KR101291127B1 - User equipment and checking virus program method using the same - Google Patents

Abstract

The present invention relates to a user device and a method for diagnosing malicious code using the same, wherein a user device including a malicious code diagnosis and treatment function is linked with a computing device in a wired or wireless manner (USB interface, Bluetooth, WLAN, etc.) under user control. It is characterized in that the detection and treatment of malicious code through real-time monitoring. According to the present invention, it is possible to perform diagnosis and treatment of malware through simple operation of the user device linked with the computing device, and to easily check the operation process of diagnosis, detection and treatment of malware from the LED and the speaker of the user device. As a result, even users with low computing power can easily diagnose and treat malware.

Description

USER EQUIPMENT AND CHECKING VIRUS PROGRAM METHOD USING THE SAME}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to computer security technology, and in particular, a user device suitable for performing malware inspection in a computing device through a user device including a diagnosis and treatment function for malware by interworking with a user device through a USB interface. And it relates to a malicious code diagnostic method using the same.

Recently, a number of malicious codes are being used in computing devices that use operating system programs, such as personal computers, laptops, and smartphones, to modify system files and various executable files in operating system programs, and to leak personal information from computing devices.

In the past, the main purpose was to disable operation files and remove executable files for each computing device. Recently, financial transactions such as banking or securities operations over the Internet, and communication of data including email or confidential information have increased. In the meantime, other people often take advantage of vulnerabilities in Internet communication security to extract personal or secret information for malicious purposes.

In order to perform the diagnosis and inspection of such malicious codes, computing device users installed software (eg, anti-virus programs) for diagnosing malware in the computing device, and executed them to perform manual inspection and real-time inspection.

At this time, the data and signature information about the malware can be periodically updated from the provider server of the malware diagnostic software, the downloaded signature information is stored in the computing device.

Therefore, the user executes an antivirus program installed on a computing device periodically or in real time to perform diagnosis and inspection of malicious code, and then diagnoses and repairs the malicious code through manual inspection and real-time inspection.

Korean Patent Publication No. 2002-0094677 (published Dec. 18, 2003) United States Patent Application Publication No. 2009/0019388 (published Jan. 15, 2009)

As described above, in the conventional method of diagnosing and treating malware in a computing device, when a vaccine program is installed in the computing device to perform real-time monitoring and manual inspection by a user request, the system process uses a certain amount or more. As a result, the resource occupancy of the CPU and memory is increased, and thus, the overall performance of the operating system may be degraded. Furthermore, when multitasking at the same time with at least one or more other applications, the basic processing speed of the computing device may be increased. Due to the slowed down.

In addition, the malicious code penetrated into the computing device attacks against the pre-installed vaccine program, there was a problem that can disable the vaccine program itself.

Accordingly, an embodiment of the present invention provides a user device capable of performing real-time monitoring, diagnosis and treatment of malicious code by interworking a user device including a malicious code diagnosis and treatment function with a computing device, and a method for diagnosing malicious code using the same. can do.

In addition, an embodiment of the present invention, the user device is connected to the computing device through a wired or wireless method (USB interface, Bluetooth, WLAN, etc.) through the user device including the malicious code diagnosis and treatment function to check the malware in the computing device A user device that can be performed and a malicious code diagnosis method using the same can be provided.

In addition, an embodiment of the present invention, after interlocking a user device including a malware diagnosis and treatment function with a computing device, a user device capable of performing detection and treatment of malicious code through real-time monitoring under the user control and using the same It can provide a way to diagnose malware.

According to an embodiment of the present invention, a malicious code diagnosis user device may include a storage and control device that connects with a computing device and drives a malware diagnosis program corresponding to a pre-stored autorun file, and the malware diagnosis program. It may include a notification device for displaying colors and texts or outputting voices and sounds according to the operation.

The storage and control device may further include an operation controller configured to drive the malware diagnosis program to perform diagnosis and treatment of malicious code in the computing device, and to store the malicious code diagnosis program data and signature file for diagnosing the malicious code. Memory may be included.

The notification device may further include a display unit that lights or blinks a different color or outputs a set character when the malware diagnosis program is driven, malware inspection, discovery and treatment are controlled by the storage and control device. It may include a speaker for outputting a predetermined sound or voice during the test, discovery, treatment.

The notification device may include a button unit for controlling the preset storage control device based on a user command input differently through one click, two clicks, or a long click.

The storage and control device may include a USB hub connected to an external USB device, and an operation control unit for performing malware diagnosis and treatment for each directory in the external USB device.

When the diagnosis of the external USB device is completed, the operation controller may allow access of the external USB device and recognize the external USB device by the computing device.

The storage and control device may be connected to the computing device through at least one of USB interfacing, Bluetooth, and WLAN.

The malware diagnosis user device according to another embodiment of the present invention receives a power supply from a power supply device to drive an operating system program, and when an external USB device is inserted, executes a malware diagnosis program to diagnose and treat malware. A storage and control device for performing the operation, a notification device for displaying colors and letters or outputting voices and sounds according to a related operation of the malware diagnosis program, and storing the corresponding information when the external USB device is inserted and It may include a USB hub that delivers to the control device.

The storage and control device may further include: an operation controller configured to drive the malware diagnosis program to perform diagnosis and treatment of malicious code for each directory in the external USB device, and the malicious code diagnosis program data for diagnosing the malicious code. And a memory for storing the signature file.

The notification device may further include a display unit that lights or blinks a different color or outputs a set character when the malware diagnosis program is driven, malware inspection, discovery and treatment are controlled by the storage and control device. It may include a speaker for outputting a predetermined sound or voice during the test, discovery, treatment.

The notification device may include a button unit for controlling the preset storage control device based on a user command input differently through one click, two clicks, or a long click.

Malware diagnosis method using a user device according to an embodiment of the present invention, when the user device is connected to the computing device, the process of driving a malicious code diagnostic program corresponding to the pre-stored in the storage and control device; Under the control of the storage and control device, the notification device may include displaying colors and texts or outputting voices and sounds according to a related operation of the malware diagnosis program.

The process of driving the malicious code diagnosis program may include driving the malicious code diagnosis program based on the malicious code diagnosis program data and signature file for diagnosing the malicious code stored in a memory to diagnose and treat the malicious code in the computing device. It may include the process of performing.

The process of driving the malware diagnosis program may include a process of performing malware diagnosis and treatment for each directory in the external USB device when an external USB device is connected to the USB hub.

And when the diagnosis of the external USB device is completed, allowing access of the external USB device and recognizing the external USB device by the computing device.

The process of driving the malware diagnosis program may include installing a file for driving the malware diagnosis program on the computing device by executing an auto executable file when the driver installation of the computing device is completed. If it is completed, it may include the process of performing a real-time monitoring for malicious code.

And the process of performing the real-time monitoring, if the malicious code is detected, the process of indicating that the dangerous state to the notification device, storing the detected malicious code in the quarantine in the user device, and And a process of treating the malicious code and displaying the safe state with the notification device when the treatment of the malicious code is completed.

The process of performing real-time monitoring on the malicious code includes, when the user command is input by one click of the user button in the real-time monitoring state, indicating that the notification device is being inspected, Performing a manual scan on the set important files and processes, if a malicious code is detected, storing the detected malicious element in a quarantine in the user device, treating the malicious code, and executing a running process. And forcibly terminating the process and displaying the safe state with the notification device when the treatment of the malicious code is completed.

And the process of performing the real-time monitoring for the malicious code, in the case of receiving a user's command clicked twice or a long time over a predetermined time in the real-time monitoring state, indicating that the notification device is being inspected And performing a manual test on a preset precision diagnosis area of the computing device.

The process of performing real-time monitoring on the malicious code includes, when an external USB device is inserted into a USB hub, indicating that the notification device is being scanned, and inspecting all directories of the external USB device, If found, the process of treating the malicious code, and if the treatment is completed or the malicious code is not found, indicating that the notification device is in a safe state, allowing access to the external USB device, It may include the step of recognizing the external USB device to the computing device.

The method for diagnosing malware may include booting by operating an operating system program in the user device when the computing device is set to boot the user device in order to recover a misdiagnose of a system file, and performing malicious code in the user device. Determining whether or not the last stored file is recovered by checking the quarantine file in which the diagnosed file is stored, and delivering the recovered file to the computing device, terminating the user device, and closing the computing device. It may include a process of rebooting.

Malware diagnosis method using a user device according to another embodiment of the present invention, when the user device is supplied with power from the power supply device, the process of driving the operating system program in the storage and control device, and an external USB device from the USB hub Is inserted, displays a color and text according to a process of executing a malware diagnosis program to perform the diagnosis and treatment of malware, and the related operation of the malware diagnosis program in a notification device under the control of the storage and control device. Or outputting voice and sound.

The process of diagnosing and treating the malicious code may include operating the malicious code diagnostic program based on the malicious code diagnosis program data and signature file for diagnosing the malicious code stored in a memory to diagnose the malicious code in the computing device. And performing treatment.

The process of diagnosing and treating the malicious code may include: indicating that the malicious device is in a dangerous state when the malicious code is detected, storing the detected malicious code in a quarantine in the user device; The process of treating the malicious code, and if the treatment of the malicious code is completed, it may include the step of displaying a safe state to the notification device.

The process of diagnosing and treating the malicious code may include: indicating that the notification device is being inspected by the notification device when a user command is input by a single click of a user button in the real-time monitoring state, and for the external USB device. A process of performing a manual scan of preset important files and processes, and if a malicious code is detected, storing the detected malicious element in a quarantine in the user device, and treating and executing the malicious code And forcibly terminating the process and displaying the safe state with the notification device when the treatment of the malicious code is completed.

The process of diagnosing and treating the malicious code may include: indicating that the notification device is being inspected when a user clicks twice on the user button or a user command long pressed for a predetermined time or longer in the real-time monitoring state. And performing a manual test on a preset precision diagnosis area of the external USB device.

According to the user device and a method for diagnosing malicious code using the same according to an embodiment of the present invention as described above, there are one or more of the following effects.

According to a user device and a method for diagnosing malware using the same according to an embodiment of the present invention, when the user device is inserted into a computing device, the system can be immediately performed after the driver installation, and thus easy to install, regardless of computer replacement. Keep your engine up to date.

In addition, the diagnosed file can be stored in the quarantine in the user device to recover the system file after operating by USB booting method when the system file is misdiagnosed.

In addition, it is possible to perform diagnosis and treatment of malware through simple operation of the user device linked with the computing device, and to check the operation process such as diagnosis, malware detection and treatment from the LED and speaker of the user device. Even users with low utilization can receive diagnosis / testing and treatment status of malware through visual and auditory, and can be used by users of all ages and physically disabled by performing manipulation with externally exposed buttons.

In addition, since the internal process of the computing device is minimized and the storage space of the computing device is not used, the system process resource share due to the malicious code diagnosis and treatment is reduced, and the malicious code diagnosis and repair program can be tampered with. By preventing the, there is an effect that can increase the user convenience and create a variety of additional services.

Meanwhile, since the malicious code diagnosis of the external USB device connected to the computing device can be performed through the USB hub of the user device, it is possible to easily determine whether the external USB device is malicious without using system resources of the computer.

In addition, since the user device itself includes an operating system program, the USB device inserted into the USB hub can be diagnosed as malicious through a separate power supply without being connected to the computing device.

1 is a configuration diagram briefly showing the structure of a malicious code diagnosis system according to an embodiment of the present invention;
2 illustrates a form of a user device according to an embodiment of the present invention;
3 is a block diagram illustrating a structure of a computing device according to an embodiment of the present invention;
4 is a flowchart illustrating an interworking procedure between a user device and a computing device according to an embodiment of the present invention;
5 is a flowchart illustrating a procedure for diagnosing and treating malignant elements during real-time monitoring of a computing device according to an embodiment of the present invention;
6 is a flowchart illustrating a safety check and a precision diagnosis procedure of a computing device using a button of a user device according to an embodiment of the present invention;
7 is a flowchart illustrating a malicious component diagnosis and treatment procedure of an external USB device using a USB hub of a user device according to an embodiment of the present invention;
8 is a flowchart illustrating a procedure for diagnosing and treating malicious components of an external USB device using a USB hub of a user device according to an embodiment of the present invention;
9 is a flowchart illustrating a recovery procedure according to a system file error according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions in the embodiments of the present invention, which may vary depending on the intention of the user, the intention or the custom of the operator. Therefore, the definition should be based on the contents throughout this specification.

Each block of the accompanying block diagrams and combinations of steps of the flowchart may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which may be executed by a processor of a computer or other programmable data processing apparatus, And means for performing the functions described in each step are created. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

Also, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

In an embodiment of the present invention, the user device including the malware diagnosis and treatment function is linked with a computing device in a wired / wireless manner (USB interface, Bluetooth, WLAN, etc.) to detect and treat malicious code through real-time monitoring under user control. To do.

Meanwhile, in the exemplary embodiment of the present invention, elements, activities, and the like, which hinder normal operation of the computing device, such as viruses, spyware, and harmful programs, are collectively defined as malicious code or malicious elements.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram briefly showing the structure of a malicious code diagnosis system according to an embodiment of the present invention.

Referring to FIG. 1, the malicious code diagnosis system may include a user device 100, a computing device 150, and the like interoperating with the user device 100. In this case, the user device 100 may include a notification device 110 and a storage and control device 120.

In more detail, after the user device 100 is connected to the computing device 150 and interlocked with each other, the user device 100 may diagnose malicious code in the computing device 150, and when the external USB device is inserted through the USB hub, the user device 100 may be connected to the external USB device. Diagnosis and treatment of malicious code can be performed.

The notification device 110 in the user device 100 may include a display unit (hereinafter referred to as a light emitting diode (LED)) 102, a button unit 104, a speaker 106, a socket 108, and the like. . The LED 102 and the speaker 106 may indicate an operating state of the user device 100 and may indicate whether the connected computing device 150 or the external USB device is safe.

For example, the LED 102 lights blue when the diagnostic is waiting, and the sound of the speaker 106 is silent. When operating, the LED 102 blinks blue, indicating that the speaker 106 is operating. Sound or voice can be output. In the case of a dangerous situation such as malware detection, the red blinking, a sound or voice indicating a danger is output. When the current state is a safe state, the green light is turned on, and the sound may be silent. In addition, when the error and the expiration date of the vaccine program, etc. are displayed, the orange may flash and the sound may be silenced.

The button unit 104 may receive a command from a user through a touch input method or a keypad type pressure sensing method, and in the case of a single click, a manual test mode for confirming the safety of the computing device 150 may be performed. Can be cured with a click when a malicious element is found. In the case of a double click or a long button click for a predetermined time or more, the precision diagnosis of the computing device 150 may be performed.

This notification device 110 may be coupled with the storage and control device 120 through the socket 108. The storage and control device 120 is combined with the notification device 110 to perform data storage non-control for diagnosing and controlling malicious elements of the computing device 150 and the external USB device. The operation control unit 122, The flash memory 124, the device controller 126, the USB hub 130, and the USB interface 140 may be included.

Since the operation controller 122 includes an antivirus engine and may include its own operating system program such as Linux, the operation control unit 122 may drive the antivirus engine when connected to the computing device 150 through the USB interface 140. In addition, when the external USB device is inserted, the USB hub 130 transmits information about the external USB device to the operation control unit 122, and the operation control unit 122 drives a vaccine engine to drive malicious elements of the external USB device. Can be diagnosed and treated.

On the other hand, when the user device 100 is supplied with power through the USB power source 160, Linux can be executed to perform malware diagnosis and treatment of an external USB device through an antivirus engine in Linux.

Accordingly, the operation control unit 122 performs real-time monitoring, diagnosis and treatment of malicious elements through the connection with the computing device 150, checks whether the computer is safe through manual inspection, precise diagnosis of the computing device 150, and external USB device. Operational control such as diagnosis and treatment of malicious elements, control of use to an independent device through the USB power supply 160, and recovery of a system file may be performed.

The flash memory 124 may store an operating system (Linux) program and an antivirus program, and may transfer the stored and requested data under the control of the operation controller 122. In addition, the partition hidden by partitioning is stored in the antivirus program files and signatures, can be used as a quarantine storage space.

In addition, the open partition can store executable files (such as vaccine program execution, malware diagnosis, engine update data, etc.) for various types of function operations for diagnosing and treating malicious elements.

Each data including an operating system program and an antivirus program stored in the flash memory 124 may be encrypted and stored. When performing data transmission / reception with the computing device 150 through a USB protocol, by encrypting and transmitting It can prevent the penetration of malicious code.

The device controller 126 performs the control of the CPU, the memory, the USB hub 130, the USB interface 140, and the like in the user device 100 under the control of the operation controller 122, and the computing device 150 and the external device. The connection of the USB device may be detected, and whether the power is supplied through the USB power supply 160 may be transmitted to the operation controller 122.

The USB interface 140 is for coupling the user device 100 and the computing device 150. When the USB interface 140 is coupled, a driver for controlling the user device 100 may be installed in the computing device 150, and the user device 100 may be installed. ) Installs the first installation file for driving through the automatic execution in the computing device 150, and drives the real-time monitoring mode.

Meanwhile, in FIG. 1, the user device 100 and the computing device 150 are connected through the USB interface 140. However, depending on the implementation method, the connection may be performed using each Bluetooth module, or the wireless LAN method may be used. It can also be done.

2 is a diagram illustrating a form of a user device according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the user device 100 as a malicious code controller may be connected to the computing device through a USB 128 method, and the LED 102 and the speaker may be used whenever the malware is detected, treated, or updated in the computing device. This can be informed to the user.

For example, in the state interlocked with the computing device 150, the blue state of the standby state of the LED 102 is turned on, and if the malicious code is detected, the LED 102 may blink red. The speaker can output the information as a voice or alarm. When the malicious code is treated in this manner, the LED 102 may repeat the flashing operation in blue, and when the treatment is completed, the LED 102 may return to the blue state again.

When the malicious code diagnosis program or the malicious code DB is automatically updated, the LED 102 may repeat a flashing operation such as blue and perform speaker output according to each operation.

In this case, when the user presses the button of the button unit 104, a manual test may be performed, or a treatment for the diagnosed malicious code may be performed. In this case, different functions can be performed by short-clicking or long-clicking the button for a predetermined time.

In addition, the malicious code diagnosis of the external USB device may be performed through the USB hub 130 without interworking with the computing device 150. That is, since the malicious code diagnosis of the inserted external USB device can be performed while interworking with the computing device 150 or receiving a separate power supply, the user can easily check the state of malware diagnosis and treatment. The control method can perform malicious code treatment on external USB devices.

Meanwhile, although FIG. 2 illustrates a user device 100, the present invention is not limited to the illustrated form, and the diagnosis and diagnosis of malicious elements may be performed without occupying system resources of the computing device 150 in conjunction with the computing device 150. As long as the device can perform the treatment, it is of course applicable to the present invention. That is, the AV engine application may be installed in the encrypted region of the smart phone, interlocked with the computing device 150 through USB interfacing, Bluetooth, WLAN, and the like, to perform diagnosis and treatment.

3 is a block diagram illustrating a structure of a computing device according to an embodiment of the present invention.

Referring to FIG. 3, the computing device 150 may include a scanning process 300, a hardware notification driver 310, a central processing unit (CPU) 320, a memory 330, a file filter driver 340, a hard disk, The flash memory 350, the network filter driver 360, the network module 370, and the like may be included.

In more detail, when the user device 100 is inserted into the computing device 150 through the USB 128 interface, the hardware notification driver 310 may check the corresponding hardware information and install a driver therefor. As the vaccine program in the user device 100 is automatically executed, the scanning process 300 may allocate system resources from the CPU 320 and the memory 330 to be used by the vaccine program of the user device 100. can do.

That is, the companion file for the antivirus program executed in the user device 100 may be installed on the hard disk of the computing device 150 to about 10 MB. This represents a remarkable difference compared to the size of the antivirus program (approximately 500MB to 2GB) installed in the conventional computing device 150, so that the system resource occupancy of the antivirus program executed in the user device 100 may also be reduced. .

Accordingly, the vaccine program executed in the user device 100 may perform malware diagnosis and treatment for the hard disk and the flash memory 350 controlled by the file filter driver 340 through the scanning process 300.

4 is a flowchart illustrating an interworking procedure between a user device and a computing device according to an embodiment of the present invention.

Referring to FIG. 4, when it is connected to the computing device 150 through the USB interface 140 of the user device 100 in step 400, the driver for the computing device 150 to control the user device 100 in step 402. Will install

In operation 404, the user device 100 executes an auto-execution file through the operation control unit 122, and installs an initial installation file, which is a real-time monitoring file, in the computing device 150.

When the file installation is completed in the computing device 150 in step 406, the process proceeds to step 408 to perform real-time malicious element monitoring of the computing device 150.

5 is a flowchart illustrating a procedure for diagnosing and treating malignant elements during real-time monitoring of a computing device according to an embodiment of the present invention.

Referring to FIG. 5, in operation 500, the operation controller 122 of the user device 100 performs real-time monitoring, and in step 502, it is determined whether a malicious element is detected. If no malicious element is detected during the real-time scan, the process proceeds to step 512, and the sound or voice indicates that the safety indicator (for example, the green light of the LED 102 is turned on and the speaker 106 is set to a safe state through the notification device 110). Output, etc.).

However, when a malicious element is detected during the real-time scan in step 502, the alarm device 110 displays a danger (for example, flashing red and a danger alert sound output) in step 504.

Thereafter, the malicious element detected in step 506 is stored and backed up in a quarantine within a predetermined space of the flash memory 124, and then, in step 508, the malicious element is treated and repaired. Thereafter, the treatment and recovery result information is transmitted to the computing device 150 to display the treatment and recovery contents through the display device of the computing device 150 in step 510, and the safety display through the notification device 110 in step 512. Will be performed.

6 is a flowchart illustrating a safety check and a precision diagnosis procedure of a computing device using a button of a user device according to an exemplary embodiment of the present invention.

Referring to FIG. 6, when the user device 100 is connected to the computing device 150 in step 600 and the user briefly presses the button unit 104 of the user device 100 in a real time monitoring state or a waiting state, As before the financial transaction, it is to check whether the computing device 150 is safe. In step 602, the notification device 110 is displayed as being checked.

In step 604, the user device 100 performs a check on a predetermined important file, a process list, and a check on corresponding programs. If the malicious element is found in step 606, the process proceeds to step 608 to perform the treatment of the found malicious element, and if the malicious element is a process, the process is forcibly terminated.

Thereafter, the diagnosed file is stored in the quarantine in the user device 100 in step 610, and in step 612, the malicious element diagnosis and treatment for the computing device 150 is completed. do.

If no malicious element is found in step 606, the process proceeds to step 612 to indicate that the notification device 110 is safe.

In operation 600, when the user presses the button unit 104 of the waiting user device 100 for more than a preset time or presses twice, the process proceeds to step 614. When the user presses the button 104 for a long time or presses twice, it is determined that the user requests to perform a detailed inspection of the computing device 150.

In other words, the user may perform a preset inspection for checking whether the computing device 150 is safe, for example, an installation package scan, a compressed file scan, a disk boot area scan, a scan of a running or service program, an automatic startup program scan, a host By performing a file check or the like, the safety of the computing device 150 can be guaranteed more reliably.

In step 616, the notification device 110 is displayed as being inspected, and in step 618, the preset precision diagnosis area is inspected, and in step 606, it is determined whether a malicious element is found.

If the malicious element is found in step 606, the process proceeds to step 608 to perform the treatment of the found malicious element, and if the malicious element is a process, the process is forcibly terminated.

Thereafter, the diagnosed file is stored in the quarantine in the user device 100 in step 610, and in step 612, the malicious element diagnosis and treatment for the computing device 150 is completed. do. However, if no malicious element is found in step 606, the process proceeds to step 612 to indicate safety to the notification device 110.

Meanwhile, in steps 608 to 612, the order may vary depending on the implementation manner. In other words, if a malicious element is found in step 606, first, the notification device 110 indicates a dangerous situation, the malicious element file diagnosed in step 610 is quarantined, and then the malicious element treatment in step 608 is performed. Thereafter, the process may proceed to step 612.

7 is a flowchart illustrating a malicious element diagnosis and treatment procedure of an external USB device using a USB hub of a user device according to an embodiment of the present invention.

Referring to FIG. 7, when the user device 100 is connected to the computing device 150 in step 700 and an external USB device is inserted into the USB hub 130 in a real-time monitoring state or waiting state, the process proceeds to step 702. The notification device 110 indicates that the malicious element is being inspected.

In operation 704, all directories in the storage space of the inserted external USB device are examined. In step 706, if the malicious element is found and the malicious element is not detected, the controller proceeds to step 708 to indicate that the notification device 110 is safe. Information is transferred to the computing device 150.

Through this, in step 712, the computing device 150 recognizes the external USB device as a USB memory device.

On the other hand, if the malicious element is found as a result of the test in step 706, the process proceeds to step 714 to indicate the dangerous state to the notification device 110, and in step 716 to perform treatment for the malicious element. The diagnosed file is stored in a quarantine to prevent misdiagnosis, and in step 720, the treated contents are transferred to the computing device 150 to be provided on the screen through the display unit.

In step 722, since the treatment for the external USB device is completed, the notification device 110 is displayed in a safe state. In addition, after step 722, as in steps 710 and 712, the user device 100 allows access of an external USB device to transfer information of the external USB device to the computing device 150, and the computing device 150 receives the external USB device. The device will be recognized as a USB memory device.

8 is a flowchart illustrating a malicious component diagnosis and treatment procedure of an external USB device using a USB hub of a user terminal according to an embodiment of the present invention.

Referring to FIG. 8, unlike FIG. 7, the user device 100 is not connected to the computing device 150, and the user device 100 is powered by the USB power 160 connected to the USB interface 140 in step 800. You will receive a supply.

In operation 802, the operation control unit 122 of the user device 100, which is powered by the USB power supply 160 without being connected to the computing device 150, may drive its own operating system program, for example, Linux.

In addition, when Linux is completed, the notification device 110 indicates that the malicious element is waiting for diagnosis in step 804. In step 806, when the external USB device is inserted into the USB hub 130, the control proceeds to step 808 to indicate that the notification device 110 is being inspected.

In step 810, all directories in the storage space of the external USB device inserted through the Linux AV engine are examined. In step 812, through the inspection, it is determined whether a malicious element is found, and when no malicious element is found, the process proceeds to step 820 to indicate that the notification device 110 is safe.

However, if a malicious element is found as a result of the test in step 812, the process proceeds to step 814, indicating that the alarm device 110 indicates a dangerous state, and in step 816, treatment for the malicious element is performed. In operation 818, the treatment content information is displayed through the notification device 110. In step 820, after the treatment content is displayed, it indicates that the current state of safety.

9 is a flowchart illustrating a recovery procedure according to a system file error according to an embodiment of the present invention.

Referring to FIG. 9, when the user device 100 is connected to the computing device 150 to perform a treatment for a malicious element, and when deleting is performed as a misdiagnosis of a system file, an operating system program of the computing device 150 may be used. An error may occur that prevents booting.

In operation 900, the computing device 150 sets a boot to the USB device, and in step 902, the user device 100 boots to its own operating system program, Linux. In operation 904, the operation controller 122 checks the contents of the corresponding files in the quarantine where the files previously diagnosed are stored.

In other words, if an error occurs during reboot after diagnosis and treatment of malicious elements, the diagnosis and treatment is incorrectly treated as a misdiagnosis of the system file. Therefore, after checking the files stored in the quarantine, the system file is recovered in step 906. (Eg, restoring deleted files, changing file names of system files backed up with malicious elements to original system file names, etc.).

When the recovery is completed in step 908, the process proceeds to step 910, the recovered file is transferred to the computing device 150 to be restored to the system folder, or the error file is replaced with the recovered file. In operation 912, a boot error is prevented by rebooting the computing device 150.

As described above, a user device and a method for diagnosing malicious code using the same according to an embodiment of the present invention may include a user device including a malicious code diagnosis and remediation function with a computing device and a wired / wireless method (USB interface, Bluetooth, WLAN, etc.). It works by detecting and treating malicious code through real-time monitoring under user control.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments, but is capable of various modifications within the scope of the invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by equivalents to the appended claims, as well as the appended claims.

100: user device 110: notification device
120: storage and control device 150: computing device
160: USB power

Claims (26)

delete A storage and control device that connects to the computing device and drives a malware diagnostic program corresponding to a pre-stored autorun file;
A notification device for displaying colors and texts or outputting voices and sounds according to a related operation of the malware diagnosis program;
The storage and control device,
An operation controller configured to run the malicious code diagnosis program to perform diagnosis and treatment of malicious code in the computing device;
It includes a memory for storing malicious code diagnostic program data and signature files for the diagnosis of the malicious code,
The operation control unit,
When the malicious code is detected by performing real-time monitoring on the computing device, the detected malicious code is stored in a quarantine,
Booting the computing device by running an internal operating system program for recovering the misdiagnosis of system files,
Checking the file in the quarantine to determine whether to recover the last stored file, and when the file is recovered, rebooting the computing device after delivering the recovered file to the computing device.
Malware diagnostic user device.
The method of claim 2,
The notification device,
A display unit which lights or flashes a different color or outputs a set character when the malware diagnosis program is driven, malware inspection, discovery and treatment under the control of the storage and control device;
Speaker that outputs a preset sound or voice when the malicious code is scanned, found, or cured
Malware diagnostic user device comprising a.
The method of claim 2,
The notification device,
Button unit for controlling the preset storage control device based on user commands input differently through single click, double click or long click
Malware diagnostic user device comprising a.
The method of claim 2,
The storage and control device,
It further includes a USB hub for connecting with an external USB device,
The operation control unit performs a diagnosis and treatment of malware per directory in the external USB device.
Malware diagnostic user device.
6. The method of claim 5,
The operation control unit,
And when the diagnosis of the external USB device is completed, permits access of the external USB device and recognizes the external USB device by the computing device.
The method of claim 2,
The storage and control device,
And a malicious code diagnosis user device connected to the computing device through at least one of USB interfacing, Bluetooth, and WLAN.
The method of claim 2,
The storage and control device receives power from a power supply device to drive the operating system program, and when an external USB device is inserted, executes a malicious code diagnostic program to perform diagnosis and treatment of malicious code.
The malware diagnosis user device,
A notification device for displaying colors and texts or outputting voices and sounds according to a related operation of the malware diagnosis program;
USB hub that transfers the information to the storage and control device when the external USB device is inserted
Malware diagnostic user device further comprising.
The method of claim 8,
The operation control unit,
By running the malware diagnostic program to perform the diagnosis and treatment of malicious code for each directory in the external USB device
Malware diagnostic user device.
The method of claim 8,
The notification device,
A display unit which lights or flashes a different color or outputs a set character when the malware diagnosis program is driven, malware inspection, discovery and treatment under the control of the storage and control device;
Speaker that outputs a preset sound or voice when the malicious code is scanned, found, or cured
Malware diagnostic user device comprising a.
The method of claim 8,
The notification device,
Button unit for controlling the preset storage control device based on user commands input differently through single click, double click or long click
Malware diagnostic user device comprising a.
When the user device is connected to the computing device, running a malware diagnosis program corresponding to an auto-executed file previously stored in the storage and control device;
Displaying colors and texts or outputting voices and sounds according to a related operation of the malware diagnosis program in a notification device under control of the storage and control device;
Storing the detected malicious code in a quarantine in the user device when a malicious code is detected by performing real-time monitoring of the computing device;
When booting the user device in the computing device to recover a system file from the computing device, booting by operating an operating system program in the user device;
Checking a quarantine file in which a file diagnosed as a malicious code in the user device is stored to determine whether to recover the last stored file, and when the file is recovered, transferring the recovered file to the computing device;
Shutting down the user device and rebooting the computing device;
Malware diagnostic method comprising a.
13. The method of claim 12,
The process of driving the malware diagnostic program,
A process of performing the diagnosis and treatment of malicious code in the computing device by running the malicious code diagnostic program based on the malicious code diagnostic program data and signature file stored in the memory.
Malware diagnostic method comprising a.
13. The method of claim 12,
The process of driving the malware diagnostic program,
When an external USB device is connected to the USB hub, a process of performing malware diagnosis and treatment for each directory in the external USB device
Malware diagnostic method comprising a.
The method of claim 14,
When the diagnosis of the external USB device is completed, allowing access of the external USB device and recognizing the external USB device by the computing device.
Malware diagnostic method comprising a.
13. The method of claim 12,
The process of driving the malware diagnostic program,
When the driver installation of the computing device is completed, installing a file for driving the malicious code diagnostic program on the computing device by executing an auto executable file;
When the installation is completed, the process of performing a real-time monitoring of the malicious code
Malware diagnostic method comprising a.
17. The method of claim 16,
The process of performing the real-time monitoring,
If the malicious code is detected, indicating that the notification device is in a dangerous state;
The process of treating the malicious code,
When the treatment of the malicious code is completed, the process of indicating that the safe state to the notification device
Malware diagnostic method comprising a.
17. The method of claim 16,
The process of performing a real-time monitoring for the malicious code,
In the real-time monitoring state, if a user command is input by one click of the user button, the process of indicating that the inspection device to the inspection;
Performing a manual check on a predetermined important file and process for the computing device;
If the malicious code is detected, storing the detected malicious code in a quarantine in the user device;
Cleaning the malicious code and forcibly terminating a running process;
When the treatment of the malicious code is completed, the process of indicating that the safe state to the notification device
Malware diagnostic method comprising a.
19. The method of claim 18,
The process of performing a real-time monitoring for the malicious code,
In the real-time monitoring state, if the user's command is clicked twice or long clicked for more than a predetermined time, the process of indicating that the inspection device to the inspection;
Performing a manual test on a preset precision diagnosis area of the computing device;
Malware diagnostic method comprising a.
17. The method of claim 16,
The process of performing a real-time monitoring for the malicious code,
When an external USB device is inserted into a USB hub, indicating that the notification device is being inspected;
Inspecting all directories of the external USB device and if the malicious code is found, treating the malicious code;
When the treatment is completed or the malicious code is not found, indicating that the notification device is in a safe state;
Allowing access of the external USB device and recognizing the external USB device with the computing device;
Malware diagnostic method comprising a.
delete 13. The method of claim 12,
Driving the operating system program in a storage and control device when the user device receives power from a power supply device;
When an external USB device is inserted from a USB hub, executing the malware diagnostic program to perform diagnosis and treatment of the malicious code;
Displaying color and text or outputting voice and sound according to a related operation of the malware diagnosis program in a notification device under the control of the storage and control device;
Malware diagnostic method comprising a.
23. The method of claim 22,
The process of performing the diagnosis and treatment of the malicious code,
And diagnosing and treating malicious code in the external USB device by driving the malicious code diagnostic program based on the malicious code diagnostic program data and the signature file for diagnosing the malicious code stored in a memory.

23. The method of claim 22,
The process of performing the diagnosis and treatment of the malicious code,
If the malicious code is detected, indicating that the notification device is in a dangerous state;
Storing the detected malicious code in a quarantine in the user device;
The process of treating the malicious code,
When the treatment of the malicious code is completed, the process of indicating that the safe state to the notification device
Malware diagnostic method comprising a.
23. The method of claim 22,
The process of performing the diagnosis and treatment of the malicious code,
In the case of receiving a user command with a single click of a user button in a real-time monitoring state, indicating that the inspection device is inspecting;
Performing a manual check on a predetermined important file and process for the external USB device;
If the malicious code is detected, storing the detected malicious code in a quarantine in the user device;
Cleaning the malicious code and forcibly terminating a running process;
When the treatment of the malicious code is completed, the process of indicating that the safe state to the notification device
Malware diagnostic method comprising a.
26. The method of claim 25,
The process of performing the diagnosis and treatment of the malicious code,
In the real-time monitoring state, if the user's command is clicked twice or long clicked for more than a predetermined time, the process of indicating that the inspection device to the inspection;
A process of performing a manual test on a preset precision diagnosis area of the external USB device.
Malware diagnostic method comprising a.

Images