KR100439169B1 - Attacker traceback method by using session information monitoring that use code mobility - Google Patents

Abstract

The present invention is directed to an attacker reverse tracking method that tracks a connection of a hacker and identifies a host that actually exists by detecting a direct intrusion attack of a hacker's host. It is about. The prior art can protect the domain to which a particular host belongs, but cannot identify the attacker. Therefore, since the attacker cannot respond to the attacker, the attacker may conduct a second and third attack against the same host via a host connected to a network different from the one used in the previous attack, in which case No action can be taken against this attack in the domain to which the host belongs. The present invention allows the attacker's location to be tracked against cyber attacks via other hosts on the Internet through session information management applying portability of code. Thus, more effective and proactive security is possible in network security. By tracking and coping with the attacker's position, it is possible to prevent the second and third attacks by the same attacker.

Description

ATTACKER TRACEBACK METHOD BY USING SESSION INFORMATION MONITORING THAT USE CODE MOBILITY}

The present invention relates to a method for backtracking an attacker through session data management using code mobility, and in particular, a direct intrusion into a host of a hacker globally performed. When an attack is detected, it is a method for backtracking an attacker that tracks a hacker's connection to identify a host that actually exists.

In general, network security is divided into a method for detecting a hacker intrusion to a specific host and a method for responding to a hacker intrusion.

Conventional network security techniques focus on how to effectively secure the security of the domain to which a particular host belongs. For example, an aspect of how to effectively detect an attack on a specific host of a corresponding domain and how to block an attacker's traffic at the entrance of his domain when detecting an attack on the specific host is performed. The focus is on protection.

This conventional technique can protect the domain to which a particular host belongs, but cannot identify the attacker. Therefore, since the attacker cannot respond to the attacker, the attacker may conduct a second and third attack against the same host via a host connected to a network different from the one used in the previous attack, in which case No action can be taken against this attack in the domain to which the host belongs.

1 is a network configuration diagram illustrating a conventional network security mechanism, wherein a firewall system 150 attacks a domain 180 including an intrusion detection system 160 and a security management system 170 from the Internet. It is configured to block.

In the figure, when a predetermined attacker attacks the domain 180 through the external Internet 110, the intrusion detection system 160 installed in the domain 180 notifies the security management system 170 of the attack. .

Security management system 170 is notified of the attack from the intrusion detection system 160 operates the firewall system 150 installed at the entrance of the domain 180 to block the traffic of the attacker connected through the Internet (140) .

In the case of FIG. 1 described above, the domain 180 can be protected from an attacker who enters through the Internet, but when the attacker changes the route host again, the attacker cannot block the traffic of the attacker. There is no choice but to allow such attacks.

The present invention has been made to solve the above problems, the session information management to apply the portability of the code to track the attacker's location in the cyber attack via another host on the Internet through the session information management applying the portability of the code Its purpose is to provide an attacker traceback method through the.

In order to achieve the above object, the present invention provides a communication sensor including a domain management server and a plurality of hosts, each of which is connected to the Internet, the monitoring sensor comprising a code for monitoring a session of a host. A first step of sending each to the hosts through the Internet and mounting them on the hosts to monitor each session of each host; And a second step of searching for the next host corresponding to the attacker's path by referring to each session information monitored by the monitoring sensor mounted on each host when the specific host is attacked.

1 is a network diagram showing a mechanism in which a conventional network security is performed,

2 is a network diagram showing an operation flow of a network security mechanism when the network environment to which the present invention is to be applied and actually applied;

3 is a schematic diagram showing an execution structure to be equipped to ensure the execution when the tracking sensor is executed by moving each host according to the present invention,

4 is a flowchart illustrating a step-by-step procedure of mounting a monitoring sensor on a specific host to monitor session information indicating a connection with a counterpart host in each host according to the present invention;

Figure 5 is a flow chart illustrating a step-by-step operation of backtracking the position of a hacker in accordance with the present invention.

<Description of the symbols for the main parts of the drawings>

280: tracking sensor 281: monitoring sensor

290: attacker host 291: via host

292: Domain Management Server 293: Damaged Host

FIG. 2 is a diagram illustrating a network environment to which the present invention is applied and an operation flow of a network security mechanism when the present invention is actually applied. Is configured to monitor each session of each host and provide attacker access path information to the tracking sensor 280 when an attacker access path information request of the tracking sensor 280 is made. The attacker connection path information is, for example, location information of a host that the attacker has just passed through.

In the figure, firstly, the monitoring sensor 281 is a fixed program code, which is mounted on each host 290, 291, 293 via the Internet to each session of each host 290, 291, 293. Monitor each of them. The tracking sensor 280 is used by an attacker for the first time while collecting connection path information about a host that was previously previously passed by an attacker provided on demand by a monitoring sensor 281 mounted on each host 290, 291, and 293. Trace back the location of the host. The sensor is a mobile code generally used, and can be sent to and mounted on each host connected to the Internet.

For example, if the intrusion prevention system detects that the victim host 293 is attacked through the Internet, the intrusion prevention system notifies the domain management server 210 of the attack.

When the domain management server is notified of the attack from the intrusion prevention system, it transmits 212 to the host 293 to the tracking sensor 280.

The tracking sensor 280 obtains (213) the location information of the host 291 that the attacker has just passed through from the monitoring sensor 281 at the victim host 293 and moves through the Internet to the via host 291 via the Internet (220). , 231). At this time, when moving across the domain is authenticated for performing the traceback of the tracking sensor 280 from the domain management server 292 (221, 230).

The tracking sensor 280 obtains the location information of the host that the attacker had just passed through from the monitoring sensor 281 at the passthru host 291 and moves through the Internet to the hacking host so that the attacker logs in and is working on the attacker. Trace host 290.

Here, the plurality of hosts 290, 291, and 293 are periodically accessed through the Internet to manage the integrity of the codes constituting the monitoring sensor 281.

3 is a schematic diagram showing an execution structure to be provided to ensure execution when the tracking sensor 280 moves and executes each of the hosts 290, 291, and 293 according to the present invention. 360 and an operating system 380 exist, and a general application program 370 runs on an operating system. The operating system 380 is a program such as Windows NT for operating a host. The operating system 380 is stored in a hard disk drive (HDD) in a host and executed when the host is first booted. It is mounted in a memory (main memory) or the like.

The sensor execution engine 330 is provided on each operating system 380 of each host 290, 291, 293 to provide an independent execution environment to the sensor 310 for reverse tracking. An operating system interface 350 interfaces the operating system 380 with the sensor execution engine 330 and the application program 370. The sensor execution engine 330 includes a sensor execution library 340 necessary for performing a function of the sensor 310 itself. Looking at the function of the sensor execution library 340, the sensor 310 security function for the security of the sensor 310 itself on the movement of the sensor 310, the sensor 310 for managing the generation and destruction of the movement of the sensor 310 There is a management function, a sensor 310 communication function for communication between the sensors 310 and the like. The sensor 310 is provided on the sensor execution engine 330 by receiving the function of the sensor execution engine 330 required to be executed through the sensor application program interface (API) 320.

4 is a flowchart illustrating a step-by-step procedure of mounting a monitoring sensor on a specific host to monitor session information indicating a connection with a counterpart host in each host according to the present invention.

First, the type of the host on which the monitoring sensor is mounted is determined (step 420).

As a result of determining the type of the host in step 420, when a new technique for monitoring is developed, the domain management server of the host on which the monitoring sensor is mounted generates a monitoring sensor suitable for the type of the host (step 430).

The monitoring sensor generated in the domain management server is stored and the step 420 is performed (440).

As a result of determining the host type in step 420, if the host on which the monitoring sensor is to be mounted is a new host, the host is queried for its operating system and application type (step 460).

The appropriate monitoring sensor is selected according to the query response (step 470).

The selected suitable monitoring sensor is moved to the querying host (step 480).

The selected suitable monitoring sensor is mounted on the sensor execution engine of the querying host (step 490).

5 is a flowchart illustrating a step-by-step operation of tracking the position of a hacker according to the present invention.

First, the security management system determines whether the intrusion detection system detects an intrusion when the host of the domain to which the domain belongs is attacked (step 510).

The security management system generates a backtracking sensor when the intrusion detection system detects an intrusion (step 520).

The security management system moves the generated backtracking sensor to the intrusion target host under attack (step 530).

The reverse tracking sensor moved to the intrusion target host inquires the attacker's previous path information to the monitoring sensor monitoring the session at the intrusion target host (540).

The backtracking sensor receives the attacker's previous path information from the monitoring sensor and determines whether the next host corresponding thereto is present in a domain different from its own domain (step 550).

If the next host exists in another domain, the management server of the other domain is requested to authenticate the reverse tracking sensor (560).

The backtracking sensor moves to another host in another domain (step 570).

The reverse tracking sensor queries the monitoring sensor mounted on the other host for the next host path on the reverse tracking path and performs step 550.

If the next host exists in the same domain, the backtracking sensor notifies the security management server of the domain where the victim host is located (590).

In the present invention, when the function of the code is upgraded, it is moved to each host in the corresponding domain through the management server of each domain.

The present invention described above allows the attacker's location to be tracked against cyber attacks via other hosts on the Internet through session information management applying portability of code. Thus, more effective and proactive security is possible in network security. By tracking and coping with the attacker's position, it is possible to prevent the second and third attacks by the same attacker. By identifying the location of the attacker, it is possible to respond to the attacker on a global level, thereby dramatically improving the ability to cope with cyber attacks. By providing mobility to code that performs security-related functions, it provides a way to perform effective security functions on a global level by performing additional functions appropriate to each host environment. By embedding the execution engine of the moving code on each host, improvements or new features can be quickly and efficiently applied to the entire security architecture.

Claims (6)

In a communication system in which a plurality of domains each having a domain management server and a plurality of hosts are each connected to the Internet, A first step of monitoring each session of each host by sending a monitoring sensor comprising a code for monitoring a session of the host to the respective hosts through the Internet and mounted on each host respectively; When a specific host is attacked, the session information applying the mobility of the code includes a second step of searching for the next host corresponding to the attacker's path and tracking the attacker by referring to the session information monitored by the monitoring sensor mounted on each host. How to track down attackers through management. The method of claim 1, The execution structure for performing the reverse tracking may include: a sensor for reverse tracking for performing the reverse tracking; A sensor execution engine mounted on each operating system of each host to include a sensor execution library necessary for performing a function of the sensor itself, and to provide an independent execution environment to the sensor; The attacker reverse tracking method through the session information management to apply the mobility of the code, characterized in that the operating system interface to interface between the operating system, the sensor execution engine, the application program. The method of claim 1, Mounting the monitoring sensor to a specific target host, step 31 of determining the type of the specific target host; In operation 32, when a new technique for monitoring is developed, the domain management server of the specific target host generates a monitoring sensor suitable for the type of the specific target host; A thirty-third step of storing the generated monitoring sensor in the domain management server and performing the thirty-first step; A thirty-fourth step of querying the specific target host for its operating system and application type when the specific target host is a new host as a result of determining the type of the host; Step 35 of selecting a suitable monitoring sensor according to the query response; And a 36 th step of mounting the selected appropriate monitoring sensor on the specific target host. 4. The session according to any one of the preceding claims, further comprising the step of managing the integrity of the code while periodically accessing the plurality of hosts through the Internet. How to track down an attacker through information management. The method according to any one of claims 1 to 3, wherein, when the function of the code is upgraded, the code is moved to each host in the corresponding domain through each domain management server to upgrade the function of the code mounted on each host. Attacker backtracking method through the session information management to apply the portability of the code, characterized in that it further comprises. 4. The method according to any one of claims 1 to 3, further comprising the step of performing an authentication procedure for attacker traceback when the next host corresponding to the attacker path is in a different domain than itself. Attacker traceback method through session information management applying portability of code.