KR100432421B1 - method and recorded media for attack correlation analysis - Google Patents

Abstract

The present invention relates to a method for analyzing an association for an attack that generates an association data between attacks by analyzing the characteristics and correlations of the intrusion detection data in order to support an effective response by constructing intrusion detection data as a knowledge base for the entire network. will be.

An association analysis method for an attack according to the present invention performs an association analysis such as repeatability analysis of an attack, similarity analysis of an attack, potential analysis and statistical behavior analysis of an attack subject and an attack target, By generating various correlation analysis data and performing knowledge base construction function of intrusion detection data, it is possible to establish more effective response strategy by providing various analysis data on current attack based on the established knowledge base. do.

Description

Method for analyzing correlation and recording media for attack {method and recorded media for attack correlation analysis}

The present invention relates to a method for analyzing an association for an attack and a recording medium therefor. Specifically, in order to support an effective response by constructing an intrusion detection data as a knowledge base for an entire network, characteristics and correlations of the intrusion detection data are supported. The present invention relates to an association analysis method for an attack that generates correlation data between attacks and a recording medium therefor.

Protecting your knowledge and services in a situation where everyone is free to use the network today is a natural and necessary task. However, constraints are not the only solution in network defense.

The main challenge of network defense is to open the way for free users to good users by restricting only certain intrusions or attacks.

However, to date, intrusion detection and response for network security has only taken a predefined response to specific attacks. This means that countermeasures are already prepared for known attack patterns, which means that only inflexible countermeasures can be made without considering the fluidity of the networks used by various users. However, the uniform response that does not take into account the risk of the attacker, the importance of the target resource, and the statistical / probabilistic possibility only emphasizes the control over the use of the network, and responds to a more flexible network situation. There is a problem that is lacking.

The present invention has been made to solve the above-described problems, and beyond the uniform response that does not consider the fluidity of the network situation by various users, the construction of intrusion detection data into a knowledge base for a more flexible network use and The purpose of this study is to provide a method for analyzing the relationship of the attack and a recording medium for it, which can provide various analysis and statistical / probabilistic analysis data on the current attack.

According to the association analysis method for an attack according to the present invention for achieving the above object, in the association analysis method for an attack through a network, if intrusion or attack detection data is received through the network, repeatability for intrusion or attack Analyzing the similarity of the attack, the potential for the attack subject and the target of the attack, and the relation for the statistical behavior; Calculating correlation analysis data for the generated attack based on the analysis result; And building a knowledge base of the intrusion detection data based on the calculated correlation analysis data.

In addition, according to the recording medium for performing the association analysis method for an attack according to the present invention, in order to perform the association analysis method for an attack, a program of instructions that can be executed by the digital processing device is implemented tangibly, In a recording medium that can be read by a digital processing apparatus, when intrusion or attack detection data is received through a network, the repeatability of the intrusion or attack, the similarity of the attack, the potential for the attack subject and the target of the attack target, Analyzing the association for statistical behavior; Calculating correlation analysis data for the generated attack based on the analysis result; And building a knowledge base of the intrusion detection data based on the calculated correlation analysis data.

In addition, in the present invention, the attack correlation analyzer builds a knowledge base for all intrusion data detected on the network and avoids generation of intrusion detection data in order to circumvent the static response by the intrusion data itself detected as before. It provides analysis data to establish more appropriate responses through various analysis results using the knowledge base.

Network intrusion detection monitors the packets on the network and determines whether the packets are legitimate or not, and determines that the packets are not intrusion or attack.

1 is a schematic block diagram of a network security system consisting of an attack correlation analyzer and an intrusion detection sensor according to the present invention;

2 is a conceptual diagram illustrating input and output data for an attack correlation analyzer of FIG. 1;

3 is a flowchart illustrating operations performed when intrusion detection data is generated in an attack correlation analyzer according to the present invention.

* Description of the symbols for the main parts of the drawings *

1; Intrusion Detection Sensor 2; Attack Correlation Analyzer

3; knowledge base

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a schematic block diagram of a network security system including an attack correlation analyzer and an intrusion detection sensor according to the present invention.

Referring to the drawings, the intrusion detection sensor 1 of the present invention performs a function of determining whether an intrusion is compared to an attack pattern on a packet on a network connected to the self, and in case of determining that the intrusion is an intrusion detection data, an attack correlation analyzer To (2).

Basically, the attack correlation analyzer 2 receives intrusion detection data from one or more intrusion detection sensors 1, and the attack correlation analyzer 2 and the intrusion detection sensor 1 may be mounted in a single system or may be separately installed. It can also be present in the system. In this case, a description thereof will be omitted in the present invention with respect to the mutual connection method.

FIG. 2 is a conceptual diagram for describing input / output data of the attack correlation analyzer 1 of FIG. 1. Referring to FIG. 2, the attack correlation analyzer 2 receives the intrusion detection data from the intrusion detection sensors 1 as mentioned above, and the attack correlation analyzer 2 builds the knowledge base 3 based on this. In addition, the association analysis is attempted using the established knowledge base 3, and as a result, the association analysis data is calculated.

3 is a flowchart illustrating an operation performed when intrusion detection data is generated by an attack correlation analyzer according to the present invention.

As shown in the figure, repeatability analysis, similarity analysis, potential analysis, statistical behavior analysis, etc. are performed from intrusion detection data. As a result of the above analysis, the correlation analysis data is calculated, and the received intrusion detection data is applied to the knowledge base again.

Repeatability analysis step (S1) is performed to evaluate whether the same attack occurs frequently and continuously. Repeatability analysis measures the frequency of occurrence of the same attack and the same service attack against the same intrusion data.

Here, the same attack means that the same attack is performed, and the same service attack means not only the same attack but also the target service.

For example, if a TCP SYN Flooding attack occurs, the repeatability analysis step analyzes the frequency of TCP SYN Flooding among intrusion data from the same attacker and calls it the same attack frequency, and if the target service of the current attack is FTP Among the same attacks, the frequency of intrusions where the target service is FTP becomes the frequency of the same service attack.

In the similarity analysis step (S2), an attempt is made to analyze similar but not similar attack behaviors. This is measured for similar frequencies except when the attacking subject and the target are the same as in the repeatability analysis.

That is, the frequency of the same attack, the frequency of the attack from the same subject, the frequency of the attack against the same target, the frequency of the attack against the same service, and the frequency of the attack against the same service without the distinction between the subject and the target. Analyze

In the potential analysis step (S3), the potential of the attack is analyzed, which is classified into a subject potential analysis, a target potential analysis, and a subject / target potential analysis.

This potential analysis is performed to evaluate the potential risk of the attack subject, the potential vulnerability of the attack target, and the potential for the attack subject to attack against the attack target. The subject potential analysis analyzes the total attack frequency, the same attack frequency, the type and frequency of the attack attempted by the subject most frequently, and the target service.

Target potential analysis analyzes the total attack frequency received by the target, the same attack frequency, the most frequently received attack and the frequency, and the target service. The subject / target potential analysis analyzes the total attack frequency between the subject and target, the same attack frequency and the most frequent attacks, their frequency, and the target service.

In the statistical behavior analysis step (S4) statistically predicts the possibility of the next attack and the attack method. It is composed of subsequent attack possibility analysis, sequential attack probability analysis, sequential subject attack probability analysis, and sequential subject / target attack probability analysis.

The attack possibility analysis analyzes the result of accumulating the probability of the next attack occurring after a specific attack in the knowledge base without sequentiality. For the purpose of future attack analysis, if any attack occurs, investigate whether there is a previous attack prior to the attack, and if there is a previous attack, the current attack information accumulates in the knowledge base as the possibility of future attack of the previous attack. do.

Based on this accumulated knowledge base, the possibility of future attacks on the current intrusion detection data is analyzed based on the percentage.

For example, we analyze the statistical possibilities for the next attack after A, 60% for B, 20% for C, and 15% for D.

In contrast, the sequential attack probability analysis considers the sequentiality of the attack. In the previous example, the attack before the A attack is considered for the probabilistic analysis after the A attack. This is because sequentiality emphasizes continuity of attacks, whereas future attack possibility analysis does not consider the sequentiality of attacks, but focuses only on probabilistic analysis of the next attack.

In the previous example, as a result of the subsequent attack possibility analysis, in the next attack possibility after the attack A, the attack of B is 60%, the attack of C is 20%, and the attack of D is 15%, etc. Analyze the likelihood of future attacks predicted after sequentiality that occurred. That is, if an attack of X-> Y-> Z is attempted before A attack, sequential attack probability analysis analyzes the probability of the next attack after X-> Y-> Z-> A attack.

Sequential subject attack probability analysis is the result of limiting the knowledge base data of sequential attack probability only to the attack subject, and sequential subject / target attack probability analysis is similarly the result of limiting the knowledge base data to the attack subject and target only.

That is, sequential subject attack probability analysis is performed to measure the behavior pattern of the attack subject, and sequential subject / target attack probability analysis is performed to analyze the attack behavior pattern from the attack subject to the target resource.

Afterwards, the intrusion detection data is constructed as a new material of the knowledge base in the knowledge base construction step (S5). In other words, intrusion detection data is constructed as data for analyzing various statistical behaviors along with repeatability analysis, similarity analysis, and potential analysis. This means that the attack correlation analyzer analyzes the attack using the knowledge base and also builds the knowledge base.

As a result of this execution process, the attack correlation analyzer calculates repeatability analysis data, similarity analysis data, potential analysis data, and statistical behavior analysis data for the current attack. This data is eventually used to formulate a response strategy for network intrusion, enabling a more effective response.

As described above, network security must consider a fairly flexible network situation. In other words, with a predefined response to a specific attack, it is virtually difficult to perform the best response by properly reflecting a fluid, organically active network situation.

According to the present invention, the knowledge base builds more diverse and in-depth information as the time accumulates for the fluid network situation, and the attack correlation analyzer presents various analysis data on the attack using the knowledge base thus constructed. .

Repeatability analysis or similarity analysis can be used to limit intrusion data generation or to reduce or group intrusion at the response level, and the potential analysis can analyze the intention and risk of the attacker, and analyze the vulnerability of the target. . In addition, statistical behavior analysis can be used to anticipate future attacks and prepare appropriate response strategies.

In other words, the attack correlation analyzer provides a variety of analysis data on current attacks based on a pre-established knowledge base on intrusion detection data collected from intrusion detection sensors, enabling the establishment of a more effective response strategy.

Claims (6)

In the association analysis method for attacks through a network, When intrusion or attack detection data is received through the network, analyzing the repetition of the intrusion or attack, the similarity of the attack, the potential of the attack subject and the target of the attack, and the association of the statistical behavior; Calculating correlation analysis data for the generated attack based on the analysis result; And And establishing a knowledge base of intrusion detection data based on the calculated correlation analysis data. The method of claim 1, wherein in the analyzing the association, The relevance to the attack for analyzing the recurrence of the attack by measuring the frequency of occurrence of the same attack or the same service attack on the same intrusion data with respect to the repeatability of the intrusion or attack, the subject and the target of the intrusion detection data Analytical Method. The method of claim 1, wherein in the analyzing the association, For the similarity of the attack, the frequency of occurrence of the same attack, the frequency of the attack from the same attack subject, the frequency of the attack to the same target, the frequency of the attack on the same service, the same attack and the same service, without distinguishing between the attack subject and the target. Correlation analysis method for an attack that analyzes the occurrence of a similar attack by measuring at least one or more of the frequency of attack. The method of claim 1, wherein in the analyzing the association, Subject potential analysis that analyzes the total attack frequency of the attack subject, the same attack frequency, the attack type and frequency that the subject attempted most frequently, and the target service with respect to the potential of the attack subject and the target of the attack target; Target potential analysis, which analyzes the total frequency of attacks received by the victim, the same frequency of attack, the frequency and frequency of the attacks most frequently received, and the target service; And Measure the potential risk of an attack with at least one of the total frequency of attack between the subject and target, the same attack frequency, and the subject / target potential analysis that analyzes the most frequent attacks, their frequency, and the target service. Association analysis method for attack. The method of claim 1, wherein in the analyzing the association, remind A subsequent attack possibility analysis for analyzing the statistical behavior of a result of accumulating the probability of the next attack to occur after a specific attack in the knowledge base without sequentiality; Sequential attack probability analysis, which analyzes the possibility of future attacks predicted in consideration of the sequentiality of the attacks; Sequential subject attack probability analysis to estimate the behavioral pattern of attack subjects by limiting knowledge base data of sequential attack probability to attack subjects only; And Calculate statistical / probabilistic prediction data of an attack by analyzing at least one of the sequential subject / target attack probability analysis that analyzes the attack behavior pattern from the subject to the target resource by limiting the knowledge base data only to the subject and target. Association analysis method for attack. In order to perform an association analysis method for an attack, a program of instructions that can be executed by a digital processing apparatus is tangibly implemented, and in a recording medium that can be read by a digital processing apparatus, When intrusion or attack detection data is received through the network, analyzing the repetition of the intrusion or attack, the similarity of the attack, the potential of the attack subject and the target of the attack, and the association of statistical behavior; Calculating correlation analysis data for the generated attack based on the analysis result; And And establishing a knowledge base of the intrusion detection data based on the calculated correlation analysis data.