KR20110070161A - Behavior pattern modelling system of network traffic for botnet detecting and behavior pattern modelling method of network traffic for botnet detecting - Google Patents

Abstract

PURPOSE: A behavior pattern modeling system of network traffic is provided to perform patterning according to a specific item about a corresponding protocol by distinguishing a protocol of the network traffic. CONSTITUTION: A botnet traffic collecting sensor collects traffic in a network. The botnet traffic collecting sensor classifies the collected traffic by destination. Based on the collected botnet traffic, a botnet detection system detects the botnet. A botnet control/security management system transmits and receives various kinds of setup and status information to a control system.

Description

BEHAVIOR PATTERN MODELLING SYSTEM OF NETWORK TRAFFIC FOR BOTNET DETECTING AND BEHAVIOR PATTERN MODELLING METHOD OF NETWORK TRAFFIC FOR BOTNET DETECTING}

The present invention relates to a behavior pattern modeling system of network traffic for botnet detection and a behavior pattern modeling method of network traffic for botnet detection. The present invention relates to a protocol for classifying network traffic based on a destination for the collected network traffic, and to a corresponding protocol. Network traffic behavior pattern modeling system for botnet detection that can classify communication behaviors for each client by modeling the network behavior by performing patterning according to detailed items and network traffic behavior pattern modeling method for botnet detection It is about.

Bot is short for robot and means a personal computer (PC) infected with malicious intention software. And a botnet is a type of network in which many computers infected with these bots are connected. The botnet is remotely controlled by the Bot Master, which is used for various malicious activities such as DDoS attacks, personal information collection, phishing, malware distribution, and spam mailing. These botnets can be classified according to the protocol used by the botnet.

Attacks through these botnets continue to increase, and methods are increasingly diversified. Unlike the case of causing Internet service failure through DDoS, there are bots that cause personal system failure or illegally acquire personal information, and illegal user information such as ID / Password and financial information. Increasingly, cybercrime abuse is becoming more common. In addition, while the existing hacking attacks show the hacker's own ability or compete with the community, the botnet shows the hacker group intensively exploiting and cooperating for the purpose of financial gain.

However, botnets are becoming more sophisticated to detect and circumvent using advanced technologies such as periodic updates, execution compression techniques, coder changes, and command channel encryption. In addition, the source of the botnet is open to thousands of variants, and the bot code can be easily generated or controlled through the user interface, making it possible for people without specialized knowledge or skills to create and use the botnet. The problem is serious. The bot zombies that make up these botnets are distributed in Internet service provider networks all over the world, and bots that control bot zombies can be migrated to other networks.

Therefore, the seriousness of the botnet is well known and many studies are being made. However, it is difficult to determine the overall configuration and distribution of botnets by detecting only the botnets of a specific internet service provider network, and there is an urgent need for a way to easily detect botnets due to many variants.

An object of the present invention is to provide a behavior pattern modeling system of network traffic for botnet detection that can effectively detect botnets and a behavior pattern modeling method of network traffic for botnet detection.

In order to achieve the above object, the present invention includes a botnet traffic collection sensor that collects traffic in the network and classifies them by destination, and a botnet detection system that detects a botnet based on the botnet traffic collected by the botnet traffic collection sensor. Provided is a behavior pattern modeling system of network traffic for botnet detection. The botnet traffic collecting sensor may classify the information received from the traffic information collecting / classifying module and the traffic information collecting / classifying module to collect the traffic by capturing packets of the monitoring network according to a collection policy using a packet capture tool. Traffic information management module for receiving and parsing traffic information and processing group data, and storing / managing the traffic information in a database, and transmitting the traffic information parsed by the traffic information management module to a transmission header and transmission data. The traffic information transmission module for dividing the data into packages and transmitting the data through the transmission channel, and the traffic information collection / classification module and the traffic information management module for classifying tool, traffic information management tool, and setting / status information of data transmission cycle information. And a sensor policy management module that sends to the traffic information transmission module. It is. The traffic information management module classifies the pattern of the collected network traffic into a transmission control protocol (TCP) and a user datagram protocol (UDP). In addition, the traffic information management module uses the Transmission Control Protocol (TCP) as a HyperText Transport Protocol (HTTP), a Simple Mail Transfer Protocol (SMTP), and the hyper. It is classified as a hypertext communication protocol other than the text communication protocol and the simple e-mail transmission protocol. The hypertext communication protocol is classified into "request" for requesting a page and "Respones" for which the server responds to a user's request. . The " request " refers to a host portion, which is a domain of a target for requesting a web server resource, a page having information on a specific page desired by the host, and information about a site transfer step that is currently connected. It is classified as a referer part that it has. The Simple Mail Transfer Protocol (SMTP) uses the Simple Mail Transfer Protocol communication itself as pattern data, and the User Datagram Protocol (UDP) patterns User Datagram Protocol communication itself. Judging from the data. The traffic information management module classifies the user datagram protocol into a domain name server (DNS) and a domain name server other than the domain name server.

In addition, the present invention includes the steps of collecting traffic, classifying the protocol of the collected traffic, and modeling the behavior for the classified traffic. Provides a pattern modeling method. The classifying the protocol of the collected traffic may include configuring the collected traffic into a client set for each destination, and extracting feature elements of the traffic configured as the client set for each destination. Configuring the collected traffic into a destination-specific client set includes storing an access record of the collected traffic, and configuring the collected traffic into a destination-specific client set.

The present invention can classify the network behavior by classifying the network traffic based on the destination for the collected network traffic and performing patterning according to the detailed items for the corresponding protocol. A behavior pattern modeling system of network traffic for botnet detection and a behavior pattern modeling method of network traffic for botnet detection can be provided.

In addition, the present invention models the network behavior, that is, by analyzing the network-based behavior pattern botnet detection that can classify the download and upload, spam server and command control server for the servers estimated to be C & C in the detected botnet group It is possible to provide a behavior pattern modeling system of network traffic and a behavior pattern modeling method of network traffic for botnet detection.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

It will be apparent to those skilled in the art that the present invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, It is provided to let you know. Like reference numerals in the drawings refer to like elements.

1 is a conceptual diagram of a behavior pattern modeling system of network traffic for botnet detection according to the present invention, and FIG. 2 is a block diagram of a behavior pattern modeling system of network traffic for botnet detection according to the present invention. 3 is a conceptual diagram of a botnet traffic collection sensor of a behavior pattern modeling system of network traffic for botnet detection according to the present invention, and FIG. 4 is a conceptual diagram of a traffic information collection module of a behavior pattern modeling system of network traffic for botnet detection according to the present invention. to be. 5 is a TCP connection pattern modeling diagram of the behavior pattern modeling system of network traffic for botnet detection according to the present invention, and FIG. 6 is a UDP connection pattern modeling of the behavior pattern modeling system of network traffic for botnet detection according to the present invention. It is a block diagram.

In the network traffic behavior pattern modeling system for botnet detection according to the present invention, as shown in FIGS. 1 and 2, a botnet detecting a botnet based on the botnet traffic collecting sensor and the botnet traffic collected by the botnet traffic collecting sensor. Detection system.

The botnet traffic collection sensor is for collecting traffic of the corresponding internet service provider network for botnet detection. As shown in FIG. 3, the botnet traffic collection sensor, a traffic information management module, a traffic information management module, a traffic information transmission module, and a sensor policy are provided. Contains a management module.

The traffic information collection module collects traffic by capturing packets of the monitoring network according to a collection policy using a packet capture tool, as shown in FIG. 4. The collected traffic information is stored in the temporary storage of the traffic information storage, and the collected information stored in the temporary storage is processed again by the traffic information management module.

The traffic information management module classifies the information received from the traffic information collection module, receives and parses the traffic information, and processes the grouped behavior information, that is, group data and peer bot information, and stores the traffic information on the database. Store / manage in. In this case, classifying and grouping traffic according to a pattern may be performed as follows.

Table 1 shows network traffic pattern data of a behavior pattern modeling system of network traffic for botnet detection according to the present invention.

 Transmission Control Protocol (TCP), which can communicate, and User Datagram Protocol (UDP), which transfers data unilaterally when exchanging information with each other. Classify as) In addition, referring to Tables 1 and 5, TCP is referred to as the HyperText Transport Protocol (HTTP) (hereinafter referred to as HTTP) and the Simple Mail Transfer Protocol (SMTP) as referred to below. Classified as other HTTP (Nomal). HTTP classifies "request" for requesting a page and "Respones" for which the server responds to a user's request. At this time, SMTP uses itself as the pattern data, and for other TCP traffic, TCP communication itself is determined as the pattern data. Further, referring to Table 1 and Fig. 6, UDP is classified into DNS and other DNS (Nomal). At this time, for UDP traffic, UDP communication itself is determined as pattern data.

Table 2 shows the connection pattern modeling criteria of the behavior pattern modeling system of the network traffic for botnet detection according to the present invention.

Referring to Table 2, the present invention classifies the protocols classified in Table 1 according to network traffic patterns in detail. In addition, according to a large classification, a fixed display such as T1, T2, U1, and the like, and a subpattern of subdivision accordingly are expressed. For details on the HTTP "Request" of TCP, the Host part, which is the domain of the web server resource request, the page containing information on the specific page desired by the host, and the current site. There is a referrer section that contains information about the steps before connecting, and it uses this to pattern traffic for HTTP "Requests". In addition, there are three data fields including a Host ID, a Page ID, and a referrer. For TCP's HTTP "Respones", pattern the traffic using the response code for that server. Pattern DNS query traffic by domain name for DNS query of UDP, and pattern traffic using IP address in response to DNS answer of UDP.

Table 3 is a pattern element data table for a detailed classification of the behavior pattern modeling system of network traffic for botnet detection according to the present invention.

ID data One www.naver.com 2 www.daum.net ·
·
· ·
·
·

Referring to Table 3, the host domain data of the HTTP connection and the domain data of the DNS query are likely to overlap, so they share a table. In addition, the host list is inserted as essential data by the HTTP request, and the domain name is stored. Domain list is the data included in the query for DNS query and the name of the domain to be queried is stored.

Table 4 shows a page list of a network traffic behavior pattern modeling system for botnet detection according to the present invention.

ID data One index.html 2 download.php ·
·
· ·
·
·

Referring to Table 4, the page list is represented by an HTTP request, and a file name indicating a detail page for requesting which server resource to use in the corresponding domain (host) is stored.

Table 5 shows a referrer list of the behavior pattern modeling system of network traffic for botnet detection according to the present invention.

ID data One http://search.naver.com/search.naver .. 2 http://www.goggle.com/search?hl=en& .. ·
·
· ·
·
·

Referring to Table 5, the referrer list is information that can be used to determine which link the performing object is followed before visiting the current page for the HTTP request, and is referred to as a Uniform Resource Locator (URL). Information is stored.

Table 6 shows a status code list of the behavior pattern modeling system of network traffic for botnet detection according to the present invention.

ID data One 1xx (information message) 2 2xx (success) 3 ... 3xx (Redirect) 4 4xx (client error) 5 5xx (server error)

Referring to Table 6, the status code is pattern data for the HTTP response, and is a response code indicating how the corresponding server handled the user's web server resource request. In addition, the status code can know the service status of the server as a response code, but there are various response codes, but this embodiment illustrates that the first code is stored as the pattern data only for the first one digit from three digits.

Table 7 shows a query IP list of the behavior pattern modeling system of network traffic for botnet detection according to the present invention.

ID data One xxx.xxx.xxx.xxx 2 xxx.xxx.xxx.xxx ·
·
· ·
·
·

Referring to Table 7, the query IP list is a response to a DNS query, that is, data about Answer traffic patterns, and stores information of IPs for the queried domains.

The present invention can model behavior patterns of network traffic using the indications and IDs described above. For example, "T1.2.1" refers to the act of entering the address directly to access the next time, and "T1.1.2.2" refers to the act of clicking on Naver after searching on Google. In addition, "T2.3" means a redirection connection, "T2.5" means a server connection error.

Meanwhile, the traffic information transmission module divides the traffic information parsed by the traffic information management module into a transmission header and transmission data, and then packages the data and transmits the data to the botnet detection system through a transmission channel.

The sensor policy management module transmits the setting / status information of the classification tool, the traffic information management tool, and the data transmission period information to the traffic information collection module, the traffic information management module, and the traffic information transmission module.

The botnet detection system is installed in an internet service provider network and detects a botnet operating in the corresponding internet service provider network based on the traffic information collected by the traffic collection sensor. One or more such botnet detection systems may exist in the Internet service provider network.

The botnet control / security management system sends and receives various settings and status information with the control system, receives group behavior information and peer bot information about the botnet from the botnet traffic collection sensor, classifies the traffic, stores it in the database after configuration and behavior analysis. do. In addition, the configuration and behavior analysis information stored in the database is transmitted back to the control system.

As described above, the present invention classifies the network activity by classifying the communication activity for each client by performing protocol classification of the network traffic on the basis of the destination for the collected network traffic, and performing patterning according to the detailed items for the corresponding protocol. It is possible to provide a behavior pattern modeling system of network traffic for botnet detection that can be modeled. In addition, the present invention models the network behavior, that is, by analyzing the network-based behavior pattern botnet detection that can classify the download and upload, spam server and command control server for the servers estimated to be C & C in the detected botnet group It can provide a behavior pattern modeling system of network traffic for.

Next, a behavior pattern modeling method of network traffic for botnet detection according to the present invention will be described with reference to the accompanying drawings. In the following description, the description overlapping with the description of the behavior pattern modeling system of the network traffic for botnet detection according to the present invention will be omitted or briefly described.

7 is a flowchart illustrating a behavior pattern modeling method of network traffic for botnet detection according to the present invention.

In the behavior pattern modeling method of network traffic for botnet detection according to the present invention, as shown in FIG. 7, the traffic collecting step S ₁ , the protocol classification step S ₂ , and the traffic acting Modeling step (S ₃ ) comprises.

In the step of collecting traffic (S ₁ ), traffic data of the network is collected using a packet capture tool according to a collection policy. To this end, traffic information collection sensors are provided in a plurality of networks, and traffic information is collected according to a traffic collection policy set by a botnet control and security management system.

In the step of classifying protocols (S ₂ ), the traffic collected in the step of collecting traffic is classified for each protocol. The step of classifying the protocol includes configuring a set of destination-specific clients (S _2-1 ), and extracting traffic feature elements (S _2-2 ).

Phase constituting the destination set by the client (S _2-1) is configured to analyze the collected protocol on collecting the traffic in the same client sets the destination. The step S _2-1 of configuring the destination-specific client set includes storing the collected access records S _2-1-1 and configuring the client set S _2-1-2 . do.

In the storing of the collected access records (S _2-1-1 ), the access records collected through the traffic information collecting sensor are stored and at the same time, all the access records collected for a certain time interval are stored.

In step S _2-1-2 , the collected traffic information is analyzed and classified according to protocols, and then configured as a client set. The classification of protocol is largely divided into TCP and UDP like the behavior pattern modeling system of network traffic for botnet detection according to the present invention described above, and TCP is classified into HTTP, SMTP and other HTTP. Also, UDP is classified into DNS and other DNS. At this time, the analysis of the protocol is to analyze the content of the actual traffic, and the group data is configured based on the IP and port, that is, the destination address.

Extracting the feature elements of the traffic (S _2-2 ) extracts the feature elements of the traffic by analyzing headers and contents of the classified protocol packets.

In the step S ₃ of modeling the behavior of traffic, the behavior of the traffic is modeled by analyzing the header of the TCP / IP layer and the IPv4 header among the features of the extracted traffic. Then, the botnet can be detected using the behavior information on the modeled traffic.

As described above, the present invention classifies the network activity by classifying the communication activity for each client by performing protocol classification of the network traffic on the basis of the destination for the collected network traffic, and performing patterning according to the detailed items for the corresponding protocol. It is possible to provide a method for modeling behavior patterns of network traffic for botnet detection that can be modeled. In addition, the present invention models the network behavior, that is, by analyzing the network-based behavior pattern botnet detection that can classify the download and upload, spam server and command control server for the servers estimated to be C & C in the detected botnet group It can provide a behavior pattern modeling method of network traffic for.

Although described above with reference to the drawings and embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit of the invention described in the claims below. I can understand.

1 is a conceptual diagram of a behavior pattern modeling system of network traffic for botnet detection according to the present invention;

2 is a block diagram of a behavior pattern modeling system of network traffic for botnet detection according to the present invention;

3 is a conceptual diagram of a botnet traffic collecting sensor of a behavior pattern modeling system of network traffic for botnet detection according to the present invention;

4 is a conceptual diagram of a traffic information collection module of a behavior pattern modeling system of network traffic for botnet detection according to the present invention;

5 is a TCP connection pattern modeling configuration diagram of a behavior pattern modeling system for network traffic for botnet detection according to the present invention;

Figure 6 is a UDP connection pattern modeling configuration of the behavior pattern modeling system of network traffic for botnet detection according to the present invention.

7 is a flowchart of a behavior pattern modeling method of network traffic for botnet detection according to the present invention;

Claims (10)

A botnet traffic collection sensor that collects traffic in the network and classifies it by destination; And a botnet detection system for detecting a botnet based on the botnet traffic collected by the botnet traffic collection sensor. The method according to claim 1, The botnet traffic collection sensor, A traffic information collection module for capturing traffic by capturing packets in the monitoring network according to a collection policy using a packet capture tool; A traffic information management module for classifying the information received from the traffic information collecting module, receiving and parsing the traffic information, processing the group data, and storing / managing the traffic information in a database; A traffic information transmission module for dividing the traffic information parsed by the traffic information management module into a transmission header and transmission data and packaging the data to transmit data through a transmission channel; and A classification tool, a traffic information management tool, and a sensor policy management module for transmitting the setting / status information of the data transmission period information to the traffic information collecting module, the traffic information management module, and the traffic information transmitting module. Behavior pattern modeling system of network traffic. The method according to claim 2, The traffic information management module classifies the collected pattern of network traffic into a transmission control protocol (TCP) and a user datagram protocol (UDP). Behavior pattern modeling system. The method of claim 3, The traffic information management module converts the Transmission Control Protocol (TCP) into a HyperText Transport Protocol (HTTP), a Simple Mail Transfer Protocol (SMTP), and the hypertext communication. Protocols and hypertext communication protocols other than the simple e-mail transmission protocol, And the hypertext communication protocol classifies "request" for requesting a page and "Respones" for which the server responds to a user's request. The method according to claim 4, The Simple Mail Transfer Protocol (SMTP) uses the Simple Mail Transfer Protocol communication itself as pattern data. The user datagram protocol (UDP) is a behavior pattern modeling system of network traffic for botnet detection, characterized in that the user datagram protocol communication itself determines the pattern data. The method according to claim 4, The " request " refers to a host portion, which is a domain of a target for requesting a web server resource, a page having information on a specific page desired by the host, and information about a site transfer step that is currently connected. Behavior pattern modeling system of network traffic for botnet detection, characterized in that it is classified as a referrer. The method of claim 3, The traffic information management module classifies the user datagram protocol (UDP) into a domain name server (DNS) and a domain name server other than the domain name server. Behavior pattern modeling system for network traffic. Collecting traffic, Classifying the protocol of the collected traffic, and And modeling behavior for the classified traffic. The method according to claim 8, Categorizing the protocol of the collected traffic, Organizing the collected traffic into a client set for each destination; And extracting a feature element of the traffic configured as the client set for each destination. The method according to claim 9, Configuring the collected traffic into a client set for each destination, Storing a connection record of the collected traffic; And constructing the collected traffic into a set of clients for each destination, and the behavior pattern modeling method of network traffic for botnet detection.

Images