KR101139537B1 - Method for detecting scanning traffic in 3g wcdma networks - Google Patents

Abstract

PURPOSE: A scanning traffic detection method of a mobile communication network is provided to apply a method for managing a memory to a TRW(Threshold Random Walk) algorithm through a bloom filter. CONSTITUTION: IP information of a corresponding source is stored(S10). A success probability and a failed probability are supposed to source. It is determined whether the collected traffic is about reconnection attempt about fail(S20). A TRW value is calculated by using the supposed probability value(S30). The calculated TRW is compared with a critical value(S40).

Description

Scanning traffic detection method of mobile communication network {METHOD FOR DetectinG SCANNING Traffic in 3G WCDMA networks}

The present invention relates to traffic detection of a mobile communication network, and more particularly, to a scanning traffic detection method of a mobile communication network.

Recently, the data traffic flowing into the mobile communication network is exploding due to the increase in the number of smartphone users and the proliferation of mobile services, thereby increasing the potential security risk of the mobile communication network infrastructure. In addition, as tethering services that can use a mobile communication terminal as an Internet modem have become popular, malicious traffic in a wired environment such as a PC is flowing into the mobile communication network.

On the other hand, the domestic mobile communication network has a closed service provision structure that allows strict operator control, so there is no security technology applied to the equipment that constitutes the mobile communication network, and it responds to malicious traffic from mobile malware infected smartphones and wired environments. This is difficult. In addition, while existing network security equipment detects and responds to harmful traffic based on IP, in a mobile communication network, an IP address is dynamically allocated every time the mobile terminal accesses the network, and the inside of the network is a NAT-based private IP address. It is difficult to apply the intrusion prevention technology of the existing Internet network because it uses.

Scanners not only generate a large amount of traffic but also cause paging traffic, which can cause serious problems in the 3G WCDMA mobile communication network which has a narrow bandwidth and limited radio resources compared to the Internet network.

Korean Unexamined Patent Publication No. 10-2011-0009813 (Invention name: Attack Detection and Tracking System and Method in All IP Network Environment)

An object of the present invention is to provide a scanning traffic detection method of a 3G WCDMA mobile communication network that detects scanning traffic flowing into the mobile communication network and improves the performance of the algorithm by using a bloom filter.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be apparent from the description, or may be learned by practice of the invention. The objectives and other advantages of the present invention will be realized and attained by the structure particularly pointed out in the claims, as well as the following description and the annexed drawings.

The present invention proposes a technique for detecting a scanning traffic that can occur in a mobile communication network using a TRW algorithm, and in order to solve the problem that it is difficult to detect when using UDP or ICMP or repeatedly scanning, the present invention is introduced in real time. In order to effectively cope with a large amount of traffic, a memory filter using a bloom filter is applied to the TRW algorithm.

The scanning traffic detection method according to the present invention can be used to counteract the security threat of the domestic mobile communication network, and is expected to be implemented as a module form to supplement the function in the existing mobile communication network management system.

1 is a structural diagram of a typical 3G mobile communication network.
2 is a structural diagram of a typical 3G protocol stack.
3 is a flowchart of a scanning traffic detection method according to the present invention;
4 is an exemplary diagram illustrating memory management using a Bloom Filter according to the present invention;

Scanning traffic detection method of a mobile communication network according to the present invention to achieve the above object,

Collecting traffic flowing into the mobile communication network and storing the IP information of the source in the interval between the Serving GPRS Supporting Node (SGSN) and the Gateway GPRS Supporting Node (GGSN), and the source is normal (H0) or scanner (H1). A process of assuming success probability and failure probability of the connection attempt at the case of), determining whether the collected traffic is about a reconnection attempt due to a connection failure, and if the traffic is not due to the reconnection attempt, Calculating a threshold random walk (TRW) value using the assumed probability value, and detecting the scanner by comparing the calculated TRW with predetermined threshold values.

Preferably, the IP information of the source is stored in an IP management table according to a method of applying a Bloom Filter.

The concept of the present invention adopts a Threshold Random Walk (TRW) algorithm to detect scanning traffic, overcomes the disadvantages of the TRW algorithm, and can efficiently and quickly search for a large amount of traffic flowing in real time. To implement a scanning traffic detection method applied to.

Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings.

1 is a structural diagram of a general 3G mobile communication network.

As shown in FIG. 1, a 3G network is composed of two main components: a circuit network for voice communication and a packet network for data communication. In addition, there are RANs that are in charge of wireless access and systems for authentication and billing.

2 is a structural diagram of a general 3G protocol stack.

As shown in FIG. 2, a Radio Network Controller (RNC) manages radio resources and a Serving GPRS Supporting Node (SGSN) is responsible for service management and support in a packet network, which is a data network. Gateway GPRS Supporting Node (GGSN) plays a role of supporting communication with the external Internet by converting IP allocation and data of packet network into IP packets. Data is transmitted by tunneling between each component. RNC and SGSN mainly use ATM protocol for Iu-PS interval, and SGSN and GGSN use GTP protocol for Gn interval. GTP protocol is an IP-based protocol for tunneling between SGSN and GGSN for communication between external internet network and 3G packet network. GTP may be classified into GTP-U for packet data, GTP-C for signaling, and GTP` (GTP prime) for charging.

The mobile communication terminal means a terminal that can use a 3G network. Such terminals are typically smartphones, and various terminals such as laptops and tablets capable of 3G communication are gradually appearing. In particular, even if a 3G mobile communication network is not available, terminals that can use Wi-Fi are communicating data through a 3G mobile communication network using tethering of a smartphone.

These various terminals are greatly different from the traffic generated according to the characteristics of each device. As a result, the traffic flowing through 3G mobile communication networks is not only smart phones but also traffic from various terminals such as laptops and netbooks. As a result, traffic that cannot be seen in the mobile communication environment is observed in various forms.

3 is a flowchart illustrating a scanning traffic detection method according to the present invention, which illustrates a scanning traffic detection algorithm employing a TRW algorithm. The TRW algorithm assumes the probability of success or failure by a normal host or a scanner attempting to connect to a remote local host, and detects scanning traffic using this.

In the present invention, traffic is collected in the Gn section between the SGSN and the GGSN, and the calculation condition is set as shown in Equation 1 below in consideration of reconnection attempt due to connection failure. (S10-S20)

[Equation 1]

(Current time-message reception time)> = (message retransmission period due to connection failure * 2)

As shown in Equation 2 below, the success / failure probability at connection is assumed when the remote source is normal (H ₀ ) or scanner (H ₁ ).

[Equation 2]

Pr [Y _i = 0┃H ₀ ] = 0.8, Pr [Y _i = 1┃H ₀ ] = 0.2

Pr [Y _i = 0┃H ₁ ] = 0.2, Pr [Y _i = 1┃H ₁ ] = 0.8

Here, Y _i represents the result of the remote source attempting to connect to the i-th remote local host. The value of Y _i is as shown in [Equation 3] below.

[Equation 3]

Finally, using the probability value assumed above, the TRW is calculated as shown in [Equation 4] below and the scanner is detected by comparing with the threshold value. (S30-S50)

[Equation 4]

If the TRW is greater than 99, the source is determined as a scanner (S60), and if it is less than or equal to 0.01, the source is determined to be normal and the corresponding IP table is deleted for efficient memory management. (S70) If the TRW is less than 99 and greater than 0.01, additional traffic transmitted from the remote source is collected to determine again whether the remote source is normal. (S10-S50)

The TRW algorithm is difficult to detect when using the User Datagram Protocol (UDP) or the Internet Control Message Protocol (ICMP), or when the scanning frequency is low, or when the scanning occurs repeatedly. In addition, it is difficult to efficiently manage memory space with repetitive input. In order to overcome this drawback, the present invention applies a Bloom Filter, which is a data structure having statistical characteristics.

Bloom Filter is a data structure with statistical characteristics, that is, a data structure with probability applied. It is a data structure that determines whether a set exists or not. It only determines whether A exists or not, and does not store A in its original form.

The specific principle of the bloom filter will be described as follows.

The bloom filter consists of two components. One is the k hash function and the other is a bit vector of the given length. We can choose the number of hash functions that match the length of the bit vector and the number of keys. All hash functions of the bloom filter match their range of values and the length of the bit vector. For example, if the vector is 200 bits, the hash function returns only numbers from 1 to 200. This ensures that all possible values are distributed evenly.

When the key comes into the bloom filter, we get it through one of the k hash functions and set it by finding the corresponding position in the bit vector. If the Bit is already set we leave it alone. There is no mechanism to turn it off in the bloom filter.

For example, with three hash functions and 14 bit vectors. Initially, this bit vector starts out empty. Let's assume that the value apple is entered and the hash function is executed to obtain the values 3, 12, and 11, respectively. Then it will look like

<bit vector>

OOOOOOOOOOOOOO-> OOXOOOOOOOXXOO

Each hash value is set in place. Then grape came back, and each had a hash value of 11,1,8. The result is shown below.

<bit vector>

XOXOOOOXOOXXOO

The eleventh digit is already set. In other words, 11 bits stores two pieces of information, apple and grape. This overlap means that the Bloom Filter can be operated very simply, and on the other hand, the existing keys cannot be removed. There is no way to delete the key named apple except to start from scratch and not insert the key named apple.

The first two keys in the bitvector are all valid in the bitvector because they were all in the bitvector and each particular value could be set. Then type the key mango. This yielded a value of 8,3,12 through a hash function. This is assumed to be valid because it is all in the bit vector. Of course, mango is not a valid value. Because all the values were already set. It's just a coincidence that the same filter and value are already created. But for now, this is called valid.

This is why Bloom Filter is called probabilistic data structure. This is because bloom filters can be false positives. The false positive is a kind of error that exists.

4 is an exemplary diagram illustrating memory management using a bloom filter according to the present invention.

As shown in Fig. 4, the IP table (IP management table) of memory management according to the present invention includes an 'IP address' field, a 'connection attempt state management' field, a 'response state management' field, and a 'number of connection attempts' field. , 'Response Count' field, 'Response Wait Time' field, and 'Source IP Management Time' field. When the traffic flowing into the mobile communication network is collected, the IP information of the corresponding sources is stored in the IP management table.

In the memory management method according to the present invention, the hashed source IP address is used as an index value, and the destination IP is recorded in the 'connection attempt status management' and 'response status management' fields to manage respective status information, thereby repeatedly inputting. Eliminates and facilitates mapping of request messages to response messages. The memory space is efficiently used by setting a predetermined time value in the 'source IP management time' field to periodically delete the memory.

The present invention has proposed a technique for detecting scanning traffic in a 3G WCDMA mobile communication network. The proposed technology can be used for countering the security threats of domestic mobile communication networks after implementation and performance / function verification, and can be implemented as a module to supplement the functions of existing mobile communication network management systems.

Although the present invention has been described with reference to the embodiment (s) shown in the drawings, this is merely exemplary, and various modifications can be made therefrom by those skilled in the art, and the embodiments described above ( It will be appreciated that all or some of these may be optionally combined. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the present invention has proposed a technique for detecting scanning traffic that may occur in a mobile communication network using a TRW algorithm, and solves a problem that detection is difficult when using UDP or ICMP or repeatedly scanning. In order to effectively cope with a large amount of traffic flowing in real time, a method of managing memory using a bloom filter is applied to the TRW algorithm.

The scanning traffic detection method according to the present invention can be used to counteract the security threat of the domestic mobile communication network, and is expected to be implemented as a module form to supplement the function in the existing mobile communication network management system.

Claims (8)

Collecting traffic flowing into the mobile communication network and storing IP information of a corresponding source in a section between a Serving GPRS Supporting Node (SGSN) and a Gateway GPRS Supporting Node (GGSN);
Assuming a success probability and a failure probability of a connection when the source is normal (H ₀ ) or scanner (H ₁ );
Determining whether the collected traffic relates to a reconnection attempt due to a connection failure;
Calculating a threshold random walk (TRW) value using the assumed probability value when the traffic is not caused by the reconnection attempt;
And detecting the scanner by comparing the calculated TRW with predetermined thresholds. The method of claim 1,
Determining whether the collected traffic relates to a reconnection attempt,
The scanning traffic detection method of the mobile communication network, which is determined according to the following calculation condition equation, and determines that the collected traffic does not meet the following reconnection attempt when the collected traffic does not satisfy the following calculation condition equation.
<Calculation Condition Expression>
(Current time-message reception time)> = (message retransmission period due to connection failure * 2) The method of claim 1, wherein the connection probability of success and probability of failure are:
Derived from the formula
Pr [Y _i = 0┃H ₀ ] = 0.8, Pr [Y _i = 1┃H ₀ ] = 0.2
Pr [Y _i = 0┃H ₁ ] = 0.2, Pr [Y _i = 1┃H ₁ ] = 0.8
The Y _i represents a result of the remote source attempting to connect to the i-th remote local host, and if the result of the connection attempt is successful, Y _i has a value of '0' and a value of '1' in case of failure. Scanning traffic detection method of communication network. The method of claim 1, wherein the TRW value is
Scanning traffic detection method of a mobile communication network, characterized in that derived from the following formula.

The method of claim 1, wherein the comparing the calculated TRW with predetermined thresholds comprises:
Determining the source with a scanner when the TRW is greater than 99;
Determining that the source is normal when the TRW is less than or equal to 0.01 and deleting the corresponding IP table for efficient memory management;
And if the TRW is less than 99 or greater than 0.01, further comprising collecting traffic transmitted from the source and determining again whether the source is normal. The method of claim 1, wherein the IP information of the source is
Scanning traffic detection method of a mobile communication network, characterized in that stored in the IP management table in accordance with the method (Bloom Filter) applied. The method of claim 6, wherein the IP management table
An 'IP address'field;
A 'connection attempt state management'field;
'Response status management'field;
With the 'number of attempts to connect'field;
With 'answer number'field;
With the 'response wait time'field;
Scanning traffic detection method of a mobile communication network comprising a 'source IP management time' field. 8. The method of claim 7, wherein the 'Source IP management time' field is
And a time setting value for periodically deleting memory storage information for efficient use of memory space.

Images