# US 2014/0157366 A1 · Network access control system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157366 A1 - Document ID: US20140157366A1 - Status: Published application - Kind: A1 - Application number: 14/127,199 - Filed: 2012-04-26 - Published: 2014-06-05 - Earliest claimed: 2011-06-23 - Assignees: Inca Internet Co., Ltd. - Inventors: Bo-Seung Ko; Sung-Eun Kim; Sang-Hoon Kim; Myung-Su Park - Web page: https://patentgrep.com/patent/US20140157366A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/554: {involving event detection and direct action} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention relates to a system and method for controlling a network access of a network packet on the basis of a thread which is inserted into a process through code injection. The network access control system according to the present invention comprises: a process inspecting unit for detecting a code injection-based thread included in a process; and a network monitoring unit for performing network filtering so as to detect a network packet having access to a network, and, if a communication subject of the detected network packet is the code injection-based thread, blocking the traffic of the detected network packet. ## Claims ### Claim 1 A network access control system, comprising: a process inspection unit configured to detect a code injection-based thread included in a process; and a network monitoring unit configured to detect a network packet accessing a network by performing network filtering, and to, if an agent of communication of the detected network packet is a code injection-based thread, block traffic of the detected network packet. ### Claim 2 (depends on 1) The network access control system of claim 1, wherein the process inspection unit comprises a process information collection unit configured to collect information about one or more processes being executed on a computer, a code injection detection unit configured to detect a code-injected area in the processes collected by the process information collection unit, and a code injection-based thread detection unit configured to detect a thread generated based on the code-injected area. ### Claim 3 (depends on 2) The network access control system of claim 2, wherein the process information collection unit collects an EProcess structure for each of the processes being executed on the computer. ### Claim 4 (depends on 2) The network access control system of claim 2, wherein the code injection detection unit comprises a virtual address space information collection unit configured to collect a virtual address range and attribute information of a virtual address space assigned to each of the collected processes, and a virtual address space inspection unit configured to inspect whether the virtual address space collected by the virtual address space information collection unit has been code-injected. ### Claim 5 (depends on 4) The network access control system of claim 4, wherein the virtual address space information collection unit collects the virtual address range and attribute information of the virtual address space assigned to each of the collected processes by inspecting a VadRoot member of an EProcess structure at a kernel level. ### Claim 6 (depends on 4) The network access control system of claim 4, wherein the virtual address space information collection unit collects the virtual address range and attribute information of the virtual address space assigned to each of the collected processes by using a VirtualQueryEx function at a user level. ### Claim 7 (depends on 4) The network access control system of claim 4, wherein the virtual address space inspection unit, if, in the attribute information of the virtual address space collected by the virtual address space information collection unit, a memory type is a private type and a protect flag value is executable, determines the virtual address space to be a code-injected area. ### Claim 8 (depends on 2) The network access control system of claim 2, wherein the code injection-based thread detection unit comprises a thread information collection unit configured to collect information about one or more threads being executed on the computer, and an address comparison unit configured to compare a start address value of each of the threads collected by the thread information collection unit with a virtual address range of a code-injected virtual address space provided the virtual address space inspection unit, and to, if the start address value of each of the collected threads falls within the virtual address range of the code-injected virtual address space, determine that a code injection-based thread is present in the code-injected virtual address space. ### Claim 9 (depends on 8) The network access control system of claim 8, wherein the thread information collection unit collects the information about one or more threads being executed on the computer by inspecting a ThreadListHead of the EProcess structure. ### Claim 10 (depends on 8) The network access control system of claim 8, wherein the thread information collection unit collects the information about one or more threads being executed on the computer by using a ZwQuerySystemInformation function. ### Claim 11 (depends on 1) The network access control system of claim 1, wherein the network monitoring unit comprises a network filter unit configured to filter the network packet, and a network blocking unit configured to selectively allow and block the traffic of the network packet based on process and thread IDs of the agent of communication of the network packet. ### Claim 12 (depends on 11) The network access control system of claim 11, wherein the network filter unit performs network filtering by using a network filter driver at a kernel level. ### Claim 13 (depends on 11) The network access control system of claim 11, wherein the network filter unit performs network filtering by hooking a socket function used by each of the processes at a user level. ### Claim 14 A network access control method, comprising: step 1 of collecting, by a network access control system, information about one or more processes being executed on a computer; step 2 of detecting, by the network access control system, a code-injected virtual address space area included in the collected processes; step 3 of detecting, by the network access control system, whether a code injection-based thread is present in the code-injected virtual address space area; step 4 of collecting, by the network access control system, traffic of at least one network packet by performing network filtering; and step 5 of selectively allowing and blocking, by the network access control system, the traffic of the network packet based on the code injection-based thread information. ### Claim 15 (depends on 14) The network access control method of claim 14, wherein step 1 comprises collecting an EProcess structure for each of the processes being executed on the computer. ### Claim 16 (depends on 14) The network access control method of claim 14, wherein step 2 comprises: step 21 of collecting, by the network access control system, information about a virtual address space assigned to each of the collected process; step 22 of selecting, by the network access control system, an inspection-target virtual address space and inspecting, by the network access control system, a memory type and protect flag value of the inspection-target virtual address space; and step 23 of, if, as a result of the inspection at step 22, it is determined that the memory type of the inspection-target virtual address space is a private type and the protect flag value is executable, determining the inspection-target virtual address space to be a code-injected area. ### Claim 17 (depends on 16) The network access control method of claim 16, wherein step 21 comprises collecting a virtual address range and attribute information of the virtual address space assigned to each of the collected processes by inspecting a VadRoot member of an EProcess structure at a kernel level. ### Claim 18 (depends on 16) The network access control method of claim 16, wherein step 21 comprises collecting a virtual address range and attribute information of the virtual address space assigned to each of the collected processes by using a VirtualQueryEx function at a user level. ### Claim 19 (depends on 14) The network access control method of claim 14, wherein step 3 comprises: step 31 of collecting, by the network access control system, information about one or more threads being executed on the computer; step 32 of selecting, by the network access control system, an inspection-target thread and comparing, by the network access control system, a start address value of the inspection-target thread with a virtual address range of the code-injected virtual address space; and step 33 of, if, as a result of the comparison at 32, it is determined that the start address value of the inspection-target thread falls within the virtual address range of the code-injected virtual address space, determining that a code injection-based thread is present in the code-injected virtual address space. ### Claim 20 (depends on 19) The network access control method of claim 19, further comprising, after step 33, including process and thread IDs of the code injection-based thread in a blocked thread list. ### Claim 21 (depends on 19) The network access control method of claim 19, wherein step 31 comprises collecting the information about one or more threads being executed on the computer by inspecting a ThreadListHead of the EProcess structure. ### Claim 22 (depends on 19) The network access control method of claim 19, wherein step 31 comprises collecting the information about one or more threads being executed on the computer by using a ZwQuerySystemInformation function. ### Claim 23 (depends on 14) The network access control method of claim 14, wherein step 4 comprises performing network filtering by using a network filter driver at a kernel level. ### Claim 24 (depends on 14) The network access control method of claim 14, wherein step 4 comprises performing network filtering by hooking a socket function used by each of the processes at a user level. ### Claim 25 (depends on 14) The network access control method of claim 14, wherein step 5 comprises: step 51 of storing, by the network access control system, process and thread IDs of the code injection-based thread in a blocked thread list; step 52 of collecting, by the network access control system, information about process and thread IDs of the collected network packet; step 53 of, once the process and thread IDs collected at step 52 have been included in the blocked thread list, blocking, by the network access control system, the traffic of the collected network packet; and step 54 of, if the process and thread IDs of the collected network packet are not included in the blocked thread list and the process ID is included in an allowed process list, allowing, by the network access control system, the traffic of the collected network packet. ### Claim 26 (depends on 25) The network access control method of claim 25, wherein step 51 comprises storing, by the network access control system, the process and thread IDs of the code injection-based thread in the blocked thread list after user verification has been performed.