KR100518119B1 - Secure Solution System based on Network - Google Patents

Abstract

The present invention relates to a network-based security solution system capable of acquiring and analyzing attack information as well as active induction of an intruder by interlocking an intrusion detection system (ID), a honeypot system, an induction induction switch system, and a management console system. In this paper, we propose a security solution system that integrates the integrated IDS and honeypot to secure new independence information and improve the performance of individual systems by integrating each performance while ensuring maximum independence between systems.

When an attacker attacks a business server in a safe area on an external public network, the intrusion detection system detects it and sends the information of the attacker's packet to the intrusion switch. The intrusion switch system honeypots the attacker's attack packet. Transfer it to the system. The honeypot system responds to the attacker by impersonating the business server, and the attacker performs the attack in the honeypot. At this time, the attacker's attack process is transmitted to the management console system to collect attack information and attack-related records.

Description

Network based security solution system {Secure Solution System based on Network}

The present invention relates to a security system, and more particularly, to induce an intruder by integrating an intrusion detection system (IDS), a honeypot system, an intrusion induction switch system, and a management console system. Rather, it relates to a network-based security solution system capable of acquiring and analyzing attack information.

The proliferation of the Internet, the increasing dependence on information, and the increasing value of information have increased the possibility of outside intrusion through the network, and the leakage and destruction of information by insiders continues to increase. Accordingly, computer systems and networks are protected by various security systems, and authentication systems, data encryption systems, and firewalls are widely known.

On the other hand, in order to protect the system from the exponentially increasing number of hacking attempts, it is impossible to operate only by simple access control or intrusion prevention system. Therefore, different technologies from the aforementioned security systems were required, and IDS and virtual manned environments were automatically detected, reported, and responded to various intrusions occurring in the system or network to prevent attacks and prevent new attacks. Various types of security systems have been developed, such as the honeypot system to be gained and the fishbowl that can trace back intruders.

However, these new security systems are also less flexible about what kind of attacks to prevent. For example, IDS has the disadvantage of being helpless against new attacks, and fish bowl or honeypot systems have the disadvantage that active operation is not possible in the form of waiting for an attacker to connect to the system. In other words, due to the characteristics of the systems that exist independently, each system does not perform its function and still presents a problem. This is because each system must complement each other and achieve continuous performance improvement.

Under these circumstances, some projects such as Honeynet and Bait & Switch have been conducted overseas to integrate individual systems into a more integrated system. Efforts must be made to integrate and complement each other and form an active system.

Accordingly, the present invention proposes a security solution system based on a network in which an IDS and a honeypot system are interworked.

In the present invention, a new IDS and honeypot system for increasing the efficiency of the system, and an intrusion induction switch system for attracting an attacker's packet having an intention of intrusion into a honeypot system without an attacker's knowledge are presented.

In addition, the present invention provides a management console system for controlling the operation of the IDS, honeypot system and switch system and to provide more efficient intrusion information to the system administrator by interlocking information from the IDS and honeypot system.

Hereinafter, a preferred embodiment of the present invention will be described with reference to the accompanying drawings.

First, the bait & switch honeypot system closest to the system proposed in the present invention will be described in detail.

1. Related Research

In the case of IDS, a variety of products are released at home and abroad, and a variety of products such as honey trap systems (ManTrap: brand name) are also being released. In addition, research such as the Honeynet Project is underway. However, a system of the same type as the system proposed in the present invention has not been developed yet, but a bait & switch honeypot system is being studied as a form of honeypot system development.

The bait & switch honeypot system has been developed as an active system to compensate for the shortcomings of the existing honeypot system (Ref. [4]).

The bait & switch honeypot system is different from the existing mantrap system (Ref. [3]) or the honeynet project (Ref. [1]). The attacker can be guided to the honeypot system without the attacker's knowledge. In addition, the rerouting target source IP is selected based on the Snort rule to induce an intruder and rerouted from the second packet coming from the target IP, and an alpha version is currently released (Ref. [2]). .

However, the bait & switch honeypot system has the following problems.

-Correct users can be attracted to honeypot system

Attackers can attack other sites from honeypots

-Threat of denial of service

2. System configuration and design according to the present invention

The system proposed in the present invention is intended to interoperate with an IDS and a honeypot system, and is an active intruder attraction system that receives IDS packets, preferably a network-based intrusion detection system (NIDS). Monitor through. In particular, the attack signal of the attacker is used to lure the attacker to the virtual honeypot system using the routing system, and the attacker's intention and attack technique are grasped.

In addition, all information is analyzed through the control console and various intrusion information and technologies are applied, and new intrusion detection methods and attack techniques are applied to the system to quickly improve the performance of IDS and firewalls to protect important assets in the future and to prevent additional attacks. It is possible to secure the countermeasure technology.

3. System configuration according to the present invention

The system proposed in the present invention is largely IDS (100) that can detect the attack intention of the attacker in advance, intrusion induction switch system (200) that can attract the detected attacker's packet to the honeypot, the intruder's actions It consists of a honeypot system 300 that can be grasped and a management console system 400 that manages the overall systems, and has a structure as shown in FIG. 1.

As shown in FIG. 1, when an attacker attacks a business server in a safe area in an external public network, the intrusion detection system 100 detects it and information of the attacker packet (IP address, port information, etc.). To the intrusion induction switch system 200. The intrusion induction switch system 200 transmits the attack packet of the attacker to the honeypot system 300. The honeypot system 300 responds to an attacker by impersonating a business server, and the attacker performs an attack in the honeypot system 300. At this time, the attacking process of the attacker is transmitted to the management console system 400 to collect attack information and attack-related records.

IDS system (100):

By integrating the results using techniques such as misuse detection, it is an intrusion detection system that performs accurate intrusion detection and flexibly adapts to the network environment. By adding information on the intrusion result and the attack pattern from the honeypot system 300, the function can be improved to more effectively detect the intrusion of the attacker.

Intrusion Switch System 200

Induces a packet for a specific attacker's IP and service information detected from the IDS 100 to the honeypot system 300 in a large network environment, and responds to the attacker's IP and service request from the honeypot system 300 to the attacker. By sending back to the server, the attacker misunderstands that he is actually attacking the server he is trying to attack.

In a real network environment, most packets are normal packets and only some of the aggressive packets should be derived. To this end, a hierarchical intrusion induction switch concept as shown in FIG. 2 is introduced.

Honeypot System 300:

It consists of a virtual system that performs the same or similar function as the system to be protected. Provides services for the attacker's packet derived from the intrusion induction switch system 200 and secures the attacker's attack technology and attack tools such as generating a system log of a local attack as well as a keystroke of the connected attacker. . In addition, by automatically recovering the system damaged from the attacker, by limiting the attacker's ability to prevent the attacker to attack other systems using the honeypot system 300.

Management console system (400):

Analyzing and integrating the information from the IDS 100 and the honeypot system 300 allows the system administrator to identify the attacker's attack and increase the effectiveness of system management. In particular, the analysis of the attack trend (Trend) and the risk of the detected attack signal based on the information from the IDS (100). In addition, the latest attack technique and information can be obtained based on the information from the honeypot system 300, and information on the new attack technique can be obtained based on the correlation with the IDS information.

The scenario in which the system proposed in the present invention intends to operate is as follows.

It simulates a system to provide a specific service in a high speed network environment.

① When an unspecified attacker tries to attack a specific system, most attackers first check the system environment through well-known attack tools such as nmap.

② During the situation of ①, the IDS 100 detects the attacker's IP having the intention of attack and notifies the intrusion induction switch system 200.

③ After checking the environment of the system, the attacker discovers the weak point of the system and tries to break into the system. At this time, the intrusion induction switch system 200 induces the attacker to attack the honeypot system 300, not the actual system by inducing all packets from the attacker to the honeypot system 300.

④ Honeypot system 300 provides a function similar to the system to be protected. In addition, the attacker who succeeded in the attack monitors all actions performed by the honeypot system 300 for additional attacks, obtains attack tools, monitors the attacker's attack method, and obtains an attack technique.

⑤ All information from the IDS 100 and the honeypot system 300 is reported to the administrator through the management console system 400, the administrator grasps all the details to obtain and protect the attacker's attack technology and attack tools It supplements the weak point of critical system.

4. System configuration according to the present invention

The system proposed in the present invention is composed of a total of four parts, that is, IDS 100, intrusion induction switch system 200, honey pot system 300, management console system 400. Each system is uniquely versatile and can perform better in an integrated system. The design of each individual system is as follows.

Honeypot system 300 has the following functions.

Real-time hacker activity monitoring and notification (stealth mode)

-Damage system recovery management (automatic, manual)

-Support for researching the latest hacking techniques by preserving installation tools

-Reduced risk of attack base

-Induction switch interworking: SRC IP (Source IP) change function for outgoing packet (corresponding real server IP address)

3 is a detailed block diagram of a honeypot system according to the present invention. Referring to FIG. 3, the kernel of the system provides a function divided into a log module 310, a management module 320, and an SRC IP change module 330.

The log module 310 is a kernel rootkit (stealth mode) and performs functions such as a keystroke log, a process execution log, a file change monitoring / recovery log, and a login / logout log, and a keystroke log module 310a. , Process execution log module 310b, file change, recovery log module 310c, and login / logout log module 310d.

In addition, the management module 320 provides functions such as file list and recovery management, providing current process information by request, and remote manager interworking in the form of a kernel backdoor.

In addition, the SRC IP change module 330 performs the SRC IP change function for the transmission packet.

4 shows a design of an IDS system. The packet distribution module 110, the detection module 120 and the corresponding module 130 is largely composed. It also has its own repository (not shown), which allows you to set rules for tasks performed by each module or to store logs that occur. The function of each module is as follows.

Packet Distribution Module 110: Network Packet Capture, IP Optimization (Defragmentation), Packet Distribution

Detection module 120: packet analysis according to the detection engine configuration, TCP segment management, rule set and detection policy

Correspondence module 130: Analysis of correlation between detection results Accurate intrusion determination, optimized intrusion information notification based on notification policy Real-time notification target server management

5 is a detailed block diagram of an intrusion induction switch system, in which the induction induction switch system plays the largest role among the entire systems.

The intrusion induction switch system 200 should lure packets from the attacker's IP captured by the IDS 100 to the honeypot system 300 and ensure that most of the normal packets operate normally. Therefore, it has a distributed structure to ensure stability even in a system providing a large capacity of services and load balancing of the intrusion induction switch system. That is, the packet received from the network is divided into a main switch 210 which receives external network packets directly and a sub switch 220 that processes an attacker packet, and performs the following functions.

Main switch 210: the packet processing part performs a function of communicating with other systems and delivering the log. It also creates an IP / Port management table to manage the attacker's IP and ports.

Sub-switch 220: stores the log information and session information, and creates a table for each IP / port to deliver the packet information to the honeypot system 300.

FIG. 7 is a block diagram of a management console system, and is largely comprised of a management console 410, an event processing server 420, and a storage 430.

The management console 410 receives a log from the IDS 100 and the honeypot system 300 and shows a current state, and includes a monitor system 411, a viewer 412, and a controller 416.

The viewer 412 is divided into an IDS viewer 413 and a honeypot viewer 414. The IDS viewer 413 receives various information about an intrusion detection received from the IDS 100 and processes the event processing in the event processing server 420. To inform administrators about current and recent attacks. In addition, the honeypot viewer 414 receives a user's current connection from the honeypot system 300, keystroke information and process information of the user to provide a framework for analyzing the attack technology of the attacker in the honeypot system. do.

In addition, by correlating information between the IDS 100 and the honeypot system 300 based on the detected attacker's IP and attack time, an attack signal for a new attack technique is captured. By applying the rule obtained through the IDS 100 contributes to the performance improvement of the IDS.

The function of the management console 410 can be summarized into three major

Event processing: The event collected from the IDS 100 is stored, and the event processing is performed based on the filtered IDS log information to store the result.

IDS intrusion information analysis: Based on the information from the IDS (100) to check the information of the attacker invading the current system. The progress of the attack can be checked by the attack time, the source IP or the destination IP, or the importance of the attack. In addition, it is possible to grasp the latest attack trend by analyzing the recent attack growth rate and traffic growth rate.

Honeypot system log information analysis: The attacker's attack technology can be obtained by grasping the keystroke of the attacker who invades the honeypot system 300 and the processor performed by the attacker. In addition, it improves the manager's management ability by alerting the attackers according to their importance.

According to the present invention, it is possible to prevent an intrusion from an attacker by inducing an attacker packet to a honeypot system. In addition, it is possible to observe the attack behavior performed by the attacker using the honeypot system, so that the attacker can acquire new attack information, and the new attack information is fed back to the IDS, thereby improving IDS performance.

* references *

[1] Know your Enemy, http://www.honeynet.org, Project Honeynet

[2] Albert Gonzalez, http://www.violating.us/projects/baitnswitch, Bait & Switch Honeypot

[3] ManTrap: A Secure Deception System, Recuouse Technologies, Inc. 2001

[4] Aurobindo Sundaram, An Intruduction to Intrusion Detection, ACM, Inc. 2002

1 is an overall block diagram of a security solution system according to the present invention.

2 is a diagram illustrating a hierarchical intrusion induction switch concept.

3 is a detailed block diagram of the honeypot system of FIG.

4 is a detailed block diagram of the IDS of FIG. 1.

5 is a detailed block diagram of the intrusion induction switch system of FIG.

6 is a detailed block diagram of the management console system of FIG.

Explanation of symbols on main parts of drawing

100: IDS 110: packet distribution module

120: detection module 130: corresponding module

200: intrusion induction switch system 210: main switch

220: subswitch 300: honeypot system

310: log module 320: management module

330: SRC IP change module 400: management console system

410: management console 420: event processing server

412 viewer 416 controller

Claims (5)

In the network-based security solution system comprising an intrusion detection system for performing the intrusion detection of the attacker on the network to obtain the attack packet information of the attacker, and a honeypot system to impersonate the protected system against the attacker's attack, An intrusion induction switch system for inducing attack packet information of an attacker detected from the intrusion detection system to the honeypot system; And And a management console system for managing overall systems and performing attack type analysis and attack risk analysis based on information from the intrusion detection system and the honeypot system. The method according to claim 1, The intrusion induction switch system, A main switch configured to perform communication with other systems and transmit logs as a packet processing part, and to manage an attacker's IP / port using an IP / port management table; And A network-based security solution system comprising a sub-switch that stores log information and session information, and makes a table for each IP / port to deliver packet information to the honeypot system. 3. The network-based security solution system of claim 1 or 2, wherein the intrusion induction switch system is a hierarchical intrusion induction switch. The method according to claim 1, wherein the management console system, An event processing server for storing events collected from the intrusion detection system and performing an event processing process based on the filtered intrusion detection system log information; An intrusion detection system viewer that checks information of an attacker who invades the current system based on information from the intrusion detection system; And A network-based security solution system comprising a honeypot system viewer that acquires attacker's attack technology by grasping an attacker's keystroke and a processor performed by the attacker. The network-based security solution system of claim 4, further comprising controllers for respectively controlling the intrusion detection system, the inductive switch system, and the honeypot system.