KR100420132B1 - Intrusion detection method for linux kernel based computer system - Google Patents

Abstract

The present invention is a new technology for detecting intrusion into a computer system in real time, and is an intrusion detection system performed in a kernel which is the lowest level of a computer operating system. To this end, the present invention has modified the kernel to obtain and store information about the working environment at the time when the computer program is executed. The reported information determines the location of the user who performed the work by the daemon program, which is a kind of monitoring program, the execution system of the program, and whether or not the work is legitimate. Notify by supervisory control device, e-mail, administrator mobile phone, etc.

Therefore, the present invention not only detects almost all intrusions by eliminating the possibility of detour through direct tracking of the work performed on the computer, but also prevents the administrator's unauthorized work orders from being performed and prevents hackers from concealing and deleting intrusion traces. Can be sealed.

Description

Intrusion detection method for linux kernel based computer system}

The present invention relates to a security technology of a computer system using a Linux operating system, and more particularly, to modify an kernel, which is the core of the Linux operating system, and to detect an intrusion into a computer system using a daemon program, a monitoring program, in real time. It is about an invasion tower method.

In general, computer security technology is classified into an intrusion detection system (IDS) and a firewall system, and is further divided into a network-based technology and a host-based technology. However, these conventional security technologies do not achieve their purpose perfectly for the following reasons.

First, existing security systems monitor only a few of the predicted paths of computer system intruders. Intruders can use a variety of intrusion paths and bypass the surveillance path.

Second, reporting on intrusion status is not effective from an administrator's point of view. In other words, detected intrusions are not known unless the administrator checks them from time to time.

Third, an intruder who successfully accesses a computer system erases his trace of intrusion, making it impossible to trace later and making the system difficult to recover.

Fourth, the current intrusion detection system (IDS) has a detection rate of 50% or less, and over time, the program should be revised for a new intrusion technique.

For this reason, the conventional intrusion detection technology does not exceed 50% of the detection rate, and the evaluation of the intrusion detection system is classified into excellent products and ordinary products based on 50%.

In order to solve the above problems, the present invention finds a unique procedure for performing all tasks in a computer system, modifies the kernel to collect information related to task execution, and obtains the information thus obtained by a daemon program. The purpose of this study is to provide a Linux kernel-based real-time detection method that can effectively detect intrusions by evaluating the legitimacy of the work performed, the worker's network location, and the worker's execution authority.

In addition, another object of the present invention is to effectively notify administrators of intrusions detected using an intrusion monitoring and control device, an automatic e-mail transmission program, a mobile phone call program, and the like so that the administrators can respond in a timely manner, and record intrusion information to trace the intruder. It is to prevent erasure or true denial.

1 is a diagram illustrating a real-time detection concept according to the present invention,

2 is a flowchart illustrating a procedure of acquiring information of a processor in a Linux kernel according to the present invention;

Figure 3 is a block diagram showing the configuration of a monitoring control device to notify the administrator by warning lights and alarm bells when intrusion is detected in accordance with the present invention, Figure 4 shows a procedure for the daemon to detect intrusion according to the present invention 5 is a configuration example of a general network to which the present invention can be applied.

* Explanation of symbols for main parts of the drawings

102: executable program 104: kernel

106: program driving information 108: daemon

310: server 320: intrusion monitoring and control device

324: RS232C driver 322: microcomputer 326,328: relay 330: warning light 340: alarm bell

In order to achieve the above object, the present invention provides a method for detecting an external illegal intrusion in a computer system that allows a local client or a remote client to access a computer server using a Linux operating system, the program execution from the client If required, a first step of retrieving an environment variable including program driving information from the kernel to the Linux operating system; A second step of analyzing the log name of the environment variable, obtaining a remote host IP of the client to generate an intrusion detection information file, and transmitting a signal to the daemon when a remote client having root authority is detected; A third step in which the daemon reads the intrusion detection information file and determines that the remote host IP is an illegal intrusion if the signal is not received; And if it is determined that the illegal intrusion, characterized in that the fourth step of stopping the execution of the program, transmitting an alarm signal to the intrusion monitoring control device and notifies the administrator of the intrusion detection fact.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. First, a general network configuration to which the present invention can be applied is a server 310 using a Linux operating system as shown in FIG. The local client 530 can be connected to the local area network via a local area network (LAN) and can be accessed by the remote accessor 540 (remote client) via the Internet 502. In this case, the local network may be connected to the Internet 502 through the router 510, and a firewall 520 may be constructed at the network connection end to protect the internal network. The supervisory control device 320 is connected.

1 is a diagram illustrating a real-time detection concept according to the present invention, and FIG. 2 is a flowchart illustrating a procedure of acquiring information of a processor in a kernel according to the present invention.

The procedure of executing the program in the Linux operating system according to the present invention is as shown in FIG. First, the execution program 102 requests the program drive to the kernel 104 of the Linux operating system (①). Accordingly, the kernel 104 stores program driving information in the program driving information DB 106 (2), and notifies the program driving to the daemon program 108 for monitoring intrusion detection according to the present invention (3). Accordingly, the daemon program 108 reads (④) and reads and analyzes the program driving information, and when intrusion detection is detected, stops the operation of the infringement program (⑤) and alerts the intrusion detection fact to an alarm device, an e-mail, Notify the administrator in real time using a mobile phone (⑥).

Typically, when a program is launched on a Linux system, the do_execve function is called to create a processor. The do-execve function calls the search binary handler search_binary_handler to find a program handler that matches the program's format. The search binary handler (search_binary_handler) function of the Linux kernel to which the present invention is applied records the environment variables as shown in Table 1 below when the processor starts. Therefore, if you check the environment variable table, you can check the process ID, command, logname, remote host IP, set-user-ID, and group ID. group-ID), etc. Meanwhile, the operation flow of the kernel for checking the information of the processor according to the present invention is as shown in FIG.

Referring to FIG. 2, when program execution is requested from a local client or an external accessor (remote client), the execution (do_execve) function for generating a processor calls a search binary handler (search_binary_handler) function (steps 201 and 202). .

In the search binary handler (search_binary_handler) module, make sure that the effective user ID (euid) has the system's highest level of root. Normally, when the euid variable is "0", the root authority is represented (step 203).

If it is a processor with root authority, step 204 obtains a worker account "logname" from the processor's environment variable.

After analyzing the log name, if the remote accessor searches for environment variables, obtains a "remote host IP" indicating the location of the remote searcher, and generates an intrusion detection information (idsinfo) file (205 ~ 207). ). Here, the intrusion detection information is defined as a file called "idsinfo" in the "proc_dir_entry" structure as described later.

In step 208, a signal (SIGINT) is sent to the daemon, and in step 209, it is checked whether the security daemon is running. Thereafter, the search binary handler (search_binary_handler) module returns to the do_execve function.

The detected intrusion detection information is recorded and transmitted to the daemon through a virtual file called intrusion detection information (idsinfo) to the processor (proc) file system by the get_idsinfo code. The additional code in the kernel required for this is:

First, a file called intrusion detection information (idsinfo) is defined in a processor directory entry (proc_dir_entry) structure. Second, the intrusion detection information (idsinfo) file is registered in the processor (proc) file system using the processor registration (proc_register) function. Third, get_idsinfo (get_idsinfo) is defined that puts processor information in the intrusion detection information (/ proc / idsinfo) file of the processor file directory. Fourth, when the daemon later attempts to read the intrusion detection information (idsinfo) file, the get root array (get_root_array) function calls get_idsinfo.

On the other hand, in step 208, the kernel sends a signal (SIGINT) to the daemon for information transfer, and the daemon receiving the signal determines whether the intrusion is detected by performing a procedure as shown in FIG. 4, when the signal is received, the daemon reads the information from the intrusion detection information (/ proc / idsinfo) file in the processor directory (401, 402). Subsequently, the IP of the remote accessor in the intrusion detection information file is compared with the predefined allowed IP list 403a to determine whether it is an allowed IP (403, 404). In addition to sending a warning signal to the 320, and notifies the fact of intrusion detection to the administrator's mobile phone or email (405 ~ 407). That is, the daemon prints the information of all remote root authority processors except the set-user-ID and set-group-ID processors checked at startup to the console and the printer. Inform the administrator via e-mail or text message.

Intrusion monitoring and control device 320 is connected to the server 310, the warning light 330 and the alarm bell 340, as shown in Figure 3, all the root (root) except the IP specified by the administrator according to the warning signal By operating on the IP of the processor, it can be monitored by a large number of employees as well as administrators.

Figure 3 is a block diagram showing the configuration of a monitoring control device to notify the administrator by warning lights and alarm rings when intrusion is detected in accordance with the present invention. Referring to FIG. 3, the server 310 and the intrusion monitoring controller 320 are connected through an RS232C serial port, and the intrusion monitoring controller 320 is a microcomputer 322, an RS232C driver 324, and a warning light 330. ) Is configured as a relay 326 for controlling, an alarm 340 for controlling the alarm bell 340.

According to the present invention, when an intrusion detection is detected, alarm functions related to the daemon are as follows.

1) Console output Various events can be displayed according to the user's requirements. The output can be displayed graphically and textually, which is an alarm function that can be displayed in consideration of the user's convenience. It is part.

2) The intrusion monitoring control device communicates with the intrusion monitoring control device 320 at the communication port (serial or USB) of the Linux server 310 as shown in FIG. 3, and the control signal of the intrusion monitoring control device 320 is specified. The one-chip microcomputer (OneChip CPU) is used to transmit / receive signals to increase the simplification and efficiency of the parts.Also, the warning lamp 330 and the alarm bell 340 control are controlled by the microcomputer (CPU: 322). (326,328).

Referring to the function of Figure 3, when the hacking attempt to the Linux server 310, the daemon detects this and outputs an alarm to the warning light 330 and the alarm bell 340. Therefore, even if the system administrator moves the seat without managing in front of the server 310 24 hours, if the alarm function according to the present invention operates, it can be monitored and monitored in real time from external hacking.

3) Sending E-mail The e-mail transmission method is a control method for the server administrator to quickly send an e-mail when a hacking infiltration occurs in the server as part of emergency measures when going out and leaving the office. The control method is that the daemon calls the mail command to send the mail to the server administrator and the person's mail address.

4) Manager mobile phone text message transmission

In addition, the mobile phone transmission method is a control method for the server administrator to quickly transmit to the mobile phone when a hacking infiltration occurs in the server as part of the emergency measures when going out and leaving the office.

5) Daemon Administrator Mode Control Method

-Full confirmation mode

This method always monitors the operating status of all processors and transmits the information.

-Automatic confirmation mode

It only sends information about the processor that it determines to be an intrusion with a remote host IP.

-Pass IP setting method

Allows administrators to set a remote host IP to prevent alarms when remote management is required.

As described above, the present invention solves the difficulty of verifying the intrusion of the existing Linux system by monitoring at the kernel level of the Linux system, so that the administrator can immediately recognize the fact and respond quickly when the intrusion occurs. In particular, by verifying the user IP at the kernel level, the user can be identified without degrading the system's performance, and even if several intruders occur at the same time, the administrator can always know the system status accurately. In other words, real-time monitoring is most effective at the kernel level. According to the present invention, the monitoring daemon periodically checks the processor, which puts a burden on the system, but the kernel monitoring that confirms the processor startup has little effect on performance. In addition, monitoring in the kernel can monitor the startup of any processor that occurs, so that the administrator can inform the administrator in real time about the startup of programs, including the shell, after the shell has been acquired by an intruder. With the in effect, the existing intrusion detection system can detect the intrusion and prevent the blockage of the inability to automatically block the function.

Claims (5)

A method for detecting external intrusions in a computer system in which a local client or a remote client can access a computer server using a Linux operating system, A first step of retrieving an environment variable including program driving information from a kernel to a Linux operating system when a program execution is requested from the client; A second step of analyzing the log name of the environment variable, obtaining a remote host IP of the client to generate an intrusion detection information file, and transmitting a signal to the daemon when a remote client having root authority is detected; A third step in which the daemon reads the intrusion detection information file and judges illegal intrusion if the remote host IP is not allowed when the signal is received; And If it is determined that the intrusion is illegal, Linux kernel-based real-time detection comprising the fourth step of stopping the execution of the program, transmitting an alarm signal to the intrusion monitoring control device and notifying the administrator of the intrusion detection fact Way. According to claim 1, wherein the intrusion detection information file Define a file called intrusion detection information (idsinfo) in the processor directory entry (proc_dir_entry) structure, and register the intrusion detection information (idsinfo) file in the processor (proc) file system using the processor registration (proc_register) function, and the processor file directory. Linux kernel-based real-time detection method, characterized by the location (/ proc / idsinfo). The method of claim 1, wherein the real-time detection method In full verification mode Monitor and monitor the operating status of all processors, In the 'auto verification mode' method, only the information of the processor determined to be an intrusion with the remote host IP is transmitted. In the 'pass through IP configuration' method, Linux kernel-based real-time detection method, characterized in that the administrator can set the remote host IP (remote host IP) to prevent the alarm when the remote management from the outside. The method of claim 1, wherein the fourth step Linux kernel-based real-time detection method characterized in that the notification by using any one or more of the intrusion detection control device equipped with an alarm bell or a warning light, e-mail or mobile phone text message. delete