KR20200044210A - Abnormal behavior packet detector for wireless IoT device - Google Patents

Abstract

According to the present invention, an abnormal behavior packet detection apparatus for wireless Internet of things (IoT) equipment comprises: a packet collection apparatus which captures all communication packets made by IoT devices in LAN and sends the communication packets to a packet analysis apparatus in real time; the packet analysis apparatus which receives packet information from the packet collection apparatus to a socket and selects data necessary for analysis with the received information; and a web application which delivers the detection result uploaded to a database (DB) in the form of json through a service API (RestAPI). The packet analysis apparatus determines whether the packet is abnormal and, if true, uploads the detection result to the DB.

Description

Abnormal behavior packet detector for wireless IoT device

The present invention relates to an abnormal behavior detection device for a wireless device, and specifically, as a device for preventing and securing an IoT device that is closely related to real life from being exposed to an attack, captures a wireless communication packet made in a LAN and captures the abnormal behavior packet It detects and uploads to DB, and it relates to an abnormal behavior packet detection device for wireless IoT equipment that provides feedback and alarm to users through a web app.

In modern times, as mobile devices are frequently used and smart TVs or set-top boxes are commonly used in the home, most of the user terminals are evolving into a form that can use services through a network. Accordingly, it is a reality that a wired / wireless gateway is used to connect various terminals to each other or to an external Internet network not only in the office but also in the home.

Recently, rather than attacking a terminal that is connected to a wired / wireless gateway due to malicious code, the attack type is changing to attack the wired / wireless gateway itself and prevent or infect or use surrounding network equipment (such as a router or gateway).

In addition, there are cases in which malicious code is set to perform an attack from a wired / wireless gateway itself to an external network rather than an attack from a terminal.

In reality, due to Internet of Things (IoT) products, which were sold to Mirai in the US in September 2016, Internet paralysis occurred in the United States, causing the entire collection to be discarded. In particular, Mirai Botnet is experiencing problems such as DDOS (Distributed Denial Of Service) attacks to other terminals through the weak IoT product.

However, in the situation where the vulnerability of malicious code is implied in the firmware of the wired / wireless gateway, there is no defense analysis technology for the transmission method through the wired / wireless gateway. Therefore, there is a very need for technology to smoothly defend and analyze malicious code transmission / reception using data vulnerability by operating in the firmware of a wired / wireless gateway.

1 is a block diagram of a conventional wired / wireless gateway.

As shown,

The wired / wireless gateway 100 connects a terminal (not shown) connected by wire or wirelessly to an external network to transmit and receive data packets. The terminal connected to the wired / wireless gateway 100 includes a variety of terminals connected to a network, such as a smart phone, a tablet PC, a mobile device such as a smart watch, a smart TV, a set-top box, a laptop, and a desktop computer to provide related functions. .

The wired / wireless gateway 100 includes a communication unit 110, a memory 120, a data analysis unit 130, a status detection unit 140, a security processing unit 150, and a first security information database 160.

The security management server 200 communicates with the wired / wireless gateway 100 and detects and blocks malicious attacks on the wired / wireless gateway by interworking with the wired / wireless gateway. The security management server 200 includes a web server 210, a security management unit 220, a second security information database 230, and a security policy database 240.

The security information providing server 300 provides security information to be included in the signature-based ruleset, that is, information about the extension change of the malicious code / malware file to the security management server 200.

The above-described known technology has a function of effectively detecting and blocking a malicious activity that infects a wired / wireless gateway and attacks an external network or attacks the wired / wireless gateway itself.

However, according to the price of the IoT device, the performance of devices such as CPU or memory varies depending on the price of the IoT device, so it is difficult to update and manage software, and the performance of the IoT device makes it difficult for the performance itself to apply the existing security technology. Because the IoT communication protocol relies heavily on the Secure Sockets Layer (SSL) due to incomplete definition, there is a problem in that the solution does not include encryption in the standard of the IoT messaging protocol MQTT, so that encryption must be added for each device in the solution.

Publication Patent Publication No. 10-2018-0059611 (published on June 5, 2018)

The present invention collects a wireless packet in the process of IoT device communication in a packet collection device in real time, transmits the information of the collected wireless packet to the packet analysis device, and the packet analysis device analyzes the transmitted packet to perform abnormal behavior. At the same time, when there is a packet that is determined to be abnormal, the information of the corresponding packet is stored in the DB and the intrusion information corresponding to the web app accessed by the user is provided.

An abnormal behavior packet detection device for a wireless IoT device of the present invention receives packet information from a packet collection device, a packet collection device to a socket, capturing all communication packets formed by IoT devices in a LAN and sending it to a packet analysis device in real time. , Includes a packet analysis device that selects data necessary for analysis with the received information, and a web app that delivers detection results uploaded to the DB in the form of json through Service API (RestAPI); The packet analysis device is characterized in that it determines whether the packet is abnormal and uploads the detection result to the DB when it is true.

In addition, the packet collection device identifies the IP band of the network in use and sends a ping to all addresses in the network, through which the IP addresses and MAC addresses of all living devices and routers in the network are identified and stored. It is characterized by executing ARP-Spoofing using information, and then implementing ARP-Redirect MITM.

In addition, the packet analysis device stores the file handle value of each rule file separated for each service (port), and when a packet comes in, gets the file handle value of the service (port) and compares the related rules, thereby speeding up the inspection. It is characterized by preventing it from being deteriorated.

Since the present invention has the form of EDR or IDS, which is a security solution that is practically recognized for its effectiveness, it has an effect of implementing security that is difficult to handle by a general user who is not an expert in an easy to apply form.

1 is a block diagram of a conventional wired / wireless gateway.
2 is a configuration diagram of a pattern-based detection engine structure applied to an abnormal behavior packet detection device for a wireless IoT device of the present invention.
3 is an M UI screen applied to an abnormal behavior packet detection device for a wireless IoT device of the present invention.
4 is an M push notification screen applied to an abnormal behavior packet detection device for a wireless IoT device of the present invention.

A preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings. For reference, the size of a component, the thickness of a line, and the like shown in the drawings referred to in describing the present invention may be expressed somewhat exaggerated for convenience of understanding.

In addition, the terms used in the description of the present invention are defined in consideration of functions in the present invention, and thus may vary according to a user, an operator's intention, and customs. Therefore, it is reasonable to define the terminology based on the contents of the present specification.

And, in the present application, the terms 'include', 'have', etc., refer to the existence of a specific number, step, operation, component, part, or a combination thereof described in the specification, and one or more other It should be understood that features or numbers, steps, actions, components, parts, or combinations thereof are not excluded in advance.

In addition, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, and only the present embodiments make the disclosure of the present invention complete, and the scope of the invention to those skilled in the art. It is provided to inform you completely.

Therefore, the present invention can be applied to various changes and may have various forms, and thus, an implementation example (態 樣, aspect) (or an embodiment) will be described in detail in the specification. However, this is not intended to limit the present invention to a specific disclosure form, and it should be understood that all modifications, equivalents, and substitutes included in the technical spirit of the present invention are included, and the expressions of the singular numbers used herein are clearly different in context. Unless you mean it, include plural expressions.

However, in describing the present invention, detailed descriptions of well-known or well-known functions or configurations will be omitted to clarify the gist of the present invention.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings.

2 is a configuration diagram of a pattern-based detection engine structure applied to an abnormal behavior packet detection device for a wireless IoT device of the present invention, FIG. 3 is an M UI screen applied to an abnormal behavior packet detection device for a wireless IoT device of the present invention, and FIG. 4 is The present invention is an M push notification screen applied to an abnormal behavior packet detection device for a wireless IoT device.

As illustrated, an abnormal behavior packet detection device for a wireless IoT device is classified into a packet collection device, a packet analysis device, and a web app.

The packet collection device captures all communication packets formed by IoT devices in the LAN and sends them to the packet analysis device in real time.

The packet uses the MAC address in the OSI Layer 2 layer environment when it is transmitted and received to each device.

Also, it increases network efficiency by not receiving packets that are not related to it. Since the packet collecting device needs to capture the packets of wireless communication that is made with all IoT devices in the LAN, the MAC address of the packet collecting device is spoofed to the MAC address of the router through ARP-Redirect MITM (man-in-the-middle attack) to communicate with the router. You can capture packets of equipment.

The method of operation is that when the packet collection device is located within a specific LAN, it identifies the IP band of the network in use and sends a ping to all addresses in the network.

Through this, all living devices in the network and the IP address and MAC address of the router are identified and stored.

ARP-Spoofing is executed using the stored information and ARP-Redirect MITM is implemented.

Packets are collected through this process.

As a collection tool, a program called Scapy is used, and Scapy is a bidirectional packet manipulation program that can perform various protocols such as forgery, decryption, transmission, capture, matching request, and response.

It is also a module that functions related to ARP-Redirect MITM and packet capture.

The packet collecting device sniffs packets passing through the device after such an environment is created.

Then, by tapping the packet through the Sniff function provided by Scapy, the contents are extracted and output, and the contents are transmitted to the packet analysis equipment. The method of transmission is socket communication, so that both devices transmit and receive data regarding packets. The packet analysis device starts pattern-based detection with the received content.

The packet analysis device receives packet information from the packet collection device to the socket.

Based on the received information, data necessary for analysis is selected.

Using the selected data, compare whether the conditions of pattern detection are satisfied, and select packets that show special patterns.

Selected data is stored in DB.

By visualizing and outputting the contents stored in the DB in the web app, the user can easily check the data.

The operation type is to keep the file handle value of each rule file separated for each service (port), and when a packet comes in, get the file handle value of the service (port) and compare the related rules to prevent the inspection speed from being reduced. .

Service (port) is classified by port number from 0 to 65535 or service name such as ssh, ftp, icmp.

According to the service (port), the rule is read and the search is started. The given offset value and option are checked first, and if not applicable, pattern comparison is started.

In the case of the offset value, it is a value that designates the location where the pattern appears, and the option is a value that specifies functions that help to detect the pattern.

After comparing the destination port of the packet and checking whether a rule matching the service (port) exists, wait for the next packet. For protocols without a port number, such as icmp, the detection method is the same as a general detection method, except that there is no port number.

It determines whether the packet is abnormal or not, and if it is true, uploads the detection result to the DB.

In the web app, the detection result uploaded to the DB is delivered in the form of json through Service API (RestAPI).

It can be accessed through a web app and the received value is parsed and output to the web composed of HTML and JavaScript.

In addition, the web app has a push function, so even if it is not checked periodically, the user automatically receives an alarm for packet detection.

The packet detecting device for anomalous behavior for the wireless IoT device of the present invention having the above-described configuration has a form of EDR or IDS, which is a security solution that is recognized for its practical use, and thus provides security that is difficult for general users who are not experts to handle. It has the effect of implementing in an easy-to-apply form.

Claims (3)

A packet collection device that captures all the communication packets made by IoT devices in the LAN and sends them to the packet analysis device in real time,
A packet analysis device that receives packet information from a packet collection device to a socket and selects data necessary for analysis with the received information.
Includes a web app that delivers the detection results uploaded to the DB in the form of json through Service API (RestAPI);
The packet analysis device determines whether the packet is abnormal and, if true, detects an abnormal behavior packet for the wireless IoT device, uploading the detection result to the DB. The method according to claim 1,
The packet collecting device,
It identifies the IP band of the network in use and sends a ping to all addresses in the network. Through this, it identifies and stores the IP addresses and MAC addresses of all the devices and routers in the network, and uses the stored information to ARP-Spoofing. An abnormal behavior packet detection device for a wireless IoT device, characterized in that it implements ARP-Redirect MITM. The method according to claim 2,
The packet analysis device,
It keeps the file handle value of each rule file separated for each service (port), and when the packet comes in, it gets the file handle value of the corresponding service (port) and compares the related rules to prevent the inspection speed from being reduced. An abnormal behavior packet detection device for wireless IoT equipment.

Images