KR102239759B1 - Method of detecting unknown threats using correlation of external threat intelligence with the packet information detected by IDSP for internal networks - Google Patents

Abstract

The present invention can detect threats unknown to an internal intrusion detection and prevention system by generating threat data using together event of internal intrusion detection and prevention system and information from external threat intelligence, thereby substantially improving the security of a network. The method comprises a step of parsing the event of the internal threat detection and prevention system, generating detection rule ID, and generating IDPS event data including detection rule ID and IDPS packet data identified by detection rule ID.

Description

{Method of detecting unknown threats using correlation of external threat intelligence with the packet information detected by IDSP for internal networks}

The present invention relates to the security of computer networks, and in particular to a method for detecting threats to unknown networks.

In the face of the 4th industrial revolution, the importance of computer networks is increasing more and more. People easily use desktops, laptops, tablets, or smartphones to access networks such as the Internet or intranet to obtain or provide information.

Networks such as the Internet and Intranet are widely used as infrastructure in various fields such as socio-cultural economy, but on the contrary, the security vulnerability of the Internet causes new social confusion factors such as paralysis of cyber culture and deterioration of the online trust base

Various technologies are being developed to prevent threats by malicious users. One of them is the Intrusion Detection/Prevention System (IDPS), an internal security solution. The internal intrusion detection/prevention system detects and blocks threats based on already established rules. The other is external threat intelligence. External threat intelligence refers to a service that collects, shares, and provides threat information from various sources. In other words, it means responding to the threat by receiving information (IP, URL, Domain, Hash, YARA) about cyber threats that occur outside the organization, not from personnel or systems inside the organization.

Using an internal intrusion detection/prevention system and external threat intelligence together seems to provide very reasonable and high security at a glance. However, in reality, simply matching the cyber threat information (IP, URL, Domain, Hash, YARA) provided by the external threat intelligence with the events of the internal intrusion detection/prevention system is often not exactly the same. There is no contribution to security improvement.

The inventors of the present invention came to complete the present invention regarding an apparatus and method for detecting an unknown threat with improved security by using both an internal intrusion detection/prevention system and an external threat intelligence after deep consideration of this problem.

The simple matching of the event of the intrusion detection/prevention system and the information of the external threat intelligence does not actually contribute to the improvement of security because the two do not match accurately. Accordingly, an object of the present invention is a method that can substantially improve security by analyzing packet information of an event of an internal intrusion detection/prevention system with a YARA detection engine using YARA signature included in information of external threat intelligence based on YARA. To provide.

Meanwhile, other objects that are not specified of the present invention will be additionally considered within a range that can be easily deduced from the detailed description and effects thereof below.

In order to achieve the above task, the detection method of an unknown threat inside the present invention uses an internal threat detection and prevention system (IDPS) and external threat intelligence, and specifically parses the events of the internal threat detection and prevention system. And generating a detection rule ID to generate IDPS event data including a detection ID and IDPS packet data identified by the detection rule ID; Parsing the external threat intelligence transmitted from the external threat intelligence and generating an external threat intelligence IoC including a YARA Indicator of Compromise (IoC) having a YARA signature; And evaluating the risk, wherein the step of evaluating the risk is performed including matching the IDPS packet data and the YARA signature using a YARA detection engine, and the matching result of the IDPS packet data and the YARA signature is In the case of positive, it is determined that there is a risk, and threat data is generated by using the YARA IoC of the YARA signature matched with the IDPS event data corresponding to the detection rule ID of the matched IDPS packet data.

In one embodiment, IDPS event data is generated with Remote IP and Vulnerability Standard Code (CVE) severity, external threat intelligence IoC is generated with IP IoC, and YARA IoC is generated with YARA severity further, The threat data includes information on remote IP and CVE severity of IDPS event data and information on YARA severity of YARA IoC, and the step of evaluating the risk includes: (a) matching IDPS packet data and YARA signature. step; (b) matching the remote IP and IP IoC of the threat data; (c) checking whether the YARA severity of the threat data is high; And (d) determining whether the threat data has a high CVE severity; and it is determined that the risk is higher as the number of positive steps in steps (a) to (d) increases.

In an embodiment, after performing the step of evaluating the risk, the risk data and the white list are matched, and the risk data corresponding to the white list is excluded from those having a risk.

By using the problem solving means of the present invention as described above, the present invention creates a threat database by using the events of the internal intrusion detection and prevention system and information of external threat intelligence together, so that the internal intrusion detection/prevention system detects unknown threats inside It can, and accordingly, the security of the network is substantially improved.

In addition, by removing the threat data related to the white list from the created threat database, the security of the network can be improved more reliably.

On the other hand, even if it is an effect not explicitly mentioned herein, it is added that the effect described in the following specification and its provisional effect expected by the technical features of the present invention are treated as described in the specification of the present invention.

1 is a schematic structural diagram of an unknown threat detection apparatus according to an embodiment of the present invention.
FIG. 2 is a schematic flowchart of a method for detecting an unknown threat within according to another embodiment of the present invention.
The accompanying drawings are exemplified by reference for an understanding of the technical idea of the present invention, and the scope of the present invention is not limited thereto.

In describing the present invention, when it is determined that the subject matter of the present invention may be unnecessarily obscured as matters that are apparent to those skilled in the art for related known functions, detailed descriptions will be omitted.

1 is a schematic structural diagram of an unknown threat detection apparatus 100 according to an embodiment of the present invention. In this document, an unknown threat is a threat that is unknown to the network's internal intrusion detection/prevention system (IDPS: Intrusion Detection/Prevention System), which cannot be detected and prevented by the internal intrusion detection/prevention system alone. do.

The apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention may be implemented in various forms.

It can be implemented in software using a computer-based device, or it can be implemented by configuring dedicated hardware. The threat detection device 100 of the present invention can be implemented using a Field Programmable Gate Array (FPGA). FPGAs are programmable semiconductors, and have a feature that allows users to implement hardware designed as needed with application specific integrated circuits (ASICs) that cannot be modified once they are manufactured. Since it is implemented as a hardware semiconductor by a logic device, it has the advantage of being much faster than software implementation. Meanwhile, the apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention may be manufactured based on a big data engine.

The apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention includes an IDPS parser 10, an external threat intelligence parser 20, and a file threat analyzer 30. In addition, it may be configured to further include an Indicator of Compromise (IoC) threat analyzer 40 and a risk evaluator 50. An operation process and result of the detection device 100 for an unknown threat according to an embodiment of the present invention may be provided through a user interface 60 such as a display device.

The IDPS parser 10 generates IDPS data 11 by parsing an event (or log) of an internal threat detection and prevention system transmitted from the internal threat detection and prevention system 1 as a source. The IDPS data 11 is composed of IDPS event data 12 and IDPS packet data 13. When the IDPS parser 10 generates the IDPS event data 12, a detection rule ID is generated so that the IDPS event data 12 can be identified, and the IDPS event data 12 is detected by the ID and information on the event. Is generated as IDPS event data (12). Information about the event includes Host IP(HIP), Remote IP(RIS), Ruld Identifier(RID), IDPS Rule category[Type](RT), IDPS rule severity(RS), number of count(#C), protocol And it means at least any one selected from Common Vulnerability Exposure (CVE). Meanwhile, IDPS packet data 13 based on the generated detection rule ID is generated. That is, the IDPS packet data 13 includes a detection rule ID for a specific event and packet data of the specific event.

Since the internal intrusion detection and prevention system 10 has a function of detecting or blocking a threat based on a previously stored threat-related rule, the internal intrusion detection and prevention system 10 detects or blocks unknown threats. Cannot be blocked. The apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention solves this problem by using the external threat intelligence source 2. External threat intelligence source (2) refers to an external threat intelligence sharing system, for example, STIX, CybOX, MEAC, YARA, OpenIoC, etc.

The external threat intelligence parser 20 generates an external threat intelligence IoC 21 by parsing the external threat intelligence transmitted from the external threat intelligence source 2. In particular, the detection device 100 of an unknown threat inside of the present invention may use YARA-based external threat intelligence among external threat intelligence. In this case, the external threat intelligence parser 20 is from the external threat intelligence source 2 The external threat intelligence IoC 21 generated by parsing the transmitted external threat intelligence may have a YARA IoC 22 including a YARA signature and a YARA severity. Meanwhile, YARA IoC(22), which is generated when generating YARA IoC(22), consists of one YARA rule within 8 bytes through rule normalization. (Child YARA Identifier) field value can be configured. This takes into account that the IDPS packet data 13 is generated based on 8 bytes. That is, it is preferable that the byte of the generated YARA rule is smaller than the byte of the IDPS packet data. YARA IoC (22) includes YARA signature [byte string] (SIG) and YARA severity (YS), and furthermore, at least one of YARA Identifier (YID), Child YARA Identifier (CYID), and YARA category[type] (YT) It may further include more. In addition, the external threat intelligence parser 20 generates an IP IoC 23 and a file IoC 24 in addition to the YARA IoC 22 from the external threat intelligence source 2. The IP IoC 23 includes Remote IP (RIP) and Protocol, and the file IoC 24 includes Hash (MD5).

The file threat analyzer 30 generates the threat data 31 using the IDPS packet data 13 and the YARA IoC 22. The file threat analyzer 30 is equipped with a YARA detection engine. Using the YARA detection engine, the IDPS packet data 13 and the YARA signature of the YARA IoC 22 are matched. If the matched result is positive, the threat data 31 using the IDPS event data 12 corresponding to the detection rule ID of the matched IDPS packet data 13 and the YARA IoC 22 of the matched YARA signature. ). By using IDPS event data (12) and YARA IoC (22) in this way, the threat data (31) is Host IP [Internal] (HIP), Remote IP (RIP), YARA category [Type] (YT), IDPS Rule category. [Type] (RT), YARA severity (YS), IDPS Rule severity (RS), Final Severity (FS), and Common Vulnerability Exposure (CVE). Accordingly, the detection device 100 for an unknown threat inside according to an embodiment of the present invention is provided from the external threat intelligence source 2 even in the case of a threat that is not stored as a rule in the internal threat detection and prevention system (IDPS). Intrusion detection and prevention is possible using the received YARA IoC (22).

The apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention may further improve security against a threat by using the IoC threat analyzer 40. To this end, the IoC threat analyzer 40 matches the threat data 31 with the IP IoC 23 of the external threat intelligence IoC 21 and the file IoC 24. The IoC threat analyzer (40) is a risk evaluator (50) if the result of matching the IP IoC (23) of the threat data (31) and the external threat intelligence IoC (21) with the file IoC (24) is positive. And transmit the information.

Meanwhile, the apparatus 100 for detecting an unknown threat inside according to an embodiment of the present invention uses the white list 41 to remove traffic determined in advance as having no threat from the threat data 31. Whitelist means a safe IoC list. The white list 41 is composed of the IP white list 42 and the file white list 43, and the white list 41 and the threat data 31 are matched, and the matched result is positive. Data corresponding to the matched IP or file is removed from the threat data 31.

The risk evaluator 50 divides the risk of the finally evaluated traffic into several levels and provides it to the user through the user interface 60. At this time, several steps?? The grade will be described in detail in the method for detecting unknown threats in the present invention, which will be described later.

The detection device 100 for an unknown threat inside according to an embodiment of the present invention can contribute to substantial security improvement against unknown threats inside by using YARA-based external threat intelligence and an internal threat detection and prevention system together. have.

FIG. 2 is a schematic flowchart of a method for detecting an unknown threat inside according to another embodiment of the present invention. A method for detecting an unknown threat inside according to another embodiment of the present invention may be driven by the detection device for an unknown threat inside according to the embodiment of the present invention.

First, a step (S10) of parsing an event of an internal threat detection and prevention system is performed. In this step, IDPS event data and IDPS packet data are generated by parsing the events of the internal threat detection and prevention system. When generating IDPS event data, a detection rule ID for the event is generated, and other information about the event is stored together. The IDPS packet data is stored together with the packet data of the event and the generated detection rule ID so as to be identifiable by the generated detection rule ID. IDPS event data includes detection rule ID, Host IP(HIP), Remote IP(RIS), Ruld Identifier(RID), IDPS Rule category[Type](RT), IDPS rule severity(RS), number of count(#C) , protocol and at least one selected from Common Vulnerability Exposure (CVE).

Next, a step (S20) of parsing the external threat intelligence is performed together with step S10. In this step, external threat intelligence is parsed to generate external threat intelligence IoC including YARA IoC, IP IoC, and file IoC. At this time, YARA IoC consists of one YARA rule within 8 bytes through rule normalization, but if the YARA rule exceeds 8 bytes, it can additionally create a YARA rule and configure the CYID (Child YARA Identifier) field value. YARA IoC includes YARA signature [byte string] (SIG) and YARA severity (YS), and further includes at least one of YARA Identifier (YID), Child YARA Identifier (CYID), and YARA category[type] (YT). Can include. Meanwhile, IP IoC includes Remote IP (RIP) and Protocol, and file IoC includes Hash (MD5).

Next, a step (S30) of evaluating the risk is performed. The step of evaluating the risk (S30) may be composed of at least one sub-step, and the risk may be quantitatively evaluated by having a plurality of steps.

First, the step (S31) of matching the IDPS packet data and the YARA signature may be performed. The YARA detection engine may be used to match the IDPS packet data and the YARA signature. If the result of matching IDPS packet data and YARA signature is positive, it is determined that there is a risk. Meanwhile, the threat data is generated by using the IDPS event data corresponding to the detection rule ID of the matched IDPS packet data and the YARA IoC of the matched YARA signature. If it doesn't match, it detects other threats because there is no risk.

If the YARA rule of the YARA IoC exceeds 8 bytes, the CYID is configured as a field value. In that case, a step (S32) of matching the IDPS packet data and the YARA signature (CYID) is performed.

If the result of matching IDPS packet data and YARA signature (CYID) with IDPS event data including detection rule ID and information on the event and IDPS packet data based on the detection rule ID is positive, the risk is It increases, and if it is negative, the step of evaluating the risk (S30) is terminated.

Next, the step of matching the IP IoC and the remote IP of the threat agent (S33), confirming whether the YARA severity of the threat data is high (S34), and confirming whether the CVE severity of the risk data is high (High). Step S35 is performed. If each step is positive, the risk increases, and if the step is negative, the step S30 of evaluating the risk is terminated. In the above-described steps S31 to S35, the greater the number of positive steps, the higher the risk is determined.

After performing the step S30 of evaluating the risk, the step S40 of matching the risk data and the white list is performed. At this stage, the whitelisted risk data is excluded from those with risk.

For threat data not excluded from the white list, the risk is calculated (S50). At this time, a higher risk score is given as there are more positive steps in each sub-step constituting the risk evaluation step S30.

As described above, the present invention can detect unknown threats in the internal intrusion detection and prevention system by generating threat data by using the event of the internal intrusion detection and prevention system together with information of the external threat intelligence, and thus the security of the network. The performance is substantially improved.

For reference, the method for detecting an unknown threat inside according to an embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software.

Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks, and ROM, RAM, A hardware device specially configured to store and execute program instructions such as flash memory or the like may be included. Examples of program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

The scope of protection of the invention is not limited to the description and expression of the embodiments explicitly described above. In addition, it is added once again that the scope of protection of the present invention may not be limited due to obvious changes or substitutions in the technical field to which the present invention pertains.

Claims (4)

As a detection method of unknown threats in the internal threat detection and prevention system using the internal threat detection and prevention system (IDPS) and external threat intelligence:
Parsing an event of an internal threat detection and prevention system, generating a detection rule ID to generate IDPS event data including a detection rule ID and IDPS packet data identified by the detection rule ID;
Generating an external threat intelligence IoC including a YARA indicator of compromise (YARA IoC) having a YARA signature by parsing the external threat intelligence transmitted from the external threat intelligence; And
Including; evaluating the risk,
The step of evaluating the risk is performed including the step of matching the IDPS packet data and the YARA signature using a YARA detection engine, and if the matching result of the IDPS packet data and the YARA signature is positive, there is a risk. Decide,
Threat data is generated by using the IDPS event data corresponding to the detection rule ID of the matched IDPS packet data and the YARA IoC of the matched YARA signature,
In the step of generating the external threat intelligence IoC, the YARA IoC generates a YARA rule through rule normalization, but the byte of the generated YARA rule is equal to or smaller than the byte of the IDPS packet data. How to detect unknown threats.
The method of claim 1,
IDPS event data is generated with Remote IP and Vulnerability Standard Code (CVE) severity, and external threat intelligence IoC is created with IP IoC, and YARA IoC is created with YARA severity.
The threat data includes information on remote IP and CVE severity of IDPS event data and information on YARA severity of YARA IoC,
The step of evaluating the risk,
(a) matching IDPS packet data and YARA signature;
(b) matching the remote IP and IP IoC of the threat data;
(c) determining whether the YARA severity of the threat data is high; And
(d) confirming whether the threat data has a high CVE severity; and
A method for detecting an unknown internal threat in which it is determined that the greater the number of positive steps in the steps (a) to (d), the higher the risk.
The method of claim 1,
After performing the step of evaluating the risk, the risk data and the white list are matched, and the risk data corresponding to the white list is excluded from the risk level. The method of claim 1,
If the byte of the generated YARA rule exceeds the byte of the IDPS packet data, additionally create a YARA rule and configure the CYID (Child YARA Identifier) field value,
In the step of evaluating the risk, IDPS packet data and YARA signature (CYID) are matched.

Images