KR100466214B1 - method and recorded media for security grade to measure the network security condition - Google Patents

Abstract

Security level setting method reflecting the variable security situation according to the present invention, when intrusion or attack detection data is received through the network, the risk of intrusion or attack subjects, the importance of the attack target, the traffic amount and traffic frequency of the intrusion data, Analyzing the severity of the intrusion data by the predetermined judgment analysis criteria, setting the security level based on the security level table predetermined for the analysis result, and according to the security level set according to the variable security situation The security level is determined and the security level is readjusted.

According to the present invention, the intrusion data and system management data are analyzed and processed to quantify the current network status to an evaluable security level, and to respond to the flexible network situation by operating a state transition model of security level. To enable the establishment and implementation of

Description

Method and recorded media for security grade to measure the network security condition}

The present invention relates to a security level setting method and a recording medium for reflecting a variable security situation, and in detail, as an index for reflecting the security situation defined as security level 0 to security level 4, the intrusion detection data The security level setting method and recording medium for reflecting the variable security situation by changing the security level in accordance with the security situation of the network that changes from time to time by quantifying this to the security level through the threshold analysis of the occurrence, and the like.

Protecting your knowledge and services in a situation where everyone is free to use the network today is a natural and necessary task. However, constraints are not the only solution in network defense.

The main challenge of network defense is to open the way for free users to good users by restricting only certain intrusions or attacks.

However, to date, intrusion detection and response for network security has only taken a predefined response to specific attacks. The security situation of the network is very flexible in time. Therefore, in response to network security, it is effective to consider the current security situation in real time and take appropriate response thereto. In other words, the uniform response that is performed without considering the current network situation is only the meaning of the control over the use of the network, and the lack of a more flexible network situation.

The present invention is to solve this conventional problem, and beyond the uniform response that does not take into account the fluidity of the network situation by various users, the application of various thresholds to the intrusion detection data collected for more flexible network use and analysis The purpose is to provide a security level setting method that reflects a variable security situation that can quantify the security situation of the current network to a security level, and a recording medium therefor.

According to the security level setting method reflecting the variable security situation according to the present invention for achieving the above object, when intrusion or attack detection data is received through the network, the risk of intrusion or attack subject, the importance of the attack target, intrusion Analyzing the traffic amount and traffic frequency of the data and the severity of the intrusion data by predetermined decision analysis criteria, and setting a security level based on a predetermined security rating table for the analysis result; And re-adjusting the security level by determining whether to maintain the set security level according to the variable security situation.

In addition, according to the recording medium for performing the security level setting method reflecting the variable security situation according to the present invention, in the data recording medium storing the security level setting program for reflecting the variable security situation, intrusion through the network Or when attack detection data is received, analyzing the risk of intrusion or attack subject, the importance of the target of attack, the amount and frequency of traffic of the intrusion data, and the severity of the intrusion data by predetermined judgment analysis criteria; Setting a security level based on a preset security level table for the analysis result; And re-adjusting the security level by determining whether the security level is maintained with respect to the set security level. The security level may be set according to the variable security situation by the executing program.

In addition, in the present invention, in order to analyze and quantify the security situation of the network, the quantitative threshold analysis on the frequency of intrusion detection data, the severity threshold analysis on the severity of the intrusion, the risk of the intruder and the importance of the attack target are performed. Network vulnerability is quantified by quantifying the current network security status from security level 0 to security level 4, and the analysis result of this security situation can be reflected in the establishment and determination of response strategy for intrusion.

In the present invention, the security level is defined as an index for evaluating the security situation, and the state transition diagram of the security level is defined, and the security level is set through threshold analysis of intrusion detection data.

As described above, in the present invention, a fluid network situation is reflected, thereby enabling a more effective situation response. Conventionally, the setting of security level mainly means security level of access control or authority control level for computer system or network equipment, but in the present invention, it is used as an evaluation unit reflecting the network situation to reflect the current security situation of the network. Use it to measure

In addition, the present invention defines a security level and a state transition model of the security level as an index for evaluating a security situation, and includes a function and a method for analyzing the threshold value of the intrusion data for performing this.

Network intrusion detection monitors the packets on the network and determines whether the packets are legitimate or not, and determines that the packets are intrusion or attack if they are not legal.

1 is a schematic block diagram of a network security system comprising a security condition analyzer and an intrusion detection sensor according to the present invention;

2 is a conceptual diagram illustrating input and output data for the security situation analyzer of FIG.

3 is a state transition diagram of the security level by the security status analyzer according to the present invention,

4 is a diagram illustrating a threshold for a security level defined in the security condition analyzer according to the present invention;

5 is a view for explaining the security level defined in the security status analyzer according to the present invention.

* Description of the symbols for the main parts of the drawings *

1; Intrusion Detection Sensor 2; Security Status Analyzer

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a schematic block diagram of a network security system including a security condition analyzer and an intrusion detection sensor according to the present invention.

Referring to the drawings, the intrusion detection sensor 1 of the present invention performs a function of determining whether or not to invade the packet from the network compared to the attack pattern, and if it is determined that the intrusion, the intrusion detection data security status analyzer ( To 2).

Basically, the security situation analyzer 2 receives intrusion detection data from one or more intrusion detection sensors 1. The security condition analyzer 2 and the intrusion detection sensor 1 may be mounted in a single system or may exist in separate systems. In this case, a description thereof will be omitted in the present invention with respect to the mutual connection method.

FIG. 2 is a conceptual diagram illustrating input and output data of the security situation analyzer of FIG. 1. Referring to the drawing, the security situation analyzer 2 inputs data on system intrusion and attack and ultimately system management data. The main function is to quantify the security situation.

The threshold can be assigned to the security condition analyzer 2 for this quantification. Based on the specified threshold, the security situation analyzer 2 performs a threshold analysis on the traffic volume and severity of the intrusion data along with the analysis of the risk of the attack subject and the importance of the target of the network intrusion data, and the analysis by the system management data. You can set the security situation by executing.

In the present invention, the following five levels of security level are defined for evaluating the security situation and quantifying it.

Security Level 0: Inability to Monitor Security Status

Security Level 1: Risk Security Situation

Security level 2: Semi-hazardous security situation

Security level 3: boundary security situation

Security level 4: safe security situation

A security level of 0 means that the security situation cannot be determined. This may be caused by various failures or failures such as a problem of the security condition analyzer itself or a problem related to the system environment of the security condition analyzer or an interface problem with an intrusion detection sensor. In other words, if it is determined that the security situation analyzer can no longer monitor and analyze the security situation, it is assigned to security level 0.

Security levels 1 to 4 are cases where normal monitoring and analysis are possible and are indicators of how serious the security situation is. Security level 4 is currently diagnosed as safe. Security level 3 is a situation where a boundary is required due to frequent checks to the network, and continuous monitoring is required. Security level 2 determines that a number of attacks are in progress on the network. It means the required state. Security level 1 is a very serious security situation and means that the response can no longer be delayed.

3 is a state transition diagram between security levels by the security status analyzer according to the present invention.

As shown in the state transition diagram, the security level is raised, that is, the situation in which the security level is serious is directly transitioned according to the results of the analysis.

For example, if a security level 1 condition occurs in security level 4, the security level 1 is immediately adjusted. Lowering, or releasing, the security level is a case in which an event corresponding to the security level no longer occurs for a certain time, in which case the security level is lowered sequentially. In other words, the occurrence of the continuous release condition results in the transition to security level 4.

In order to set the security level, the security condition analyzer analyzes intrusion information and threshold analysis for network intrusion data. However, the results of this analysis are used as events for state transitions from security level 1 to security level 4, but not as events for security level 0. That is, setting security level 0 and releasing security level 0 perform state transition by system failure or failure information.

The analysis of the intrusion information performs the risk of the intruder and the importance of the attack target. The risk of intrusion subjects is divided into general, preliminary blacklist and blacklist, respectively. The distinction between the preliminary blacklist and the blacklist is possible through system configuration or analysis, which is outside the scope discussed in the present invention.

The criticality analysis of the attack target is divided into three stages of general, important, and very important for the target. The classification method for this is also not the scope of the present invention, it is assumed that it can be obtained through the system data. This distinction suggests that different analyzes may be possible for the same attack depending on the attacking subject and target.

In addition, two levels of thresholds are maintained for threshold analysis for intrusions and attacks. These are divided into lower threshold and upper threshold, respectively. Operation of a threshold means an analysis of whether an event corresponding to the threshold has occurred for a certain period of time. That is, the setting of the threshold is composed of a pair of time values representing a period and a value measuring a frequency.

The traffic threshold for intrusion detection data means to maintain the threshold by the total frequency of collected intrusion data.

In addition, to analyze the severity of intrusion detection data, the Security Situation Analyzer classifies each attack pattern into five severities.

Severity 1: Indeterminate

Severity 2: Low Level Security Check (Warning)

Severity 3: High Level Security Check (Minor)

Severity 4: Low Level Attack Behavior

Severity 5: Critical Attack Behavior

4 illustrates types of thresholds maintained by the security condition analyzer, and FIG. 5 illustrates a process of setting a security level using these thresholds.

Referring to FIG. 4, AlertTrafficThreshold represents an intrusion detection data traffic frequency threshold, and has an upper threshold and a lower threshold.

IndeterminateAttackThreshold represents the threshold for the severity 1 frequency of intrusion detection data, WarningAttackThreshold represents the threshold for the severity 2 frequency of intrusion detection data, MinorAttackThreshold represents the threshold for the severity 3 frequency of intrusion detection data, and MajorAttackThreshold is the intrusion detection data The threshold for the severity 4 frequency of is shown, and CriticalAttackThreshold is the threshold for the severity 5 frequency of intrusion detection data.

Hereinafter, the security level using the threshold value will be described with reference to FIG. 5. The state of the security level 0 illustrated in the present invention cannot be determined, system failures such as power and hardware, software failures such as a database, and security. This is the security level in case of situation analyzer failure or communication session failure with intrusion detection sensor.

The level of security level 1 is considered to be very serious, with the Alert Traffic High Threshold exceeded for a continuous period of time, the Critical Attack High Threshold exceeded, the Critical Attack Low Threshold exceeded for the "critical" resources, and "very Critical Attack Low Threshold or Major Attack High Threshold exceeded for "Major" resources, Critical Attack Low Threshold exceeded for "Preliminary Blacklist" members, Critical Attack Low Threshold or Major Attack High Threshold exceeded for "Blacklist" members Is the rating.

A security level of 2 is considered critical and includes: Alert Traffic High Threshold Exceeded, Critical Attack Low Threshold Exceeded, Major Attack High Threshold Exceeded, Major Attack Low Threshold Exceeded for "Important" Resources, and "Very Important" Major Attack Low Threshold or Minor Attack High Threshold Exceeded, Major Attack Low Threshold Exceeded for "Preliminary Blacklist" Members, Major Attack Low Threshold for "Blacklist" Members Exceeded Major Attack Low Threshold or Minor Attack High Threshold Exceeded.

Security Level 3 is a boundary condition that requires Alert Traffic Low Threshold, Major Attack Low Threshold, Minor Attack High Threshold, Minor Attack Low Threshold for "Important" resources, and "Very Critical" resources for Minor Attack Low Threshold or Warning Attack High Threshold Exceeded, Minor Attack Low Threshold Exceeded for "Preliminary Blacklist" Members, Minor Attack Low Threshold for "Blacklist" Members Exceeded Security Level.

Security level 4 is considered to be safe and the above phenomenon does not occur. In addition, other thresholds are used for statistics.

In practice, unlike the analysis of these thresholds, the application can be performed differently depending on the application range or purpose. In other words, when the lower threshold of severity 5 is violated, it may be set as security level 2 as shown in FIG.

As described above, network security must consider a fairly flexible network situation. In other words, with a predefined response to a specific attack, it is virtually difficult to perform the best response by properly reflecting a fluid, organically active network situation.

According to the present invention, the intrusion data and system management data are analyzed and processed to quantify the current network status to an evaluable security level, and to respond to the flexible network situation by operating a state transition model of security level. Can be established and implemented.

Claims (9)

When intrusion or attack detection data is received through the network, analyzing the risks of the intrusion or attack subject, the importance of the attack target, the traffic volume and traffic frequency of the intrusion data, and the severity of the intrusion data by predetermined judgment analysis criteria. ; Setting a security level based on a preset security level table for the analysis result; And And re-adjusting the security level by determining whether to maintain the set security level according to the variable security condition. The security level setting method reflecting the variable security situation. The method of claim 1, wherein in the analyzing using the predetermined analysis criteria, And a risk level of the attack subject reflects a variable security situation analyzed according to a stage to which the attack subject belongs in a preset attacker risk list. The method of claim 1, wherein in the analyzing using the predetermined analysis criteria, The importance level of the attack target, security level setting method that reflects a variable security situation to be analyzed according to the stage of the attack target of the predetermined target important list. The method of claim 1, wherein in the analyzing using the predetermined analysis criteria, The amount of traffic and the frequency of the intrusion data security level setting method reflects a variable security situation that analyzes whether the event corresponding to the predetermined traffic amount and frequency analysis criteria has occurred. The method of claim 1, wherein in the analyzing using the predetermined analysis criteria, The severity of the intrusion data is a security level setting method that reflects a variable security situation that analyzes whether or not an event corresponding to a predetermined intrusion data severity analysis criteria has occurred. The method of claim 1, wherein in setting the security level, The security level table reflects a variable security situation having one or more security levels as a result of combining the risk of the intrusion or the subject of attack, the importance of the target of attack, the amount and frequency of traffic of the intrusion data, and the severity of the intrusion data. How to set security level. The method of claim 1, wherein in the step of readjusting the security level, Increasing the security level directly raises it to the appropriate security level. Downgrade of security level is a security level setting method that reflects a variable security situation that is sequentially lowered by security level step by step. The method of claim 7, wherein The downward adjustment of the security level is a security level setting method that reflects a variable security situation that occurs when an event corresponding to the security level no longer occurs for a certain time. A computer-readable recording medium having recorded thereon a program for executing the security level setting method reflecting the variable security situation according to any one of claims 1 to 8 on a computer.