Back to results
US 12,596,801 B2Granted
Method and apparatus for detecting command control server of malicious application
AssigneeS2W Inc.
InventorsSang Duk Suh, Jae Ki Kim
Life of this patent
Estimating the term…
Abstract
Provided is an apparatus for detecting a command control server, the apparatus including: a collection unit configured to collect a malicious application; a malicious type determination unit configured to analyze the malicious application to determine a malicious type of the malicious application; and a command control server detection unit configured to detect a command control server associated with the malicious application based on the determined malicious type.
Claims9
An apparatus for detecting a command control server, the apparatus comprising:
- a processor;
- and
- a memory storing instructions executable by the processor,
- wherein the processor is configured to execute the instructions to:
- collect a malicious application,
- analyze the malicious application to determine a malicious type of the malicious application, and
- detect the command control server associated with the malicious application based on the determined malicious type,
- wherein the malicious type is one of:
- a first type in which a first file containing encrypted information about the command control server is present in the malicious application,
- a second type in which an encrypted class or encrypted command calling the command control server is present in the malicious application, and
- a third type in which information related to communication with an external server is present in the malicious application,
- wherein based on the malicious type being the third type and the external server being a community server, the processor is further configured to execute the instructions to:
- identify profile information of a community user identified in the information related to the communication with the external server,
- obtain the encrypted information about the command control server using a string included in the profile information of the user, and
- decrypt the encrypted information about the command control server by using an decryption key corresponding to the encrypted information.
12 more elements
A method of detecting a command control server, the method comprising:
- collecting a malicious application;
- analyzing the malicious application to determine a malicious type of the malicious application;
- and
- detecting the command control server associated with the malicious application based on the determined malicious type,
- wherein the malicious type is one of:
- a first type in which a first file containing encrypted information about the command control server is present in the malicious application,
- a second type in which an encrypted class or encrypted command calling the command control server is present in the malicious application, and
- a third type in which information related to communication with an external server is present in the malicious application, and
- wherein based on the malicious type being the third type and the external server being a community server, the detecting of the command control server comprises:
- identifying profile information of a community user identified in the information related to the communication with the external server,
- obtaining the encrypted information about the command control server using a string included in the profile information of the user, and
- decrypting the encrypted information about the command control server by using a decryption key corresponding to the encrypted information.
9 more elements
Dependencies are inferred from the claim text.