KR102075003B1 - Security server and managing method thereof - Google Patents

Abstract

The security server according to an embodiment of the present invention includes an engine unit for storing detection information generated by analyzing traffic flowing from the outside, receiving detection information from the engine unit, and transmitting the received detection information to a distributed processing process. A distributed processing unit for matching and setting a transmission path of the inflowed traffic, and a destination of a transmission path set by the distributed processing unit, and a container unit for receiving and processing the incoming traffic from the distributed processing unit.

Description

SECURITY SERVER AND MANAGING METHOD THEREOF

The present invention relates to a security server and a method of operating the security server. More specifically, the present invention relates to a security server and a method of operating a security server free from malicious code or hacker attacks.

Due to the rapid increase in the use of the Internet around the world, the path of infection of malware or ransomware targeting servers or PCs is diversified, and the damages are increasing every year.

On the other hand, if a server or PC is infected with malware or ransomware, it can be controlled from the outside, and it is not only exploited for distribution of other malware or ransomware, leakage of internal data, but also DDoS (Distributed Denial of Service) attacks can be carried out, so subsequent damage cannot be said.

In addition, if a server or PC is infected with malware or ransomware, it may be abused as a bot. A bot forms a network group called botnet, which is illegal by the command of a bot master. It collects information, sends spam mails, phishes, distributes malware, and conducts DDoS attacks. These botnets can damage not only Internet users' own PCs, but also network infrastructure such as routers and Domain Name System (DNS) servers. Can give

Looking at the path of users infected with malware or ransomware, first, the bot master hacks the update server of a program frequently used by the user or the web site to connect to, and injects the malware or ransomware, and then the user Malware or ransomware is installed on your PC when you update it from an update server or access its website. After that, when the bot agent installed on the user's PC connects to the C & C (C & C) server of the bot master, the bot master acquires the control authority for the corresponding PC. . In other words, all malware or ransomware infections originate from hacked servers and are performed by zombie PCs whose bot masters have gained control, requiring new ways to fundamentally block hacking of servers that are the start of the infection. do. The present invention relates to this.

Republic of Korea Patent Publication No. 10-2016-0028724 (2016.03.14)

The technical problem to be solved by the present invention is to provide a security server and a method of operating a security server that can fundamentally block hacking.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

Security server according to an embodiment of the present invention for achieving the technical problem, the engine unit for storing the detection information generated by analyzing the traffic introduced from the outside, receiving the detection information from the engine unit, A distributed processor configured to set a transmission path of the incoming traffic by matching detection information with a distributed processing process, and a destination of a transmission path set by the distributed processor, and a container unit configured to receive and process the incoming traffic from the distributed processor. do.

According to an embodiment of the present disclosure, the engine unit is an IDS / IPS engine, and the detection information may include at least one of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic. Can be.

According to an embodiment of the present disclosure, when it is determined that the traffic introduced from the outside is normal traffic based on the received detection information, the distributed processing process sets a first path as a transmission path and based on the received detection information. When it is determined that the traffic introduced from the outside is abnormal traffic, the second path may be set as a transmission path.

According to an embodiment of the present disclosure, the container unit may include a destination of the first route as the first group container and a destination of the second route as the second group container.

According to an embodiment of the present disclosure, the second group container may be deleted or initialized at predetermined time intervals.

According to an embodiment of the present disclosure, the apparatus may further include a communication unit downloading a base image for generating the container unit from an external server, wherein the distribution processor is configured to download the base image downloaded by the communication unit in the same format as the container unit. You can create and distribute it.

According to an embodiment of the present disclosure, the container unit may include a manager container that receives the inflowed traffic from the distributed processing unit, and a worker that receives the inflowed traffic from the manager container and performs processing corresponding to the purpose. It may further include a container.

On the other hand, operating method of the security server according to another embodiment of the present invention, the engine unit stores the detection information generated by analyzing the traffic flowing from the outside, the distributed processing unit receives the detection information from the engine unit, Matching the received detection information to a distributed processing process to establish a transmission path of the incoming traffic, and wherein the container unit, which is a destination of the transmission path set by the distributed processing unit, receives and processes the incoming traffic from the distributed processing unit. Steps.

According to an embodiment of the present disclosure, the engine unit is an IDS / IPS engine, and the detection information may include at least one of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic. Can be.

According to an embodiment of the present disclosure, the setting of the transmission path may include determining whether the traffic flowing from the outside is normal traffic based on the received detection information, and wherein the traffic flowing from the outside is normal traffic in the determining step. If it is determined that the first path as the transmission path and the step of determining that the traffic from the outside is determined to be abnormal traffic, the step may further comprise the step of setting the second path to the transmission path have.

According to an embodiment of the present disclosure, the container unit may include a destination of the first route as the first group container and a destination of the second route as the second group container.

According to an embodiment of the present disclosure, after the setting of the second path as a transmission path, the method may further include deleting or initializing the second group container at a predetermined time interval.

According to an embodiment of the present disclosure, the communication unit downloads a base image for generating the container unit from an external server, and the distribution processor generates the base image downloaded by the communication unit in the same format as the container unit. The method may further include distributing.

According to an embodiment of the present disclosure, the container unit may include a manager container that receives the inflowed traffic from the distributed processing unit, and a worker that receives the inflowed traffic from the manager container and performs processing corresponding to the purpose. It may further include a container.

According to the present invention as described above, since the computer program automatically determines the fiber direction of the heart according to the user's specific point selection, it is possible to eliminate the possibility of errors such as deviations and input mistakes according to the expert's viewpoint. It works.

In addition, since the fibrous direction of the heart can be accurately determined, there is an effect of accurately selecting a region to be subjected to a radiofrequency electrode catheter ablation procedure.

Effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a diagram showing the overall configuration included in the security server according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an engine unit forming and managing a separate detection information group inside detection information.
3 is a view showing an implementation of docker technology.
4 is a diagram illustrating a conventional virtual machine.
5 illustrates a container to which docker technology is applied.
6 is a view showing a detailed configuration of a container unit.
7 is a diagram illustrating a detailed configuration of a first group container.
8 is a diagram illustrating a state in which the communication unit generates and distributes the downloaded base image in the same format as the container unit.
9 is a flowchart illustrating representative steps of a method of operating a security server according to another embodiment of the present invention.
FIG. 10 is a diagram illustrating detailed steps included in step S920 in the flowchart illustrated in FIG. 9.
FIG. 11 is a diagram illustrating detailed steps included in step S930 in the flowchart illustrated in FIG. 9.
12 is a diagram illustrating a traffic processing flowchart when it is determined that traffic introduced from the outside is normal traffic.
FIG. 13 is a diagram illustrating a traffic processing flowchart when it is determined that traffic flowing from the outside is normal traffic.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms, and only the embodiments are intended to complete the disclosure of the present invention and provide general knowledge in the technical field to which the present invention belongs. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Unless otherwise defined, all terms used in the present specification (including technical and scientific terms) may be used as meanings that can be commonly understood by those skilled in the art. In addition, terms that are defined in a commonly used dictionary are not ideally or excessively interpreted unless they are specifically defined clearly.

Meanwhile, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase.

As used herein, “comprises” and / or “comprising” refers to a component, step, operation and / or element that is mentioned in the presence of one or more other components, steps, operations and / or elements. Or does not exclude additions.

1 is a diagram showing the overall configuration that the security server 100 according to an embodiment of the present invention.

However, this is only a preferred embodiment for achieving the object of the present invention, some components may be added or deleted as necessary, and the other configuration may also play a role that one configuration performs.

The security server 100 according to an embodiment of the present invention may include an engine unit 10, a distributed processing unit 20, a container unit 30, and a communication unit 40 as shown in FIG. 1, and the like. Although it may further include a processor (not shown), a network interface (not shown), memory (not shown), storage (not shown), and a data bus (not shown) connecting them required to implement the security server 100. For the convenience of explanation, it is not shown in FIG. 1.

The engine unit 10 stores detection information generated by analyzing traffic introduced from the outside.

Here, the external means all routes connected to the security server 100 and the network according to an embodiment of the present invention. Accordingly, the user of the route may include not only normal ordinary users but also malicious hackers. This is because the hacker also accesses the security server 100 according to an exemplary embodiment of the present invention as a user. Therefore, traffic from outside may also include traffic for malicious hackers as well as traffic for normal ordinary users.

On the other hand, the traffic is treated as a unit by the sender and the receiver in the process of transmitting data as well as the universal meaning of the amount of all communication and data transmitted to the security server 100 according to an embodiment of the present invention. It is the broadest concept that encompasses the meaning of packet, which is the aggregate that is transmitted. That is, the word traffic to be used in the following description may be replaced by a packet.

The engine unit 10 analyzes the traffic introduced from the outside, where the analysis is performed by various information possessed by the traffic, for example, a source IP, a source Mac, a destination IP, a destination Mac, and a signature name. It can be seen as a previous step for generating detection information by detecting information and attributes of the corresponding traffic.

Meanwhile, the engine unit 10 may be implemented as an IDS / IPS engine, and may not only generate new detection information but also download and store detection information through an external network. That is, the engine unit 10 may serve as a kind of database, and the detection information may be an external device such as an external server (not shown) that may be connected to the engine unit 10 itself or through the network with the engine unit 10. Can be stored in

The detection information generated by the engine unit 10 may include any one or more of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic, and the distributed processing unit 10 to be described later. It can include all of the various information that can be used to establish the transmission path of the traffic by matching the distributed processing process of the). Further, in generating the detection information, the engine unit 10 may generate at least one of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the traffic, and the detection information source IP for the specific traffic. One or more of the source Mac, destination IP, destination Mac, and signature name can be matched and merged. For example, if the source IP of the newly generated detection information of the engine unit is 218.237.65.1, the engine unit 10 matches the detection information having the source IP of 218.237.65.1 in the detection information for the specific traffic previously stored. Newly created detection information and previously stored detection information can be merged and stored. On the other hand, even if the source IP is the same destination IP may be different, in this case, the engine unit 10 may form a separate detection information group inside the detection information to manage for each different destination IP. For example, as shown in FIG. 2, detection information may be separately managed for each destination IP, such as 1-1 detection information 11 and 1-2 detection information 12, within the first detection information. Furthermore, the engine unit 10 may form and manage separate detection information groups not only when the destination IP described above is different, but also when the source Mac, destination Mac, and signature names are different. to be. That is, the engine unit 10 may form and manage a separate detection information group based on this information if any one information included in the newly generated detection information matches only one information included in the previously stored detection information. Can be.

Returning to the description of FIG. 1 again.

The distributed processing unit 20 receives the detection information from the engine unit 10, sets the transmission path of the incoming traffic by matching the received detection information with the distributed processing process.

The detection information received from the engine unit 10 includes not only the detection information newly generated by the engine unit 10, but also all of the detection information merged with previously stored detection information and detection information formed in a group, and according to one embodiment of the present invention. The administrator of the security server 100 according to an example may set to receive any one of the detection information or any one or more of the detection information, and set the priority to prioritize any of the detection information. You can also set to receive.

The distributed processing process is the most essential process performed by the distributed processing unit 20, and is a process of determining which transmission path to send traffic from outside according to detection information. More specifically, when the traffic from the outside is determined to be normal traffic based on the received detection information, the transmission path is set as the first path and when the traffic is determined as abnormal traffic, the distributed path is detected. According to the information, a transmission path setting rule or algorithm for determining which transmission path to send traffic from outside is set in advance.

 Here, the transmission path setting rule or algorithm may be set as follows, for example. If the detection information includes one or more of Origin IP, Origin Mac, Destination IP, Destination Mac, and Signature name, the first path, if the IP or Mac contains a specific array of numbers, include the specific policy name. In this case, the transmission path may be set as the second path. Such a transmission path setting rule or algorithm may be individually set by an administrator of the security server 100 according to an embodiment of the present disclosure, and may be updated or downloaded through a network at predetermined time intervals.

Further, the distributed processing unit 20 may be driven by an artificial intelligence bot by newly determining the transmission path of the externally introduced traffic according to the detection information, and continuously learning the transmission contents to achieve big data. In this case, the operator of the security server 100 according to an embodiment of the present invention will not need to set, update or download a transmission path setting rule or algorithm cumbersomely, and the security server 100 according to an embodiment of the present invention. ), And the performance will be improved continuously.

Meanwhile, the destination of the incoming traffic transmission path is the container unit 30 which will be described later, and the docker technique applied to the container unit 30 will be briefly described before describing the container unit 30.

Docker is an open source container virtual server technology, and the service operating environment as shown in FIG. 3 under the concept that the immutable infrastructure paradigm, more specifically, separates the host OS from the service operating environment and does not change the operating environment once set. After creating a base image and deploying it to a server, it is executed. When a service is updated, a new base image is created and distributed without changing the operating environment itself. Here, a container is a container that contains all the elements necessary to operate a service, and the elements in a container are not only open source software that is frequently used, but also programs of their own.

4 illustrates a conventional virtual machine, and FIG. 5 illustrates a container to which docker technology is applied. According to FIG. 5, a container to which docker technology is applied shares a host OS and an OS kernel. No guest OS is required. Therefore, there is an advantage of providing a light user environment, and does not require process scheduling itself to prevent duplication of functions between the host OS and the guest OS. In addition, containers with Docker technology do not virtualize CPUs, RAM, HDDs, and networks, operate on the same as the host OS by themselves, and can deploy multiple virtual machines simultaneously with one base image. It also has the advantage of being easy to use.

Returning to the description of FIG. 1 again.

The container unit 30 is a destination of the transmission path set by the distributed processing unit 20, and receives and processes the traffic flowing from the distributed processing unit 20.

The container unit 30 receives and processes the incoming traffic, and can be seen as a configuration that provides an actual service according to a user's request, and the detailed configuration of the container unit 30 is illustrated in FIG. 6.

The container unit 30 includes a first group container 31 and a second group container 32, and is illustrated as including the second group container 32 in FIG. 6, but this is illustrated for convenience of description. It is only an exemplary diagram, and of course, it may include an Nth group container (not shown, where N is a positive integer) according to the type of service.

The basic structure of the first group container 31 and the second group container 32 is similar, but there is a difference that the traffic received through the transmission path is different. In the description of the distributed processing unit 20, the first path is set as a transmission path when it is determined that the traffic is normal and the second path is set as a transmission path when it is determined that the traffic is abnormal. 31), and the destination of the second route is the second group container 32. That is, the first group container 31 receives and processes normal traffic, and the second group container 32 receives and processes abnormal traffic.

On the other hand, processing here means providing the service according to the request of the user as it is, which is also the second group container 32 for receiving and processing abnormal traffic. This is because if the traffic is not provided because of abnormal traffic, the hacker can detect it and try to bypass it in another way. In other words, if the second group container 32 that receives and processes abnormal traffic also provides the service as it is, the hacker considers that his or her purpose has been achieved and is unlikely to attempt an additional attack.

However, since the second group container 32 is also the same as the general group container, when receiving and processing abnormal traffic, the second group container 32 is infected with malware or ransomware, and adversely affects the entire security server 100 according to an embodiment of the present invention. Can be crazy In order to prevent this, the second group container 32 is initialized or deleted at a predetermined time interval. For example, the second group container 32 may be set to initialize or delete the second group container 32 at an interval of one hour. The group container 32 may be configured to receive and process abnormal traffic and to initialize or delete it as soon as the user's request is terminated.

7 illustrates a detailed configuration of the first group container 31, in which the first group container 31 receives a manager container 31-1 that receives the traffic flowing from the distributed processing unit 20. And one or more worker containers 31-2 that receive traffic from the manager container 31-1 and perform processing in accordance with the purpose.

In this case, the manager container 31-1 plays a role as a kind of control unit, and distributes the traffic to the worker container 31-2 according to a request of a user included in the traffic flowing from the distributed processing unit 20. . For example, when the first group container 31 includes worker containers a that provide a service for a request A, and worker containers b that provide a service for a B request, If the request is A, the manager container 31-1 receives the traffic and distributes the traffic to worker container a.

Meanwhile, although the first group container 31 is illustrated as including four worker containers 31-2 in FIG. 7, the worker group 31-1 may include a plurality of worker containers 31-1. Of course. In addition, although described based on the first group container 31, the second group container 32 may also have the same structure as the first group container 31.

Meanwhile, in the above description, the second group container 32 is deleted or initialized at predetermined time intervals, which can be regarded as removing one group container, and requires creation of a new group container that performs the same role. . This relates to docker technology, which will be described in detail below.

The communication unit 40 downloads a base image for generating the container unit 30 from an external server (not shown).

Here, the external server (not shown) may be a server to which docker technology is applicable, for example, a docker hub, and the downloaded base image is obtained by the user through the security server 100 according to an embodiment of the present invention. It should be reformed into a form that can provide the requested services. This may be performed by the distributed processing unit 20, and the distributed processing unit 20 may generate and distribute the base image downloaded by the communication unit 40 in the same format as the container unit 30.

8 shows a state in which the communication unit 40 creates and distributes the downloaded base image in the same format as the container unit 30. The downloaded base image is a base container, an installed package, and an uploaded image. It is distributed in a form including a file, which will be referred to as a first base image.

The first base image is used to create and distribute a second base image. The second base image is an image added with the bottommost “Editing” portion of the first base image. Editing provides a service requested by the user. Can be viewed as a modified and optimized part.

Meanwhile, the second base image may be used to generate and distribute the third base image in the same manner as described above. In this case, the editing part may be different according to the type of service requested by the user. However, since the basic process is the same as creating and distributing the second base image, a detailed description thereof will be omitted to avoid duplication.

In the above description, as the second group container 32 is deleted or initialized at predetermined time intervals, the distribution processor 20 distributes the generated base image to replace the second group container 32. For example, the distribution processor 20 may distribute the first base image to a position where the second group container 32 is deleted or initialized. In this case, the first base image may be different from the second group container 32. It should be of the same format. This is because the same type of service as the service provided by the second group container 32 must be provided.

Meanwhile, the first group container 31 may be configured to receive and process normal traffic, or may be deleted or initialized at regular time intervals as in the second group container 32, and accordingly, the distributed processing unit 20 may generate The base image may be distributed to replace the first group container 31. In this case, since the first group container 31 is configured to receive and process normal traffic, the backup group should be included in the base image in a state of backing up data that should be prevented from being deleted or initialized, such as log data on service provision history. something to do.

The security server 100 according to an embodiment of the present invention has been described so far. According to the present invention, the service according to the request is provided to the abnormal traffic introduced from the outside as it is, and the second group container 32 is deleted or initialized at a predetermined time interval, thereby turning the attention of the hacker connected for the attack. In addition, it can prevent the server or PC from being infected with malware or ransomware, and can prevent additional damage.

In addition, because the guest OS does not need to be installed, the processing speed is very fast, and since it does not virtualize CPU, RAM, disk, and network, it does not occupy physical resources and thus can be used lightly.

Furthermore, since the container unit 30 is generated and distributed based on the base image, hacking is not possible at all, and the container unit 30 is automatically generated by the distributed processing unit 20 according to the amount of traffic flowing from the outside. Uninterrupted service can be provided because it can be increased. In addition, in the case of a personal terminal, the container unit 30 can be connected to a network, and a program for providing a service is mounted on the container unit 30 and used, so that a vulnerability does not affect the host.

On the other hand, the security server 100 according to an embodiment of the present invention can be implemented by the operating method of the security server 100 including all the same technical features, it will be described with reference to Figures 9 to 13 below.

9 is a flowchart illustrating representative steps of a method of operating the security server 100 according to another embodiment of the present invention.

However, this is only a preferred embodiment in achieving the object of the present invention, of course, some steps may be added or deleted as necessary.

First, the engine unit 10 stores detection information generated by analyzing traffic introduced from the outside (S910).

The engine unit 10 may be implemented by an IDS / IPS engine, and the detection information may include any one or more of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic.

Thereafter, the distributed processing unit 20 receives detection information from the engine unit 10, sets the transmission path of the incoming traffic by matching the received detection information with the distributed processing process (S920).

Step S920 may be embodied in a detailed step as shown in FIG. 10. In operation S912, whether the traffic introduced from the outside is normal traffic based on the received detection information, and the traffic introduced from the outside in step S912. If it is determined that the normal traffic, the step of setting the first path to the transmission path (S914) and the step of setting the second path to the transmission path (S916) if the traffic introduced from the outside is determined to be abnormal traffic (S916) The method may further include a step (S918) of deleting or initializing the second group container 32 at a predetermined time interval after the step S916.

In this case, the container unit 30 may include a first group container 31 that is a destination of the first path and a second group container 32 that is a destination of the second path.

If the transmission path of the traffic has been set, the container unit 30 which is the destination of the transmission path set by the distributed processing unit 20 receives and processes the traffic introduced from the distributed processing unit 20 (S930).

In this case, the container unit 30 receives the traffic from the manager container 31-1 and the manager container 31-1 that receives the traffic flowing from the distributed processing unit 20, and performs the processing according to the purpose. The worker container 31-2 may further include.

Meanwhile, the step S930 may be embodied in detailed steps as shown in FIG. 11, and the communication unit 40 downloads the base image for generating the container unit 30 from an external server (not shown) (S932). And generating and distributing the base image downloaded by the communication unit 40 in the same format as that of the container unit 40 (S934).

FIG. 12 is a flowchart illustrating a traffic processing when the traffic introduced from the outside is determined to be normal traffic in step S912, and FIG. 13 is a flowchart illustrating the traffic processing when the traffic introduced from the outside is determined to be normal traffic in step S912. In the case of normal traffic, the traffic is processed to the first group container 31 and the abnormal traffic to the second group container 32.

Although not described in detail in order to avoid duplication, the operating method of the security server 100 according to another embodiment of the present invention has the same technical features as the security server 100 according to an embodiment of the present invention. Of course, all of the contents described with reference to FIGS. 1 to 8 may be applied.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

100: security server
10: engine part
20: distributed processing unit
30: container part
31: First group container
31-1: Manager Container
31-2: Walker container
32: second group container
40: communication unit

Claims (14)

An engine unit which stores detection information generated by analyzing traffic introduced from the outside;
A distributed processing unit which receives detection information from the engine unit, and sets the transmission path of the incoming traffic by matching the received detection information with a distributed processing process; And
A container unit which is a destination of a transmission path set by the distributed processing unit, and receives and processes the incoming traffic from the distributed processing unit;
In a security server comprising:
The distributed processing process,
If the traffic introduced from the outside is determined to be normal traffic based on the received detection information, set a first path as a transmission path,
When the traffic introduced from the outside is determined to be abnormal traffic by the received detection information, set a second path as a transmission path,
The destination of the first route is a first group container included in the container unit,
The destination of the second route is a second group container included in the container unit.
Security server. The method of claim 1,
The engine unit,
IDS / IPS engine,
The detection information,
At least one of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic,
Security server. delete delete The method of claim 1,
The second group container,
Deleted or reset at regular intervals,
Security server. The method of claim 1,
A communication unit which downloads a base image for generating the container unit from an external server;
Include more,
The dispersion processing unit,
To generate and distribute the downloaded base image in the same format as the container,
Security server. The method of claim 1,
The container unit,
A manager container for receiving the incoming traffic from the distributed processing unit; And
A worker container configured to receive the incoming traffic from the manager container and perform a process corresponding to the purpose;
Further comprising,
Security server. In the operating method of the security server including a communication unit, an engine unit, a distributed processing unit and a container unit,
Storing, by the engine unit, detection information generated by analyzing traffic introduced from the outside;
Receiving, by the distributed processor, detection information from the engine unit, and matching the received detection information with a distributed processing process to establish a transmission path of the inflowed traffic; And
Receiving and processing the incoming traffic from the distributed processor by the container, which is a destination of a transmission path set by the distributed processor;
In the operating method of the security server comprising a,
Setting the transmission path,
Determining whether the traffic introduced from the outside is normal traffic based on the received detection information;
Setting the first path as a transmission path when the traffic from the outside is determined to be normal traffic in the determining step; And
Setting a second path as a transmission path when it is determined that the traffic introduced from the outside is abnormal traffic in the determining step;
More,
The destination of the first route is a first group container included in the container unit,
The destination of the second route is a second group container included in the container unit.
How security servers work. The method of claim 8,
The engine unit,
IDS / IPS engine,
The detection information,
At least one of a source IP, a source Mac, a destination IP, a destination Mac, and a signature name of the incoming traffic,
How security servers work. delete delete The method of claim 8,
After setting the second path as a transmission path,
Deleting or initializing the second group container at regular time intervals;
Further comprising,
How security servers work. The method of claim 8,
Downloading, by the communication unit, a base image for generating the container unit from an external server; And
Generating and distributing, by the distributed processor, the base image downloaded by the communication unit in the same format as that of the container unit;
Further comprising,
How security servers work. The method of claim 8,
The container unit,
A manager container for receiving the incoming traffic from the distributed processing unit; And
A worker container configured to receive the incoming traffic from the manager container and perform a process corresponding to the purpose;
Further comprising,
How security servers work.

Images