KR102040371B1 - Apparatus and method for analyzing network attack pattern - Google Patents

Abstract

An apparatus and method for analyzing network attack patterns is disclosed. The network attack pattern analysis method includes collecting network logs at predetermined intervals through an intrusion detection system, extracting attack detection elements from the network logs, and analyzing network attack patterns using the attack detection elements; The method may include outputting the analysis result in the form of a graph.

Description

Analysis and method of network attack pattern {APPARATUS AND METHOD FOR ANALYZING NETWORK ATTACK PATTERN}

Embodiments of the present invention relate to a network attack pattern analysis and method for real-time monitoring of a network log, detecting a network attack, and outputting a graph analysis result of the network attack pattern.

A network intrusion detection system is used to collect and analyze network logs, detect network attacks, and perform network traffic management.

However, as the amount of network traffic rapidly increases due to the recent development of IT devices such as smart phones and the Internet of Things, the amount of network logs increases rapidly, and the network intrusion detection system takes a lot of time to process a large amount of network logs. This makes it difficult to process network logs in real time.

Therefore, the network intrusion detection system is not easy to detect the network attack from the network log and analyze the network attack pattern quickly.

In addition, even if a network attack is detected, it is not easy for a user to grasp a network attack state since the network attack state is not visualized and provided.

The present invention collects network logs in which an attack is detected based on a predetermined rule from an intrusion detection system, and analyzes a network attack pattern from the collected network logs, thereby preventing unnecessary data (eg, a network not attacked). By omitting the process of log), it is possible to reduce the time required for data processing for network attack pattern analysis, thereby enabling real-time processing of network logs.

The present invention collects network logs at set intervals and analyzes network attack patterns in real time through attack detection elements extracted from the network logs, thereby quickly determining network attack patterns for network logs. do.

In addition, an object of the present invention is to make it easy to grasp the analysis results by outputting the analysis results for the network attack pattern in the form of a graph.

In order to achieve the above object, the network attack pattern analysis apparatus, through an intrusion detection system, an interface unit for collecting a network log every set period, and extracts an attack detection element from the network log, and using the attack detection element, It may include a processor for analyzing a network attack pattern, and a display unit for outputting the analysis result in the form of a graph.

In order to achieve the above object, a network attack pattern analysis method includes collecting network logs at predetermined intervals through an intrusion detection system, extracting an attack detection element from the network log, and using the attack detection element, Analyzing the attack pattern, and outputting the analysis result in the form of a graph.

According to an embodiment of the present invention, by collecting network logs from which an attack is detected based on a predetermined rule from an intrusion detection system, and analyzing network attack patterns from the collected network logs, unnecessary data (eg, By omitting the process of network log not attacked, the time required for data processing for network attack pattern analysis is reduced, thereby enabling real-time processing of network logs.

According to an embodiment of the present invention, by collecting network logs at set intervals and analyzing network attack patterns in real time through attack detection elements extracted from the network logs, it is possible to quickly determine network attack patterns for network logs. To be.

In addition, according to an embodiment of the present invention, by outputting the analysis results for the network attack pattern in the form of a graph, it is possible to easily grasp the analysis results.

1 is a view showing an example of the configuration of the network attack pattern analysis apparatus according to an embodiment of the present invention.
2 is a diagram showing another example of the configuration of the network attack pattern analysis apparatus according to an embodiment of the present invention.
3 is a view for explaining an example of network attack pattern detection in the network attack pattern analysis apparatus according to an embodiment of the present invention.
4 is a view for explaining an example of extracting an attack detection element in the network attack pattern analysis apparatus according to an embodiment of the present invention.
5 is a diagram illustrating an example of network logs collected by the network attack pattern analysis apparatus according to an embodiment of the present invention.
6 is a view for explaining an example of an attack detection method in an intrusion detection system for providing a network log to the network attack pattern analysis apparatus according to an embodiment of the present invention.
7 to 9 are diagrams showing examples of a graph provided as a result of analyzing a network attack pattern in the network attack pattern analysis apparatus according to an embodiment of the present invention.
10 is a flowchart illustrating a network attack pattern analysis method according to an embodiment of the present invention.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings and the contents described in the accompanying drawings, but the present invention is not limited or limited to the embodiments.

1 is a view showing an example of the configuration of the network attack pattern analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 1, an apparatus 100 for analyzing network attack patterns according to an embodiment of the present invention may include an interface unit 101, a processor 103, a database 105, and a display unit 107.

The interface unit 101 may collect network logs every set period (eg, 1 minute) through the intrusion detection system. In this case, the interface unit 101 may collect the network log from which the attack is detected based on a predetermined rule from the intrusion detection system, and store the network log in the first database 105. That is, since the interface unit 101 collects only abnormal network logs determined by intrusion detection, unnecessary network log collection and analysis can be minimized.

The processor 103 may extract an attack detection element from the network log, and analyze the network attack pattern using the attack detection element. In this case, the processor 103 may extract information of at least one of a destination port, a destination IP, and a source IP as the attack detection element, and may include a second database ( 105).

Iii) Example of analyzing network attack pattern by using destination port

)의 수(또는, 설정된 주기 동안 추출된 데스티네이션 포트의 평균)에 대한 상기 추출된 데스티네이션 포트(

)의 수의 비율이 설정치(

)(예컨대, 1.8)를 초과하는지를 확인할 수 있다. 이때, 프로세서(103)는 상기 확인 결과, [수학식 1]에서와 같이, 상기 비율이 상기 설정치를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 포트 스캐닝(Port Scanning) 공격으로 분석할 수 있다.The processor 103 extracts, as an attack detection element, a destination port at any point in time, and sets a set average usage destination port (

The number of extracted destination ports (or the average of the destination ports extracted during a set period)

Ratio of the number of

) (Eg, 1.8). In this case, when the ratio exceeds the set value as shown in Equation 1, the processor 103 converts the network attack pattern to the port scanning attack as the port scanning attack. Can be analyzed.

That is, in the case of a port scanning attack, the processor 103 attempts a global search for an open port on an approached destination, so that the number of destination ports in the corresponding time zone in the firewall log is greater than the number of destination ports in the normal time. Due to the increase, Equation 1 can be used to analyze whether the port scanning attack.

)의 수(예컨대, 100)를 초과하는지를 더 확인할 수 있으며, [수학식 2]에서와 같이, 상기 추출된 데스티네이션 포트의 수가, 설정된 데스티네이션 포트의 수를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 포트 스캐닝 공격으로 분석할 수 있다.In addition, the processor 103 may determine that the number of extracted destination ports is set to a destination port (

It is possible to further determine whether the number of (), for example, 100), and, as shown in Equation 2, if the number of extracted destination ports exceeds the set number of destination ports, The network attack pattern may be analyzed by a port scanning attack.

In relation to the port scanning attack, the processor 103 further checks [Equation 2], and if the number of destination ports in the corresponding time zone does not exceed the number of ports used in the network, the port scanning attack is performed. If it is determined that the number of users of the corresponding network service is larger than the usual time, the number of accesses to the serviced port increases, thereby eliminating the possibility of making a mistake in the port scanning attack.

Ii) Example of analyzing network attack pattern using destination IP

)의 수(또는, 설정된 주기 동안 추출된 데스티네이션 아이피의 평균)에 대한 상기 추출된 데스티네이션 아이피(

)의 수의 비율이, 설정치(

)(예컨대, 1.8)를 초과하는지를 확인할 수 있다. 이때, 프로세서(103)는 상기 확인 결과, [수학식 3]에서와 같이, 상기 비율이 상기 설정치를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 호스트 스캐닝(Host Scanning) 공격으로 분석할 수 있다.The processor 103 extracts, as an attack detection element, a destination IP at any point in time, and sets a set average use destination IP (

The number of extracted destination IPs (or average of destination IPs extracted during a set period).

Ratio of the number of

) (Eg, 1.8). In this case, as shown in Equation 3, the processor 103 converts the network attack pattern for the arbitrary time point into a host scanning attack when the ratio exceeds the set value. Can be analyzed.

That is, the processor 103 means that in the case of a host scanning attack, the approaching destination becomes more diverse than usual, so that the number of destination IPs of the corresponding time zone increases in the firewall log than the destination IP of the usual time. Due to this, through Equation 3, it can be analyzed whether the host scanning attack.

)의 수(예컨대, 40)를 초과하는지를 더 확인할 수 있으며, [수학식 4]에서와 같이, 상기 추출된 데스티네이션 아이피의 수가, 설정된 데스티네이션 아이피의 수를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 호스트 스캐닝 공격으로 분석할 수 있다.In addition, the processor 103 may determine the number of the extracted destination IP, and set the destination IP (

It is possible to further determine whether the number of (), for example, 40), and as shown in Equation 4, if the number of extracted destination IP exceeds the set number of destination IP, The network attack pattern may be analyzed by a host scanning attack.

In relation to the host scanning attack, the processor 103 further checks [Equation 4], and if the number of destination IPs in the corresponding time zone does not exceed the number of IPs used in the network, the host scanning attack is performed. If it is determined that the number of users of the corresponding network service is larger than usual, the number of accesses to the serviced host is increased, thereby eliminating the possibility of making a mistake in the host scanning attack.

Iii) An example of analyzing network attack patterns using network logs, source IPs, and destination IPs.

)의 양(또는, 설정된 주기 동안 수집된 네트워크 로그의 평균)에 대한 상기 수집된 네트워크 로그(

)의 양의 제1 비율이, 제1 설정치(

)(예컨대, 20)를 초과하고, 상기 추출된 데스티네이션 아이피(

)의 수에 대한 상기 추출된 소스 아이피(

)의 수의 제2 비율이, 제2 설정치(

)(예컨대, 10)를 초과하는지를 확인할 수 있다.The processor 103 may extract a source IP and a destination IP as the attack detection element at any point in time. In this case, the processor 103 sets the average network log (

The collected network log (or the average of the network logs collected during the set period)

The first ratio of the positive amount is the first set value (

(E.g., 20), and the extracted destination IP (

The extracted source IP for the number of

The second ratio of the number of) is the second set value (

) (Eg, 10).

The processor 103 determines that the first ratio exceeds the first set value as shown in Equation 5, and the second ratio sets the second set value as shown in Equation 6; If exceeded, the network attack pattern for the arbitrary time point may be analyzed as a distributed denial of service (DDoS) attack.

That is, in the case of a DDoS attack, the processor 103 analyzes whether the DDoS attack is performed through Equation 5, because the amount of logs generated in the corresponding time zone is much larger than the amount of logs in the usual time zone. can do.

In addition, the processor 103 checks Equation 6 so that a large number of users attack a small number of network hosts to determine that the source IP is significantly higher than the destination IP. Just by increasing the number of users of the service, you can eliminate the possibility of misjudging a DDoS attack.

Iii) Example of analyzing network attack pattern using source IP

)의 수(또는, 설정된 주기 동안 추출된 소스 아이피의 평균)에 대한 상기 추출된 소스 아이피(

)의 수의 비율이, 설정치(

)(예컨대, 2)를 초과하는지를 확인할 수 있다. 이때, 프로세서(103)는 상기 확인 결과, [수학식 7]에서와 같이, 상기 비율이 상기 설정치를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 웜(Worm) 또는 바이러스(Virus) 공격으로 분석할 수 있다.The processor 103 extracts, at any point in time, a source IP as the attack detection element, and sets a set average use source IP (

The extracted source IP (or the average of the extracted source IPs for a set period)

Ratio of the number of

) (Eg, 2). At this time, the processor 103, when the ratio exceeds the set value, as shown in the equation (7), the processor (Worm) or virus (Virus) for the network attack pattern for the arbitrary time point ) Can be analyzed as an attack.

That is, the processor 103 may analyze whether it is a worm or a virus attack through Equation 7 due to an increase in the amount of activity of the source IP in the case of a worm or a virus attack.

)의 수(예컨대, 20)를 초과하는지를 더 확인할 수 있으며, [수학식 8]에서와 같이, 상기 추출된 소스 아이피의 수가, 설정된 소스 아이피의 수를 초과하는 경우, 상기 임의의 시점에 대한 상기 네트워크 공격 패턴을, 웜 또는 바이러스 공격으로 분석할 수 있다.In addition, the processor 103 may determine that the number of the extracted source IPs is set as a source IP (

It can be further confirmed that the number of (), such as 20), and, as shown in Equation 8, when the number of the extracted source IP exceeds the number of the set source IP, the Network attack patterns can be analyzed as worm or virus attacks.

In relation to a worm or virus attack, the processor 103 further checks [Equation 8], and if the number of source IPs in the corresponding time period does not exceed the number of IPs used in the network, the worm or virus attack is performed. By not determining, only an increase in the amount of activity that can occur periodically can eliminate the possibility of erroneous determination as a worm or virus attack.

Iii) An example of analyzing network attack patterns using network log changes.

)의 양에 대한 네트워크 로그(

)(즉, 제1 시점에서 수집된 네트워크 로그)의 양의 제1 비율이, 제1 설정치(

)(예컨대, 1.0)를 초과하는지를 확인하고, 상기 제1 시점에서의 상기 네트워크 로그(

)의 양에 대한 제2 시점에서의 네트워크 로그(

)(즉, 제2 시점에서 수집된 네트워크 로그)의 양의 제2 비율이, 제2 설정치(

)(예컨대, 0.1) 미만인지를 확인할 수 있다. 여기서, 제2 시점(

)(예컨대, 1시 01분)은 제1 시점(

)(예컨대, 1시 00분)에서 설정된 주기(예컨대, 1분 또는 10분)가 경과된 시점에 해당한다.The processor 103 may, at any first point in time, set an average network log (

Network logs for the amount of

) (I.e., network logs collected at the first time point),

) (E.g., 1.0) and the network log at the first time point (

Network log at the second point in time for the amount of

(I.e., network logs collected at a second time point), the second ratio of the amount

(E.g., less than 0.1). Here, the second time point (

) (E.g., 01:01) is the first time point (

(E.g., 1:00), the time period set (e.g., 1 minute or 10 minutes) has elapsed.

The processor 103 determines that the first ratio exceeds the first set value as shown in Equation 9, and the second ratio sets the second set value as shown in Equation 10. If all exceed, the network attack pattern for the second time point may be analyzed as a network failure occurrence.

That is, when the network failure occurs, when the network failure occurs, the network traffic increases rapidly due to the increase in the number of users of the network service or the attack, and when the traffic that the network cannot handle is recorded, the network failure occurs and the network at the next time point. Due to the suspension of activity, Equation 3 can be used to analyze whether a network failure has occurred. In this case, when a network failure occurs because a large amount of non-threat logs are collected before the point in time (t-1), the processor 103 checks whether the log generation amount at the corresponding point in time (t) decreases rapidly, Analyze if a failure has occurred.

The database 105 can include a first database 105 and a second database 105. Here, the first database 105 may be, for example, Hadoop Distributed File System Storage (HDFS), and collected network logs may be stored. In addition, the second database 105 may be Hive storage, and an attack detection element extracted from the network log may be stored.

The display unit 107 may output the analysis result in a graph form (eg, bar graph, line graph, pie graph, etc.). In this case, the display unit 107 may provide the analysis result in the form of a web interface. Here, the display unit 107 may provide a web page including an analysis condition setting window for receiving an analysis period from the user, together with a result output window for providing the analysis result to the user. The analysis period may be set to a default value (for example, today). When the analysis period is changed and input, the display unit 107 re-analyzes the network attack pattern from the network log collected in the corresponding period from the processor 103. The result can be received and output.

2 is a diagram showing another example of the configuration of the network attack pattern analysis apparatus according to an embodiment of the present invention.

2, the network attack pattern analysis apparatus 200 includes a log collector 201, an HDFS 203, a log extractor 205, a Hive 207, a log analyzer 209, and a display 211. ) May be included. Here, the network attack pattern analysis apparatus 200 distributes network logs using a MapReduce framework capable of efficiently processing a large amount of data and a Hadoop Distributed File System, which is a data distributed storage system. Store and process to efficiently detect network attacks.

The log collector 201 may receive a network log every set period (for example, one minute) from the server, and distribute the network log to the HDFS 203 of the cluster to support a real-time network attack pattern. In this case, the server may collect network logs through an intrusion detection system (IDS) for detecting network intrusion. Here, the intrusion detection system may be, for example, a Snort-based intrusion detection system that performs real-time traffic analysis and packet logging in IP.

The HDFS 203 may store a network log.

The log extractor 205 may extract elements (eg, source IP, destination IP, destination port, time) required for network attack detection from the network log stored in the HDFS 203. At this time, the extracted elements are stored in the Hive 207 which is a MapReduce based data warehouse.

Hive 207 may store elements necessary for network attack detection.

The log analyzer 209 analyzes, for example, four network attack patterns (Port Scanning, Host Scanning, DDos, worm or virus attack) and network failure using the elements extracted by the log extractor 205. can do.

The display unit 211 may be a statistical programming language, for example, using R to visualize in a graph form (eg, a bar graph, a line graph, a pie graph, etc.) and then display it on the web to provide the user. . R is an open source program and a language for statistics / data mining and graphing. R is used for large data analysis and supports various functions. R is compatible with other development languages, can be processed in real time by interworking with the web, and is useful for providing as a web service.

3 is a view for explaining an example of network attack pattern detection in the network attack pattern analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 3, the apparatus for analyzing network attack patterns according to an embodiment of the present invention may collect network logs generated from a snort through a log collector 301.

The apparatus for analyzing network attack patterns stores network logs in HDFS, for example, in 1 minute increments through shell scripts (303). Here, the time at which the network log is stored may be set by the user.

The network attack pattern analysis apparatus may extract elements necessary for attack detection analysis (Source_IP, Destination_IP, Destination_Port, time) from the network log stored in Log Storage (HDFS) through the log extraction unit (305).

The apparatus for analyzing network attack patterns may store the extracted elements in Sub Storage (HIVE) (307).

The network attack pattern analysis apparatus may derive a network attack type (eg, five types) by analyzing the network log based on the extracted elements through the log analysis unit (309).

The apparatus for analyzing network attack patterns may visualize the analyzed result in a web interface form using a data statistics based programming language (eg, R) (311).

The network attack pattern analysis apparatus may create a new rule for the newly detected attack type and store it in Sub Storage (HIVE) (313).

4 is a view for explaining an example of extracting an attack detection element in the network attack pattern analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 4, the network attack pattern analysis apparatus converts the network logs collected in an atypical form into structured data through a log extracting unit, and elements necessary for network attack detection in the converted network logs (ie, attack detection elements). Can be extracted.

The element may include, for example, at least one of a source IP, a destination IP, a destination port, and a time. Here, the source IP may include source information of the attack, and the destination IP and the destination port may include information indicating an attack target.

On the other hand, the network attack pattern analysis apparatus may perform a large network log extraction and analysis using MapReduce, a distributed programming framework that processes a large amount of data. At this time, the network attack pattern analysis apparatus may perform a map step and a reduce step through map reduce.

The network attack pattern analysis apparatus may classify data by pairing a key and a value with data scattered in a network log.

In addition, the network attack pattern analysis apparatus may extract data through filtering and sorting as the reduce step.

Specifically, in order to extract the elements necessary for the network attack detection, the network attack pattern analysis apparatus may perform three steps.

As a first step, the network attack pattern analysis apparatus may extract an element from a network log, for example, as illustrated in FIG. 5, through a map-reduce process (401). At this time, the network attack pattern analysis apparatus reads the network log line by line, extracts three elements of source IP, destination IP, and destination port, and then uses the source IP as a key. ), The destination IP and destination port can be stored as values in HDFS.

The network attack pattern analysis apparatus, as a second step, extracts the count of each element from the network log (403). At this time, the network attack pattern analysis apparatus may set each element as a key, and set the number of elements as a value, and store them in the HDFS. At this time, the network attack pattern analysis apparatus calculates the number of elements from network logs collected periodically, for example, for 1 minute, and calculates an average value for the number of elements in 10 minute units (or 1 minute unit). Can be stored in

As a third step, the apparatus for analyzing network attack patterns may store a value processed through a map-reduce process in Hive using, for example, Hibernate Query Language (HQL) (405).

6 is a view for explaining an example of an attack detection method in an intrusion detection system for providing a network log to the network attack pattern analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 6, the intrusion detection system may be a Snort-based intrusion detection system. The rule may perform pattern matching on a packet using a rule and detect network attacks and problems. In this case, the rule may be defined in advance in order to detect an attack, and a rule header indicating a pattern for an already detected attack and what action to perform when an attack of the pattern is detected. 601 may include a rule option 603 indicating additionally to be performed.

The intrusion detection system can detect network attacks by checking whether the collected network logs match the rules. In this case, the intrusion detection system may detect various network attacks by using various kinds of pre-written rules.

When the network log (or packet) is collected, the intrusion detection system may check whether the rule matches the rule and then perform a task specified in the rule if it matches. At this time, the intrusion detection system may be a task specified in the rule, first, to warn the node, second, to record the collected network log (or packet) or third, to delete the collected network log (or packet).

For example, the intrusion detection system may perform an operation for generating an alert when a pattern is input to port 53 of 123.234.56.78 which is a specific IP address in all IPs and all PORTs through the TCP protocol. In this case, the intrusion detection system may set the message "Attempt to access a Domain Name Server (DNS)" and an ID of the corresponding Snort Rule to 10000010 according to a rule option for the alert.

7 is a diagram illustrating an example of a graph provided as a result of analyzing a network attack pattern in the network attack pattern analysis apparatus according to an embodiment of the present invention.

Referring to FIG. 7, the apparatus for analyzing a network attack pattern extracts a destination IP from a network log collected at an arbitrary time point, and the ratio of the number of extracted destination IPs to the set number of average used destination IPs is equal to: When the number of extracted destination IPs exceeds the set value and the number of destination IPs set, the network attack pattern for the arbitrary time point may be analyzed by a host scanning attack.

At this time, the network attack pattern analysis apparatus measures the number of occurrences and the total number of each element (Destination Port, Destination IP, Source IP) and prepares them as a line graph. Can be output. Here, it can be seen that the value of the destination port has increased compared to the source IP value or the destination IP.

Also, when the network attack pattern is analyzed as a worm or a virus attack, the network attack pattern analysis apparatus may generate and output a line graph as illustrated in FIG. 8 when the network attack pattern is analyzed as a worm or a virus attack. At this time, it can be seen that the source IP value increased.

In addition, the network attack pattern analysis apparatus may generate and output a line graph as shown in FIG. 9 when the network attack pattern is analyzed as the occurrence of a network failure based on the change in the network log. At this time, it can be seen that the log amount immediately before the occurrence of the failure is higher than the average value.

10 is a flowchart illustrating a network attack pattern analysis method according to an embodiment of the present invention.

Referring to FIG. 10, in operation 1001, the apparatus for analyzing network attack patterns may collect network logs at predetermined intervals through an intrusion detection system. At this time, the network attack pattern analysis apparatus may collect the network log, the attack is detected based on a predetermined rule from the intrusion detection system.

In operation 1003, the network attack pattern analysis apparatus may extract an attack detection element from the network log, and analyze the network attack pattern using the attack detection element. In this case, the network attack pattern analysis apparatus may extract at least one information of a destination port, a destination IP, and a source IP as the attack detection element.

First, the network attack pattern analysis apparatus extracts a destination port as the attack detection element at any point in time, and the ratio of the number of extracted destination ports to the set average number of used destination ports exceeds a set value. You can check. In this case, the network attack pattern analysis apparatus may analyze the network attack pattern for the arbitrary time point by a port scanning attack ^공격) when the ratio exceeds the set value as a result of the checking.

In addition, the network attack pattern analysis apparatus may further check whether the number of the extracted destination ports exceeds the number of the set destination ports, and the number of the extracted destination ports exceeds the number of the set destination ports. The network attack pattern for the arbitrary time point may be analyzed by a port scanning attack.

At any point in time, the network attack pattern analysis apparatus extracts, as the attack detection element, a destination IP, and determines whether the ratio of the number of the extracted destination IP to the set number of average used destination IPs exceeds a set value. You can check it. In this case, the network attack pattern analysis apparatus may analyze the network attack pattern for the arbitrary time point by a host scanning attack ⁱⁱ⁾ when the ratio exceeds the set value as a result of the checking.

In addition, the network attack pattern analysis apparatus may further check whether the number of the extracted destination IP exceeds the set number of destination IP, and the number of the extracted destination IP exceeds the set number of destination IP. The network attack pattern for the arbitrary time point may be analyzed by a host scanning attack.

The network attack pattern analysis apparatus may extract a source IP and a destination IP as the attack detection element at any point in time. At this time, the network attack pattern analysis apparatus determines that the first ratio of the amount of the collected network logs to the set amount of the average network log exceeds the first set value, and the extracted source for the number of extracted destination IPs. It can be confirmed whether the second ratio of the number of IPs exceeds the second set value.

The network attack pattern analysis apparatus may determine the network attack pattern for the arbitrary time point when the first ratio exceeds the first set value and the second ratio exceeds the second set value as a result of the checking. DOS: can analyze (DDoS Distribute Denial of Service) attacks ^ⅲ).

The network attack pattern analysis apparatus may extract a source IP as the attack detection element at any point of time, and determine whether a ratio of the number of extracted source IPs to a set average number of used source IPs exceeds a set value. . At this time, the network attack pattern analysis unit can the check result, the ratio analysis, if it exceeds the set value, the network attack pattern for said arbitrary time, the worm (Worm) or virus (Virus) attack ^ⅳ) have.

In addition, the network attack pattern analysis apparatus may further check whether the number of the extracted source IPs exceeds the set number of source IPs, and when the number of extracted source IPs exceeds the number of set source IPs, the arbitrary The network attack pattern for the time point may be analyzed as a worm or virus attack.

The network attack pattern analysis apparatus determines whether the first ratio of the amount of the network log to the set average network log amount exceeds a first set value at any first time point, and the network log at the first time point. It may be confirmed whether the second ratio of the amount of the network log at the second time point to the amount of is less than the second set value. Here, the second time point corresponds to the time point at which the period set in the first time point has passed.

The network attack pattern analysis apparatus determines the network attack pattern for the second time point when the first ratio exceeds the first set value and the second ratio exceeds all of the second set value as a result of the checking. It can analyze the network failure ^ⅴ).

In operation 1005, the apparatus for analyzing network attack patterns may output the analysis result in the form of a graph (eg, a bar graph, a line graph, a pie graph, etc.). In this case, the apparatus for analyzing network attack patterns may provide a web page including an analysis condition setting window for receiving an analysis period from the user as well as a result output window for providing the analysis result to the user.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the devices and components described in the embodiments may be, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors, microcomputers, field programmable arrays (FPAs), It may be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of explanation, one processing device may be described as being used, but one of ordinary skill in the art will appreciate that the processing device includes a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that it may include. For example, the processing device may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and configure the processing device to operate as desired, or process independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored in one or more computer readable storage media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed by various computer means and stored in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions stored in the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer readable storage media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Hardware devices specially configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Although the embodiments have been described by the limited embodiments and the drawings as described above, various modifications and variations are possible to those skilled in the art from the above description. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components Or even if replaced or substituted by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the claims that follow.

100: network attack pattern analysis device
101: interface unit 103: processor
105: database 107: display unit

Claims (14)

Collecting network logs at predetermined intervals through an intrusion detection system;
Extracting 1) Source IP, 2) Destination IP, and 3) Destination Port from the network log as an attack detection element, and using the attack detection element, Analyzing the attack pattern; And
Outputting the analysis result in the form of a graph
Including,
Analyzing the network attack pattern,
At any point in time, as the attack detection element, 2) extracting a destination IP; And
When the ratio of the number of extracted 2) destination IPs to the set number of average used destination IPs exceeds the set value, the number of the extracted 2) destination IPs exceeds the set number,
Analyzing the network attack pattern for the arbitrary time point as a host scanning attack
Including,
Outputting the analysis result in the form of a graph,
Outputting a broken line graph in which the number of occurrences of the destination port and the total number of times increase compared to the 1) source IP or 2) the destination IP;
Network attack pattern analysis method comprising a. The method of claim 1,
Collecting the network log,
Collecting the network log from which the attack is detected based on a predetermined rule from the intrusion detection system.
Network attack pattern analysis method comprising a. The method of claim 1,
At this point in time, as the attack detection element, 3) a destination port is extracted,
Analyzing the network attack pattern,
Checking whether the ratio of the extracted number of 3) destination ports to the set number of average used destination ports exceeds a set value; And
Analyzing the network attack pattern for the arbitrary time point as a port scanning attack when the ratio exceeds the set value as a result of the checking;
Network attack pattern analysis method further comprising. delete The method of claim 1,
At this point in time, when 1) the source IP and 2) the destination IP are extracted as the attack detection element,
Analyzing the network attack pattern,
Checking whether a ratio of the amount of the network log to the set amount of the average network log exceeds a first set value;
Checking whether the ratio of the number of extracted 1) source IPs to the number of extracted 2) destination IPs exceeds a second set value; And
If the ratio, each of the ratio exceeds both the first set value and the second set value, the step of analyzing the network attack pattern for the random point of time, Distribute Denial of Service (DDoS) attack
Network attack pattern analysis method further comprising. The method of claim 1,
At this point in time, as the attack detection element, 1) when the source IP is extracted,
Analyzing the network attack pattern,
Checking whether the ratio of the number of extracted 1) source IPs to the set average number of used source IPs exceeds a set value; And
If the ratio exceeds the set value, analyzing the network attack pattern for the arbitrary time point as a worm or virus attack
Network attack pattern analysis method further comprising. The method of claim 1,
Analyzing the network attack pattern,
Checking, at any first point in time, that the ratio of the amount of network log to the set average network log amount exceeds a first set value;
Confirming whether a ratio of the amount of the network log at the second time point to the amount of the network log at the first time point is less than a second set value, wherein the second time point has elapsed a period set at the first time point At the time of completion; And
Analyzing the network attack pattern for the second time point as occurrence of a network failure when each of the ratios exceeds both the first set value and the second set value as a result of the checking;
Network attack pattern analysis method further comprising. An interface unit for collecting network logs at predetermined intervals through an intrusion detection system;
A processor that extracts 1) a source IP, 2) a destination IP, and 3) a destination port from the network log and analyzes a network attack pattern using the attack detection element; And
A display unit for outputting the analysis result in a graph
Including,
The processor,
At any point in time, as the attack detection element, 2) a destination IP is extracted, and the ratio of the number of extracted 2) destination IPs to a set average number of used destination IPs exceeds a set value, When the number of the extracted 2) destination IP exceeds the set number, the network attack pattern for the arbitrary time point is analyzed by a host scanning attack,
The display unit,
Compared to 1) the source IP or 2) the destination IP, 3) outputting a line graph in which the number of occurrences and the total number of the destination ports increase.
Network attack pattern analysis device. The method of claim 8,
The interface unit,
Collecting the network log, the attack is detected based on a predetermined rule from the intrusion detection system
Network attack pattern analysis device. The method of claim 8,
At this point in time, as the attack detection element, 3) a destination port is extracted,
The processor,
Confirm that the ratio of the extracted number of 3) destination ports to the set number of average used destination ports exceeds a set value; and, when the result of the check indicates that the ratio exceeds the set value, Analyzing the network attack pattern by port scanning attack
Network attack pattern analysis device. delete The method of claim 8,
At this point in time, when 1) the source IP and 2) the destination IP are extracted as the attack detection element,
The processor,
The ratio of the amount of the network log to the set average network log is greater than a first set value, and the ratio of the number of extracted 1) source IPs to the number of extracted 2) destination IPs is Determine whether the second setting value is exceeded, and when the ratio indicates that each of the ratios exceeds both the first setting value and the second setting value, the network attack pattern for the arbitrary time point is analyzed as a DDoS attack. doing
Network attack pattern analysis device. The method of claim 8,
At this point in time, as the attack detection element, 1) when the source IP is extracted,
The processor,
The ratio of the number of extracted 1) source IPs to the set number of average used source IPs is greater than a set value, and when the result of the check is that the ratio exceeds the set values, Analyzing network attack patterns as worm or virus attacks
Network attack pattern analysis device. The method of claim 8,
The processor,
At any first point in time, determine whether the ratio of the amount of the network log to the set average network log amount exceeds the first set value,
The ratio of the amount of the network log at the second time point to the amount of the network log at the first time point is less than a second set value, and wherein the second time point, the period set at the first time point has elapsed At that time
As a result of the check, when each of the ratios exceeds both the first set value and the second set value, the network attack pattern for the second time point is analyzed as a network failure occurrence.
Network attack pattern analysis device.

Images