KR101657180B1 - System and method for process access control system - Google Patents

Abstract

The present invention relates to a process access control system and method for monitoring and controlling an access of a process of performing a security threat operation in a user terminal, the process access control system comprising a user terminal and an integrated management server, The process access control system comprising: a monitoring unit for monitoring a process of communicating with the user terminal; An inspection unit for analyzing the process to determine whether the process is an abnormal process; A processing unit for controlling access of the abnormal process; A tracking unit for collecting information of the abnormal process; A controller for supervising, analyzing, accessing and tracking the process; A policy storage unit for storing an abnormal behavior reference value of the process and a process characteristic of each attack type; And an event log storage unit for storing events generated in association with the abnormal process. According to the present invention, there is an effect that the security is enhanced because the file access, the event message, the resource, and the network of the process are analyzed and controlled under various conditions in order to determine the risk of the process of communicating with the user terminal.

Description

[0001] SYSTEM AND METHOD FOR PROCESS ACCESS CONTROL SYSTEM [0002]

The present invention relates to a process access control system and method for securing a user terminal, and more particularly, to a process access control system and method for monitoring and controlling an access of a process for making a security threat in a user terminal will be.

Recently, information processing terminals such as PCs, notebook PCs, UMPCs, portable game machines, PDAs, PMPs, smart phones, WiBro terminals and telematics terminals have diversified and become smaller and complex, The number of security threats is expanding due to the deterioration of the availability of terminals due to attacks such as theft, denial of service, APT (Advanced Persistent Threat) attacks, malicious codes such as viruses, Trojan horses and DDoS.

In order to avoid a security threat directed to such a terminal, the prior art Patent Registration No. 10-0959264 discloses a system and method for blocking a zombie PC that monitors network processes and blocks attack packet transmission by hooking a network service request from a terminal There is a bar.

However, in the case of the prior art, since only the packet information of the process using the network is compared and it is judged whether or not the process is a malicious process, there is a problem in that it can not be judged whether or not the process is dangerous under other conditions.

Korean Patent No. 10-0959264

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above-mentioned problems, and it is an object of the present invention to enhance security of a terminal by judging possibility of process risk and controlling access through file access, event message, And to provide a process access control system and method.

According to an aspect of the present invention, there is provided a process access control system including a user terminal and an integrated management server, the process access control system for monitoring and controlling an access of an abnormal process in the user terminal, The process access control system comprising: a monitoring unit for monitoring a process of communicating with the user terminal; An inspection unit for analyzing the process to determine whether the process is an abnormal process; A processing unit for controlling access of the abnormal process; A tracking unit for collecting information of the abnormal process; A controller for supervising, analyzing, accessing and tracking the process; A policy storage unit for storing an abnormal behavior reference value of the process and a process characteristic of each attack type; And an event log storage unit configured to store events generated in association with the abnormal process.

The checking unit may check whether a file in the protection file or the protection path of the process is accessed or a threshold of the amount of data when the file of the process is used is exceeded.

In addition, the checking unit may check whether the process generates a dangerous system message in the security of the user terminal; The dangerous system message may be at least one of a file deletion, a file modification, a file creation, a process termination, a process generation, a network command, and a firewall command.

On the other hand, the checking unit can check whether the number of handles generated by the process, whether the number of threads exceeds a reference value, whether the DLL file loaded by the process includes a setting DLL file, or whether the process generated by the process includes a setting dependent process have.

The checking unit may check whether the source IP address of the packet to which the process communicates is a protection IP (IP band), or check whether the packet to which the process communicates exceeds the multiple IP connection limit value.

In addition, the checking unit may check whether the rate of traffic increase of the packet with which the process communicates exceeds the set value.

According to another aspect of the present invention, there is provided a process access control method including a user terminal and an integrated management server, the process access control method for monitoring and controlling an access to an abnormal process in the user terminal, the method comprising: (A) Wow; (B) examining a file accessed by the process at a user terminal; (C) examining an event generated by the process at a user terminal; (D) checking resources used by the user terminal in the process; And (E) determining whether the user terminal has terminated the process according to an inspection value and terminating the process.

The checking of the file in step (B) may include checking whether a file in the specific protection file or protection path of the process is accessed, or whether the amount of data used when the file of the process is used exceeds a threshold.

In addition, the event checking in the step (C) may include checking whether the process generates a dangerous system message to the security of the user terminal; The dangerous system message may be at least one of a file deletion, a file modification, a file creation, a process termination, a process generation, a network command, and a firewall command.

The resource checking in the step (D) may include checking whether the number of handles generated by the process, whether the number of threads exceeds a reference value, whether the DLL file loaded by the process includes a setting DLL file, or the setting of a dependent process It may be to check whether the dependent process is included.

According to another aspect of the present invention, there is provided a process access control method including a user terminal and an integrated management server, the process access control method for monitoring and controlling an access of an abnormal process in the user terminal, Wow; (G) checking the IP address of the packet with which the process is communicating; (H) checking the type of the packet with which the process is communicating; (I) checking the traffic growth rate of the packet with which the process is communicating; And (J) determining whether the network is blocked according to the inspection result, and blocking the network and sending a message.

The checking of the IP address of step (G) may include checking whether the source IP address of the packet communicated by the process is a protection IP (IP band), whether the packet is in communication with the process, It can be checking.

The traffic growth rate check of step (I) may include checking whether a rate of traffic increase of a packet communicated by the process exceeds a preset value.

In the present invention as described above, the following effects can be expected.

The present invention has the effect of enhancing security by analyzing and controlling file access, event messages, resources, and network of the process under various conditions in order to determine a risk of a process of communicating with a user terminal.

1 is a block diagram showing the configuration of a process access control system according to the present invention;
2 is a flow chart illustrating a process access control method according to the present invention;
3 is an exemplary diagram showing an example of a specific DLL file setting in the process access control method according to the present invention;
4 is a diagram illustrating an example of a window in which a network blocking message is displayed in the process access control method according to the present invention;

Hereinafter, a process access control system and method according to a specific embodiment of the present invention will be described with reference to the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. , Which may vary depending on the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowcharts may be performed by computer program instructions (execution engines), which may be executed by a general-purpose computer, special purpose computer, or other programmable data- The instructions that are executed through the processor of the computer or other programmable data processing equipment will generate means for performing the functions described in each block or flowchart of the block diagram.

These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible for the instructions stored in the block diagram to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of the flowchart.

Computer program instructions may also be loaded onto a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible that the instructions that perform the data processing equipment are capable of providing the steps for executing the functions described in each block of the block diagram and at each step of the flowchart.

Also, each block or step may represent a portion of a module, segment, or code that includes one or more executable instructions for executing the specified logical functions, and in some alternative embodiments, It is also possible for functions to occur out of order.

That is, it is also possible that the two blocks or steps shown are actually concurrently performed, and that the blocks or steps are performed in the reverse order of the function as required.

1 is a block diagram showing a configuration of a process access control system according to the present invention.

Hereinafter, a specific embodiment of a process access control system according to the present invention will be described in detail with reference to FIG.

The process access control system according to the present invention comprises a user terminal 100 and an integrated management server 200.

The user terminal 100 may include various electronic devices such as a computer, a notebook computer, a smart phone, and a tablet PC. A control program may be installed on the user terminal 100, Monitors the process of communicating with the user terminal 100 based on the received policy, and controls access to the abnormal process. The user terminal 100 communicates with the abnormal process and transmits the generated event log to the integrated management server 200.

The user terminal 100 includes a monitoring unit 110, an inspection unit 120, a control unit 130, a processing unit 140, a tracking unit 150, and a storage unit 160.

First, the monitoring unit 110 monitors a file input / output, a packet, an event message, and the like of processes performed in the user terminal 100 and transmits information of the processes to the checking unit 120 through the control unit 130 .

The checking unit 120 analyzes a file input / output, an event message, a resource setting, a communication packet information, and the like of the processes to determine whether the process is in violation of the policy based on the policy stored in the storage unit 160, 130) to transmit the policy violation judgment result of the process.

Specifically, in the file input / output portion, the checking unit 120 determines whether a file access right of a process, a file access path, a system and important protection file access, and a data amount when the process reads and writes a file exceed a setting threshold.

In addition, in the event message portion, the checking unit 120 determines whether or not the process calls a dangerous system command or a system message to the set security.

In the resource setting part, the checking unit 120 determines whether or not the handle, the number of threads generated by the process, the reference value exceeded, the loaded DLL file of the process, and whether or not the process creates the setting dependent process.

In addition, the checking unit 120 determines whether or not a policy violation, such as a source and an access path, a packet type, an amount of traffic, and the like of a packet with which a process communicates is determined.

The control unit 130 receives a policy violation discrimination result of the process from the inspection unit 120 and transmits a process interruption or termination command that violates the policy to the processing unit 140. When the processing unit 140 receives a command The process is shut down or terminated according to

In addition, the tracking unit 150 investigates detailed information and traces of a process that violates the security policy, and facilitates tracking of the source of the violating process and other user terminals associated with the process.

The policy storage unit 162 and the event log storage unit 164 may be configured to store a security policy for information on an abnormal process and an event log generated on the user terminal 100. [ ).

First, the policy storage unit 162 stores information such as an abnormal process file input / output, a packet, an event message, and the like. The event log storage unit 164 stores an event log in the process in the processing unit 140 do.

The control unit 130 not only plays a role of controlling overall control programs executed on the user terminal 100, but also transmits a blocking or termination command of a process that violates the policy as described above, Stores the policy received from the policy management unit 200 in the policy storage unit 162 and transmits the event log to the integrated management server 200 in the process stored in the event log storage unit 164.

Meanwhile, the integrated management server 200 determines characteristics of each type of attack of the abnormal process, determines a security policy for each process action, transmits the security policy to the user terminal 100, And stores the analyzed information.

At this time, the types of attacks of the abnormal process include an APT (Advanced Persistent Threat) attack, a DDoS attack, a Trojan horse, and the like.

The APT attack refers to a type of information that is latent in a computer for a long time while it is invisible or malicious. In the APT attack type, a process penetration, a botnet activity, a DDoS attack, an important security device access attack, Network access communication, and the like.

The DDoS attack is an attack that maliciously attacks the system and causes the system to run out of resources so that it can not be used as intended. The Trojan, when the user terminal executes the program infected with the malicious code, The malicious code that removes important information of the malicious code.

Hereinafter, a process access control method according to the present invention will be described in detail with reference to FIG.

As shown in FIG. 2, the process access control method according to the present invention starts by executing a process on the user terminal 100 (S110).

After the process is executed, the control program installed in the user terminal 100 performs various tests based on the abnormal process information stored in the policy storage unit 162 for the process.

First, the checking unit 120 checks a file accessed by the process in the user terminal 100 (S120).

At this time, the access file checking is performed including a file access right of the process, a file access path, whether access to the system and critical protection file, and whether the amount of data when the process reads and writes a file exceeds a setting threshold.

The checking unit 120 determines whether the process invokes a dangerous system command or a system message to the set security (S130).

Here, the dangerous system command or system message may include file deletion, creation, modification, download, process termination, network command, and firewall command.

Thereafter, the control unit 130 determines whether the process is terminated according to the determination result of the inspection unit 120 (S140).

If the checking unit 120 determines that the process is not terminated as an abnormal process and the process is not terminated, the checking unit 120 determines whether to use the resources of the process to determine whether to block or terminate the process.

First, the resource setting details on the user terminal 100 of the process are read (S150), and it is determined whether or not the number of threads generated by the process exceeds a reference value (S160).

At this time, the reference value is a threshold number of threads stored in the policy storage unit 162. When the number of threads generated by the process exceeds the reference value, it means a situation where the work performance amount surges abnormally. In this case, since the operation of the network becomes unstable, it is preferable to block the process for performing stable operation of the connected user.

If it is determined in operation 160 that the number of threads does not exceed the reference value, the process determines whether the DLL file loaded by the process is included in the configuration DLL file (S170).

Here, the DLL file is a dynamic-link library file, which has various functions that can be called by other programs. In case of an abnormal process, a specific DLL file is generated, and the generated DLL files are injected And it uses a lot of methods to leak personal information.

The configuration DLL file is a list of DLL files received from the integrated management server 200. As shown in FIG. 3, a list of DLL files loaded by an abnormal process is stored in the policy storage unit 162. FIG.

If it is determined in step 170 that the DLL file loaded by the process is not included in the configuration DLL file, it is determined whether the dependent process created by the process is included in the configuration dependent process (S180).

At this time, the setting dependent process is stored in the policy storage unit 162 like the reference value and the setting DLL file, and includes a list of dependent processes of a normally known abnormal process.

In addition, in the case of a dependent process generated by an abnormal process, since the generated path has a normal process name but has a normal process name, the file path of the dependent process generated by the process is analyzed to generate It is possible to determine whether or not the process is an abnormal process by determining whether the process is a dependent process generated in a path different from the location where the process is performed.

Thereafter, if the inspection unit 120 does not determine that the process is an abnormal process as a result of all the tests of steps 160 to 180, the inspection is terminated (S190).

If it is determined in step 160 that the inspection unit 120 determines that the process is an abnormal process, the process unit 140 ends the process in step S200.

In addition, after terminating the process in operation 200, the tracking unit 150 may check detailed information and traces of a process that is in violation of the security policy, and determine a source for the violated process and other related user terminals So as to facilitate tracking.

Meanwhile, the checking unit 120 not only terminates the abnormal process by inspecting the file input / output, the event message, and the resource setting of the processes, but also controls the network by inspecting packets communicated by the process.

First, the checking unit 120 compares the source IP address and the destination IP address of the packet with which the process communicates with the set IP address (S210).

Here, the set IP (IP band) address means an IP band to block access or protect, and is stored in the policy storage unit 162.

In step S220, the checking unit 120 checks whether the packet transmitted by the process exceeds a multiple IP connection limit value stored in the policy storage unit 162.

If multiple IPs are connected to the user terminal 100 excessively, there is a high possibility that the user terminal 100 is a zombie PC. The zombie PC is a PC that runs on hackers' orders regardless of the will of the computer user who is infected with the malicious code. Hackers use malicious code to install numerous zombie PCs using ActiveX or e-mail attachments, When a certain date and time are reached, a specific site is concurrently accessed and attacked, thereby causing the target site server to go down.

After step 220, the checking unit 120 determines whether a specific packet type of the process has occurred or not (step S230).

At this time, the specific packet type includes a packet type generated by a known abnormal process, and is received from the integrated management server 200 and stored in the policy storage unit 162.

Thereafter, the checking unit 120 checks whether the rate of increase of the packet traffic to which the process communicates exceeds a set value (S240).

In the event of a surge in packet traffic growth, a hacker is likely to be a DDoS attack that uses a large number of zombie PCs to transmit a huge amount of data to only one server, thereby hindering the normal functioning of a particular server.

As a result of the checking in steps 210 to 240, the checking unit 120 determines whether the network is blocked (S250). If the packet accesses the set IP (IP band) If the specific packet type is generated and the traffic growth rate of the packet exceeds the set value, the network is blocked (S260).

After the network is shut down, the controller 130 transmits a network shutdown message as shown in FIG. 4 (S270).

On the other hand, if it is determined in operation 250 that the process is not an abnormal process, the controller 130 ends the inspection (S280).

It will be understood by those skilled in the art that various changes and modifications may be made without departing from the scope of the invention as defined in the appended claims. It is self-evident.

The present invention relates to a process access control system and method for securing a user terminal, and more particularly, to a process access control system and method for monitoring and controlling an access of a process for making a security threat in a user terminal The present invention has the effect of enhancing security by analyzing and controlling file access, event message, resource and network of the process under various conditions in order to determine a risk of a process of communicating with a user terminal.

100: user terminal 110:
120: Inspection unit 130:
140: processing unit 150: tracking unit
160: storage unit 162: policy storage unit
164: Event log storage unit 200: Integrated management server

Claims (13)

A monitoring unit for monitoring a process of communicating with a user terminal; An inspection unit for analyzing the process to determine whether the process is an abnormal process; A processing unit for controlling access of the abnormal process; A tracking unit for collecting information of the abnormal process; A control unit for supervising the monitoring, analysis, access control and tracking of the process; A policy storage unit for storing an abnormal behavior reference value of the process and a process characteristic for each attack type and an event log storage unit for storing events generated in association with the abnormal process, A method for controlling access to a process, comprising:
(A) executing a process at a user terminal;
(B) checking whether the process accesses a predetermined protection file in the user terminal, whether the file on the protection path is accessed, and whether the amount of data used when the file is used in the process exceeds a threshold;
(C) examining an event generated by the process at a user terminal;
(D) terminating the process when it is determined that the process is an abnormal process as a result of the checking in the steps (B) and (C);
(E) if the execution of the process is maintained as a result of the step (D), checking the resources used by the user terminal in the process;
(F) terminating the process when the number of threads generated by the process exceeds the reference value or the DLL file loaded by the process is included in the DLL file stored in the policy storage unit as a result of the resource check in the step (E) ;
(G) analyzing a file path of a dependent process created by the process when execution of the process is maintained as a result of performing the process (F), and when the process is determined to be an abnormal process, ;
(H) collecting information of the terminated process when the process ends as a result of the step (D), the step (F) or the step (G);
(I) checking whether the source and destination IP of the packet with which the process communicates correspond to a protected IP (IP band) and whether the packet with which the process is communicating exceeds a multiple IP connection limit;
(J) checking the type of packet with which the process is communicating;
(K) checking a traffic increase rate of a packet with which the process communicates; And
(L) determining whether or not the network is blocked according to the inspection results of the steps (I) to (K), and blocking the network and transmitting a message.
The method according to claim 1,
The event checking in the step (C)
Checking whether the process generates a dangerous system message to the security of the user terminal;
The system message, which is dangerous for security,
A file deletion, a file modification, a file creation, a process termination, a process creation, a network command, and a firewall command.
3. The method according to claim 1 or 2,
The traffic growth rate check of step (K)
Wherein the step of checking whether a traffic increase rate of a packet communicated by the process exceeds a set value.
delete delete delete delete delete delete delete delete delete delete

Images