KR20200039550A - Method for real-time encryption packet separation and identification in high speed traffic and interworking with yara detection on identified packet, and apparatus thereof - Google Patents

Abstract

The present invention relates to a packet-based threat detection apparatus capable of providing encrypted traffic visibility in interconnection with a YARA detection technique. The apparatus is executed based on a hardware module including a field programmable gate array (FPGA) and a memory. Moreover, the packet-based threat detection apparatus includes: an encrypted traffic decryption engine (110) decrypting encrypted network traffic data with a certificate; a trespassing detection engine (120) detecting and blocking a threat by applying a predetermined trespassing detection rate for the decrypted traffic data; and a packet-based YARA detection engine (130) re-detecting a threat by applying a packet-based YARA rule to traffic data, from which the trespassing detection engine (110) does not detect a threat, instead of creating a complete file by combining all traffic data.

Description

METHOD FOR REAL-TIME ENCRYPTION PACKET SEPARATION AND IDENTIFICATION IN HIGH SPEED TRAFFIC AND INTERWORKING WITH YARA DETECTION ON IDENTIFIED PACKET, AND APPARATUS THEREOF}

The present invention relates to the security of computer networks, and in particular to the security of encrypted packets in high-speed traffic.

Computer networks are used to obtain and share information in modern information society. It is to obtain information from a server by connecting to a network such as an intranet or the Internet using a smartphone, desktop, or laptop computer, or to upload information to the server to share information.

When such a large number of users access and exchange enormous amounts of information, there is always an attempt to steal information or attack the server by malicious users.

Security technologies such as Secure Socket Layer (SSL) have been developed and used to prevent abnormal attacks or hacking attempts of such networks. SSL is a technology that can keep all transmitted data private by using an encrypted link between the web server and the user's browser. However, if you use SSL technology, you can keep the data secure, but if you need to detect data for security, the problem that cannot be decrypted occurs again.

Therefore, prior art security equipments must provide functions for encryption traffic visibility to detect these encrypted data. The prior art encryption traffic visibility providing system has three functions. First, the ability to decrypt (equivalent) the encrypted traffic, second, the ability to detect / block threats based on the rules used in the Intrusion Detection / Prevention System for the decrypted traffic, Third, if the decrypted traffic contains files, it creates a complete file by combining all traffic and detects whether the file is a malicious file or not.

However, in order to detect / block all files in the encrypted traffic in this way, it is necessary to combine and detect all the traffic including the files, so the prior art requires considerable time and computing power. In particular, since network traffic must be detected and blocked in real time, the problem of time and performance eventually leads to an increase in cost.

After deeply considering these problems, the inventors of the present invention have come to complete the present invention regarding an apparatus and method for more effective detection and blocking of files in an encrypted packet.

An object of the present invention is to provide an apparatus for detecting and blocking malicious codes (malware files) by separating and identifying an encrypted packet in real time within high-speed traffic.

It takes a considerable amount of time and money to detect malware in real time within high-speed traffic. Therefore, another object of the present invention is to implement a detection device for providing encryption traffic visibility that can reduce time and cost by reducing real-time malware detection time in high-speed traffic.

On the other hand, other objects not specified in the present invention will be additionally considered within a range that can be easily deduced from the following detailed description and its effects.

In order to achieve the above problems, the present invention is a packet-based threat detection device through providing cryptographic traffic visibility executed based on a hardware module including a field programmable gate array (FPGA) and memory:

An encryption traffic decryption engine that decrypts the encrypted network traffic data using a certificate;

An intrusion detection engine that detects and blocks a threat by applying a predetermined intrusion detection rule to the decrypted traffic data; And

A packet-based YARA detection engine that re-detects a threat by applying YARA rules based on a packet, rather than combining all of the traffic data and generating a complete file for traffic data in which the threat is not detected by the intrusion detection engine; It is characterized by including.

In a packet-based threat detection apparatus through providing encryption traffic visibility according to a preferred embodiment of the present invention, the packet-based YARA detection engine:

A string definition unit defining a YARA string based on a packet;

Condition definition unit for defining the conditions of the packet-based YARA rule: and

It is preferable to include a YARA rule translator that changes the standard YARA rule into a packet-based YARA rule structure.

In addition, in a packet-based threat detection apparatus through providing encryption traffic visibility according to any preferred embodiment of the present invention, the encryption traffic decryption engine, intrusion detection engine, or packet-based YARA detection engine is implemented in a hardwired logic of the FPGA. Can be executed through hardware.

By the above-described problem solving means of the present invention, the present invention has the effect of detecting / blocking malicious code in real time using the reduced YARA pattern without combining all of the encrypted traffic including the file.

In addition, since it does not combine all of the encrypted traffic containing the file, the time required to detect the malicious code can be much shorter than that of the prior art, and thus there is an effect of lowering the price of a blocking system having the same performance.

On the other hand, even if the effects are not explicitly mentioned herein, it is noted that the effects described in the following specification expected by the technical features of the present invention and the potential effects thereof are handled as described in the specification of the present invention.

1 is a structural diagram of an entire system according to a preferred embodiment of the present invention.
2 is a structural diagram of a packet-based YARA detection engine according to a preferred embodiment of the present invention.
3 is an example of application of a packet-based YARA rule according to an exemplary embodiment of the present invention.
4 is a flowchart of a method for detecting threats according to another preferred embodiment of the present invention.
5 is a schematic structural diagram of a hardware board according to another preferred embodiment of the present invention.
※ The accompanying drawings indicate that they are exemplified by reference for understanding the technical idea of the present invention, and the scope of the present invention is not limited thereby.

Hereinafter, a configuration of the present invention guided by various embodiments of the present invention and effects resulting from the configuration will be described with reference to the drawings. In the description of the present invention, when it is determined that the subject matter of the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a schematic structural diagram of a packet-based threat detection apparatus through providing encryption traffic visibility according to an exemplary embodiment of the present invention.

The threat detection device according to the present invention can be implemented in various forms. It may be implemented in software using a computer-based device, or may be implemented by configuring dedicated hardware. The threat detection device of the present invention can be implemented using a field programmable gate array (FPGA). Unlike the application specific integrated circuit (ASIC), which cannot be modified once it is made of a programmable semiconductor, the FPGA has a feature that enables users to implement hardware designed according to their needs. Because it is implemented as a hardware semiconductor by a logic element, it has an advantage that it is much faster than a software implementation.

The packet-based threat detection apparatus 10 that provides cryptographic traffic visibility according to any preferred embodiment of the present invention is composed of an encryption traffic decryption engine 110, an intrusion detection engine 120, and a packet-based YARA detection engine 130. .

The encrypted traffic decryption engine 110 decrypts traffic data encrypted with Secure Socket Layer (SSL), Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS), and the like. In other words, it converts the inscription into plain text.

SSL is a secure socket layer and a communication protocol for safely transmitting data over the Internet. Netscape Communications Inc., an industry standard protocol for securely sending and receiving data between web browsers and web servers, can be applied to other TCP / IP applications such as File Transfer Protocol (FTP) as well as the Web. SSL has authentication encryption.

HTTPS transmits encrypted session data through SSL or TLS protocol instead of using plain text in socket communication. Therefore, it is possible to ensure proper protection of data. The default TCP / IP port for HTTPS is 443.

SSL or HTTPS decryption is performed using the corresponding certificate 112. Creates, deletes or updates session information for each traffic session, blocks unauthorized traffic data and records logs.

The unencrypted traffic data is bypassed by the encryption traffic decryption engine 110 and transmitted to the intrusion detection engine 120.

The intrusion detection engine 120 detects a threat based on the intrusion detection rule 122 for the decrypted traffic data or the traffic data bypassed because it is not encrypted. Blocks the traffic data where the threat is detected and records it in the detection log (20). Traffic data for which the threat has not been detected is transmitted to the YARA detection engine 130.

The packet-based YARA detection engine 130 detects threats such as malware by applying the YARA rule 132 to traffic data in which the threat is not detected by the intrusion detection engine 120.

In this way, the first threat is detected by the intrusion detection rule 122 of the intrusion detection engine 120, and then the dual threat is re-detected by the YARA rule 132 of the packet-based YARA detection engine 130. Detect threats by process. The intrusion detection rule 122 is a rule name composed of information indicating that it is an intrusion detection rule, a letter or a number to be used as a rule name (minimum / maximum length applied, for example, minimum 3 characters, maximum 200 characters), and the risk applied by classifying it as upper and lower. It can be composed of a signature that consists of a response method, a header and a detection phrase for the risk of notifying the packet, and how to process the detected packet. On the other hand, the Yarra rule 132 is information indicating that the Yarra room, a letter or a number to be used as the rule name (minimum / maximum length applied, for example, at least 3 characters, maximum 200 characters), the risk of notifying the risk applied by being divided into upper and lower, And it may be composed of a signature including signature metadata, a signature string, and a signature condition.

2 is a structural diagram of a packet-based YARA detection engine 130.

The packet-based YARA detection engine 130 includes a string definition unit 134, a condition definition unit 136, and a YARA rule translator 138.

The string definition unit 134 defines a YARA string based on a packet. Each string is limited to one packet size, and the string is limited to a text string and a hexa string. Strings do not support Perl-based regular expressions (PCRE), and regular expressions only support wildcards (*) and question marks (?). Wide strings are also supported.

The condition definition unit 136 defines a condition of a packet-based YARA rule. Possible conditions are 1. All of them, 2. Any of them, 3. AND, and so on. For OR, rules are divided into strings, and file size conditions are not supported because conditions are defined based on packets.

The string definition unit 134 or the condition definition unit 136 does not support YARA additional module options (PE, ELF, Cuckoo, Magic, HASH, MATH).

The YARA rule translator 138 changes the packet-based YARA rule definition in which the standard YARA rules are packet-based in the string definition unit 134 and the condition definition unit 136 so that the packet-based YARA detection engine 130 can process them. Optimize.

For example, in a preferred embodiment of the present invention, the YARA rule translator 138 translates the rule name in the standard YARA rule table to correspond to the rule number 310 in FIG. 3 and the risk to match the string 1. In addition, the signature metadata is translated into strings 2 and 3, the rest of the signature string, and the signature condition is translated to correspond to the condition 330 of FIG. 3 to update the YARA rule.

In particular, in a preferred embodiment of the present invention, when each component of the standard YARA table is input to the YARA rule translator, the YARA rule is recognized by the FPGA and is divided into detailed rules in an easy structure to perform the detection process.

The abbreviated Yarra rule is uploaded to the internal logic of the FPGA, and the header value of packets passing through the FPGA and all data in the payload are matched in real time on a byte-by-byte basis to find conditions that match the YARA rules loaded in the FPGA.

The advantage is that the same detection result can be obtained even if the standard YARA rule is shortened or modified by updating the standard YARA rule as above. Therefore, even if the standard YARA rules are modified based on packets, the same detection as the standard YARA rules is possible.

Using this updated YARA rule, the preferred YARA detection engine of the present invention is signature metadata detection, signature string detection, signature detection for each of N packets (N is an integer greater than 1) composed of a header and a payload, respectively. Condition detection is performed.

3 shows the packet-based YARA rule structure translated in this way.

YR # 1 to YR # 3 310 denote YARA rule numbers. Each YARA rule includes a string value 320 and a YARA rule match condition (Condition 330).

As a result of applying this packet-based YARA rule, packets of packet data (Packet Payload) are displayed with YR ID # 1 to 2 (340), which are the YARA rule ID numbers matched with the YARA rule.

The packet-based YARA rule detection engine 130 of the present invention performs a string match check on a packet-by-packet basis using high-speed dedicated hardware. By blocking packets that meet the conditions 330 of each YARA rule on a packet-by-packet basis, the function of blocking the inflow of threatening files is performed. Blocked packets are delivered to the application layer for the entire file combination. When detection and blocking are performed in the YARA rule, a record is recorded in the detection log 20.

4 is a flowchart of a method for detecting a threat by the packet-based threat detection device 10 through providing the above-mentioned encryption traffic visibility.

First, traffic data encrypted with SSL, HTTPS, etc. is decrypted using a certificate (S10). The unencrypted traffic data is passed to the next step without decryption.

The decrypted traffic data or unencrypted traffic data detects a threat by applying an intrusion detection rule (S20) (S30). Then, when a threat is detected, the packet is blocked (S60) and a log is recorded.

Next, if the threat is not detected by applying the intrusion detection rule, the threat is detected once again by applying the YARA rule (S40) (S50). To apply the YARA rule, the packet-based YARA string is pre-defined, the conditions of the packet-based YARA rule are predefined, and then the standard YARA rule is transformed using the packet-based YARA rule translator. The process of transforming and applying the packet-based YARA rule is as described above. When a threat is detected, the packet is blocked (S60) and a log is recorded.

5 is a structural diagram of the entire module in the case where the packet-based threat detection apparatus 10 through providing encryption traffic visibility according to the present invention is configured in the FPGA board. Both HTTPS-encrypted and unencrypted traffic can be threat-detected.

The encrypted traffic decoding engine 110 corresponds to the SSL Traffic Handling Module in the city example. In addition, the Network Attack Mediation Module and Active Session Management Module are superimposed on the intrusion detection engine 120 and the packet-based YARA detection engine.

According to the present invention as described above, by applying the YARA rule on a packet-by-packet basis, it is possible to detect a threat through providing the visibility of an encrypted packet in real time, and it is possible to detect a threat much faster than processing it with software using a dedicated FPGA hardware design. This has the effect of reducing the time for threat detection.

On the other hand, although not shown, the packet-based threat detection device of the present invention may include one or more processors and memory, and various hardware and / or software modules for implementing functions and improving performance may be added. In addition, as described above, the present invention is executed based on a hardware module including an FPGA, thereby enabling faster and more accurate detection of malicious modules.

For reference, a threat detection method through providing visibility of an encrypted packet according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and available to those skilled in computer software.

Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs, DVDs, magnetic-optical media such as floptical disks, and ROM, RAM, Hardware devices specifically configured to store and execute program instructions, such as flash memory, may be included. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine codes such as those produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

The scope of protection of the present invention is not limited to the description and expression of the embodiments explicitly described above. In addition, it is pointed out once again that the scope of protection of the present invention may not be limited by obvious changes or substitutions in the technical field to which the present invention pertains.

Claims (3)

It runs on the basis of a hardware module that includes a Field Programmable Gate Array (FPGA) and memory:
An encryption traffic decryption engine that decrypts the encrypted network traffic data using a certificate;
An intrusion detection engine that detects and blocks a threat by applying a predetermined intrusion detection rule to the decrypted traffic data; And
A packet-based YARA detection engine that re-detects a threat by applying YARA rules based on a packet, rather than combining all of the traffic data and generating a complete file for traffic data in which the threat is not detected by the intrusion detection engine; A packet-based threat detection device through providing encryption traffic visibility.
According to claim 1,
The packet-based YARA detection engine:
A string definition unit defining a YARA string based on a packet;
A condition definition unit defining a condition of a packet-based YARA rule; And
A YARA rule translator that converts a standard YARA rule into a packet-based YARA rule structure; a packet-based threat detection device through providing encryption traffic visibility.
According to claim 1,
The encryption traffic decryption engine, intrusion detection engine or packet-based YARA detection engine is characterized in that it is executed through hardware by a hardwired (Hardwired) logic of the FPGA, packet-based threat detection device through the provision of encryption traffic visibility.

Images