present disclosure may include a malicious file identification unit (140).

[0059] In some embodiments, the malicious file determination unit (140) may be a module implemented with software, hardware, and / or a combination thereof for determining whether a file to be examined is malicious based on the hash value of the file to be examined and the values ​​stored in the malicious information storage unit (130).

[0060] In some embodiments, the malicious file determination unit (140) can determine whether a file to be examined is malicious based on the distance value between the file to be examined hash value and the malicious file hash value and / or the modified malicious file hash value calculated by the distance determination unit (120) and the preset modification threshold distance value stored in the malicious information storage unit (130).

[0061] Each module included in FIG. 2 will be described in detail below in FIG. 3 and FIG. 4.

[0062]

[0063] FIG. 3 is a flowchart illustrating the process of a tamper-proof attack defense device generating malicious information according to some embodiments of the present disclosure.

[0064] Referring to FIG. 3, a tamper attack defense device according to some embodiments of the present disclosure may perform the step (S100) of generating a first tamper distance value between a first malicious file hash value and a first tampered malicious file hash value.

[0065] Although omitted in FIG. 3 for convenience and brevity of explanation, multiple modified malicious files may exist for a single malicious file, and in this case, the modification distance between hash values ​​equal to the number of modified malicious files can be calculated for a single malicious file. That is, if multiple modified malicious files exist for a first malicious file, the first modification distance can be calculated equal to the number of modified malicious files.

[0066] In some embodiments, if one or more first modification distances are generated for a first malicious file in step (S100), a step (S200) of determining a first modification threshold distance value to determine whether a file to be inspected is a malicious file based thereon may be performed.

[0067] In some embodiments, the first modulation threshold distance value may be a distance value serving as a criterion for determining whether the file to be examined is a malicious file with respect to the first malicious file and / or the first modulation malicious file. That is, if the distance between the hash value of the file to be examined and the hash value of the first malicious file and / or the hash value of the first modulation malicious file is less than or equal to the first modulation threshold distance value and / or less than, the file to be examined may be determined to be a malicious file.

[0068] In some embodiments, the first modulation threshold distance value may be determined based on statistical values ​​of one or more first modulation distance values. For example, the first modulation threshold distance value may include an average value, a minimum value, a maximum value, a quantile value, and / or a median value of the first modulation distance values.

[0069] Referring again to FIG. 3, a tamper attack defense device according to some embodiments of the present disclosure may include a step (S300) of caching one or more calculated first tamper distance values, a first malicious file hash value, one or more first tamper malicious file hash values ​​and / or the first tamper threshold distance value when a first tamper threshold distance value is determined in step (S200). As described above in FIG. 2, the caching according to step (S300) may be performed within a malicious information storage unit.

[0070]

[0071] FIG. 4 is a flowchart illustrating the process of a tamper attack defense device classifying malicious files according to some embodiments of the present disclosure.

[0072] Referring to FIG. 4, a tamper attack defense device according to some embodiments of the present disclosure may perform the step (S400) of calculating the hash value of a file to be examined for maliciousness.

[0073] In some embodiments, a hashing method for generating a hash value of a file to be inspected may use a technique such as a hashing technique for generating hash values ​​of a malicious file and a modified malicious file. For example, a hashing technique for generating hash values ​​of a file to be inspected, a malicious file, and a modified malicious file may utilize a locality-sensitive hashing technique.

[0074] In some embodiments, when a hash value of a file to be examined is generated through step (S400), the tamper attack defense device according to the present disclosure may perform a step (S510) of determining a first detection distance value between the hash value of the file to be examined and the first malicious file hash value.

[0075] In some embodiments, the first detection distance value may be determined using an algorithm for determining the similarity between two strings between the file hash value to be examined and the first malicious file hash value. For example, the first detection distance may be determined using an edit distance, n-gram, Jaccard Similarity, and / or LCS (Longest Common Subsequence) algorithm.

[0076] In some embodiments, when a first detection distance value is calculated through step (S510), the modulation attack defense device of the present disclosure may perform a step of determining whether the first detection distance value is smaller than a preset first modulation threshold distance value (S610). If the first detection distance value is smaller than the first modulation threshold distance value (S610, Yes), the file to be inspected may be classified as a malicious file (S700). If the first detection distance value is not smaller than the first modulation threshold distance value (S610, No), the file to be inspected may be classified as a normal file (S800).

[0077]

[0078] FIG. 5 is a flowchart illustrating the process of a tamper attack defense device classifying malicious files according to some other embodiments of the present disclosure.

[0079] Referring to FIG. 5, a tamper attack defense device according to some embodiments of the present disclosure may perform the step (S400) of calculating the hash value of a file to be examined for maliciousness.

[0080] In some embodiments, a hashing method for generating a hash value of a file to be inspected may use a technique such as a hashing technique for generating hash values ​​of a malicious file and a modified malicious file. For example, a hashing technique for generating hash values ​​of a file to be inspected, a malicious file, and a modified malicious file may utilize a locality-sensitive hashing technique.

[0081] In some embodiments, when a file hash value to be examined is generated through step (S400), the tampering attack defense device according to the present disclosure may perform step (S520) of determining a second detection distance value based on the file hash value to be examined, a first malicious file hash value, and a first tampering malicious file hash value.

[0082] In some embodiments, the second detection distance value may be determined based on statistical values ​​regarding the detection distance values ​​between the target file hash value, the first malicious file hash value, and the first tampered malicious file hash value, respectively. For example, the hash value distance between the target file and the first malicious file, which is the distance between the target file hash value and the first malicious file hash value, may be calculated, and one or more hash value distances between the target file and the first tampered malicious file, which are the distances between each of the first tampered malicious file hash value and the target file hash value, may be calculated, and then the second detection distance value may be determined using these statistical values. For example, the second detection distance value may be determined by the average, maximum, minimum, quantile, and / or median values ​​of the hash value distance between the target file and the first malicious file and the hash value distance between the target file and the first tampered malicious file.

[0083] As described above in FIGS. 1 to 4, the hash value distance can be determined using an algorithm for determining the similarity between two strings between the hash value of a file to be examined and the hash value of a first malicious file. For example, the hash value distance can be determined using an edit distance, n-gram, Jaccard Similarity, and / or LCS (Longest Common Subsequence) algorithm.

[0084] In some embodiments, when a second detection distance value is calculated through step (S520), the modulation attack defense device of the present disclosure may perform a step of determining whether the second detection distance value is smaller than a preset first modulation threshold distance value (S620). If the second detection distance value is smaller than the first modulation threshold distance value (S620, Yes), the file to be inspected may be classified as a malicious file (S700). If the first detection distance value is not smaller than the first modulation threshold distance value (S620, No), the file to be inspected may be classified as a normal file (S800).

[0085]

[0086] FIG. 6 is a graph showing the performance of a modulation attack defense device according to some embodiments of the present disclosure.

[0087] Referring to Fig. 6, it is confirmed that among the modulation attack defense techniques according to the prior art, techniques based on SiSl, FullDOS, and Genetic Algorithm reveal vulnerabilities to modulation attacks.

[0088] Referring again to FIG. 6, it can be seen that in the case of SiSl+TLSH, FullDOS+TLSH, and Genetic Algorithm+TLSH, where the modulation attack defense technique according to the present disclosure is additionally applied to the modulation attack defense technique for the prior art, a defense performance of 99% or more against modulation attacks is shown.

[0089] At this time, the statistical values ​​of the modulation distance for determining the value of the modulation threshold distance for applying the modulation attack defense technique according to the present disclosure are as shown in [Table 1] below. At this time, in one embodiment, the modulation threshold distance may be set to be greater than the maximum value of the modulation distance.

[0090] Statistics Type Value (711,650 samples) Mean 5.66 Standard Deviation 2.32 Minimum 0.00 25 Quantile Value 4.00 Median 6.00 75 Quantile Value 8.00 Maximum 9.00

[0091] FIG. 7 is a block diagram showing the configuration of a modulation attack defense device of the present disclosure.

[0092] The computing device (800) may include a memory (810), a processor (820), a communication unit (830), and an input / output interface (840), and as shown in FIG. 7, the computing device (800) may be configured to communicate information and / or data through a network using the communication unit (830).

[0093] The memory (810) may include any non-transient computer-readable recording medium. According to one embodiment, the memory (810) may include a permanent mass storage device such as random access memory (RAM), read-only memory (ROM), disk drive, solid state drive (SSD), flash memory, etc. As another example, a permanent mass storage device such as ROM, SSD, flash memory, disk drive, etc. may be included in the computing device (800) as a separate permanent storage device distinct from the memory. Additionally, an operating system and at least one program code may be stored in the memory (810).

[0094] These software components may be loaded from a computer-readable recording medium separate from the memory (810). This separate computer-readable recording medium may include a recording medium that can be directly connected to the computing device (800), for example, a computer-readable recording medium such as a floppy drive, disk, tape, DVD / CD-ROM drive, or memory card. As another example, the software components may be loaded into the memory (810) via a communication unit (830) rather than a computer-readable recording medium. For example, at least one program may be loaded into the memory (810) based on a computer program installed by files provided through the communication unit (830) by developers or a file distribution system that distributes installation files for applications.

[0095] The program described herein may include program instructions, data files, and data structures, either individually or in combination. The program may be designed and created using machine code or high-level language code. The program may be specifically designed to implement the invention described above, or it may be implemented using various functions or definitions that are known and available to those skilled in the art in the field of computer software. A program for implementing the invention described above may be recorded on a recording medium readable by a processor.

[0096] Memory can store a program that performs the aforementioned operation and the operation described below, and the processor can execute the program stored in memory. When there are multiple processors and memory, it is possible for them to be integrated on a single chip or to be provided in physically separate locations. Memory may include volatile memory such as S-RAM (Static Random Access Memory, S-RAM) and D-RAM (Dynamic Random Access Memory) for temporarily storing data. Additionally, memory may include non-volatile memory such as ROM (Read Only Memory), EPROM (Erasable Programmable Read Only Memory), and EEPROM (Electrically Erasable Programmable Read Only Memory) for long-term storage of control programs and control data.

[0097]

[0098] The processor (820) may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to another user terminal (not shown) or another external system by memory (810) or communication unit (830).

[0099] The processor may include various logic circuits and arithmetic circuits, process data according to a program provided from memory, and generate control signals based on the processing results. In this case, the memory and the processor may each be implemented as separate chips. Alternatively, the memory and the processor may be implemented as a single chip.

[0100] The processor (820) may include one or more processors. In this case, the one or more processors may be homogeneous or heterogeneous processors. For example, the processor (820) may include heterogeneous processors such as a central processing unit (CPU), a graphics processing unit (GPU), a tensor processing unit (TPU) and / or a neural processing unit (NPU). For convenience of explanation, one or more homogeneous or heterogeneous processors may be referred to as 'processors' within this specification.

[0101] The communication unit (830) may provide a configuration or function for a user terminal (not shown) and a computing device (800) to communicate with each other via a network, and may provide a configuration or function for the computing device (800) to communicate with an external system (e.g., a separate cloud system). For example, control signals, commands, data, etc. provided under the control of the processor (820) of the computing device (800) may be transmitted to the user terminal and / or the external system through the communication unit (830) and the network, and through the communication unit of the user terminal and / or the external system.

[0102] The wired communication unit may include various wired communication units such as a Local Area Network (LAN) module, a Wide Area Network (WAN) module, or a Value Added Network (VAN) module, as well as various cable communication units such as USB (Universal Serial Bus), HDMI (High Definition Multimedia Interface), DVI (Digital Visual Interface), RS-232 (recommended standard 232), power line communication, or POTS (plain old telephone service).

[0103] In addition to Wi-Fi modules and WiBro (Wireless broadband) modules, the wireless communication unit may include a wireless communication unit that supports various wireless communication methods such as GSM (global System for Mobile Communication), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), UMTS (universal mobile telecommunications system), TDMA (Time Division Multiple Access), LTE (Long Term Evolution), 4G, 5G, and 6G.

[0104] The wireless communication unit may include a wireless communication interface comprising an antenna and a transmitter that transmit a Wi-Fi signal. Additionally, the wireless communication unit may further include a Wi-Fi signal conversion module that modulates a digital control signal output from the control unit through the wireless communication interface into an analog wireless signal under the control of the control unit.

[0105] The wireless communication unit may include a wireless communication interface comprising an antenna and a receiver for receiving a Wi-Fi signal. Additionally, the wireless communication unit may further include a Wi-Fi signal conversion module for demodulating an analog wireless signal received through the wireless communication interface into a digital control signal.

[0106] The short-range communication unit is for short-range communication and can support short-range communication by using at least one of Bluetooth, RFID (Radio Frequency Identification), Infrared Data Association (IrDA), UWB (Ultra Wideband), ZigBee, NFC (Near Field Communication), Wi-Fi (Wireless-Fidelity), Wi-Fi Direct, and Wireless USB (Wireless Universal Serial Bus) technologies.

[0107] Additionally, the input / output interface (840) of the computing device (800) may be a means for interfacing with a device (not shown) for input or output that is connected to the computing device (800) or that the computing device (800) may include.

[0108] The input unit is for receiving information and data, including audio information (or signals), text, etc., from a network or a user, and may include at least one microphone and at least one of a user input unit. Data collected from the input unit may be analyzed and processed into a user control command.

[0109] The user input unit is intended to receive information from a user, and when information is input through the user input unit, the control unit can control the operation of the device to correspond to the input information. Such a user input unit may include a hardware physical key (e.g., a button, dome switch, jog wheel, jog switch, etc. located on at least one of the front, rear, and side of the device) and a software touch key. As an example, the touch key may consist of a virtual key, soft key, or visual key displayed on a touchscreen-type display unit through software processing, or may consist of a touch key placed on a part other than the touchscreen. Meanwhile, the virtual key or visual key may have various forms and may be displayed on the touchscreen, for example, as a graphic, text, icon, video, or a combination thereof.

[0110] In FIG. 7, the input / output interface (840) is shown as an element configured separately from the processor (820), but is not limited thereto, and the input / output interface (840) may be configured to be included in the processor (820). The computing device (800) may include more components than those in FIG. 7. However, there is no need to clearly illustrate most of the prior art components.

[0111] The processor (820) of the computing device (800) may be configured to manage, process, and / or store information and / or data received from a plurality of user terminals and / or a plurality of external systems.

[0112] The methods and / or various embodiments described above may be realized in digital electronic circuits, computer hardware, firmware, software, and / or combinations thereof. Various embodiments of the present disclosure may be executed by a data processing device, for example, one or more programmable processors and / or one or more computing devices, or may be implemented as a computer program stored on a computer-readable recording medium and / or a computer program stored on a computer-readable recording medium. The computer program described above may be written in any form of programming language, including a compiled language or an interpreted language, and may be distributed in any form, such as a standalone program, a module, a subroutine, etc. The computer program may be distributed through a single computing device, a plurality of computing devices connected through the same network, and / or a plurality of computing devices distributed to be connected through a plurality of different networks.

[0113] The methods and / or various embodiments described above may be performed by one or more processors configured to execute one or more computer programs that process, store, and / or manage any functions, functions, etc. by operating based on raw samples or generating output data. For example, the methods and / or various embodiments of the present disclosure may be performed by special-purpose logic circuits such as a Field Programmable Gate Array (FPGA) or an Application Specific Integrated Circuit (ASIC), and an apparatus and / or system for performing the methods and / or embodiments of the present disclosure may be implemented as a special-purpose logic circuit such as an FPGA or an ASIC.

[0114] One or more processors executing a computer program may include one or more processors of a general-purpose or special-purpose microprocessor and / or any type of digital computing device. The processor may receive instructions and / or data from each of read-only memory and random access memory, or receive instructions and / or data from read-only memory and random access memory. In the present invention, components of a computing device performing the methods and / or embodiments may include one or more processors for executing instructions and one or more memory devices for storing instructions and / or data.

[0115] According to one embodiment, a computing device may exchange data with one or more mass storage devices for storing data. For example, the computing device may receive and / or receive data from a magnetic disc or an optical disc, and may transfer data to a magnetic disc or an optical disc. A computer-readable storage medium suitable for storing instructions and / or data associated with a computer program may include, but is not limited to, any form of non-volatile memory including semiconductor memory devices such as EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable PROM), and flash memory devices. For example, a computer-readable storage medium may include magnetic discs such as internal hard disks or removable disks, optical magnetic discs, CD-ROMs, and DVD-ROMs.

[0116] To provide interaction with a user, the computing device may include, but is not limited to, a display device for providing or displaying information to the user (e.g., CRT (Cathode Ray Tube), LCD (Liquid Crystal Display), etc.) and a pointing device (e.g., keyboard, mouse, trackball, etc.) on which the user can provide input and / or commands, etc. on the computing device. That is, the computing device may further include any other type of device for providing interaction with the user. For example, the computing device may provide any form of sensory feedback to the user for interaction with the user, including visual feedback, auditory feedback and / or tactile feedback. In this regard, the user may provide input to the computing device through various gestures such as visual, vocal, and motion.

[0117] In the present invention, various embodiments may be implemented in a computing system comprising backend components (e.g., data servers), middleware components (e.g., application servers), and / or frontend components. In this case, the components may be interconnected by any form or medium of digital data communication, such as a communication network. For example, the communication network may include a Local Area Network (LAN), a Wide Area Network (WAN), etc.

[0118] A computing device based on the exemplary embodiments described herein may be implemented using hardware and / or software configured to interact with a user, including a user device, a user interface (UI) device, a user terminal, or a client device. For example, the computing device may include a portable computing device such as a laptop computer. Additionally or alternatively, the computing device may include, but is not limited to, Personal Digital Assistants (PDAs), tablet PCs, game consoles, wearable devices, Internet of Things (IoT) devices, Virtual Reality (VR) devices, Augmented Reality (AR) devices, etc. The computing device may further include other types of devices configured to interact with a user. Additionally, the computing device may include a portable communication device suitable for wireless communication over a network such as a mobile communication network (e.g., a mobile phone, a smartphone, a wireless cellular phone, etc.). A computing device may be configured to communicate wirelessly with a network server using wireless communication technologies and / or protocols such as radio frequency (RF), microwave frequency (MWF) and / or infrared frequency (IRF).

[0119]

[0120] The above descriptions are specific embodiments for carrying out the present disclosure. The present disclosure will include not only the embodiments described above, but also embodiments that can be simply modified or easily modified. Furthermore, the present disclosure will include technologies that can be easily modified and implemented using the embodiments described above. Accordingly, the scope of the present disclosure should not be limited to the embodiments described above, but should be defined by the claims set forth below as well as equivalents to the claims of the present disclosure.

Claims

1. A method for defending against tampering attacks on malicious files executed by one or more processors, wherein the method for defending against tampering attacks comprises: For a first malicious file and one or more first modified malicious files modified from the first malicious file, a step of generating a first malicious file hash value and one or more first modified malicious file hash values; A step of determining a first modification threshold distance for the first malicious file based on the first malicious file hash value and one or more first modification malicious file hash values; Step of generating a hash value for the file to be inspected; and The method includes the step of determining whether the file to be examined is a malicious file based on the hash value of the file to be examined, the hash value of the first malicious file, or the hash value of one or more first modified malicious files. The first malicious file hash value, the first modified malicious file hash value, and the inspection target file hash value are characterized by being generated using a locality-sensitive hashing technique. Defense method against tampering attacks.

2. In Paragraph 1, The step of determining the first modification threshold distance for the first malicious file is, A step of calculating one or more first modification distance values ​​based on the first malicious file hash value and one or more first modification malicious file hash values; and The method is characterized by including the step of determining the first modulation threshold distance based on the statistical value of one or more first modulation distance values. Defense method against tampering attacks.

3. In Paragraph 2, The statistical value of the above one or more first modulation distance values ​​is, Characterized by including any one of an average value, a maximum value, a minimum value, a quantile value, or a median value. Defense method against tampering attacks.

4. In Paragraph 2, The above one or more first modulation distance values ​​are, Characterized by being determined based on the similarity between the first malicious file hash value and the one or more first modified malicious file hash values. Defense method against tampering attacks.

5. In Paragraph 4, The above similarity is, Characterized by using similarity between strings, Defense method against tampering attacks.

6. In Paragraph 5, The similarity between the above strings is, Characterized by using editing distance, Defense method against tampering attacks.

7. In Paragraph 1, The step of determining the first modification threshold distance for the first malicious file is, The method is characterized by including the step of storing the first malicious file hash value, the one or more first modified malicious file hash values, and the first modified threshold distance in a cache memory. Defense method against tampering attacks.

8. In Paragraph 1, The step of determining whether the above-mentioned file to be inspected is a malicious file is, A step of determining a first detection distance value between the hash value of the file to be inspected and the hash value of the first malicious file; and The method is characterized by including the step of determining whether the file to be inspected is a malicious file by comparing the first detection distance value and the first modification threshold distance. Defense method against tampering attacks.

9. In Paragraph 1, The step of determining whether the above-mentioned file to be inspected is a malicious file is, A step of determining a second detection distance value based on the above-mentioned inspection target file hash value, the above-mentioned first malicious file hash value, and the above-mentioned one or more first modified malicious file hash values; and The method is characterized by including the step of determining whether the file to be inspected is a malicious file by comparing the second detection distance value and the first modification threshold distance. Defense method against tampering attacks.

10. In Paragraph 9, The step of determining the second detection distance value above is, A step of calculating the hash value distance between the file to be examined and the first malicious file based on the hash value of the file to be examined and the hash value of the first malicious file; A step of calculating a hash value distance between one or more target files and one or more first modified malicious files based on the hash value of the target file and the hash value of one or more first modified malicious files; and The method is characterized by including the step of determining the second detection distance value using the statistical values ​​of the hash value distance between the inspection target file and the first malicious file and the hash value distance between one or more inspection target files and the first modified malicious file. Defense method against tampering attacks.

11. A computer-readable, non-transient recording medium having a program recorded thereon for executing the tampering attack defense method described in claim 1.

Images