TWM563582U - Network intrusion detection system - Google Patents

Abstract

A network intrusion detection system includes a network intrusion detection device, a hub, a firewall module, a switch, a plurality of terminal devices, and a control terminal. The network intrusion detection device includes a network packet An analysis module, a scanning module, a response detection module, a command detection module, and a blocking service detection module. The network packet analysis module is connected to the scanning module, the response detection module, the command detection module, and the blocking service detection module, respectively. The network intrusion detection device is connected to a hub, and receives network packets transmitted to the hub, and uses these modules to scan and analyze whether packets from the Internet carry malicious attack content, and The attacked message was returned to a control terminal and an alert was issued.

Description

Network Intrusion Detection System

A network intrusion detection system, especially a system with a network intrusion detection device, can scan different network attack behaviors.

In the current network age, many communication processes are achieved through the network. Once the device is connected to the network, the probability of being maliciously attacked or stealing information increases. Therefore, how to reduce the loss after being attacked is important. problem.

Existing network protection functions use firewalls as a line of defense against external attacks. The firewall can set specific packets. When the firewall receives these specific packets, these specific packets will be allowed to enter the device, and the packets not in the settings will be blocked by the firewall. For general network attacks, the firewall can effectively block these attacks, protect the security of equipment and software, and ensure that data is not stolen.

However, the firewall can only block packets that are not accepted by the device. It cannot detect higher-level network attacks such as attacks on system and application vulnerabilities, buffer overflow attacks, or Trojan horse attacks. Or intercept. These high-level network attacks will disguise as packets allowed by the original system, without being blocked by the firewall to enter the system for attack, thereby paralyzing the equipment system or stealing confidential information, resulting in security issues.

In order to solve the problem that the firewall cannot effectively detect high-level network attacks, this author proposes a network intrusion detection system, which includes a network intrusion detection system. The network intrusion detection system uses multiple analysis modes. The group detects network attack behaviors and analyzes the patterns of network attack behaviors individually to achieve the effect of network monitoring.

In order to achieve the above purpose, the present invention creates a network intrusion detection system including: a hub having a first port and a plurality of second ports; a network intrusion detection device connected to the hub; One of the second ports has a network packet analysis module, a scanning module, a response detection module, a command detection module, and a blocking service detection module; a firewall module, Is connected to the first port of the hub; a switch is connected to one of the second ports of the hub; a plurality of terminal devices are connected to the switch; and a control terminal is connected to the switch Device.

The network intrusion detection device includes: a network packet analysis module that captures a plurality of packets received from an external network and analyzes the specifications of the packets; a scanning module, and The network packet analysis module is connected, the scanning module receives the packets analyzed by the network packet analysis module, and performs content analysis on the packets; a response detection module is connected to the network The packet analysis module is connected, and the response detection module receives the packets and analyzes the codes of the packets; a command detection module is connected with the network packet analysis module, and the command detection module The system receives these packets and detects the correctness of the commands or parameter settings carried by the packets; a blocking service detection module connected to the network packet analysis module, and the blocking service detection module The department receives these packets and detects network paralysis and attacks on services.

The network intrusion detection device is connected to the hub, so that all packets entering the network intrusion detection system through the firewall module will pass through the hub and be received by the network intrusion detection device. The intrusion detection device analyzes whether there are attack instructions in the packets according to different network attack patterns, and compares the characteristics of the attack instructions with a characteristic database in the network intrusion detection device, where the characteristic data The library stores various attack behavior characteristics and packet characteristics that can be received by the network intrusion detection system. Analyze the network attack behavior through the modules of the network intrusion detection device, and compare the analysis with the signature database, and then notify the control terminal that an attack has occurred, and respond to the control terminal, The result is network monitoring and protection.

10‧‧‧Network Intrusion Detection Device

11‧‧‧Network Packet Parsing Module

12‧‧‧Scan module

14‧‧‧ Response Detection Module

16‧‧‧Command detection module

18‧‧‧ blocking service detection module

19‧‧‧Memory device

191‧‧‧Characteristic database

20‧‧‧ Hub

21‧‧‧First port

22‧‧‧Second Port

30‧‧‧Firewall Module

40‧‧‧exchanger

41a ~ 41c‧‧‧Terminal equipment

50‧‧‧Control terminal

Figure 1: Schematic diagram of this authoring network intrusion detection system.

Figure 2: Schematic diagram of the network intrusion detection device of this creation.

Please refer to FIG. 1, this invention creates a network intrusion detection system, which includes a network intrusion detection device 10, which is used under the MODBUS TCP / IP network architecture and is installed In a hub 20, where the hub 20 has a first port 21 and a plurality of second ports 22, the first port 21 is connected to a firewall module 30; the second ports 22 It is connected to a switch 40 and the network intrusion detection device 10 respectively, wherein the firewall module 30 is used to filter packets from the Internet and transmit the filtered packets to the hub 20. The hub 20 receives the filtered packets and sends all the packets to the switch 40 and the network intrusion detection device 10 respectively; the switch 40 is further connected to a plurality of terminal devices 41a to 41c. In this embodiment, a control terminal 50 is further provided, and the control terminal 50 is connected to the switch 40. The network The intrusion device 10, the hub 20, the firewall module 30, the switch 40, the terminal devices 41a to 41c, and the control terminal 50 form the network intrusion detection system, wherein the control terminal 50 is provided for the system administrator Operation and monitoring.

Please refer to FIG. 2 further, the network intrusion detection device 10 includes: a network packet analysis module 11, a scanning module 12, a response detection module 14, a command detection module 16, and a block The service detection module 18 and a memory device 19. The network packet parsing module 11 is connected to the scanning module 12, the response detection module 14, the command detection module 16 and the blocking service detection module 18 respectively; the memory device 19 is connected to The network packet analysis module 11, the scanning module 12, the response detection module 14, the module 16, and the blocking service detection module 18 are connected. The network intrusion detection device 10 uses a sniffing method to simultaneously transmit network packets that are to be transmitted to the switch 40 through the hub 20 to the network intrusion detection device 10 to monitor the networks. Security of road packets.

The memory device 19 includes a feature database 191. The feature database has a normal list and an abnormal list. The items stored in the normal list may include, but are not limited to, the IP address and MAC of each device in the network intrusion detection system. Address, device's own identification data, normal function code, and normal header format and normal data content of network packets that can be received by the network intrusion detection system; the items stored in the anomaly list include different network attacks The appearance and characteristics include malicious function codes, instruction attacks, etc.

In an embodiment, before the network intrusion detection device 10 is officially activated, the network intrusion detection device 10 may be set up in a secure intranet to establish default items on the abnormal list and the normal list. The secure intranet only has the terminal devices and communication packets between the terminal devices, but does not receive packets from the outside Internet. It is different from the network intrusion detection system that includes these terminals. Communication packets from devices 41a to 41c, and network packets from the outside Internet. When the network intrusion detection device 10 is set up in the secure intranet, it will initially collect the header format of the communication packets, the normal data content, and the IP and MAC addresses of each terminal device, and record them in the network. In the regular list, use this as a preset list item. In addition, the system administrator can add known cyber attack patterns to the anomaly list in advance.

When the network intrusion detection device 10 is actually applied, it can be set up in the network intrusion detection system and analyze the network packets. When it is determined that a network packet belongs to a malicious attack packet, the feature database 191 is not When the state of the malicious attack is stored, the system administrator can manually input the characteristics of the malicious attack through the control terminal 50 into the signature database 191 for storage. When the terminal devices 41a to 41c increase or decrease, the IP locations and identity identification data of the terminal devices 41a to 41c can also be manually added to the feature database 191 through the control terminal 50.

The network packet analysis module 11 is an industrial control network analysis framework, which is used to receive packets from the Internet and decode the packets to obtain the header and data content of the packet, and compare it with the feature database 191 The normal list and the abnormal list are compared to confirm whether the header and data contents in the packet are accepted by the system as the first stage of filtering.

When the network packet analysis module 11 determines that the network packets can pass the filtering, the network packet analysis module 11 transmits the network packets to the scanning module 12 and the response detection separately and simultaneously. The module 14, the instruction detection module 16 and the blocking service detection module 18 perform the second-stage analysis and processing by these modules.

The scanning module 12 is configured to scan the IP location and MAC address of each node device in the network intrusion detection system. Each node device in the network intrusion detection system, such as the hub 20, the switch 40, and the terminal devices 41a to 41c, each has a separate IP location and MAC address. These IP locations The MAC addresses are stored in the feature database 191 in advance. When any node device is maliciously replaced, or a new device is maliciously placed in the network intrusion detection system, the new device after replacement or another installation will have a new IP location and a new MAC address. When the scanning module 12 matches the feature database 191, the new IP location and the new MAC address are not original in the network intrusion detection system, and this message will be returned to the Control terminal 50.

The scanning module 12 can also detect network packets with malicious function codes. In the network intrusion detection system, the hub 20, the switch 40, and the terminal devices 41a to 41c each have an identification unit, and the identification unit stores the manufacturer, model, adoption protocol, and function code of the device itself Information that can identify the identity of each of these devices. When an attack from the Internet occurs, for example, if an unknown packet carries a malicious function code, the malicious function code is intended to replace the normal function code to cause the terminal devices 41a to 41c of the network intrusion detection system to operate. abnormal. When the scanning module 12 compares network packets according to the lists in the feature database 191 and detects malicious function codes, the scanning module 12 returns a message to the control terminal 50.

The response detection module 14 is used to detect whether the network packets carry another malicious function code. This malicious function code may consist of only 0, 1, or random numbers, or change the length of the original packet of the network intrusion detection system, or in the original packet of the network intrusion detection system. Randomly add random numbers or symbols. When the response detection module 14 detects that the network intrusion detection system is invaded by the function code attack packet, it sends a message to the control terminal 50.

The instruction detection module 16 is used to detect attacks such as abnormal control commands or abnormal parameter settings. When the network packets carry a command attack, the command attack will enter the network intrusion detection system to attack the control instructions of the terminal devices 41a to 41c, so that the terminal devices 41a to 41c issue an incorrect command. Errors in the control process and abnormalities in the transmission of information between the terminal devices 41a to 41c, or destruction of parameter settings in the terminal devices 41a to 41c, make the terminal devices 41a to 41c unable to operate normally. When the command detection module 16 detects that the network packets have the command attack, it will return the attacked message to the control terminal 50 to notify the user to take countermeasures.

The blocking service detection module 18 is used to detect whether the network intrusion detection system has received a large number of network packets within a certain period of time. Denial of service attack is a network attack mode, which sends a large number of network packets to the network intrusion detection system in a short period of time, so that the network intrusion detection system receives a large number of packets in a short period of time. Packet, which in turn blocks the network communication of the network intrusion detection system News situation. The blocking service detection module 18 presets the upper limit of the packets that can be received within a specified time interval. When the network intrusion detection system receives a large number of error check codes (CRC) within the specified time When there are a large number of packets, the blocking service detection module 18 returns the attacked message to the control terminal 50. When the control terminal 50 receives the above-mentioned attack messages, it will issue a warning message to notify the user to take countermeasures, such as cutting off the connection with the external network or interrupting the operation of a certain terminal device. Afterwards, analyze the appearance of this cyber attack, and add the analyzed characteristics of the cyber attack to the anomaly list.

Since the action of the hub 20 uses message broadcasting, when a network packet enters the hub 20, the hub 20 will broadcast these network packets to all devices connected to the hub 20 in a broadcast manner. The network intrusion detection system 10 is connected to the hub 20. Using the functions of the hub 20, the network intrusion detection system 10 can receive all network packets entering the network intrusion detection system, and The attacked information is transmitted to the control terminal 50 through the hub 20 and the switch 40 to allow the user to judge the degree of attack, which can protect the network intrusion detection system and reduce damage when it is attacked. .

Claims (7)

A network intrusion detection system includes: a hub having a first port and a plurality of second ports; a network intrusion detection device connected to one of the second ports of the hub, It has a network packet parsing module, a scanning module, a response detection module, a command detection module and a blocking service detection module; a firewall module is connected to the hub. A first port; a switch connected to one of the second ports of the hub; a plurality of terminal devices connected to the switch; and a control terminal connected to the switch. The network intrusion detection system according to claim 1, wherein: the network packet analysis module captures a plurality of packets received from an external network, and analyzes the specifications of the packets; the scanning module Connected to the network packet analysis module, the scanning module receives the packets analyzed by the network packet analysis module, and performs content analysis on the packets; the response detection module and the network The packet analysis module is connected, and the response detection module receives the packets and analyzes the codes of the packets; the instruction detection module is connected with the network packet analysis module, and the instruction detection module It receives these packets and detects the correctness of the commands or parameter settings carried by the packets. The blocking service detection module is connected to the network packet analysis module. The blocking service detection module is Receive these packets and detect network paralysis and attack services. The network intrusion detection system according to claim 2, the network intrusion detection device is installed on the second port of the hub, and the second port of the hub is further connected to the switch The switch is connected to a plurality of terminal devices, where each terminal device includes manufacturer, model, communication protocol used, and network location (IP) and MAC address and other identification information. The network intrusion detection system according to claim 3, the network intrusion detection device includes a memory device, the memory device stores a signature database, the signature database records characteristics of malicious attacks, and meets normal specifications Packet format. The network intrusion detection system according to claim 4, wherein: after receiving the packets, the network packet analysis module analyzes the headers and bodies of the packets to confirm the headers and bodies of the packets Whether the format of the packet meets the standard; the scanning module analyzes the information in the packets, including the source of the packets, the device identity information of the terminal devices, and the function codes in the packets, and confirms whether the packets contain a first malicious Function code, the first malicious function code will replace the normal function code, so that the terminal devices in the network intrusion detection system operate abnormally; the response detection module analyzes whether the packets carry a second malicious function Code, the coding combination of the second malicious function code may be random numbers, wrong length, or maliciously change the instruction code in the network intrusion detection system; the instruction detection module scans the packets for any change in program control Malicious instructions for status, frequent switching of switches, changing operating setpoints, or device shutdown / startup commands; the blocking service detection module is pre-set in a period Between the upper limit of the number of the received packet, and the upper limit of the number of errors in the packet received this time. The network intrusion detection system according to claim 5, the network intrusion detection device includes a memory device, the memory device stores a signature database, and the signature database records the characteristics of the malicious attack and meets the normal specifications Packet format. The network intrusion detection system according to claim 6, wherein: when the network packet analysis module analyzes that the format of the packets does not meet the standard, it sends a signal to the control terminal; the scanning module analyzes the packets The information inside is different from the device information stored in the feature database, or when the first malicious function code is carried, a signal is sent to the control terminal; the response detection module analyzes that the packets carry the A second malicious function code, which is a random number, an incorrect length, and a command code that changes the original system, sends a signal to the control terminal; the instruction detection module detects these When the packet has an instruction to maliciously change the original system process and status, a signal is sent to the control terminal; the blocking service detection module receives the number of packets that exceed the original set limit within a period of time, or receives more than the original set When the maximum number of packet errors is reached, a signal is sent to the control terminal.