KR100543664B1 - system for protecting of network and operation method thereof - Google Patents

Abstract

The present invention relates to an online service system device and a method of operating the same, and in particular, to facilitate the process of detecting and blocking various abnormal network accesses, and to minimize the loss of the packet transmission according to the operation. The goal is to provide an intrusion detection system (IDS) that can simplify the construction of the entire system and improve speed and stability.

To this end, the network protection method using the network protection device of the present invention comprises the steps of: continuously checking whether the request for a session connection between each computer system by receiving an interrupt signal using the interrupt unit; A second step of controlling to transmit a data packet transmitted through the session to the kernel when a request signal for a session connection from one computer system to another computer system is generated in the process; The kernel interlocks with the memory database to read whether there is an abnormality in the received data packet, and determines whether to transmit or block the corresponding data packet to the transmission target computer system according to the read result, and performs control according to the determination. The third step, which is presented below, is a series of processes presented and performed.

Intrusion Detection System, IDS Kernel, Memory Database (MDB)

Description

System for protecting of network and operation method

1 is a block diagram schematically illustrating a network in which a conventional intrusion detection system is constructed.

2 is a block diagram schematically illustrating a network protection device in which an intrusion detection system according to the present invention is constructed.

Figure 3 is a schematic diagram showing the interworking configuration between the IDS kernel and the memory database of the intrusion detection system according to the present invention

4 is a flowchart schematically illustrating an operation process of a network protection device in which an intrusion detection system according to the present invention is constructed.

5 is a flow chart briefly illustrating a process of performing intrusion detection and defense according to interworking between an IDS kernel and a memory database of an intrusion detection system according to the present invention.

FIG. 6 is a flowchart briefly illustrating a process of operating an analysis processor of an IDS kernel among operating processes of FIG. 5;

FIG. 7 is a flowchart briefly illustrating a process of operating a defense processor of an IDS kernel during the operation of FIG. 5.

8 is a flowchart briefly illustrating a process of operating a tracking processor of an IDS kernel during an operation of FIG. 5;

FIG. 9 is a flowchart briefly illustrating a process of operating an alert processor of an IDS kernel during an operation of FIG. 5; FIG.

FIG. 10 is a flowchart schematically illustrating a process of operating a logging processor of an IDS kernel during an operation of FIG. 5.

Explanation of symbols for main parts of the drawings

100, Intrusion Detection System (IDS) 120. Interrupt Section

130. IDS Kernel 131. Packet Acquisition Processor

132. Analysis Processor 133. Defense Processor

134. Management processor 135. Alert processor

136. Trace Processor 137. Logging Processor

138. Packet Transfer Processor

160. Memory Database (MDB) 170. Data Bus

180.HDD 190.User Interface (UI)

200, hub

The present invention relates to an apparatus and a method of operating the same to prevent abnormal intrusion into a specific network online and to prevent abnormal use, misuse, abuse, etc. using a computer system inside the network.

At present, due to the rapid development of the Internet environment, each individual can freely acquire or transmit the necessary information within the Internet environment, and even if each enterprise is located at a long distance, the various data can be obtained through the Internet. Sharing is now possible.

However, as described above, as various information can be freely transmitted and acquired within the Internet environment, not only misuse and abuse of each personal information have soared, but in particular, as the leakage of important information data increases in each enterprise, Importance is growing.

Recently, an intrusion prevention system for blocking access from an unauthorized system such as an intrusion detection system (IDS) has been installed on each network to prevent the leakage of information as much as possible.

At this time, the IDS is not directly involved in the communication between the networks, but adopts a passive method of monitoring the session when a communication session occurs between specific networks.

In other words, the IDS is built as a separate server included in the network and continuously monitors sessions between systems within a network connected to an external network through the Internet to check whether there is an error in each data communicated through the session. This is because it operates to forcibly block the session if there is a problem by checking.

However, considering that the existing IDS as described above is an application program installed on an operating system (OS) of a specific system, the overall processing speed is slow and there are a lot of packet loss during the intrusion detection process.

For example, as shown in FIG. 1, the system 10 in which the IDS application 11 is installed may use the interrupt unit 12 to monitor an interrupt signal of each computer system connected to each hub 20. When the session connection between computer systems is established, the transmission data packet between the connected sessions is checked and transmitted to the network driver 14 through the kernel 13, and the network driver 14 transmits the IDS application 11. Through this, whether the data packet is abnormal or not is read.

During this process, the kernel 13 receiving the data packet through a device such as a network interface card 15 is transmitting the data packet of the network driver 14 to the network driver 14 and the network driver 14 receives the IDS. During the transmission of the data packet to the application 11, a large amount of packet loss occurred with a decrease in the processing speed.

That is, as the overall process of intrusion detection by IDS has a lot of data movement, it has no choice but to limit the processing speed, such as bottlenecks in the data transfer process by the kernel (13). The biggest problem is that a lot of loss occurs in the transmission process and the data cannot be inspected.

In addition, when the normal IDS checks an abnormal session connection between specific systems during its operation, it blocks the mutual sessions by simultaneously sending a defensive packet to each of the session connected systems. There was a technical difficulty.

In particular, the existing IDS has a session connection with the other network and its monitoring is performed, and when an abnormality is found in the monitoring process, the denial of service (DOS) attack is controlled to block the mutual sessions. And vulnerabilities that are exploited by hackers using Distributed Denial Of Service (DDOS) and User Datagram Protocol (UDP).

The present invention has been made to solve the conventional problems as described above, the object of the present invention is to facilitate the process for the detection and blocking of various abnormal network access and at the time of packet delivery according to its operation It is to provide a network protection device having an intrusion detection system (IDS) and a method of operating the same to minimize losses, to simplify the construction of the entire system, and to improve speed and stability.

In accordance with an aspect of the present invention, a computer system of a network built outside a specific area connected through an internet network and a specific computer system of a network built inside a specific area, or a network built inside a specific area. At least one hub installed for data transfer between each computer system; A plurality of server computer systems and personal computer systems that form a network constructed inside the specific area and are connected to each hub so as to be networkable; At least one is installed between any one of the hubs and the other hub connected to the hub, or a data transfer path between the computer system, receiving an interrupt signal for data transfer between the data transfer paths and intrusion detection and An intrusion detection system (IDS) having a kernel in which an intrusion detection engine is modularized to perform a defense is provided.

A first step of continuously checking whether a request for a session connection between each computer system is performed through the reception of an interrupt signal using an interrupt unit in the network protection method of the present invention according to the above aspect; A second step of controlling to transmit a data packet transmitted through the session to the kernel when a request signal for a session connection from one computer system to another computer system is generated in the process; The kernel interlocks with the memory database to read whether there is an abnormality in the received data packet, and determines whether to transmit or block the corresponding data packet to the transmission target computer system according to the read result, and performs control according to the determination. The third step is to include: how to proceed.

Hereinafter, with reference to the accompanying drawings, an embodiment of an apparatus for a network protection and an operating method thereof of the present invention will be described in more detail with reference to FIGS.

First, FIG. 2 is a schematic diagram of an apparatus for network protection of the present invention.

That is, the network protection device of the present invention includes a large number of computer systems 300 connected to a network, at least one hub 200 for data transfer between the respective computer systems, and abnormality of data transmitted between the computer systems. It is constructed to include an intrusion detection system (IDS) 100 that is configured to read and block abnormal data and deliver only the abnormal data to the transmission target computer system.

Each computer system 300 constituting the network protection device forms a network constructed inside a specific area, is connected to each hub 200 in a networkable connection, and controls between each computer system 300. It consists of a number of server computer systems for performing other tasks such as e-mail and a personal computer system used by each individual.

The hub 200 acquires data transmitted from a specific computer system through an internet network or an intranet network, and transfers the data to the transmission target computer system 300, and may include a router function. It may or may not be.

In this case, when the hub 200 does not include a router function, it is a matter of course that a separate router 400 is provided between the hub 200 and the internet network.

In addition, the hub 200 constituting the network protection device is connected to a computer network (for example, a personal PC, etc.) of a network built outside a specific area in a state connected through an internet network, and a specific computer system of a network built inside a specific area. It is installed for data transmission between computers or between computer systems in a network built inside a specific area.

The intrusion detection system 100 constituting the network protection device includes a data transmission path between any one hub of each hub 200 constituting the network and another hub connected to the hub or the computer system 300. At least one is installed on.

At this time, the intrusion detection system 100 receives an interrupt signal for data transmission between the data transmission paths and performs an intrusion detection and defense in which the intrusion detection engine is modularized. 130, a network interface card (NIC) for transmitting and receiving data in a state of being connected to a network, and whether or not data is received through the NIC. Interrupt unit 120 that reads the interrupt signal according to the intermittent, and temporarily stores each data packet received through the IDS kernel 130, information about the abnormality of each packet and the abnormal state of each packet A memory database (MDB), each of which stores control information on a corresponding method, is referred to as an MDB (160), and is connected to perform data transmission between the components. And a data bus 170.

That is, the present invention implements the engine for the intrusion detection and defense of the intrusion detection system as a modular IDS kernel 130.

In addition, the IDS kernel 130 includes a packet collecting processor 131, an analysis processor 132, a defense processor 133, and a manager processor 134. Is done.

At this time, the packet collection processor 131 continuously receives the corresponding data packet and stores the data packet in the MDB 160 when it is determined whether the data is received through the interrupter 120.

In addition, the analysis processor 132 analyzes each data packet stored in the MDB 160, reads whether there is more than that, and stores the information in the MDB 160 again.

In addition, the defense processor 133 performs a role of selectively defending based on information according to whether there is an error of each data packet stored in the MDB 160.

In addition, the management processor 134 manages and operates each processor such that each unique task can be performed simultaneously.

In addition, in the present invention, the IDS kernel 130 as described above is processed to generate a selective alert based on the information according to the presence or absence of each packet stored in the MDB 160 (Alert Processor 135) And continuously checking the storage space of the trace processor 136 and the MDB 160 that trace back the invaded path based on the information according to the abnormality of each data packet stored in the MDB 160. When the storage space is insufficient compared to the preset storage space, a logging processor 137 for storing an additional data packet or a processed data packet in a separate hardware storage space, and the data determined to be a normal packet. It is proposed to further include a packet processor 138 for transmitting only the packet to the transmission target computer system.

In this case, the separate hardware storage space may be a conventional HDD 180.

3 illustrates a configuration diagram according to a state set for interworking between the IDS kernel and the memory database as described above.

In addition, the intrusion detection system 100 constituting the network protection device according to the present invention has a user interface (UI: User Interface) for the administrator to manage the system in response to the occurrence of abnormal operation of each data packet for manual operation ) 190 is further included to show that it is built.

In this case, the UI displays an operation state of the IDS kernel 130 and becomes an application program for receiving an operation signal from an administrator.

Hereinafter, the network protection method of the present invention as described above will be described in more detail with reference to the flowcharts of FIGS. 4 to 8 that are attached on the basis of an operation process of the network protection device.

First, the hub 200 constituting the network protection device of the present invention receives a connection request data signal from a specific computer system or a signal according to data transmission through an internet network or an intranet network, and receives the signal. The computer system 300 checks and transmits the obtained data signal to the network in which the computer system is included.

In addition, the intrusion detection system 100 of the present invention is installed on the data transmission path between the hub 200 and the network to form a session connection with the path through which the data is transmitted through the NIC 150. S110)

Thereafter, the intrusion detection system 100 receives a data packet transmitted through the session (S120).

At this time, the interrupt unit 120 constituting the intrusion detection system 100 is continuously reading the interrupt signal according to whether or not the data is received through the NIC 150, and thus the data through the NIC 150. If is received, reads the interrupt signal thereof and delivers the received data packet to the IDS kernel 130 (S130).

In addition, the IDS kernel 130 stores the received data packet in the MDB 160 and performs interworking with the MDB 160 to check and defend the data packet according to an abnormality.

In this process, when there is an error in the received data packet, the IDS kernel 130 disables the transfer to the transmission target computer system 300 and simultaneously stores the details (S150) and then releases the session connection (S160). Block further data packet transmission.

On the other hand, if there is no abnormality in the received data packet, the transmission of the data packet is allowed and the details are stored (S170), and the transfer is performed to the transmission target computer system 300 (S180).

In this case, the IDS kernel 130 and the intrusion detection and the corresponding process by interworking with the MDBs will be described in more detail with reference to the flowcharts of FIGS. 5 to 10.

First, when the data packet to the IDS kernel 130 is received through the NIC 150 and the interrupter 120 as shown in the flowchart of FIG. 5, the IDS kernel 130 transmits the data packet to the packet collection processor 131. By continuously collecting and delivering the data packet to the MDB 160, the corresponding data packet is stored in the MDB 160 (S141).

At this time, the packet collection processor separates the received data into various types of information such as protocol, session, server, client, and the like, and stores them in the MDB 160.

At the same time, the IDS kernel 130 uses the management processor 134 to analyze the analysis processor 132, defense processor 133, tracking processor 136, logging processor 137, alert processor 135, and packet transfer processor. At step 138, a plurality of data packets are simultaneously executed to confirm whether there is an abnormality in each data packet stored in the MDB 160, and to thereby process the same.

At this time, the analysis processor 132 analyzes each data packet stored in the MDB 160 as shown in the flowchart of FIG. 6 and reads whether there are any more errors, and the result information is read by the MDB 160. Resave to.

The abnormality check of the data packet by the analysis processor is performed based on the information on the type of the normal data packet already registered in the MDB or the information on the type of the abnormal data packet.

In this case, examples of the information about the abnormal data packet type include whether various viruses are infected, whether the same data is repeatedly transmitted using a user datagram protocol (UDP floating attack), or a predetermined number of times a ping command is preset. (E.g., 30 times) or more (Ping Floding attack), whether the program is sending a large amount of mail (mail bomb attack), File Transfer Protocol (FTP) data packet below 1024 times Whether the port is set to open (FTP Port Bound attack), whether it is configured to execute unauthorized commands (Write, Delete, etc.) (FTP Violation attack), Web service or More statements than strings that can be handled by a service program, such as the Telnet service or the File Transfer Protocol service. Whether the string is included (whether a buffer overflow attack), whether the hardware address of the registered router (MAC address) and the transmitted hardware address of TCP / IP (IP spoofing attack), finger command (Finger) It may be included or not (Finger attack), etc., but is not limited to this may be more diverse.

In addition, the result of confirming whether or not the data packet is abnormal by the analysis processor 132 based on the above details is stored in the MDB 160.

That is, when it is determined that the data packet is a normal type, the result information is stored in the MDB 160, and when it is determined that the data packet is an abnormal type, the result information and the corresponding type are stored in the MDB 160. . In addition, the analysis processor continues to check whether there is an error of another data packet stored in the MDB 160.

In addition, the defense processor 133 performs processing according to an error occurrence type of each error occurrence data packet stored in the MDB 160 as shown in the flowchart of FIG. 7.

For example, in the case of a data packet having various viruses, antivirus software is executed to perform the treatment, and the treated data packet is reset to a normal data packet and stored in the MDB 160. At this time, if it is impossible to perform the treatment by the antivirus software, the data packet is deleted and further transmission is blocked.

However, the method is not necessarily limited to that performed by the method, and may be set to block deletion of the data packet and further transmission without performing the treatment.

If the type of anomaly is an attack by various hackers, the countermeasure (eg, deletion of the corresponding data packet and blocking of the corresponding session) is performed according to the corresponding hacking method for each hacking type registered in the MDB 160, and a virus and If normal error data is not a hacker intrusion, a countermeasure according to a set countermeasure (for example, return) is performed.

In addition, while the above process is in progress, the tracking processor 136 of the IDS kernel 130 continuously checks whether or not an error occurs in each data packet stored in the MDB 160 as shown in the flowchart of FIG. When an abnormal occurrence of a data packet due to an invasion is confirmed, the trace of the intrusion path and the original destination of the data packet is performed.

At this time, tracing of the intrusion path by the tracking processor 136 confirms the IP (Internet Protocol) for the sending computer system through the MDB 160 in which the analysis information of the corresponding data packet is stored, and has recently connected the session to the IP. Check the IP of the computer system that received the same data packet as the data packet in which the abnormality occurred in each computer system.

This process is performed repeatedly until the IP of the computer system where the corresponding data packet has not been received but the transmission has been performed, and at the same time, each data packet within a range of time adjacent to the occurrence confirmation time of the abnormal data packet. This is done by identifying each computer system that has received and transmitted the data.

Then, the IP identified by the above process is determined to be an hacked IP and the details are stored, and at the same time, the session is blocked with other computer systems currently connected to the IP.

At this time, the present invention further proposes that the transmission details of data packets performed through session connection between each computer system are sorted and stored for each time zone so that the above-described process can be performed.

In addition, the final computer system identified through the above process determines the start point of the transmission of the abnormal data packet, acquires the IP, and stores the IP in the MDB 160 along with the intrusion path.

Also, in the above process, the alert processor 135 of the IDS kernel 130 is operated at the same time as the processor 131, 132, 133, 134, 136, and 137 as shown in the flowchart of FIG. 9. If abnormality of specific data packet is confirmed during the process, the administrator who manages the network is notified to the administrator according to the abnormality to directly check by the administrator. Make it manageable.

At this time, the notification is sent to the administrator by the alert processor 135 of the IDS kernel 130 to provide various information such as the details of the abnormal data packet stored in the MDB 160, the information of the intruded computer system, the intrusion type, and the like. It is possible to transmit to the interface (User Interface) 190, the UI 190 by displaying the received information on the computer system screen of the administrator.

As described above, the UI 190 does not play a role of notifying only the details of the abnormal data packet confirmed through the alert processor 135 of the IDS kernel 130. More preferably, the MDB 160 and the IDS kernel 130 are configured to receive the corresponding information so as to notify the information on the transmission status of the various data packets, the type of the abnormal data packet, and the result of the processing.

In addition, the logging processor 137 of the IDS kernel 130 continuously checks the storage state of the MDB 160 as shown in FIG. When exceeding a predetermined allowable storage capacity it serves to distribute and store various data packets stored in the MDB (160) in the HDD 180, which is a separate hardware storage space.

At this time, in the separate hardware storage space, various details of the intrusion detection result according to interworking between the processors 131, 132, 133, 134, 135, 136, and 137 of the IDS kernel 130 and the MDB 160. Ensure that information is continuously registered.

This is to consider the limitations on the storage space of the MDB (160) and to reduce the load due to the load of the MDB (160) to perform the continuous operation in conjunction with the IDS kernel 130 for intrusion detection For sake.

That is, when the administrator of the network performs an inquiry on various intrusion detection operation details through the user interface 190, the corresponding information may be acquired through hardware for storing data separately, thereby storing the information for the MDB 160. It suggests that the burden of space and the increase of load can be eliminated. Of course, the results of the intrusion detection may be stored in the MDB.

In addition, the packet transfer processor 138 of the IDS kernel 130 may perform the processes 131, 132, 133, 134, 135, 136 of the IDS kernel 130 as described above. 137) and the computer to which the data is transmitted, passing through the interrupt unit 120 and the NIC 150 only through the data packet confirmed as abnormal as a result of the data packet received through the interworking between the MDB 160 and each other. Delivered to system 300.

At this time, the delivery of the data packet without abnormality is performed in the reverse order with respect to the data packet delivery process to the first IDS kernel 130.

That is, a network in which a data packet having no abnormality from the IDS kernel 130 is sequentially transmitted to the interrupter 120 and the NIC 150, and the transmission target computer system 300 is established through the NIC 150. It is delivered to the hub (or transmission target computer system) 200 of.

Of course, when it is confirmed that there is an error in the data packet, as described above, the data transmission is further performed by blocking the connection session with the transmitting computer system which has transmitted the data packet in cooperation with the defense processor 133. Measures are taken to prevent this from happening.

As a result, computer systems forming a predetermined network can be protected from viruses, hacking, and the like by the sequential and repetitive execution of the above-described processes.

As described above, the network protection device and the network protection method using the same according to the present invention implement an engine for intrusion detection as a modular kernel, thereby shortening a path for the processing, thereby achieving a better processing time. Has become effective.

In addition, the data loss is reduced as the flow path of the data packet is shortened, thereby preventing the corruption of the data.

In addition, by implementing the kernel as an intrusion detection engine and installing it on the flow path of each data, it is possible to block the abnormal data before the corresponding abnormal data is transmitted to the computer system to be transmitted. There is an effect that the defense against hacking attacks can be carried out more completely.

Claims (23)

At least one installed for data transfer between computer systems in a network built outside a specific area connected through the Internet network and between specific computer systems in a network built inside a specific area or between each computer system in a network built inside a particular area. Herb; A plurality of server computer systems and personal computer systems that form a network constructed inside the specific area and are connected to each hub so as to be networkable; At least one is installed between any one of the hubs and the other hub connected to the hub, or a data transfer path between the computer system, receiving an interrupt signal for data transfer between the data transfer paths and intrusion detection and To read the interrupt signal according to whether the intrusion detection engine is modularized to perform the defense, a network interface card (NIC) for data transmission and reception, and whether data is received through the network interface card. A memory database for temporarily storing an interrupt unit and a data packet received through the modular kernel, and storing information on an abnormality of each packet and control information on a corresponding method for each abnormal state of each packet ( Memory Data Base) and data transfer between the components Luer so the associated data bus (Data Bus) is provided with an intrusion detection system comprising (IDS; Instrusion Detection System): The network protection device deployment, including. delete The method of claim 1, The modular kernel Gathering Processor (Gathering Processor) that continuously receives the data packet when the data is received through the interrupt unit and stores in the memory database, An analysis processor (Analyze Processor) for analyzing each data packet stored in the memory database to read whether there is more than that, and stores the information in the memory database; A defense processor for performing a selective defense based on information according to whether or not each packet is stored in the memory database; A manager processor for managing the multi-processor of each processor; And a packet transfer processor configured to deliver a data packet, which has been identified as none or more than one of the packets stored in the memory database, to the transmission target computer system. The method of claim 3, wherein The modular kernel And a warning processor (Alert Processor) for generating a selective alert based on the information according to the abnormality of each packet stored in the memory database. The method of claim 3, wherein The modular kernel And a trace processor (Case Processor) for tracking the intrusion path based on the information according to the abnormality of each packet stored in the memory database. The method of claim 3, wherein The modular kernel A logging processor that continuously checks the storage space of the memory database and stores additional data packets or processed data packets in a separate hardware storage space when the storage space is insufficient compared to a preset storage space. Network protection device characterized in that it is further included. The method of claim 1, Intrusion Detection System And a user interface for allowing an administrator to manually operate in response to abnormal operation of each data packet. A first step of continuously checking whether a session connection between each computer system is requested by receiving an interrupt signal using an interrupt unit; A second step of controlling to transmit a data packet transmitted through the session to the kernel when a request signal for a session connection from one computer system to another computer system is generated in the process; The kernel interlocks with the memory database to read whether there is an abnormality in the received data packet, and determines whether to transmit or block the corresponding data packet to the transmission target computer system according to the read result, and performs control according to the determination. The third step: the operation of the network protection device, characterized in that proceeds. The method of claim 8, The second step of delivering the data packet to the kernel Connecting a session between a specific computer system requesting a session connection and a network interface card constituting the intrusion detection system; Receiving a data packet through the connected session; And continuously transmitting the data packet received through the network interface card to a kernel, wherein the operation of the network protection device is performed sequentially. The method of claim 8, The third stage of operation Driving a packet collection processor of the kernel to continuously receive the data packet and to store the received data packet in a memory database; Driving an analysis processor of the kernel to read each data packet stored in a memory database to read whether there is an error, and to store the result information in the memory database; When the occurrence of abnormality of the specific data packet stored in the memory database is confirmed, the defensive forwarding of the corresponding data packet is performed by running the defensive processor of the kernel, and the abnormal occurrence of the specific data packet stored in the memory database may not be confirmed. In some cases, the step of delivering the corresponding data packet to the transmission target computer system through a packet transmission processor, the operation is performed by including each operation. The method of claim 10, Processor operation is controlled such that simultaneous operations can be performed by a management processor. The method of claim 10, And separating the data packet into information such as protocol, session, server, client, etc. before storing the data packet in the memory database. How to operate a network protection device. The method of claim 10, To read if there is any further analysis of the data packet Comparing and searching whether the data packet is a data type infected with various viruses previously registered in the memory database; And if it is determined that the corresponding data packet is a data type infected with a virus as a result of the comparison search, reading out that the data packet has an error: the operation of the network protection device further comprises. The method of claim 10, To read if there is any further analysis of the data packet Comparing and searching whether the corresponding data packet is a data type according to each hacking pattern set in the memory database; If it is determined that the corresponding data packet is a data type according to at least one predetermined hacking pattern, the step of reading out that the corresponding data packet is abnormal: operating the network protection device further comprising: Way. The method of claim 10, To read if there is any further analysis of the data packet Comparing and searching whether the corresponding data packet is a type of blocking target data set in the memory database;  And if it is determined that the corresponding data packet is at least one block type data to be blocked as a result of the comparison search, reading out that the corresponding data packet has an error: further comprising the step of operating the network protection device. The method of claim 15, Blocked data types are A method for operating a network protection device comprising any one of data for access to an unauthorized site and data for access to a computer system that does not have a right. The method of claim 10, When abnormality of specific data packet stored in memory database is confirmed And transmitting the details of the abnormality to the user interface of the intrusion detection system through a warning processor of the kernel so that the administrator of the system can be notified. The method of claim 10, When abnormality of specific data packet stored in memory database is confirmed And performing a selective defense based on information according to whether there is an abnormality of the packet through a defense processor of a kernel. The method of claim 18, Performing the selective defense A method for operating a network protection device, characterized by blocking a connection session with a sending computer system of an abnormal data packet to prevent further transmission and deleting the corresponding data packet stored in a memory database. The method of claim 10, When abnormality of specific data packet stored in memory database is confirmed The method of operating a network protection device further comprises the step of tracking the intrusion path through the trace processor of the kernel. The method of claim 20, Tracking the intrusion path Identifying an Internet Protocol (IP) for the sending computer system of the data packet; The process of confirming the IP of the computer system that has transmitted the same data packet as the data packet in which an abnormality has occurred among the computer systems that have been connected to the IP of the recently identified computer system is repeated to confirm the starting point IP of the data packet transmission. The operation method of a network protection device, characterized in that performed by including. The method of claim 21, To check the IP of the computer system that sent the same data packet as the abnormal data packet And continuously storing the transmission history of the data packet performed through the session connection between each computer system according to the time. The method of claim 10, The third step is Continuously checking the storage space of the memory database by a logging processor of the kernel; And, If it is determined that the storage space is insufficient compared to the preset storage space, the step of storing the data packet to which the logging processor is added or the processed data packet in a separate hardware storage space. Method of operating a network protection device characterized in that.

Images