KR20200052165A - Meta information platform devices and methods for recycle standard/threat traffic - Google Patents

Abstract

The present invention relates to a meta information platform device for recycling normal/threat traffic and to a method thereof. The method comprises the steps of: receiving traffic in a real network environment by a collection module and storing and transmitting the traffic in a packet unit; analyzing the packet received from the collection module by a traffic analysis module and generating application layer data; analyzing information extracted from the application layer data by a metadata generation module and generating metadata; generating unit traffic composed of network information including the generated metadata by a unit traffic generation module; and generating a dataset including protocol information of associated unit traffic by a dataset generation module.

Description

META INFORMATION PLATFORM DEVICES AND METHODS FOR RECYCLE STANDARD / THREAT TRAFFIC for recycling normal / threat traffic

The present invention relates to a meta-information platform device and a method for constructing it for use in cyber training using traffic collected from a real network.

With the rapid development of communication technology and the spread of the Internet today, users can easily obtain and share information they want. In addition, as large-scale cyber attacks or advanced persistent attacks such as APT (Advanced Persistent Threat) to public institutions or corporate internal networks occur, the importance of security systems that apply security policies based on them is increasing.

Conventionally, intrusion prevention systems (IPSs) that detect / block various types of intrusion behavior or next-generation firewalls were introduced to protect existing networks to protect threats from outside. However, since it is difficult to identify cyber attacks that are continuously evolving with such a security system, a number of security systems have been introduced for high security, but when an infringement occurs, it is difficult to quickly identify the infringement and respond to it.

The method to compensate for this is to construct the same cyber network as the actual network and simulate the training by generating the threat traffic using the traffic generator. Cyber simulation training is easy to find vulnerabilities as well as accurate identification of internal networks. However, when training using a traffic generator, the reliability of the result of cyber simulation training is high because the normal and threat traffic used for training is different from the traffic used for the actual network, and there is a limit in the type of traffic that can generate a threat. There is a problem that cannot be guaranteed.

Korean Registered Patent No. 1460589 (name: cyber war simulation training control server)

An object of the present invention is to provide a meta information platform in a form that can be used in a traffic generator by avoiding the simulated traffic method used in cyber training and reusing traffic collected from a real network.

The method for constructing a meta information platform according to an embodiment of the present invention for achieving the above object is a step of receiving traffic in a real network environment by a collection module and storing and transmitting in packet units, the collection module by a traffic analysis module Analyzing the packet received from and generating application layer data, generating metadata by analyzing information extracted from the application layer data by the metadata generation module, and generating the meta by the unit traffic generation module And generating a unit traffic composed of network information including data and generating a data set including protocol information of the unit traffic related by the data set generation module.

In one embodiment, the step of generating the application layer data, extracts IP (internet protocol), port (Port) and sequence (Sequence) information by analyzing the network layer of the received packet, the extracted IP , Combining the packets associated with port and sequence information to generate the application layer data.

In one embodiment, the step of generating the metadata generates metadata by analyzing location information of fields extracted from the application layer data and length values of the fields, and the generated metadata includes the collected When reusing traffic, it is characterized in that it is modified to be the same as the user's cyber network environment.

In one embodiment, in the step of generating the data set, the association between the unit traffic is characterized by IP, port, protocol, and sequence information of packets.

The meta information platform device according to an embodiment of the present invention for achieving the above object is analyzed by analyzing a collection module for collecting and storing traffic in a packet unit in a real network environment, and a packet received from the collection module An analysis module for generating data capable of generating traffic, wherein the analysis module analyzes the network layer of the received packet to generate application layer data, and extracts a field according to a protocol from the generated application layer data The traffic analysis module, the application layer data and the metadata of the location information of the extracted field and the length value of the field to generate metadata, and the unit traffic consisting of network information including the generated metadata information. Generating unit traffic generating module and the relevant unit Traffic is characterized by including a data set generation module for generating a data set.

The present invention is a meta-information platform that a user can use in a traffic generator in cyber simulation training, and reuses the traffic collected from a real network, so there are various types of normal / threat traffic used for training. In addition, since the traffic used for training is the same as the actual traffic, the reliability of the training result is high, and as a result, the effect of training is improved.

1 is a configuration diagram of a meta information platform device according to an embodiment of the present invention.
2 is a flowchart illustrating a method for building a meta information platform according to an embodiment of the present invention.

Hereinafter, exemplary embodiments disclosed herein will be described in detail with reference to the accompanying drawings, but the same reference numerals will be assigned to the same or similar components, and overlapping descriptions thereof will be omitted. The suffixes "modules" and "parts" for components used in the following description are given or mixed only considering the ease of writing the specification, and do not have meanings or roles distinguished from each other in themselves. In addition, in describing the embodiments disclosed in this specification, detailed descriptions of related known technologies are omitted when it is determined that the gist of the embodiments disclosed in this specification may be obscured. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed in the specification is not limited by the accompanying drawings, and all modifications included in the spirit and technical scope of the present invention , It should be understood to include equivalents or substitutes.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a meta information platform device according to an embodiment of the present invention.

First, the meta information platform device may include a collection module 100 and an analysis module 200, wherein the analysis module 200 is a traffic analysis module 210, a metadata generation module 220, and a unit traffic generation module It may include a 230 and the data set generation module 240.

The collection module 100 serves to receive and store and transmit traffic from a real network. The input traffic maintains the original form and is collected and stored in packet units. In particular, when using a traffic generator in a cyber simulation training, since traffic collected in a real network environment can be collected and transmitted, there is an effect of ensuring reliability of the training result.

Here, the traffic can be classified into normal traffic and threat traffic. Here, normal traffic represents traffic generated according to general actions / tasks / activity of users connected in the network. For example, general traffic means traffic generated due to web behavior, mail transmission / reception, FTP file transmission, video conference, and video transmission. In addition, the threat traffic represents traffic caused by an action / task / activity of a malicious purpose. For example, threat traffic refers to traffic caused by an increase in traffic load due to excessive scans, DDoS and worm infections, and the like.

The analysis module 200 is a module for generating a highly reliable training traffic by analyzing packets of actual traffic received from the collection module 100, specifically, a traffic analysis module 210 and a metadata generation module 220 , A unit traffic generation module 230 and a dataset generation module 240.

The traffic analysis module 210 performs a network traffic analysis 211 function and an application protocol analysis 212 function.

The network traffic analysis 211 function of the traffic analysis module 210 analyzes the network layer of the received packet and extracts information such as IP (internet protocol), port (Port), and sequence (Sequence). The extracted information is used to analyze and classify a correlation between a plurality of packets. Here, an association relationship between a plurality of packets means packets in which information such as extracted IP, port, and sequence is related to each other. Each payload is extracted by combining a plurality of classified packets based on an association relationship, and generated as application layer data that can be analyzed.

The application protocol analysis 212 function of the traffic analysis module 210 identifies protocol types in the generated application layer data and provides fields (sender, receiver, etc.) necessary for traffic reuse according to the identified protocol types. Identify and extract.

The metadata generation module 220 generates metadata by identifying the location information of the extracted fields from the application layer data and the length values of the corresponding fields. Here, metadata is data for data. That is, information that follows along with the data to add additional information. ‘Meta’ means ‘transcendence’ or ‘with a higher degree of logic’. Metadata refers to information about what data is structured and where it is located. For example, in a digital camera, each time a picture is taken and recorded, information of the camera itself and picture information such as time of exposure, exposure, whether the flash is used, resolution, and picture size are stored together with image data.

The purpose of generating metadata in the metadata generation module 220 is to allow the user to modify data to be suitable for a cyber network configuration when reusing the collected traffic.

The unit traffic generation module 230 generates data composed of network information including metadata information generated previously. Each unit traffic is used as a request and response form of traffic distributed in cyber simulation training.

The data set generation module 240 generates a data set in a form including protocol type and number information of related unit traffics. Here, the relevant unit traffic refers to a set of packets recombined in the order in which packets classified by session are transmitted by comparing IP, port, protocol, and sequence between the source and the destination in the network.

The dataset will be needed when selecting the type of protocol in the traffic distribution plan of the training scenario used in cyber simulation training.

Using the above modules, the result of collecting and analyzing real traffic of the actual network may be stored and checked (250). Based on the stored results, it is possible to construct a cyber network identical to the actual network, and generate reliable traffic by using a traffic generator to generate traffic suitable for the training scenario to perform highly reliable simulation training.

2 is a flowchart illustrating a method for building a meta information platform according to an embodiment of the present invention.

As described below, a method for constructing a meta information platform according to an embodiment of the present invention is to construct a meta information platform in a form that can be used in a traffic generator by reusing collected traffic in a real network environment for cyber simulation training. It is an invention. Hereinafter, the present invention will be described with reference to FIG. 2.

First, the collection module 100 stores the traffic generated in the actual network in packet units and transmits it to the analysis module (S300).

The packet received from the collection module 100 is analyzed by the traffic analysis module 210 and application layer data is generated (S310).

Specifically, in the traffic analysis module 210, the network layer of the packet received from the collection module is analyzed to extract information such as IP (internet protocol), port (Port), and sequence (Sequence). The extracted information is used to analyze and classify a correlation between a plurality of packets. Here, an association relationship between a plurality of packets means packets in which information such as extracted IP, port, and sequence is related to each other. Each payload is extracted by combining a plurality of classified packets based on an association relationship, and generated as application layer data that can be analyzed.

The metadata generation module 220 generates metadata by analyzing the information extracted from the application layer data (S320).

The purpose of generating metadata is to allow users to modify data to suit the cyber network configuration when reusing the collected traffic.

The unit traffic generation module 230 generates unit traffic composed of network information including the generated metadata (S330). Each unit traffic is used as a request and response form of traffic distributed in cyber simulation training.

The data set generation module 240 generates a data set including protocol information of the unit traffic that is relevant (S340).

Here, the relevant unit traffic refers to a set of packets recombined in the order in which packets classified by session are transmitted by comparing IP, port, protocol, and sequence between the source and the destination in the network.

 The dataset will be needed when selecting the type of protocol in the traffic distribution plan of the training scenario used in cyber simulation training.

Using the above-mentioned modules, traffic of a real network environment is collected and analyzed, and the result of the analysis is stored (S350). Based on the stored results, the same cyber network as the real network is constructed, and threat traffic is generated (S360) using a traffic generator to generate traffic suitable for the training scenario, thereby performing highly reliable simulation training.

In the case of cyber simulation training, in order to increase the effectiveness of training, it is necessary to make it difficult to identify training traffic to the training target. To this end, by utilizing the meta information platform construction method according to an embodiment of the present invention, real traffic is recycled and variously applied for general background traffic, training threat noise traffic, etc. You can. In addition, for repetitive training for the same purpose, a combination of datasets created and stored can be more useful.

The above detailed description should not be construed as limiting in all respects and should be considered illustrative. The scope of the invention should be determined by rational interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention.

100: collection module
200: analysis module
210: traffic analysis module
211: network traffic analysis function
212: application protocol analysis function
220: metadata generation module
230: unit traffic generation module
240: dataset creation module

Claims (5)

Receiving traffic in a real network environment by a collection module and storing and transmitting in packet units;
Analyzing the packets received from the collection module by the traffic analysis module and generating application layer data;
Generating metadata by analyzing information extracted from the application layer data by the metadata generation module;
Generating unit traffic composed of network information including the generated metadata by the unit traffic generating module; And
And generating a data set including protocol information of the unit traffic related by the data set generation module. According to claim 1,
The step of generating the application layer data,
Analyze the network layer of the received packets to extract IP (internet protocol), port (Port) and sequence (Sequence) information, and extract the payload (Payload) by analyzing the extracted IP, port and sequence information , Application layer data is generated by combining packets with the extracted IP, port, and sequence information. According to claim 1,
The step of generating the metadata,
Meta data is generated by analyzing the location information of the fields extracted from the application layer data and the length values of the fields,
The generated metadata,
When reusing the collected traffic, a meta information platform construction method characterized in that it is modified to be the same as the user's cyber network environment. According to claim 1,
In the step of generating the data set,
The association between the unit traffics is a method of establishing a meta information platform characterized by IP, port, protocol, and sequence information of packets. A collection module that collects, stores, and transmits traffic in a packet unit in a real network environment; And
And an analysis module generating data capable of generating simulated traffic by analyzing packets received from the collection module,
The analysis module,
A traffic analysis module that analyzes a network layer of the received packet to generate application layer data, and extracts a field according to a protocol from the generated application layer data;
A metadata module that generates metadata by analyzing the application layer data, the location information of the extracted field, and the length value of the field;
A unit traffic generation module that generates unit traffic composed of network information including the generated metadata information; And
A meta information platform device comprising a data set generation module in which the relevant unit traffic generates a data set.

Images