KR100351305B1 - Intrusion detection system to interact with access control and method for intrusion confrontation - Google Patents

Abstract

The present invention relates to an intrusion detection system and an intrusion response method that interoperate with access control systems such as an intrusion blocking system and a filtering router in an intrusion detection system using a mixed intrusion detection model. More specifically, the misuse detection unit and abnormal behavior Unlike the countermeasures classified by the type of attack by the detection unit, the security policy violation detection unit, security policy violation detection unit and misuse detection unit, security policy violation detection unit and abnormal behavior detection unit, security policy violation detection unit, and misuse detection unit The present invention relates to an intrusion detection system and an intrusion countermeasure method according to the use of an intrusion detection model, such as when an abnormal behavior detection unit and a reanalysis unit are mixed.

Description

Intrusion detection system to interact with access control and method for intrusion confrontation}

The present invention relates to an intrusion detection system and an intrusion response method that interoperate with access control systems such as an intrusion blocking system and a filtering router in an intrusion detection system using a mixed intrusion detection model. More specifically, the misuse detection unit and abnormal behavior Unlike the countermeasures classified by the type of attack by the detection unit, the security policy violation detection unit, security policy violation detection unit and misuse detection unit, security policy violation detection unit and abnormal behavior detection unit, security policy violation detection unit, and misuse detection unit The present invention relates to an intrusion detection system and an intrusion countermeasure method according to the use of an intrusion detection model, such as when an abnormal behavior detection unit and a reanalysis unit are mixed.

In the linkage between a conventional intrusion detection system and an intrusion blocking system (access control system), the blocking function is defined in advance according to the type of attack or the administrator is defined. This requires a detailed analysis of all attack types or the response behaviors to them.

In addition, in the case of multiple attacks attacked by a large number of disguised hosts, it is very difficult to create an intrusion prevention rule, and thus the system or network may be paralyzed without responding to the attack.

The interworking function with the conventional access control system focuses only on the interworking with routers and switches that perform intrusion blocking systems or filtering functions. The system interworking with the intrusion detection system is a network level access control system as a firewall, a router, or a switch. In this case, there is no countermeasure except for disconnection when attacking from the inside to the inside.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to use an intrusion detection method without performing an intrusion blocking function according to an attack type or user definition in interworking with an intrusion detection system and an access control system. By providing a blocking function according to the form, to provide an intrusion blocking system that can solve the difficulty of setting the intrusion response function.

Another object of the present invention can be extended by interworking with an access control system having a host-level filtering function as well as an access control system of a network level such as an intrusion blocking system, a filtering router, a filtering switch, and the like that the existing intrusion detection system works with. To provide an intrusion countermeasure.

It is still another object of the present invention to provide an intrusion countermeasure that maintains a minimum service of a server without incurring paralysis of a system and a network even by introducing a concept of a minimum allowed domain.

1 is a block diagram illustrating an intrusion detection system interoperating with an access control according to the present invention;

Figure 2 is an interaction diagram for explaining the interaction of the intrusion detection system in conjunction with the access control according to the present invention,

3 is a flowchart illustrating a filtering rule generator for an event detected by a security policy detector according to the present invention;

4 is a flowchart illustrating a filtering rule generator for an event detected by an abuse detector according to the present invention;

5 is a flowchart illustrating a filtering rule generator for an event detected by an abnormal behavior detector according to the present invention;

6 is a flowchart illustrating a filtering rule generator for an event detected by a reanalyzer according to the present invention;

7 is a block diagram illustrating an intrusion detection system that works with access control according to another embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

160: intrusion response unit 161: general intrusion response unit

162: access control system interworking unit 163: filtering rule generation unit

164: port-based filtering rule generator 165: IP-based filtering rule generator

166: allowed domain list based filtering rule generator

167: filtering rule generator

168: access control system filtering rule transmission unit

In order to achieve the above object, the present invention provides a general intrusion countermeasure unit that performs general countermeasure functions such as alarming, logging, and disconnection for an event determined to be an intrusion in the intrusion detecting unit, and performs intrusion in conjunction with an access control system. It characterized in that it is configured to include an access control system interlock to block.

The access control system interworking unit may be configured to include a filtering rule generation unit for generating an access control rule according to a characteristic, and a filtering rule transmission unit for transmitting the filtering rule to an access control system for a network or an access control system for a host. .

The filtering rule generator includes a port-based filtering rule generator for blocking an intrusion port, an IP-based filtering rule generator for blocking an intruder's IP, and all other than the minimum allowed domain to maintain minimum service of an organization. And a filtering rule generator for blocking a traffic and generating a filtering rule list-based filtering rule for changing a previously applied rule.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an intrusion detection system that works with access control according to the present invention.

As shown here, all traffic from the external or internal network 100 to the network where the monitored server 110 is located is collected at the data collection unit 120 of the intrusion detection system, and the data filtering and abbreviation unit 130. After filtering from the intrusion detection unit 140 is analyzed as an intrusion is reported to the warning and reporting unit 150, the intrusion response unit 160 performs a corresponding action.

The intrusion detection unit 140 is composed of a security policy violation detection unit 141, misuse detection unit 142, abnormal behavior detection unit 143, re-analysis unit 144. Each intrusion detection model detects security policy violations or backdoors based on IP and port, detects known hacking attacks, detects abnormal traffic or denial of service attacks, and re-analyzes events determined to be intrusions. .

In response to the event determined to be intrusion in the intrusion detection unit 140, the intrusion response unit 160 is interlocked with the general intrusion response execution unit 161 and the access control system to perform a general response function such as alarm, logging, disconnection The access control system interworking unit 162 to block the intrusion performs a corresponding action.

The access control system interworking unit 162 generates an access control rule according to the characteristics of the filtering rule generating unit 163, and access control system 170 or host for the network through the access control system filtering rule transmission unit 168. The filtering rule is transmitted to the access control system 180 for use.

The filtering rule generator 162 includes a port-based filtering rule generator 164 for blocking an intrusion port, an IP-based filtering rule generator 165 for blocking an intruder's IP, and a minimum number of institutions. It includes a permitted domain list-based filtering rule generator 616 for blocking all traffic other than the minimum allowed domain for service maintenance, and a filtering rule correction unit 167 for changing a previously applied rule.

2 is a port-based filtering rule generator 164, an IP-based filtering rule generator 165, and a minimum allowed domain list of the filtering rule generator 163 according to the intrusion determination result of the intrusion detection unit 140 of the present invention. It is an interaction diagram for explaining the interaction of the based filtering rule generation unit 166, filtering rule correction unit 167 and the like.

As shown here, the event detected by the access control policy violation or the backdoor based on the IP and the port in the security policy violation detection unit 141 is the port-based filtering rule generator 164 of the filtering rule generator 163. And the IP-based filtering rule generator 165 are processed in the IP-based filtering rule generator 165, the event detected as a hacking behavior known by the misuse detection unit 142 is processed by the IP-based filtering rule generator 165 of the filtering rule generator 163. .

In addition, an event detected as abnormal traffic or a denial of service attack by the abnormal behavior detection unit 143 is processed by the IP-based filtering rule generation unit 165 and the minimum allowed domain list based filtering rule generation unit 166, and the re-analysis. The result of re-analyzing the event determined to be intrusion by the unit 144 is processed by the filtering rule correction unit 167 of the filtering rule generator 163.

The filtering rule of the access control system generated by the filtering rule generation unit 163 is transferred from the access control system filtering rule transmission unit 168 to the network access control system 170 and the host access control system 180 to be external. And blocks the attack from the internal network 100 to the monitored server 110.

3 is a flowchart illustrating a filtering rule generator for an event detected by a security policy violation detector that detects an access control policy violation or a backdoor based on an IP and a port.

As shown here, if the security policy violation detection unit 141 detects an access control policy violation or a back door based on IP and port, it is transmitted to the filtering rule generator 163 for intrusion response. The filtering rule generator 163 first determines whether an attacker is internal or external (S200). If the external attacker, if the traffic is inbound (Inbound) or outbound (Outbound) is determined (S210), if the traffic is inbound, in conjunction with the network level access control system to generate a filtering rule based on the IP (S211) and If the traffic is outbound, in conjunction with the network level access control system to generate a filtering rule based on the port (S212).

Otherwise, if the attacker is an internal attacker, it is determined whether the traffic is inbound or outbound (S213). If the traffic is inbound, the filtering rule is generated based on the IP in association with the access control system at the host level (S214), and the traffic is out. If bound, it creates a filtering rule based on the port in association with the access control system at the host level (S215).

The filtering rules S211, S212, S214, and S215 generated by the filtering rule generator 163 are transferred to the access control system filtering rule transmitter 168.

4 is a flowchart illustrating a filtering rule generator 163 for an event detected by the misuse detection unit 142 for detecting a known hack.

As shown here, if a known hacking attack is detected in the misuse detection unit 142, it is delivered to the filtering rule generator 163 for intrusion response. The filtering rule generator 163 first determines whether an attacker is internal or external (S300). If the attacker is an external attacker, the filtering rule is generated based on the IP interworking with the network level access control system (S310). Otherwise, if the attacker is an internal attacker, the filtering is performed based on the IP interworking with the access control system at the host level. Create a rule (S320). The filtering rules S310 and S320 generated by the filtering rule generator 163 are transferred to the access control system filtering rule transmitter 168. The misuse detection unit 142 is most efficient when the misuse detection unit 142 processes only the events allowed by the security policy violation detection unit 141.

5 is a flowchart illustrating a filtering rule generator 163 for an event detected by an abnormal behavior detection unit 143 for detecting abnormal traffic or a denial of service attack.

As shown here, if an abnormal traffic or a denial of service attack is detected in the abnormal behavior detection unit 143, it is transmitted to the filtering rule generator 163 for intrusion response. The filtering rule generator 163 first determines whether the attack is a single attack or multiple attacks (S400). If it is a single attack, it is determined whether the attacker is external or internal (S410). If the external attacker, create a filtering rule based on the IP interworking with the network level access control system (S420), and if the internal attacker, create a filtering rule based on the IP interworking with the access control system at the host level (S430). .

Otherwise, in the case of multiple attacks such as a distributed service attack, the minimum allowed domain list based filtering rule is generated with reference to the minimum allowed domain list 450 preset by the administrator (S440). Here, the minimum allowed domain list 450 is set to an institutional IP address, a domestic IP address, a country or region IP address, and the administrator may define it.

The filtering rules S420, S430, and S440 generated by the filtering rule generator 163 are transferred to the access control system filtering rule transmitter 168.

The abnormal behavior detection unit 143 is most efficient when the abnormal behavior detection unit 143 processes only the events allowed by the security policy violation detection unit 141 and the determined result is a denial of service attack.

6 is a flowchart illustrating a filtering rule generator 163 for a result of reanalyzing an event determined to be an intrusion by the reanalyzer 144.

As shown here, the result of re-analyzing the event determined to be an intrusion in the re-analyzer 144 is transmitted to the filtering rule generator 163 to modify the stage response or the filtering rule. First, by comparing the results re-analyzed by the previous response behavior with reference to the intrusion-specific correspondence list 510 to determine whether the modification of the response behavior is necessary (S500). If the modification of the response is not necessary, the process is terminated (S520). Otherwise, if the modification is necessary, the filtering rule is modified according to the response (S530). The filtering rule S530 generated by the filtering rule generator 163 is transferred to the access control system filtering rule transmitter 168.

7 is another embodiment according to the present invention, without using the security policy violation detection unit 141, misuse detection unit 142 and abnormal behavior detection unit 143 and re-analysis unit 144 intrusion detection model Intrusion detection unit (including a policy violation or backdoor detection unit 601, a known hacking attack detection unit 602, abnormal traffic or denial of service attack detection unit 603, a re-analysis unit 604 for re-analyzing the detected event ( When 600 is configured, the configuration and operation of the filtering rule generator 610 are described.

As shown here, the event detected by the security policy violation or the backdoor detection unit 601 is a Port-based filtering rule generator 611 and an IP-based filtering rule generator 612 of the filtering rule generator 610. The event detected by the known hacking attack detector 602 is processed by the IP-based filtering rule generator 612 of the filtering rule generator 610.

In addition, the event detected by the abnormal traffic or the denial of service attack detection unit 603 is processed by the IP-based filtering rule generator 612 and the minimum allowed domain list-based filtering rule generator 613. The result of re-analyzing the event determined to be intrusion by the reanalyzer 604 is processed by the filtering rule corrector 614 of the filtering rule generator 610.

The filtering rules 611, 612, 613, and 614 of the access control system generated by the filtering rule generator 610 are transferred from the access control system filtering rule transmitter 620 to the network access control system 630 and the host access control system 640. It is forwarded to block the attack from the external and internal network 650 to the monitored server 660.

In addition, when there is no host level access control system, it may be replaced by an internal access control system such as a filtering router and a switch that controls access to the internal network.

Therefore, as described above, the present invention relates to a method of coping with an access control policy when interworking an intrusion detection system and an access control system (such as an intrusion blocking system). By not providing intrusion prevention function according to the definition and providing the blocking function according to the usage method of the intrusion detection method, the intrusion detection system automatically performs the appropriate response function for intrusion behavior without the administrator having any knowledge about hacking and response. There is an advantage to this.

In addition, the present invention provides a network-level access control system such as an intrusion blocking system, a filtering router, a filtering switch, etc. to which the existing intrusion detection system works, as well as an access control system having a host-level filtering function. In addition, there is an advantage that can actively block internal attacks.

In addition, the present invention introduces the concept of the minimum allowed domain composed of the internal IP address, domestic IP address, country-specific IP address, administrator definition, etc. to minimize the system and network in spite of distributed service attack There is an advantage to maintain.

Claims (7)

Intrusion detection unit including security policy violation detection unit, misuse detection unit, abnormal behavior detection unit, and re-analysis unit, and the event of intrusion detection in the intrusion detection unit according to the response set by the administrator In the intrusion detection system comprising an intrusion response unit for performing intrusion response functions such as resetting the environment, The intrusion response unit is a general intrusion response performing unit for performing a general response function, such as alarm, logging, disconnection for the event determined to be intrusion in the intrusion detection unit; Intrusion detection system in conjunction with the access control, characterized in that it comprises an access control system interlocking unit interlocking with the access control system to block intrusion. The apparatus of claim 1, wherein the access control system interworking unit comprises: a filtering rule generating unit generating an access control rule according to a characteristic; Intrusion detection system in conjunction with the access control, characterized in that it comprises a filtering rule transmission unit for transmitting the filtering rule to the network access control system or the host access control system. The apparatus of claim 1, wherein the filtering rule generator comprises a tote-based filtering rule generator for blocking an intrusion port, an IP-based filtering rule generator for blocking an intruder's IP, and a minimum allowed domain for maintaining a minimum service of an organization. Intrusion detection system in conjunction with the access control, characterized in that configured to include a filtering domain rule-based filtering rule generation unit for blocking all other traffic, and a filtering rule modification for changing a previously applied rule. In the intrusion response method of the intrusion detection system comprising a security policy violation detection unit, misuse detection unit, abnormal behavior detection unit and re-analysis unit, In the security policy violation detector, if the event is determined to be an intrusion, the security policy violation detection unit passes to the filtering rule generator; In the filtering rule generation unit, first, determining whether it is an internal attacker or an external attacker; A second determination step of determining whether the traffic is inbound or outbound if the external attacker is the first determination step; If the inbound traffic in the second determination step, generating a filtering rule based on IP in association with a network level access control system; If the outbound traffic in the second determination step, generating a filtering rule based on a port in association with a network level access control system; A third determination step of determining whether the traffic is inbound or outbound if the internal attacker is the first determination step; If the traffic is inbound in the third determination step, generating a filtering rule based on the IP by interworking with the access control system at the host level; If the traffic is outbound in the third determination step, generating a filtering rule based on a port in association with an access control system at a host level; The filtering rules generated by the filtering rule generating unit may include a step of passing the access control system filtering rule transmitting unit. 5. The method of claim 4, further comprising: passing the event to the filtering rule generator when the event is determined to be an intrusion by the misuse detection unit. In the filtering rule generator, first, a fourth determination step of determining whether the attacker is an internal attacker or an external attacker; Creating a filtering rule based on an IP interworking with a network level access control system if the attacker is an external attacker in the fourth determination step; Creating a filtering rule based on an IP interworking with the access control system at the host level if the attacker is an internal attacker in the fourth determination step; The filtering rules generated by the filtering rule generating unit may include a step of passing the access control system filtering rule transmitting unit. The method as claimed in claim 4, further comprising: when the event is determined to be an intrusion in the abnormal behavior detection unit, passing to the filtering rule generator; In the filtering rule generator, first, a fifth determination step of determining whether a single attack or multiple attacks is performed; A sixth judgment step of determining whether the attacker is an internal attacker or an external attacker if the single attack in the fifth determination step is performed; Creating a filtering rule based on an IP interworking with a network level access control system if the attacker is an external attacker in the sixth judging step; Creating a filtering rule based on an IP interworking with the access control system at the host level if the attacker is an internal attacker in the sixth judging step; Creating a minimum allowed domain list based filtering rule with reference to a minimum allowed domain list preset by an administrator in the case of multiple attacks such as a distributed service attack in the fifth determination step; The filtering rules generated by the filtering rule generating unit may include a step of passing the access control system filtering rule transmitting unit. 5. The method of claim 4, further comprising: passing the event to the filtering rule generator when the event is determined to be an intrusion by the reanalyzer. In the filtering rule generator, first, a seventh judging step of determining whether a corrective action is required by comparing the result of re-analyzing the previous response action with reference to the intrusion-specific correspondence list, If it is not necessary to correct the corresponding act in the seventh judging step, ending; Modifying the filtering rule according to the corresponding action when the seventh determination step requires modification; The filtering rule generated by the filtering rule generating unit includes the step of passing to the access control system filtering rule transmission unit.