KR102018348B1 - User behavior analysis based target account exploit detection apparatus - Google Patents

Abstract

The present invention relates to an apparatus for detecting exploit of a target account based on user behavior analysis, which comprises: an account activity collecting unit collecting account activities of a user generated through data communication with an external device; an account activity graph generating unit storing an account activity area in nodes and linking the nodes in time series to generate an account activity graph; a user behavior analysis unit analyzing a behavior of the user based on the account activity graph; and a target account exploit detection unit detecting the account or the account activity abnormality based on the user behavior analysis to detect the exploit of the target account of an internal attacker.

Description

Target account takeover detection device based on user behavior analysis {USER BEHAVIOR ANALYSIS BASED TARGET ACCOUNT EXPLOIT DETECTION APPARATUS}

The present invention relates to a target account takeover detection technology based on user behavior analysis, and more particularly, user behavior that can detect target account takeover by an internal attacker by detecting abnormal account activity of the user based on the account activity graph. The present invention relates to an analysis-based target account takeover detection device.

Software is becoming increasingly important, and most companies and companies are maintaining business continuity through online services. Since most of these services are provided by utilizing server system resources, stable operation is essential in terms of security and availability of server systems to ensure business continuity.

Recently, server system protection measures are required due to the strengthening of information protection laws and regulations, and enterprise-wide servers including effective access control and audit trails to protect assets from internal and / or external attacks of various advanced techniques. A system control response plan is needed. In addition, existing server security technologies focus on external attacks, limiting their ability to respond to potential insider threats.

Korean Patent Laid-Open No. 10-2017-0122548 relates to a method and apparatus for recognizing an APT attack using analysis of related data of an abnormal process, and includes a vaccine program of a host device such as a server or a personal computer (PC) on a network of an enterprise or an organization. For an abnormal process (application), such as a malicious process detected in real time in the security system, historical association data is generated from past association data, and past association information on data relations and actions performed associated with the process is based on the APT step 5, that is, propagation ( Disclosed are techniques for detecting advanced cyber target attacks (APTs) by analyzing delivery, exploitation, installation, C0026 # C (Command 0026 # Control) communications, and actions.

Korean Laid-Open Patent Publication No. 10-2014-0078329 relates to an internal network target attack response device and method, and the internal network target attack response device includes ECDMAX (Exploit, C2, Download, Lateral Movement, External Network Attack, Exfiltration) in the behavior profile. Based on the step by step attack tracking and counteracting techniques are disclosed.

Korean Patent Publication No. 10-2017-0122548 (2017.11.06) Korean Patent Publication No. 10-2014-0078329 (2014.06.25)

An embodiment of the present invention is to provide a target account takeover detection apparatus based on user behavior analysis that can detect abnormal account activity of the user based on the account activity graph to detect the target account takeover by the internal attacker.

An embodiment of the present invention is to analyze the pattern of the user's account activity collected for a certain period of time and model the type of attack to detect the target account takeover detection based on user behavior analysis that can detect the attack type corresponding to the target account takeover To provide.

An embodiment of the present invention is to provide a target account takeover detection apparatus based on user behavior analysis that can solve that the internal attack is not detected by the conventional server security technology.

Among the embodiments, the target account takeover detection apparatus based on user behavior analysis may include an account activity collector configured to collect account activity of a user generated through data communication with an external device, and store the account activity area in a node and arrange the nodes in time series order. An account activity graph generator for generating an account activity graph by linking, a user behavior analyzer for analyzing a user's behavior based on the account activity graph, and detecting an abnormality of the account or the account activity based on the user behavior analysis; Target account takeover detection unit for detecting the target account takeover of the internal attacker.

In one embodiment, the account activity collector may periodically and continuously collect resources associated with account activity by the user.

In one embodiment, the account activity graph generator may generate nodes and group nodes in a time series order based on a normal user's behavior pattern according to a predetermined connection relationship between the resources of the account activities.

In one embodiment, the account activity graph generator may model an attacker type of an internal attacker having an abnormal connection relationship between nodes out of the time series in the account activity graph.

In one embodiment, the user behavior analysis unit may detect a user behavior abnormality by comparing the user's behavior pattern with a criterion based on the account activity graph.

In one embodiment, the target account takeover detection unit APT (Advanced Persistent) on the basis of the concentration per unit time or the concentration of the perpetual account access or attacker in the abnormal connection relationship between the nodes of the account activity graph detected the user behavior abnormality Threat) can be detected.

In one embodiment, the target account takeover detection unit may determine that an account associated with a resource stored in the node having an abnormal connection corresponds to an attack target account if the concentration per unit time or the concentration per cycle is greater than or equal to a certain criterion.

In one embodiment, when the target account takeover detection is detected, the target account takeover may be sent to the associated smart phone after closing the account access, or may request a password change after reducing the account authority.

The disclosed technique can have the following effects. However, since a specific embodiment does not mean to include all of the following effects or only the following effects, it should not be understood that the scope of the disclosed technology is limited by this.

The target account takeover detection apparatus based on user behavior analysis according to an embodiment of the present invention may detect abnormal account activity of the user based on an account activity graph to detect a target account takeover by an internal attacker.

The target account takeover detection apparatus based on user behavior analysis according to an embodiment of the present invention may detect an attack type corresponding to a target account takeover by analyzing a pattern of user's account activity collected for a certain period of time and modeling an attack type. have.

The target account takeover detection apparatus based on user behavior analysis according to an embodiment of the present invention can solve that an internal attack is not detected by a conventional server security technology.

1 is a diagram illustrating a target account takeover detection system based on user behavior analysis according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an apparatus for detecting a target account takeover based on user behavior analysis of FIG. 1.
FIG. 3 is a diagram illustrating functional elements of a processor of the target account takeover detecting apparatus based on user behavior analysis of FIG. 1.
FIG. 4 is a flowchart illustrating a method of detecting a target account takeover based on a user behavior analysis performed by the apparatus for detecting a target account takeover based on the user behavior analysis of FIG. 1.
FIG. 5 is an exemplary diagram illustrating a graph of an account activity of a target account takeover detecting apparatus based on user behavior analysis of FIG. 1.

Description of the present invention is only an embodiment for structural or functional description, the scope of the present invention should not be construed as limited by the embodiments described in the text. That is, since the embodiments may be variously modified and may have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, the objects or effects presented in the present invention does not mean that a specific embodiment should include all or only such effects, the scope of the present invention should not be understood as being limited thereby.

On the other hand, the meaning of the terms described in the present application should be understood as follows.

Terms such as "first" and "second" are intended to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, the first component may be named a second component, and similarly, the second component may also be named a first component.

When a component is referred to as being "connected" to another component, it should be understood that there may be other components in between, although it may be directly connected to the other component. On the other hand, when a component is referred to as being "directly connected" to another component, it should be understood that there is no other component in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "comprise" or "have" refer to a feature, number, step, operation, component, part, or feature thereof. It is to be understood that the combination is intended to be present and does not exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

In each step, an identification code (e.g., a, b, c, etc.) is used for convenience of description, and the identification code does not describe the order of the steps, and each step clearly indicates a specific order in context. Unless stated otherwise, they may occur out of the order noted. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be embodied as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all kinds of recording devices in which data can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Generally, the terms defined in the dictionary used are to be interpreted to coincide with the meanings in the context of the related art, and should not be interpreted as having ideal or excessively formal meanings unless clearly defined in the present application.

1 is a view for explaining a target account reconnaissance detection system based on user behavior analysis according to an embodiment of the present invention.

Referring to FIG. 1, a target account takeover detection system 100 based on user behavior analysis may include an external device 110 and a target account takeover detection device 120 based on user behavior analysis.

The external device 110 corresponds to a computing device that communicates with the target account takeover detection device 120 based on user behavior analysis through data communication, and may be implemented as, for example, a smartphone, a laptop, or a computer. The present invention is not limited thereto and may be implemented in various devices such as a tablet PC. The external device 110 may be connected to the target account takeover detection device 120 based on user behavior analysis through at least one external device 110 and the target account takeover detection device 120 based on the user behavior analysis. Can be connected at the same time.

The target account takeover detecting apparatus 120 based on user behavior analysis may correspond to a server that detects a target account takeover by establishing an attack type model based on a user's account activity graph generated through data communication with the external device 110. Can be. In one embodiment, the target account takeover detection device 120 based on user behavior analysis is implemented as a separate server or device capable of proactive response to the attack by detecting the target account takeover of the attacker in the data communication with the external device 110 However, the present invention is not limited thereto.

In one embodiment, the target account takeover detection device 120 based on user behavior analysis may be implemented including a database (not shown), and may be implemented independently of the database. When implemented independently of the database, the target account takeover detection device 120 based on user behavior analysis may be connected to the database by wire and / or wireless to transmit and receive data. Hereinafter, a more detailed description related to the target account takeover detection apparatus 120 based on user behavior analysis will be described with reference to FIG. 3.

The database is a storage device capable of storing information necessary for detecting a target account takeover of the target account takeover detecting apparatus 120 based on user behavior analysis. In one embodiment, the database may store information about variables that may occur in analyzing the user's behavior to verify the account, but is not limited thereto, the target account takeover detection device 120 based on the user behavior analysis In the process of detecting the target account takeover, the collected information may be collected or processed in various forms.

FIG. 2 is a diagram illustrating an apparatus for detecting a target account takeover based on user behavior analysis of FIG. 1.

Referring to FIG. 2, the target account takeover detection device 120 (hereinafter, referred to as a target account takeover detection device) based on user behavior analysis may include a processor 210, a memory 220, a user input / output unit 230, and a network input / output unit 240. ) May be included.

The processor 210 may perform the target account takeover detection based on the user behavior analysis in FIG. 4, manage the memory 220 that is read or written in this process, and the volatile memory in the memory 220. You can schedule synchronization times between nonvolatile memories.

The processor 210 may control the overall operation of the target account takeover detection apparatus 120 based on user behavior analysis, and is electrically connected to the memory 220, the user input / output unit 230, and the network input / output unit 240. You can control the data flow between them. The processor 210 may be implemented as a central processing unit (CPU) of the target account takeover detecting apparatus 120.

The memory 220 may include a secondary memory device which is implemented as a nonvolatile memory such as a solid state disk (SSD) or a hard disk drive (HDD), and is used to store the entire data necessary for the target account takeover detection device 120. And a main memory device implemented with volatile memory such as random access memory (RAM).

The user input / output unit 230 includes an environment for receiving user input and an environment for outputting specific information to the user, and includes, for example, a mouse, a trackball, a touch pad, a graphic tablet, a scanner, a touch screen, a keyboard, or a pointing. It may include an input device including an adapter such as a device and an output device including an adapter such as a monitor. In one embodiment, the user input / output unit 230 may correspond to a computing device connected through a remote connection, in which case, the target account takeover detection device 120 based on user behavior analysis may be performed as a server.

The network input / output unit 240 may include an environment for connecting with the target account takeover detection apparatus 120 based on user behavior analysis, and may include, for example, an adapter for local area network (LAN) communication. . In one embodiment, the target account takeover detection apparatus 120 based on user behavior analysis may be connected to a network through the network input / output unit 240.

FIG. 3 is a diagram illustrating functional elements of a processor of the target account takeover detecting apparatus based on user behavior analysis of FIG. 1.

Referring to FIG. 3, the apparatus 120 for detecting a target account based on user behavior analysis may include an account activity collector 310, an account activity graph generator 320, a user behavior analyzer 330, and a target account deodorization detector. 340 and the control unit 350.

The account activity collector 310 may collect data related to the user's account activity. In detail, the account activity collector 310 may collect account activities of the user generated through data communication with the external device 110. For example, the account activity collector 310 may include a login record, such as the date and time the account was used by the user, an Internet Protocol (IP) address used to access the account, user rights of the account, and the like. Resource information of account activities can be collected, and the account activity is not necessarily limited thereto.

The account activity collector 310 may periodically and continuously collect resources associated with account activity by the user, and transmit the account activities to the account activity graph generator 320 to connect the collected account activities in time series order. have.

The account activity graph generator 320 may receive at least one account activity from the account activity collector 310. More specifically, the account activity graph generator 320 may generate an account activity graph by storing an account activity area in a node and linking the nodes in time series order. Here, the account activity area may include resources of account activities, attributes of resources, and the like. In one embodiment, the account activity graph generator 320 may determine a criterion for analyzing the user's behavior pattern by graphing the user's account activity that is periodically collected. In other words, the order of user actions can be known from the linked time series order between the account activity areas stored in the node in the account activity graph.

The account activity graph generator 320 may generate a graph through a time series order of the account activity areas to establish an attack type model. Resources stored in the node of the account activity graph may include various information related to account takeover, such as IP address, domain, email, and malware. Accordingly, the account activity graph is a state in which nodes and group nodes are created in a time series order based on a normal user's behavior pattern according to a constant relationship between resources of account activities. Attack types such as dangerous behaviors and potential threats with connections can be modeled.

The user behavior analyzer 330 may analyze the user's behavior based on the account activity graph generated by the account activity graph generator 320. Here, the user behavior analysis may mean analyzing an account pattern that a user usually uses. More specifically, the user behavior analyzer 330 may grasp the user's behavior pattern about where and how the user accesses and uses the account through time series analysis.

In one embodiment, the user behavior analyzer 330 may detect a user behavior abnormality by comparing the user's behavior pattern with a criterion based on an account activity graph. The user behavior analyzer 330 may perform time series analysis on user behavior by arranging the user behavior in the order of time through the user log.

The target account takeover detection unit 340 may detect an advanced persistent threat (APT). Here, APT (Advanced Persistent Threat) is an intelligent persistent attack that targets an organization or enterprise and then continuously attempts to attack it. It is also called 'sustainable threat' or 'intelligent sustainable threat'. Advanced Persistent Attacks (APTs) mostly begin with malware infections, which help hackers gain access to target servers while infecting nearby computers. The hacker gains the right to access the internal network through the backdoor created by the malware, and attacks the target server by accessing it.

The target account takeover detecting unit 340 detects an intelligent persistent attack (APT) based on an account access or an attacker's concentration per unit time or concentration per cycle of an abnormal connection between nodes of an account activity graph in which a user behavior abnormality is detected. can do. In one embodiment, the target account takeover detection unit 340 may detect an advanced persistent attack (APT) by analyzing whether it is concentrated at a specific time. In another embodiment, the target account takeover detection unit 340 may detect an advanced persistent attack (APT) by analyzing whether the target account is concentrated in a specific region, that is, a specific IP address.

The target account takeover detecting unit 340 may determine that an account associated with a resource stored in a node having an abnormal connection corresponds to an attack target account when the concentration per unit time or the concentration per cycle is greater than or equal to a certain criterion. Here, the concentration per unit time or the concentration per cycle may correspond to the temporal and spatial concentration of user account activity toward a specific account, specific criteria may correspond to criteria that can be set by the user, and the target account may be an attacker. This may correspond to an account attacked by. In one embodiment, the target account takeover detection unit 340 may determine that the account is attacked by the attacker when concentrated at a specific time or in a specific region, and through this process, the account is subject to the attacked account. It can be determined as applicable.

More specifically, the target account takeover detecting unit 340 may detect the target account takeover of the internal attacker by detecting an account or an abnormal activity on the basis of the user behavior pattern analyzed by the user behavior analyzing unit 330. The target account takeover detecting unit 340 may detect the target account takeover of the internal attacker by monitoring the determined attack target account. For example, the attacker may exist as an internal attack terminal, and the target account takeover may include the target account reconnaissance, the target account takeover, and the target account access for achieving the target such as file illegal manipulation (duplicate or change). It is not limited thereto.

In other words, the target account takeover detecting unit 340 may continuously detect the attack target account determined based on the user behavior analysis to detect in advance what attack the attack target accounts. The target account takeover detection apparatus 120 based on the user behavior analysis of the present invention may prevent an attack by an internal attacker by detecting the target account takeover of an attacker in advance.

The target account takeover detecting unit 340 may close the account access when the attacker's target account takeover is detected, and then transmit the authentication number to the associated smartphone. In one embodiment, the target account takeover detection unit 340 may transmit an authentication number to a user terminal associated with the attack target account, that is, a smartphone, and the user receives the authentication number to close the account access by detecting the target account takeover. Can be released. In another embodiment, the user may allow the account access to be closed even if the user receives the authentication number. For example, a user may want to close an account if the account has not been used for a certain period of time.

The target account takeover detection unit 340 may reduce the account authority and request a password change when the attacker's target account takeover is detected. In this case, reducing the account authority may include reducing the range that the user can access using the account, as shown in Table 1 below, and the access range may be changed and set by the administrator. It is not limited to this.

Before zoom out After shrinking Accessible Access denied Accessible Accessible … … Accessible Access denied

The target account takeover detection manager (hereinafter, the administrator) may set the range of account authority reduction according to the target account takeover step. The target account takeover step may be set from step 1 to N step, and may mean that the risk of target account takeover increases as step N goes, but is not necessarily limited thereto. The manager may reduce the account authority as much as the target account takeover detected through the target account takeover detection unit 340 is at step N, that is, at a high risk level, rather than at a low risk level. For example, step 1 can reduce one, while step N can reduce N.

The target account takeover detection unit 340 may reduce the account authority of the target account, and request the user to change the password. For example, the target account takeover detecting unit 340 may increase the account authority of the corresponding account if the password change is detected by the user after requesting a password change. The target account takeover detecting unit 340 may restore the account right before reducing the account right.

The control unit 350 may control the overall operation of the target account takeover detection device 120 based on the user behavior analysis, the account activity collector 310, the account activity graph generator 320, and the user behavior analyzer 330. ) And the control flow or data flow between the target account takeover detection unit 340.

FIG. 4 is a flowchart illustrating a method of detecting a target account takeover based on a user behavior analysis performed by the apparatus for detecting a target account takeover based on the user behavior analysis of FIG. 1.

In FIG. 4, the account activity collection unit 310 may collect account activities of a user generated through data communication with an external device (step S410).

The account activity graph generation unit 320 may generate an account activity graph by storing the account activity area in the node and linking the nodes in time series order (step S420).

The user behavior analyzer 330 may analyze the user's behavior based on the account activity graph (step S430).

The target account takeover detecting unit 340 may detect a target account takeover by an internal attacker by detecting an abnormality of an account or an account activity based on the analysis of user behavior (step S440).

FIG. 5 is an exemplary diagram illustrating a graph of an account activity of a target account takeover detecting apparatus based on user behavior analysis of FIG. 1.

Referring to FIG. 5, the target account takeover detection apparatus 120 based on the user behavior analysis analyzes the account activity graph generator 320 for the account activity resources of the user which is periodically and continuously collected through the account activity collector 310. The account activity graph can be constructed. In this case, the account activity resources of the user are stored in the nodes constituting the account activity graph, and the nodes may be linked in the order of account activity time of the user to form a connection relationship. For example, the sequence of time series from the first node to the second node, the second node to the third node, and the third node back to the first node means the user's account activity pattern at a specific time or region. Assuming that the routine is a normal routine, abnormal routines are generated when abnormal resources are generated or detected instead of the resources of the second node after the resources stored in the first node are generated or detected at a specific time or region. Can be detected. Here, the abnormal account activity may refer to an abnormal user behavior.

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art will be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below I can understand that you can.

100: Target account takeover detection system based on user behavior analysis
110: external device
120: Detecting target account takeover based on user behavior analysis
210: processor 220: memory
230: user input and output unit 240: network input and output unit
310: account activity collector 320: account activity graph generator
330: user behavior analysis unit 340: target account takeover detection unit
350: control unit

Claims (8)

An account activity collector configured to collect account activities of a user generated through data communication with an external device;
An account activity graph generator configured to store an account activity area in a node and link the nodes in time series order to generate an account activity graph;
A user behavior analysis unit that analyzes and analyzes an account pattern which is normally used by a user based on the account activity graph; And
A target account takeover detection unit for detecting an account attack of an internal attacker by detecting an abnormality of the account or the account activity based on the user behavior analysis;
The account activity graph generation unit
An internal attacker having nodes and group nodes in a time series order based on a normal user's behavior pattern according to a constant connection relationship between resources of the account activities, and having an abnormal connection relationship between nodes out of the time series order in the account activity graph. Model attack types,
The user behavior analysis unit
The apparatus for detecting user's behavior based on user behavior analysis, characterized in that the user behavior abnormality is detected by comparing the user's behavior pattern with the criteria based on the account activity graph.
The method of claim 1, wherein the account activity collector
Target account takeover detection device based on user behavior analysis, characterized in that the collection of resources associated with the account activity by the user periodically and continuously.
delete delete delete The method of claim 1, wherein the target account takeover detection unit
User behavior characterized by detecting APT (Advanced Persistent Threat) based on the account access or the attacker's concentration per unit time or concentration per cycle of abnormal connection between the nodes of the account activity graph in which the user behavior abnormality is detected Analysis-based target account takeover detection device.
The method of claim 6, wherein the target account takeover detection unit
If the concentration per unit time or concentration per cycle is above a certain criterion, the target account takeover detection device based on the user behavior analysis, characterized in that the account associated with the resource stored in the node with the abnormal connection relationship is determined to correspond to the target account .
The method of claim 1, wherein the target account takeover detection unit
If the target account is detected, the target account takeover detection device based on user behavior analysis, characterized in that after closing the account access, sending a verification code to the associated smartphone or requesting a password change after reducing the account authority.

Images