KR101257057B1 - Apparatus and method of preventing dormant dangerous port by profiling network traffic data - Google Patents

Abstract

The present invention relates to an apparatus and a method for securing stability of an internal system and a network. In a potential dangerous port limiting device through profiling of network traffic data applied to the first embodiment according to the present invention, the profiling module 110 includes TCP (TCP) included in the network traffic data transmitted from the network security system 100. Traffic information is extracted from Transmission Control Protocol (IP) and Internet Protocol (IP) headers and the amount of data on each port is detected. In addition, the profiling module 110 stores the traffic information of the traffic data of which the destination IP is an internal IP among the transmitted network traffic data and the detected data amount in the DB 120 based on the extracted traffic information. do. The statistical data generating module 130 generates statistical data that accumulates the data amount of each port for each IP by using the traffic information and the data amount in real time or at a designated period, and the policy module 140 determines a predetermined amount of data. Control to block the network traffic data of the restricted port for each IP that is less than the standard of. Accordingly, the present invention is a very excellent invention to remove the vulnerability of the network to facilitate the use of the internal network, and to reduce the work load of the network (system) administrator.

Network traffic data, TCP / IP, protocol, port

Description

Apparatus and method of preventing dormant dangerous port by profiling network traffic data}

1 is a block diagram of a conventional network security system.

2 is a block diagram of a potential dangerous port limiting device through profiling of network traffic data applied to the first embodiment according to the present invention.

3A and 3B illustrate the formats of Transmission Control Protocol (TCP) and Internet Protocol (IP) headers.

4 is a flowchart of a method for limiting potentially dangerous ports through profiling of network traffic data applied to the first embodiment according to the present invention.

5 illustrates statistical data generated in the first embodiment according to the present invention.

          <Description of the symbols for the main parts of the drawings>

10,100: Network security system 11: Rule DB

12: management module 13: detection rule DB

14: detection / blocking module 110: profiling module

120: DB 130: statistical information generation module

140: policy module

The present invention relates to an apparatus and a method for securing the stability of an internal system and a network, and more particularly, to internal network system by profiling network traffic data for a period of time and using the same to block potentially dangerous ports. And a potentially dangerous port limiting apparatus and method through profiling network traffic data to secure network stability.

1 is a block diagram of a network security system 10 according to the related art.

A rule database (DataBase, hereinafter referred to as 'DB') 11 stores the entire rule. The management module 12 controls the rule selected by the administrator to be stored in the detection rule DB 13 among all the rules stored in the rule DB 11, and detects and blocks by the detection / blocking module 14. Control to initiate.

The detection / blocking module 14 sequentially reads the rules stored in the detection rule DB 13 and sequentially compares the read rules with the input network traffic data in packet units. A detection operation and network traffic data including a packet matching the read rule are determined as harmful traffic data and blocked.

However, in the conventional network security system configured and operated as described above, only a detection and blocking operation for known vulnerable ports is made, and there is a problem that a risk may be exposed by an unknown and potentially vulnerable port.

Therefore, the present invention was created to solve the above problems, and the potential dangerous port limiting device by profiling network traffic data for a certain period of time and profiling network traffic data using the same to block potentially dangerous ports. And a method.

Potentially dangerous port limiting apparatus through profiling network traffic data according to the first embodiment of the present invention for achieving the above object, extracts the traffic information from the network traffic data (network traffic data) and the amount of data of each port Profiling module for detecting the; A statistical data generation module for generating statistical data by accumulating the data amount of each port of each IP of the network traffic data using the traffic information and the data amount; And a policy module for controlling network traffic data of a restricted port for each IP having a data amount less than or equal to a predetermined reference value among the generated statistical data.

In addition, the potential dangerous port limiting apparatus through profiling network traffic data according to the first embodiment of the present invention further comprises a DB for storing at least one or more internal IP, wherein the traffic information, the destination IP is the internal IP Can be.

The DB may further store the traffic information and data amount.

The DB may further store a profiling time.

The DB may further store the generated statistical data.

The DB may further store a date of generating last statistical data.

The profiling module may extract the traffic information from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the network traffic data.

The traffic information may include at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port.

In addition, the potential dangerous port restriction method through profiling network traffic data according to the first embodiment of the present invention, profiling to extract the traffic information from the network traffic data (network traffic data) and detect the data amount of each port step; A statistical data generation step of generating statistical data by accumulating the data amount of each port for each IP of the network traffic data using the traffic information and the data amount; And, among the generated statistical data, the policy step of controlling the network traffic data of the restricted port for each IP, the data amount is less than a predetermined reference value.

In the traffic information, the destination IP may be an internal IP.

The profiling step may further include storing the traffic information and the data amount.

The profiling step may further include storing a profiling time.

The generating of the statistical data may further include storing the generated statistical data.

The generating of the statistical data may further include updating a last statistical data generation date.

In the profiling step, the traffic information may be extracted from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the network traffic data.

The traffic information may include at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port.

By the above configuration and flow, the apparatus and method for limiting potentially dangerous ports through profiling of network traffic data according to the present invention profiling network traffic data for a certain period of time and using the same to block potentially dangerous ports. It is.

Hereinafter, an apparatus and method for limiting potentially dangerous ports through profiling network traffic data will be described in detail with reference to the accompanying drawings.

FIG. 2 is a block diagram of a potential dangerous port limiting device through profiling network traffic data applied to the first embodiment according to the present invention, and FIGS. 3A and 3B are Transmission Control Protocol (TCP) and Internet Protocol (IP). ) Shows the format of the header.

In a potentially dangerous port limiting device through profiling network traffic data applied to the first embodiment according to the present invention, the network security system 100 may further include a packet (or The network traffic data received in units of bits) is transmitted to the profiling module 110 and the network traffic data of the IP-restricted port is blocked by the control of the policy module 140.

The profiling module 110 extracts traffic information from TCP (Transmission Control Protocol) and IP (Internet Protocol) headers included in the network traffic data transmitted from the network security system 100, and calculates the data amount of each port. Detect.

The extracted traffic information includes at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port (see FIGS. 3A and 3B). ).

In addition, the profiling module 110 stores the traffic information of the traffic data of which the destination IP is an internal IP among the transmitted network traffic data and the detected data amount in the DB 120 based on the extracted traffic information. .

Therefore, the DB 120 stores traffic information including at least one of a protocol, a destination IP, and a port, a data amount, and a profiling time.

Statistics data generation module 130, the traffic information and data amount stored in the DB 120 in real time or every designated statistical information generation cycle (day, week, month)} When the profiling time is read out and the last statistical data generation date is not today's date, statistics data is accumulated by accumulating the data amount of each port by IP using the traffic information and data amount that the profiling time is earlier than yesterday's date. After generating, the generated statistical data is stored in the DB 120 in association with the profiling time and the last statistical data generation date is updated in the DB (120).

Subsequently, the policy module 140 classifies the restriction ports for each IP by using the statistical data whose profiling time is yesterday among the statistical data stored in the DB 120 as described above, and classifies the restricted ports for each IP in the network security. By transmitting to the system 100, the network traffic data of the restricted port for each IP is controlled to be blocked.

4 is a flowchart of a method for limiting potentially dangerous ports through profiling of network traffic data applied to the first embodiment according to the present invention, and FIG. 5 illustrates statistical data generated in the first embodiment according to the present invention. will be.

Hereinafter, the operation of the potential dangerous port limiting device through profiling of the network traffic data configured as described above will be described in detail with reference to FIGS. 4 and 5.

First, when profiling of network traffic data is requested (YES in S401), the network security system 100 may profile the network traffic data (network traffic data) received in packet (or bit) units. To send.

Subsequently, the profiling module 110 may transmit traffic information (protocol, source) from a TCP (Transmission Control Protocol) and IP (Internet Protocol) header included in the network traffic data transmitted from the network security system 100. A source IP (Internet Protocol) and a port, a destination IP (Internet Protocol) and a port} are extracted, and the amount of data for each port is detected (S402).

The profiling module 110 determines whether the destination IP of the network traffic data is an internal IP based on the extracted traffic information, and determines that the destination IP is an internal IP (YES in S403). The traffic information, the amount of data and the profiling time are stored in the DB 120 (S404).

For reference, in step 403, the profiling module 110 determines whether the destination IP is the internal IP by sequentially comparing the destination IP among the extracted traffic information with the internal IP stored in the DB 120.

In addition, the traffic information stored in step 404 may include at least one or more of a protocol, a destination IP, and a port.

In this way, when the profiling operation is terminated and the generation of the statistical data is requested in real time or every designated statistical data generation period {per day, week per month, month per month} (YES in S405). The statistical data generation module 130 determines whether the profiling time stored in the DB 120 is up to yesterday's date and whether the last statistical data generation date pre-stored in the DB 120 is today.

As a result of the determination, when the last statistical data generation date is not the present date (YES in S406), the statistical data generation module 130 may include traffic information and data having a profiling time from the DB 120 earlier than yesterday. The amount of data is read (S407), and statistical data is generated by accumulating the amount of data of each port for each IP using this (S408) (see FIG. 5).

In addition, the statistical data generation module 130 stores the statistical data generated as described above in association with the profiling time in the DB and updates the last statistical data generation date stored in the DB 120 to today (S409).

Subsequently, if a policy application is requested (YES in S410), the policy module 140 reads statistical data having a profiling time from yesterday from the DB 120 (S411), and the amount of data among the read statistical data. The restricted ports for each IP that are less than or equal to the predetermined reference value are classified (S412) (see FIG. 5).

Subsequently, the policy module 140 transmits the classified IP restricted ports to the network security system 100 (S413), thereby controlling network traffic data of the restricted IP ports.

As described above, the present invention has been described with reference to the embodiments shown in the drawings, which are merely exemplary, and those of ordinary skill in the art to which the present invention pertains should not depart from the spirit and scope of the present invention. It will be apparent that various modifications, changes and equivalent other embodiments are possible without departing. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

As described above, the apparatus and method for limiting potentially dangerous ports through the profiling of network traffic data according to the present invention, by profiling network traffic data for a period of time and using the same to block potentially dangerous ports, It is an excellent invention that eliminates the problem of using the internal network, and reduces the workload of the network (system) administrator.

Claims (16)

Extracts traffic information from network traffic data and detects the data volume of each port, sequentially compares the destination IP among the traffic information with the internal IP stored in the DB.If the destination IP is the internal IP, the traffic information and data Profiling module for storing the amount and profiling time in the DB; Read the previous traffic information and data amount by checking the profiling time to accumulate the data amount of each port for each IP to generate statistical data, and store the statistical data in DB by linking the profiling time to the last statistical data. Statistical data generation module for updating the date in the DB; And The network traffic data including a policy module for reading the statistical data stored in the DB, classifying restricted ports for each IP whose data amount is less than a predetermined standard among the read statistical data, and controlling network traffic data of the restricted ports for each IP to be blocked. Potentially dangerous port limiter through profiling. The method of claim 1, wherein the policy module Among the statistical data stored in the DB, the potential dangerous port limiting device through the profiling of network traffic data, characterized in that the profiling time comprises a policy module that uses the statistical data of the day before. delete delete delete delete The method of claim 1, wherein the profiling module, Potentially dangerous port limiting apparatus through profiling network traffic data, characterized in that the traffic information is extracted from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the network traffic data. The method of claim 1, wherein the traffic information, Potential risks through the profiling of network traffic data comprising at least one of a protocol, a source Internet Protocol (IP) and a port, a destination Internet Protocol (IP), and a port. Port Restrictor. Extracts traffic information from network traffic data and detects the data volume of each port, sequentially compares the destination IP among the traffic information with the internal IP stored in the DB.If the destination IP is the internal IP, the traffic information and data A profiling step of storing the amount and the profiling time in a DB; Read the previous traffic information and data amount by checking the profiling time to accumulate the data amount of each port for each IP to generate statistical data, and store the statistical data in DB by linking the profiling time to the last statistical data. Generating statistical data to update the date in the DB; And A policy step of reading the statistical data stored in the DB, classifying restricted ports for each IP whose data amount is less than a predetermined threshold among the read statistical data, and controlling network traffic data of the restricted ports for each IP to be blocked. How to limit potential dangerous ports through profiling. 10. The method of claim 9, wherein said policy step is Among the statistical data stored in the DB, the profiling time limiting the potential dangerous port through the profiling of the network traffic data, characterized in that it comprises the step of using the statistical data of the day before. delete delete delete delete The method of claim 9, wherein the profiling step, A method for limiting potentially dangerous ports through profiling network traffic data, characterized in that the traffic information is extracted from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the network traffic data. The method of claim 9, wherein the traffic information, Potential risks through the profiling of network traffic data comprising at least one of a protocol, a source Internet Protocol (IP) and a port, a destination Internet Protocol (IP), and a port. How to restrict ports.

Images