KR100432168B1 - Multiple Intrusion Detection Objects in Security Gateway System for Network Intrusion Detection - Google Patents

Abstract

The present invention relates to a security gateway system using multiple intrusion detection objects, comprising: network packet information extracting means for receiving actual network packets from an interface which is a lower network layer and generating abbreviated audit data; Network intrusion detection performing means for analyzing the presence or absence of intrusion using the multiple intrusion detection objects for the reduced audit data generated by the network packet information extracting means and providing the analysis result to the cyber patrol agent; An intrusion pattern database in which an intrusion pattern required for determining an intrusion in the network intrusion detection performing means is stored; A cyber patrol agent responsible for the overall management and generation and delivery of alert messages for the secure gateway system; And an alert processing unit that is in charge of policy delivery and alert message delivery from the cyber patrol agent. According to this configuration, it is possible to determine whether an intrusion is obtained by collecting packets from a network and using multiple intrusion detection objects.

Description

Multiple Intrusion Detection Objects in Security Gateway System for Network Intrusion Detection}

The present invention relates to a security gateway system for network intrusion detection, and more particularly, to a gateway system and an intrusion detection method using multiple intrusion detection objects configured to collect packets from a network and determine whether there is an intrusion therefrom.

While the development of the Internet has a positive effect of speeding up transmission and transmitting large amounts of data, it has a positive effect of improving work efficiency, improving quality of life and strengthening national competitiveness. Intrusion, leakage and tampering with sensitive information, negative functions such as illegal use, computer viruses and denial of service are increasing day by day, and the amount of damage caused is severe.

That is, the detection and blocking of intrusion through the network cannot be overlooked, and the development of a system for intrusion detection has many research challenges in terms of information protection.

Conventional intrusion detection techniques can be broadly classified into intrusion detection model-based classification methods based on detection methods and data source-based classification methods based on detection areas.

The intrusion detection model-based classification can be further divided into abnormal intrusion detection techniques and misuse intrusion detection techniques. These intrusion detection models are used to analyze intrusion patterns and classification and detection methods required for intrusion detection system development. It provides a lot of base information.

The data source-based classification can be further classified into host and network-based intrusion detection systems, which detect different kinds of intrusion types according to data sources.

The conventional intrusion detection system to which the intrusion detection technique described above is applied collects data from a host or a network, and the collected data is analyzed by applying a specific intrusion detection model. That is, an appropriate response is made according to the analysis result of the log information of the host, the system call information, and the packet information on the network.

Up to now, various types of intrusion detection systems have been developed at home and abroad. For these systems, intrusion is defined as the potential for deliberate and illegal attempts to access information, manipulate information, and system incapacitation, and ongoing research has been conducted with the recognition of the necessity of research on system or computer network intrusion detection.

Early research on intrusion detection began with a single host-oriented study, but the development of the Internet requires its scope to be expanded into networks.

Next-generation Intrusion-Detection System (NIDES), a study initiated by SRI International's Computer Science Laboratory (CSL), uses both statistical algorithms to detect abnormal behavior and misuse intrusion detection techniques that apply expert systems for known intrusion types. It has been continuously improving its functionality and performance.

The NIDES protocol type is currently being evaluated as a system that facilitates component reuse and configuration, and these technologies continue to contribute to system security.

In addition, the structure of NIDES can be extended to perform network monitoring and intrusion detection through collection of network data, rule-based and statistical analysis, and can be extended to enable cooperation between several NIDES.

However, most existing intrusion detection systems are generally designed and applied to a single system environment, which makes it difficult to expand to a large network.

In addition, even if it has a structure that can be extended like NIDES, performance assurance problems such as large data processing, load incurred by intrusion detection, system stability, etc. are considered to be a big problem.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and an object of the present invention is to generate multiple intrusion detection objects based on object-oriented modeling for efficient intrusion detection in a target security gateway system, and to detect each intrusion detection. The present invention provides a security gateway system and an intrusion detection method using multiple intrusion detection objects that determine whether an intrusion is made by analyzing abbreviated audit data of a network packet for each object.

The present invention for achieving the above object is network packet information extraction means for receiving the actual network packet from the interface of the lower network layer to generate the abbreviated audit data; Network intrusion detection performing means for analyzing the presence or absence of intrusion of the reduced audit data generated by the network packet information extracting means and providing the analysis result; An intrusion pattern database in which an intrusion pattern required for determining an intrusion in the network intrusion detection performing means is stored; A cyber patrol agent responsible for the overall management and generation and delivery of alert messages for the secure gateway system; And an alarm processing means for delivering a policy and an alert message from the cyber patrol agent. The security gateway system includes an intrusion detection function using multiple intrusion detection objects.

The present invention provides a method for detecting intrusions for intrusions detectable by a single match, comprising the steps of: reading abbreviated audit data from a message queue; Selecting the intrusion detection analysis object from multiple intrusion detection objects to correspond to the abbreviated audit data; Reading an intrusion pattern object for the selected intrusion detection analysis object from an intrusion pattern stack and searching for corresponding intrusion patterns; And transmitting an alert when the searched intrusion pattern matches the abbreviated audit data. The intrusion detection method using the multiple intrusion detection objects in the security gateway system that detects the intrusion through the routine includes a.

The present invention also provides a method for detecting intrusions for intrusions detectable by a state change, the method comprising: reading abbreviated audit data from a message queue; Selecting an intrusion detection analysis object corresponding to the reduced audit data; Reading an intrusion pattern object for the selected intrusion detection analysis object from an intrusion pattern stack and searching for intrusion patterns; And distinguishing whether the searched intrusion pattern is in an initial state or a last state, and inserting the search pattern into the intrusion pattern stack in the initial state. If the detected intrusion pattern is in the last state, transmitting an alert; if not, determining a time stamp; If the detected intrusion pattern exceeds the time stamp, delete it from the search pattern object, and conversely, if the time stamp does not exceed the time stamp, searching for the next pattern or reading new abbreviated audit data; Provides an intrusion detection method using multiple intrusion detection objects in the gateway system.

1 is a diagram illustrating a service network in which a security gateway system is located;

2 is a block diagram illustrating a security gateway system having an intrusion detection function using multiple intrusion detection objects according to the present invention;

FIG. 3 is a block diagram showing the manner in which the network intrusion detection performing apparatus receives the abbreviated audit data from the network packet information extraction and transmission apparatus; FIG.

4 is a flowchart of performing intrusion detection for intrusions detectable by a single match;

5 is a flowchart of performing intrusion detection for intrusions detectable by a state change;

6 is a block diagram illustrating a stack control method for controlling multiple intrusion detection objects.

* Description of the symbols for the main parts of the drawings *

100: cyber patrol control system 200: security gateway system

201: alarm processing device 202: cyber patrol agent

203: network intrusion detection performing apparatus 204: intrusion pattern database

205: network packet government extractor

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a diagram illustrating a service network in which a security gateway system according to the present invention is located.

Referring to the drawings, the present invention forms a service network that protects a plurality of security gateway systems 200 through the cyber patrol control system 100.

The cyber patrol control system 100 receives security alerts from lower security gateway systems 200, establishes and transmits a corresponding policy, and the security gateway system 200 is a main internal component. It can operate independently with devices and is widely distributed and performed across the wide area network.

2 is a block diagram schematically illustrating the security gateway system 200.

Referring to the drawings, the security gateway system 200 of the present invention receives an actual network packet from an interface, which is a lower network layer, and generates a network packet information extracting apparatus 205 for generating abbreviated audit data. Network intrusion detection execution apparatus 203 for analyzing the presence or absence of intrusion against abbreviated audit data and providing the analysis result, and intrusion pattern database 204 storing intrusion patterns required for determining intrusion presence in the network intrusion detection execution means. And a cyber patrol agent 202 in charge of overall management and generation and delivery of an alert message for the security gateway system, and an alert processing device 201 in charge of policy delivery and alert message delivery from the cyber patrol agent.

In addition, the network intrusion detection execution apparatus 203 may include an event reception message queue controller 236, an alert transmission message queue controller 231, a signal controller 232, a database controller 234, an intrusion detection execution engine 235, and an alarm. The generator 233 is included.

The network intrusion detection performing apparatus 203 configured as described above receives the abbreviated audit data from the network packet information extracting device 205 below in the event receiving message queue controller 236, and the alert delivery message queue controller 231. The alert message according to the result of the intrusion detection is transmitted to the upper cyber patrol agent 202.

In addition, the signal controller 232 applies the policy transmitted from the cyber patrol system 100 to the network intrusion detection performing apparatus 203, the database controller 234 is the intrusion pattern information from the intrusion pattern database device 204 Handle them.

The intrusion detection execution engine 235 performs intrusion detection using multiple intrusion detection objects based on the information provided from the controllers, and the alarm generator 233 generates an alarm message according to the presence or absence of the intrusion audit data. Create

In addition, the network packet information extracting apparatus 205 of the present invention is a message queue 301 for detecting intrusion for each service and protocol by using the abbreviated audit data generated by receiving the actual network packet from the wide area network interface as the lower network layer as shown in FIG. Based on the traffic measurement and separated into a message queue (302) for detecting intrusion and delivered to the upper network intrusion detection performing apparatus 203.

The event reception message queue controller 236 distributes the abbreviated audit data from the message queues 301 and 302 to an appropriate intrusion detection analysis object in the intrusion detection performing engine 235, and thus the present invention. By using two message queues 301 and 302, faster data processing is possible.

4 is a flowchart illustrating a method of performing intrusion detection for intrusions detectable by a single match according to the present invention.

Referring to the drawings, the present invention performs intrusion detection for intrusions detectable by a single match in the network intrusion detection execution apparatus 203. In the network intrusion detection execution apparatus 203, the message queues 301 and 302 are first used. Read abbreviated audit data from the (S401), and select the appropriate intrusion detection analysis object for the reduced audit data (S402).

That is, to select an analysis object corresponding to the abbreviated audit data from multiple intrusion detection objects consisting of DNS analysis object, WEB analysis object, FTP analysis object, RPC analysis object, TCP analysis object, UDP analysis object and ICMP analysis object. do.

Thereafter, the intrusion pattern object for the selected intrusion detection analysis object is read from the intrusion pattern stack 403 (S404), and the corresponding intrusion patterns are retrieved (S405).

When the search is completed on the intrusion paddles by the above method, it is determined whether the searched pattern is matched with the abbreviated audit data from the lower part (S406), and when the search result is matched with the abbreviated audit data, an alert is transmitted (S407). ) Otherwise, a routine for reading new abbreviated audit data from the message queues 301 and 302 is performed.

5 is a flowchart illustrating a method of performing intrusion detection for intrusions detectable by a state change in the present invention.

Referring to the drawings, the present invention performs the intrusion detection for intrusions detectable by the state change in the network intrusion detection performing apparatus 203. In this case, unlike in FIG. It is determined whether the intrusion by measuring the.

First, in the same manner as shown in FIG. 4, the network intrusion detecting apparatus 203 first reads the abbreviated audit data from the message queues 301 and 302 (S501), and selects an appropriate intrusion detection analysis object for the corresponding abbreviated audit data. It is made (S502).

Thereafter, the intrusion pattern object for the selected intrusion detection analysis object is read from the intrusion pattern stack 403 (S504), the corresponding intrusion patterns are searched (S505), and it is determined whether the searched pattern is in an initial state (S506).

If it is determined in step 506 that the searched pattern is in the initial state, the search pattern is inserted 507 into the intrusion pattern stack, and if not, it is checked whether it is in the last state (S508).

As a result of the determination in step 508, if the retrieved pattern is in the last state, an alarm is transmitted (S512), and if not, the presence or absence of a time stamp is checked (S509).

If it is determined in step 509 that the time stamp has been exceeded, the retrieved pattern object is deleted from the intrusion pattern stack 503 (S511). Otherwise, the next pattern is searched or new abbreviated audit data is read.

In the present invention, the insertion and deletion of the search pattern is performed on the individual pattern object, and is not performed when the object is not an individual pattern but an object representing the basic entire patterns of the analysis object.

6 is a block diagram illustrating a stack control method for controlling multiple intrusion detection objects according to the present invention.

Referring to the figure, the network intrusion detection performing apparatus 203 of the present invention controls the intrusion pattern stack to control the multiple intrusion detection objects to detect intrusions for intrusions detectable by a state change as shown in FIG. 5. Used to perform

The intrusion pattern stack 602 largely includes a classification pattern object 603 and an individual pattern object 604, and the classification pattern object 603 represents a pattern object including an entire pattern of a corresponding analysis object.

Unlike the pattern object 603 according to the classification, the individual pattern object 604 indicates a single search pattern and is created to enable a search for a recently searched pattern in advance.

In the security gateway system 200 of the present invention, when the system is initialized (S601), the intrusion pattern stack 602 has only the pattern object 603 for each classification, and the classification for retrieving the pattern for the corresponding abbreviated audit data initially. The patterns to be searched are read from the pattern object 603 (S605), and a pattern thereof is searched (S606).

The first retrieved pattern 608 is set to an initial state (S607) and inserted into the invasive pattern stack 602 as an individual pattern object 604, thus occupying the highest priority in the next retrieval.

Finally, when the search pattern is in the timeout state (S609), the pattern is discarded from the intrusion pattern stack 602 (S610).

What has been described above is just one embodiment for implementing a security gateway system having an intrusion detection function using multiple intrusion detection objects according to the present invention, the present invention is not limited to the above embodiment, the following patents Without departing from the gist of the present invention claimed in the claims, anyone of ordinary skill in the art will be included in the technical idea of the present invention to the extent that various modifications can be made.

As described above, the present invention generates multiple intrusion detection objects based on object-oriented modeling for efficient intrusion detection in the security gateway system, and analyzes the abbreviated audit data for the network packet for each intrusion detection object. Since it is determined to determine whether the intrusion, there is an advantage that can perform intrusion detection and search significantly faster than the conventional intrusion detection system.

In addition, the security gateway system having an intrusion detection function using multiple intrusion detection objects according to the present invention can perform efficient intrusion detection in a wide area network, and creates loads of intrusion detection objects by creating several intrusion detection objects. The advantage is that it can be distributed and thereby ensure system stability.

Claims (8)

Network packet information extracting means for receiving actual network packets from an interface which is a lower network layer and generating abbreviated audit data; Network intrusion detection performing means for analyzing the presence or absence of intrusion using the multiple intrusion detection objects for the reduced audit data generated by the network packet information extracting means and providing the analysis result to the cyber patrol agent; An intrusion pattern database in which an intrusion pattern required for determining an intrusion in the network intrusion detection performing means is stored; A cyber patrol agent responsible for the overall management and generation and delivery of alert messages for the secure gateway system; And Alert processing means for the policy delivery and alert message delivery from the cyber patrol agent; security gateway system using a multiple intrusion detection object comprising a. The method of claim 1, wherein the network packet information extracting means The intrusion detection data is divided into a message queue for detecting an intrusion for each service and a protocol, and a message queue for detecting an intrusion based on the traffic measurement, and delivered to the upper network intrusion detection performing means. Gateway system with intrusion detection using According to claim 1, wherein the network intrusion detection performing means An event reception message queue controller configured to receive abbreviated audit data from the network packet information extraction and transmission device below; An alert delivery message queue controller configured to deliver an alert message according to an intrusion detection result to a higher cyber patrol agent; A signal controller for applying a policy from a higher level to the network intrusion detection performing device; A database controller for processing the intrusion pattern information from the intrusion pattern database device; An intrusion detection execution engine that performs intrusion detection using a plurality of intrusion detection objects based on information provided from the controllers; And And an alert generator for generating an alert message according to the presence or absence of the intrusion audit data for the abbreviated audit data. According to any one of claims 1 to 3, wherein the network intrusion detection performing means In order to determine whether the abbreviated audit data is an intrusion, multiple intrusion detection objects are determined by integrating the intrusion detection analysis objects and determining the intrusion by searching for intrusion patterns included in each intrusion detection analysis object. Secure Gateway System. According to any one of claims 1 to 3, wherein the network intrusion detection performing apparatus After selecting the intrusion detection analysis object for the abbreviated audit data read from the message queue, the intrusion pattern object for the selected intrusion detection analysis object is read from the intrusion pattern stack, and the intrusion pattern object by category and the individual intrusion pattern object are appropriately changed according to the state transition. Security gateway system using multiple intrusion detection object, characterized in that by determining whether the intrusion by inserting and removing. According to any one of claims 1 to 3, wherein the network intrusion detection performing apparatus In order to determine whether there is an intrusion based on traffic measurement of the corresponding abbreviated audit data, the states of intrusion patterns included in the intrusion detection analysis object are respectively displayed, and the intrusion is based on the initial state, the last state, and the state transition through time stamp checking. Security gateway system using multiple intrusion detection object, characterized in that for performing detection. A method for detecting intrusions for intrusions detectable by a single match, the method comprising: Reading abbreviated audit data from the message queue; Selecting the intrusion detection analysis object from multiple intrusion detection objects to correspond to the abbreviated audit data; Reading an intrusion pattern object for the selected intrusion detection analysis object from an intrusion pattern stack and searching for corresponding intrusion patterns; And And transmitting an alert when the detected intrusion pattern matches the abbreviated audit data. The intrusion detection method using multiple intrusion detection objects in the security gateway system, characterized in that the intrusion is detected through a routine. A method for detecting intrusions for intrusions detectable by state changes, the method comprising: Reading abbreviated audit data from the message queue; Selecting an intrusion detection analysis object corresponding to the reduced audit data; Reading an intrusion pattern object for the selected intrusion detection analysis object from an intrusion pattern stack and searching for intrusion patterns; And Distinguishing whether the intrusion pattern is found in the initial state or the last state, and inserting the search pattern into the intrusion pattern stack in the initial state; If the detected intrusion pattern is in the last state, transmitting an alert; if not, determining a time stamp; Detecting an intrusion through a routine comprising the step of deleting from the search pattern object if the searched intrusion pattern exceeds the time stamp, and searching for the next pattern or reading new abbreviated audit data if it does not exceed the time stamp. Intrusion detection method using multiple intrusion detection objects in a security gateway system.