KR101902654B1 - Method for detecting smart worm propagation vulnerability and program therefor - Google Patents

Abstract

A method for diagnosing a worm propagation vulnerability according to an exemplary embodiment of the present invention includes the steps of: checking a frequency of occurrence of a packet loss or a worm detection; Controlling the propagation speed of the worm according to a result of checking the occurrence frequency of the packet loss or the worm; And diagnosing the worm propagation vulnerability according to the detection result of the success or failure of the worm propagation attack.

Description

METHOD FOR DETECTING SMART WORM PROPAGATION VULNERABILITY AND PROGRAM THEREFOR [0002]

The present invention relates to a method of diagnosing an intelligent worm propagation vulnerability and a program implementing the intelligent worm propagation vulnerability. More specifically, the present invention relates to a method of diagnosing an intelligent worm propagation vulnerability to diagnose an actual intelligent IoT worm propagation vulnerability, It is about a program.

A worm is a malicious code capable of spreading itself. Once a device is infected with a worm, it selects other infected devices and propagates the worm. The difference between a worm and an existing malware is that it allows the entire network to be created under the attacker's control quickly because of its ability to propagate itself. Therefore, understanding and diagnosing a worm propagation vulnerability is essential for detecting and blocking worm propagation so that the entire network operates normally.

The research on malicious worms in the existing Internet and wireless networks has been conducted for more than 10 years, and several methods have been proposed for the diagnosis of worm propagation vulnerability.

Intelligent worms intelligently adjust worm propagation speed according to network traffic or detection system operation. However, existing methods do not address this problem.

Related patent literature: Korean Registration No. 10-1283565

An object of the present invention is to provide a method for diagnosing an intelligent worm propagation vulnerability that diagnoses an actual intelligent worm propagation vulnerability in an object Internet environment and a program implementing the intelligent worm propagation vulnerability diagnosis method.

The method for diagnosing a worm propagation vulnerability according to an embodiment of the present invention includes the steps of: checking a frequency of occurrence of a packet loss or a worm detection; Controlling the propagation speed of the worm according to a result of checking the occurrence frequency of the packet loss or the worm; And diagnosing the worm propagation vulnerability according to the detection result of the success or failure of the worm propagation attack.

The step of controlling the propagation speed of the worm may correspond to a step of increasing the propagation speed of the worm when a small amount of packet loss occurs and a control of decreasing the propagation speed of worm when a large amount of packet loss occurs.

The step of controlling the propagation speed of the worm may correspond to the step of controlling the worm propagation speed so as to increase the worm propagation speed when the worm detection failure occurs more than a preset value or when the detection is not performed.

In addition, the step of diagnosing the worm propagation vulnerability includes steps of adjusting the propagation speed of the worm, adjusting the setting of the detection technique, and adjusting the occurrence of packet loss by adjusting the amount of network traffic, .

Selecting a random method, a hop-by-hop method, and a target list method on the setting of the worm propagation method before the step of checking; And performing a worm propagation according to a set method, wherein the random method is a method of arbitrarily selecting and propagating devices to be worm propagated, and the hop-by-hop method is a method of propagating worm propagation The target list method can correspond to a method in which worm propagation is performed by designating a target device for worm propagation.

The method of diagnosing a worm propagation vulnerability according to an embodiment of the present invention includes the steps of: setting a worm propagation vulnerability diagnostic method of the first aspect as a first type; And setting a worm propagation vulnerability diagnostic method for diagnosing a worm propagation vulnerability according to the detection result to a second type by detecting network traffic according to the following equation.

≪ Equation &

는 0번째 타임슬롯에서 s번째 타임슬롯까지 감염되어야할 대상 노드들의 개수, N은 전체 노드 수이다.Here, ψ represents the rate of pairwise infection,

Is the number of target nodes to be infected from the 0th time slot to the s < th > time slot, and N is the total number of nodes.

According to the intelligent worm propagation vulnerability diagnosis method and the program implementing the intelligent worm propagation vulnerability detection method according to the present invention, it is possible to perform an actual intelligent worm propagation vulnerability diagnosis in the Internet environment of objects.

1 is a block diagram illustrating an intelligent worm propagation vulnerability diagnostic system in accordance with an embodiment of the present invention.
2 is a view for explaining a process of the intelligent worm propagation vulnerability diagnosis system according to an embodiment of the present invention.
3 to 5 are flowcharts illustrating an intelligent worm propagation vulnerability diagnostic method according to an exemplary embodiment of the present invention.
6 is a diagram illustrating a diagnostic device according to an intelligent worm propagation vulnerability diagnostic method according to an exemplary embodiment of the present invention.

Specific structural and functional descriptions of the embodiments of the present invention disclosed herein are for illustrative purposes only and are not to be construed as limitations of the scope of the present invention. And should not be construed as limited to the embodiments set forth herein or in the application.

The embodiments according to the present invention are susceptible to various changes and may take various forms, so that specific embodiments are illustrated in the drawings and described in detail in this specification or application. It should be understood, however, that the embodiments according to the concepts of the present invention are not intended to be limited to any particular mode of disclosure, but rather all variations, equivalents, and alternatives falling within the spirit and scope of the present invention.

The terms first and / or second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are intended to distinguish one element from another, for example, without departing from the scope of the invention in accordance with the concepts of the present invention, the first element may be termed the second element, The second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, .

On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. Other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, the terms "comprises ", or" having ", or the like, specify that there is a stated feature, number, step, operation, , Steps, operations, components, parts, or combinations thereof, as a matter of principle.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as ideal or overly formal in the sense of the art unless explicitly defined herein Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in the drawings, the same components are denoted by the same reference numerals as possible. Further, the detailed description of known functions and configurations that may obscure the gist of the present invention will be omitted.

It should be noted that the embodiments of the present invention disclosed in the present specification and drawings are only illustrative of the present invention in order to facilitate the understanding of the present invention and are not intended to limit the scope of the present invention. It is to be understood by those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

1 is a block diagram illustrating an intelligent worm propagation vulnerability diagnostic system in accordance with an embodiment of the present invention. The intelligent worm propagation vulnerability diagnosis system 10 includes an intelligent worm propagation vulnerability diagnosis apparatus 200. The intelligent worm propagation vulnerability diagnosis apparatus 200 collects packets transmitted through the network 100, Perform vulnerability diagnosis.

The intelligent worm propagation vulnerability diagnosis apparatus 200 includes a network interface 210, a worm propagation pattern module 220, a worm type management module 230, a worm generation module 240, a detection module 250, . The DB 260 functions to store various data and information to be collected or various kinds of data processed and processed internally.

The network interface 210 is an interface means for the intelligent worm propagation vulnerability diagnosis apparatus 200 of the present invention to collect packets from the network 100.

The worm propagation pattern module 220 sets a pattern such as a worm propagation pattern, for example, a random method, a hop-by-hop method, and a target list method, and controls the worm propagation according to the pattern .

The worm type management module 230 controls the worm propagation vulnerability diagnosis based on the basic type intelligent type.

The worm generation module 240 functions to generate a worm to be propagated. For example, considering the worm propagation pattern according to the worm propagation pattern module 220 and the worm propagation type according to the worm type management module 230, The worm is generated to propagate the worm.

The detection module 250 performs a function of diagnosing a worm propagation vulnerability and detects a vulnerable device.

More specific details of the present invention will be described below.

FIG. 2 is a diagram for explaining the processing of the intelligent worm propagation vulnerability diagnosis system according to an exemplary embodiment of the present invention, and shows a basic configuration of an intelligent worm propagation vulnerability diagnostic method on the Internet.

In case of worm type basic type, it diagnoses worm propagation vulnerability according to Epidemic model. Specifically, the worm traffic is propagated based on the Epidemic model (1) below.

는 0번째 타임슬롯에서 s번째 타임슬롯까지 감염되어야할 대상 노드들의 개수, N은 전체 노드 수이다.Here, ψ represents the rate of pairwise infection,

Is the number of target nodes to be infected from the 0th time slot to the s < th > time slot, and N is the total number of nodes.

In case of intelligent type of worm type, worm propagation vulnerability that is controlled dynamically according to the frequency (or ratio) of packet loss or worm detection and the operation of detection technique is diagnosed. For example, the intelligent worm propagation vulnerability diagnosis system 10 increases the propagation speed of the worm when the packet loss is small, and decreases the propagation speed of the worm when a lot of packet loss occurs.

Also, the intelligent worm propagation vulnerability diagnosis system 10 increases the propagation speed of the worm if there are many worm detection failures or if there is no detection technique. In addition, the intelligent worm propagation vulnerability diagnosis system 10 collects information on the list of already infected devices so as not to infect them again, and diagnoses the worm propagation vulnerability according to the detection result of the success or failure of the worm propagation attack. For example, the intelligent worm propagation vulnerability diagnosis system 10 determines that there is a vulnerability if the propagation of the worm succeeds while dynamically adjusting the occurrence of packet loss by adjusting the propagation speed of the worm propagation rate, setting the detection technique, and adjusting the amount of network traffic.

In the case of a worm propagation pattern, a random method, a hop-by-hop method, and a target list method can be selected. Here, the random method is a method of randomly selecting devices to be worm propagated, Method is a method in which devices infected by worm propagation continue to set neighboring devices as infected objects and worm propagation occurs and target list method is a method in which worm propagation is performed by designating devices to be worm propagated.

The worm payload corresponds to the part where a content type of the worm is set to generate a worm that matches the type. For example, when the intelligent type and the hop-by-bop method are combined, a worm according to the type is generated and worm propagation is performed, and the system 10 performs the vulnerability diagnosis accordingly.

3 to 5 are flowcharts illustrating an intelligent worm propagation vulnerability diagnostic method according to an exemplary embodiment of the present invention. The intelligent worm propagation vulnerability diagnostic method is performed by the intelligent worm propagation vulnerability diagnostic system 10 shown in Fig.

3, the intelligent worm propagation vulnerability diagnosis system 10 detects network traffic based on Equation (1) (S10), and then detects The worm propagation vulnerability is diagnosed according to the result (S20).

4 is a flow chart for explaining an intelligent diagnosis method. Referring to FIG. 4, a packet loss or a worm detection occurrence frequency (or ratio) is checked (S100), and a packet loss or a worm detection The propagation speed is controlled according to the check result of the occurrence frequency (or ratio) (S200).

For example, the intelligent worm propagation vulnerability diagnosis system 10 increases the propagation speed of the worm when the packet loss is small, and decreases the propagation speed of the worm when the packet loss is large. Further, the intelligent worm propagation vulnerability diagnosis system 10 increases the propagation speed of the worm when the worm detection failure occurs frequently or is not detected. In addition, the intelligent worm propagation vulnerability diagnosis system 10 collects information on the list of already infected devices and does not infect them again.

Thereafter, the worm propagation vulnerability is diagnosed based on the detection result of the success or failure of the worm propagation attack (S20). For example, the intelligent worm propagation vulnerability diagnosis system 10 determines that there is a vulnerability if the propagation of the worm succeeds while dynamically adjusting the occurrence of packet loss by adjusting the propagation speed of the worm propagation rate, setting the detection technique, and adjusting the amount of network traffic.

Referring to FIG. 5, the worm is set (S1000). Here, the setting of the worm may correspond to the setting of the worm propagation method, and it can be set by selecting random method, hop-by-hop method, or target list method. In the hop-by-hop method, devices infected by worm propagation set neighboring devices to be infected and continue to propagate worms. , And the target list method is a method in which worm propagation is performed by designating a target device for worm propagation.

Then, the set worm is propagated (S2000), and the attack success or failure is recognized (S3000).

6 is a diagram illustrating a diagnostic device according to an intelligent worm propagation vulnerability diagnostic method according to an exemplary embodiment of the present invention. 6, among the devices indicated by dotted lines and solid lines, the IoT devices 117.7.0.1 and 117.7.0.2 indicated by the solid lines are screened by the above-described method, The result is a visual representation of exposure to a worm propagation vulnerability.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It is not. That is, it is apparent to those skilled in the art that various embodiments based on the technical idea of the present invention are possible.

Claims (6)

Worm propagation vulnerability diagnostic system,
Checking a frequency of packet loss or worm detection occurrence;
Controlling the propagation speed of the worm according to a result of checking the occurrence frequency of the packet loss or the worm; And
And diagnosing the worm propagation vulnerability according to the detection result of the worm propagation attack success or failure,
The step of controlling the worm propagation speed includes:
A method for controlling the worm propagation speed so as to increase the worm propagation speed if the worm detection failure occurs at a predetermined value or is not detected. The method according to claim 1,
The step of controlling the worm propagation speed includes:
Wherein the worm propagation speed is increased when the packet loss is low and the worm propagation speed is decreased when the packet loss is large. delete Worm propagation vulnerability diagnostic system,
Checking a frequency of packet loss or worm detection occurrence;
Controlling the propagation speed of the worm according to a result of checking the occurrence frequency of the packet loss or the worm; And
And diagnosing the worm propagation vulnerability according to the detection result of the worm propagation attack success or failure,
The step of diagnosing the worm propagation vulnerability includes:
Worm Propagation Vulnerability Diagnosis Method, which is a step that judges that a vulnerability exists if the propagation of a worm propagates successfully while dynamically adjusting the propagation speed of the worm, adjustment of the detection method, and control of the amount of network traffic. Worm propagation vulnerability diagnostic system,
Checking a frequency of packet loss or worm detection occurrence;
Controlling the propagation speed of the worm according to a result of checking the occurrence frequency of the packet loss or the worm; And
And diagnosing the worm propagation vulnerability according to the detection result of the worm propagation attack success or failure,
Before the checking step,
Selecting a random mode, a hop-by-hop mode, and a target list mode according to the setting of the worm propagation method; And
And performing worm propagation according to the set method,
In the hop-by-hop method, devices infected by worm propagation set neighboring devices as infection targets and continue to propagate worms. And the target list method corresponds to a method in which a worm propagation is performed by designating a worm propagation target device. A computer program stored in a medium for causing a computer to execute a method of diagnosing a worm propagation vulnerability according to any one of claims 1, 4, and 5 in combination with a computer.

Images