KR100523483B1 - The system and method of malicious traffic detection and response in network - Google Patents

Abstract

The present invention relates to a system and method for detecting and responding to harmful traffic in a network. The system monitors a change in traffic flowing into a security node system in an active network security framework, and transmits a traffic to a security management system when a change is detected. Monitoring unit; Hazardous traffic tracking to determine whether or not to track harmful traffic, and transmits to the security node system; And a harmful traffic tracking unit that detects an IP address having an out-of-reference traffic component, detects and blocks the out-of-reference traffic transmitted from the IP address on the security node system where the IP address is located, and delivers the result to the security management system. It features. According to the present invention, harmful traffic such as bandwidth-consuming distributed denial of service attacks can be detected early, and the source thereof can be traced to block the source.

Description

{The system and method of malicious traffic detection and response in network}

The present invention relates to network security, and more particularly, to a harmful traffic detection and response system and method for detecting and responding to harmful traffic that causes traffic congestion of a network on a security framework using an active network.

Recently, as the cyber attack through the Internet becomes more diverse and complicated, it is difficult to detect and respond effectively to a single security system. Therefore, integrated security management technology and integrated control systems have been proposed to organically associate and automatically manage single security systems. However, the passive security management system that centrally manages only a limited single security management area has difficulty in preventing cyber attacks through the global wide area network of the Internet.

Moreover, Distributed Denied Of Service (DDoS) attacks are considered a very serious network security problem. DDoS attacks are difficult to distinguish from normal traffic, making it difficult to predict in advance, and the magnitude of damage is very large across the network. In addition, the majority of DDoS attacks are evolving into a bandwidth-consuming attack that depletes resources of the entire network by introducing a large amount of harmful traffic into the network, causing serious problems not only in terms of network security but also in managing existing network resources. have. In particular, even if the DDos attack blocks the harmful packet in the attacker's domain, since the harmful traffic flows into the delivery network, congestion and resource depletion of the entire network are not solved. Therefore, serious problems are emerging that cannot be solved by existing local security structures. In light of this situation, there is no practical way to fully predict and respond to all DDoS attacks, but a detection / response technique is needed to minimize the loss of network resources and services due to DDoS attacks.

This requires an active and intelligent response technology that can detect harmful traffic in advance and block harmful traffic at the first entry point of the hacker domain or security management area that transmits harmful traffic. This functionality requires a flexible, dynamic, decentralized and collaborative active security management mechanism rather than the traditional passive and static integrated management approach.

The technical problem to be achieved by the present invention is to provide a harmful traffic detection / response system in the network to detect and respond to harmful traffic causing traffic congestion in the network, such as distributed denial of service attacks on a security framework using an active network There is. That is, an object of the present invention is to detect and track harmful packets causing traffic congestion of a network in real time on a network security framework using an active network to block corresponding harmful traffic at an initial access point to which harmful packets flow.

Another technical problem to be solved by the present invention is to detect and respond to harmful traffic in a network that enables detection and response of harmful traffic causing traffic congestion in a network such as distributed denial of service attacks on a security framework using an active network. To provide.

In order to achieve the above technical problem, a harmful traffic detection / response system in a network according to the present invention includes an active network security framework including at least two distributed security management areas, wherein the security management area is an access point of a wide area network. Security node system which is located at and performs security function, and includes security management system that responds to security violations occurred in security management area and controls security status, and monitors the change of traffic flowing into the security node system. A traffic monitoring unit for transmitting event information about the traffic change exceeding a predetermined reference value to a security management system of the security management area; A harmful traffic tracking management unit for determining whether to track harmful traffic from the event information delivered to the security management system and transmitting the harmful traffic to the security node system; And detecting a source IP address and a destination IP address having a traffic component exceeding a predetermined reference value, and analyzing the traffic transmitted from the source IP address on a security node system located in a security management area where the source IP address is located. And a harmful traffic tracking unit that detects and blocks traffic exceeding a predetermined reference value and delivers harmful traffic detection and response results to the security management system in the corresponding security management area. In addition, it is preferable that the harmful traffic detection and response system in the network further includes a harmful traffic blocking report unit for notifying the active security management system that initially requested harmful traffic tracking of harmful traffic detection and response results.

In order to achieve the above another technical problem, harmful traffic detection and response method in a network according to the present invention includes monitoring the change in the traffic of the network and transmitting event information on the detected traffic change exceeding a predetermined value. Stage 1; A second step of determining whether to track harmful traffic by receiving the event information; And a third step of detecting a source address of the traffic exceeding the predetermined reference value if it is determined that tracking is necessary, analyzing the traffic transmitted from the source address, and then blocking the traffic exceeding the predetermined reference value. It is characterized by.

The second step detects the source IP address and the destination IP address of the traffic exceeding a predetermined threshold, and analyzes the traffic transmitted from the source IP address for each service port in a predetermined system on the network where the source IP address is located. After that, it is preferable to block traffic exceeding a predetermined threshold.

The harmful traffic detection and response method in the network may further include notifying the system that requested the harmful traffic tracking of the harmful traffic detection and response result of the third step.

In order to achieve the above another technical problem, a method for detecting and responding to harmful traffic in a network according to the present invention includes an active network security framework including at least two distributed security management areas, wherein the security management area includes a wide area network. When a security node system including a security node system located at an access point and a security management system that responds to a security breach occurring in a security management area and controls a security state is monitored, changes in traffic flowing into the security node system are monitored. A first step of transmitting event information on the security management system when a traffic variation exceeding a predetermined reference value is detected; Determining whether harmful traffic is tracked from the event information delivered to the security management system, and generating a harmful traffic tracking sensor and transmitting the harmful traffic tracking sensor to a security node system located in the management domain; And detecting a source IP address and a destination IP address having a traffic component exceeding a predetermined threshold value, replicating and transmitting itself to the security node systems on the local network where the source IP address is located, and migrating to the corresponding active security node system. Afterwards, a third step of analyzing traffic transmitted from the corresponding source IP address for each service port and detecting and blocking traffic exceeding a predetermined reference value may be included.

The second step is to determine whether or not to track harmful traffic from the event information delivered to the security management system, create a harmful traffic tracking sensor and transmit it to the security node system located in the management domain, and the harmful traffic detection and response results to the corresponding security management It is preferable to further include the step of delivering to the security management system in the area, and the result of harmful traffic detection and response to the security management system that initially requested the harmful traffic tracking. The event information is preferably transmitted to the security management system through the traffic audit sensor.

A computer readable recording medium having recorded thereon a program for executing the invention described above is provided.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention. A preferred embodiment of the present invention operates on a network security framework using an active network. Therefore, the network security framework using the active network will be described first.

In order to overcome the problems of the prior art described above, the future security infrastructure should be able to cooperatively and cooperatively manage security between multiple distributed security management areas, and be flexible and open to easily accommodate new security mechanisms and protocols. It should be able to provide security mechanisms. Active security management framework using active network is required as a security infrastructure that can reflect the requirements of the change of security environment. In other words, future network security infrastructures will proactively extend the current security infrastructure to provide wide-area networks that provide defensive security within a single network, and will be able to apply new security mechanisms more flexibly and dynamically. You need to be able to provide security, and you need to provide intelligent security that can respond more quickly and sensitively to changes in your network security environment.

First, the active security technology will be described. The necessary element technologies to satisfy the requirements of active security technology are as follows. The first is the security management function, which operates in wide area networks such as the Internet, in the security management of certain limited internal networks. Secondly, it is a mutually collaborative function between security management domains (domains). Third, it is a flexible security infrastructure that can dynamically adopt detection and response mechanisms for new attacks without changing the system. Fourth, it is an active response technology that identifies and monitors intruders who have executed network attacks and isolates them from the network by security policy. Fifth, it actively monitors the security status of the network and is sensitive to changes in the security environment. A technique for realizing a security mechanism and a framework that satisfies the above requirements is called an active security technique. 1 illustrates an active security management framework and mechanism.

Next, the active security management framework will be described. An active security management framework using an active network is composed of an active security node 100 that provides an active networking function on a subscriber network as shown in FIG. 1 and an active security management system 110 that controls them. Form one security management domain. In addition, each security management domain is distributed across the entire network and does not have a separate management layer for interworking and collaboration. That is, all active security control is performed through active packets, and interworking and collaboration between security domains are also performed by active packets.

2 illustrates an active security system platform structure. The active security node is equipped with an active sensor processing engine capable of receiving and executing a mobile security sensor as shown in FIG. 2, and an active security management system is additionally equipped with an application for active security management. Each component of the active security management framework is described and the major functions for each are as follows.

First, active networking will be described. The development of network protocols, which are the basis of communication between nodes on a network, is very slow, while the advances in computer computing, the spread of the Internet, and the emergence of new network applications, such as the World Wide Web. This is because protocol standardization to secure interoperability between networks is very slow compared to new technology development. Standardization work by standardization organizations such as IETF, ISO, etc. takes a lot of effort and time, and even if a protocol is specified, it takes more time to apply and operate on the actual network. In order to solve this problem on the Internet, Defense Advanced Research Project Agency (DARPA) proposed the concept of active network as a technology to realize a flexible and high-performance network.

An active network is a network in which a router or a switch capable of executing a mobile program transmitted through a packet switching network is arranged so that the mobile program included in the transmitted active packet can be appropriately calculated and processed according to service characteristics or user requirements. to be. In other words, the network architecture that gives the user the ability to program the network is called an active network. The network infrastructure (Infra) of the active security management framework consists of an active network. When using an active network, network security can be actively developed for the following reasons. First, routers or switches on a network can recognize and execute security response programs sent to them in a network processing step without a special protocol. Second, the security manager can programmatically control the security counterpart required in each node. In other words, security mechanisms on the network can be deployed and removed more flexibly and flexibly, and distributed network devices and security devices can be managed.

It is a new concept of security mechanism that can solve the problems of the existing static security mechanism that can interlock the security functions installed in the product development by the specified protocol and provide only the limited security functions. In order to provide an active network security framework that provides security control and collaboration between nodes deployed in a wide-area network, a complex hierarchy of security functions and multiple communications for communication between them are required. Protocol should be provided. The network security framework using an active network uses active packets instead of protocols, which simplifies the security structure and saves network resources by transmitting and executing the security functions themselves to security counterparts in the active packets.

Describes the active security management execution environment. In order to manage the security status of the network by using the mobile security sensor in the active network, each security system in the security management domain must be equipped with a function for recognizing and executing the mobile security sensor at the network layer. In addition, the active security management system should be equipped with an active security management engine for performing security management functions. As such, the active security management execution environment consists of a mobile security sensor processing block and an active security management block.

The mobile security sensor processing engine will be described. 3 illustrates functional blocks of a mobile security sensor processing engine and an active security management engine, and the functions of each block are as follows. The active packet processing unit 300 recognizes and receives the mobile security sensor transmitted in the form of an active packet at the network layer, passes it to the mobile security sensor execution unit, and encapsulates the newly created mobile security sensor into an active packet. Perform the function of sending to.

The Security Sensor Execution Enviornment 320 performs a function of receiving a mobile security sensor from an active packet processor and executing the same within a limited computing resource. If the code to be executed is not included in the sensor, it is downloaded from the code server and executed. Resource allocation required for the execution of the mobile security sensor and the function of transmitting the newly created mobile security sensor to the network are required for the active packet processing unit of the lower layer. The mobile security sensor 340 provides an executable mobility application that stores security response policy information or an execution program that should be actually executed at a security node in an active network.

The Security Enforcement Interface 310 performs a function of providing an abstracted interface for the mobile security sensor to collectively control security response functions of various heterogeneous nodes. In other words, the mobile security sensor provides unified interfaces for controlling the security countermeasures that are substantially implemented at the network node, such as packet filtering or blocking. The security response performing interface unit absorbs the difference in security response functions provided by each network node and provides a unified mobile security sensor development method by abstracting only common essential functions.

The active security management engine 330 is an application engine mounted in an active security management system. The active security management engine 330 performs an active security response to security violations reported from each security system in the security domain to monitor the security state of the network. It is a software engine that provides automatic control.

The active security management function manages all the information on the security response behavior generated by generating the mobile security sensor and transmitting it to the network or executing the received mobile security sensor. In addition, the network security status information collected from the security response sensor transmitted to the network is managed and a security response unit (mobile security sensor) is provided to the network to dynamically control and manage the network-level security status. 4 shows a functional structure of an active security management sensor, and each function is as follows.

The security violation event matching unit (Security Alert I / F) 400 collects in real time the alert data transmitted from a security system such as an intrusion detection system or a firewall installed in the security management domain. Multi-protocol matching is provided to match each protocol to collect alarm data transmitted through various protocols such as COPS, IAP, and SNMP.

The security policy decision unit 410 performs a function of determining which counterpart to execute in response to the detected security violation. The security response execution unit 420 performs a function of distributing the determined security policy to the network by generating a sensor for executing a substantial response such as intruder tracking, intruder isolation, packet blocking, and the like. The sensor manager 430 stores and manages information and execution states of all sensors transmitted and received on the network in a database system. By managing sensor information, it is possible to grasp the security response status requested from other domains. The event manager 440 performs a message processing and management function for exchanging information about a transmission / reception sensor with a mobile security sensor processing engine. That is, it is a functional module for exchanging information on the sensor to be transmitted by security policy decision and information on the sensor received from another domain with the mobile security sensor processing engine. The manager matching unit (Security Manager GUI I / F, 450) reports the security management status to the security manager and accepts the administrator's manual intervention and applies it to the security mechanism.

An active security management scenario will be described. It describes a spoofed IP trace back, which is an example of an active security function operating on an active security framework using an active network. Spoofed IP attacks are a technique used in most DDoS attacks to deceive the intrusion source by forging the source IP address in the packet. The proposed scenario is a traceback mechanism for tracking the sender of the actual packet and isolating it from the network.

In order to realize this, Active Security Node (MoSE: Mobile Security Engine) installed in Edge Point of each Secure Domain performs Ingress Filtering function to prevent forgery and manipulation of IP addresses of other domains by hackers. Prevent it in advance to limit the scope of IP spoofing to one security domain. FIG. 5 illustrates a spoofed IP reverse tracking mechanism and functional procedure in an active security management framework using an active network.

The set of procedures for the scenario is as follows. The first step is an IP address masquerading step. Hacker A located in Secure Domain A falsifies the IP address of Host A located in the same domain as its IP address. The second step is a server attack step in another domain, and attempts a flood series DoS (Denial of Service) attack to server B located in a secure domain B. The third step is intrusion detection alert transmission. SGS_IDS in security zone B detects an attack and sends an intrusion detection alert to the active security management system B (ASMS-B), where the intrusion detection alert is sent to the detected harmful packet. It contains abbreviated information and detection information about the system. In the fourth step, the packet block sensor is transmitted. The active security management system B (ASMS-B) detects the source IP address (the IP address of the forged host A) of the harmful packet from the received intrusion detection alert. In order to block harmful packets from the IP address, it creates a packet blocking sensor and sends the packet blocking sensor to MoSE-B located at its domain access point. In the fifth step, the packet blocking sensor is executed, and the MoSE-B receiving the packet blocking sensor executes the blocking sensor received through the execution environment to block the inflow of harmful packets. Therefore, MoSE-B blocks not only the hacker's counterfeit packet, but also the normal packet of Host A forged IP address. The sixth step is a traceback sensor transmission step, where the active security management system B (ASMS-B) refers to the source IP address that transmitted the harmful packet by referring to the intrusion detection alert data received by (step 3) (security area A). Host A source IP address of) Creates and sends the backtracking sensor as the destination address. The seventh step is a backtracking sensor execution step. The backtracking sensor transmitted in the sixth step is received and executed by MoSE-A located at the access point of the secure area A. The traceback sensor retrieves outgoing Ethernet frame reduction information recorded by the logging sensor, extracts log information that matches harmful packet information, and compares the MAC origin address recorded in the log information with the IP address stored in the ARP table. And the actual source IP address. The eighth step is to report the execution result of the traceback sensor, and transmits the traceback request information, the success or failure, and the obtained source address to the ASMS-A located in the corresponding domain. The ninth step is the transmission of packet blocking sensor for intruder isolation. The ASMS-A receiving the traceback sensor execution result from the MAC source address of the detected fraudulent user to block the transmission of the packet from the identified source address. Send a packet blocking sensor that blocks packet forwarding to MoSE-A. The tenth step is to report the result of infiltrating the intruder, and the active security management system A (ASMS-A) transmits the final traceback result and the corresponding information to the active security management system B (ASMS-B) that requested backtracking. The eleventh step is to transmit an unblocking sensor for session recovery for a normal packet. In step 5, ASMS-B uses an unblocking sensor to recover a session that blocked a normal packet of a host A forged with an IP address. Create and send an unblocking sensor to MoSE-B. The twelfth step is to execute an unblocking sensor for session recovery for a normal packet, and the MoSE-B receiving the unblocking sensor recovers a session that blocks a normal packet of the host A that has been forged an IP address in step 5. After that, notify the ASMS-B of the recovered result. Therefore, MoSE-B does not detect hacker's forged packet and packet inflow from hacker's source IP address, and allows for just packet inflow from forged host IP address. The thirteenth step is a step of notifying the security manager. The ASMS-B notifies the security manager of information of the traceback report sensor received in the tenth and twelfth steps.

Meanwhile, a harmful traffic detection and response system and a method thereof according to the present invention will be described in detail. 6 illustrates a network security framework and a network configuration using an active network for functioning a harmful traffic detection and response system according to the present invention. The network security framework and network using the active network include at least two security management areas and are distributed. In FIG. 6, three security management areas are shown, corresponding to active security node systems 600, 620, and 630 that perform security functions located at access points of a wide area network, and respond to security violations occurring in the security management area. Active security management system (610, 640, 650) for controlling the security status.

7 is a block diagram illustrating a harmful traffic detection and response system according to the present invention, and includes a traffic monitoring unit 700, a harmful traffic tracking management unit 710, a harmful traffic tracking unit 720, and a harmful traffic blocking report unit 730. )

The traffic monitoring unit 700 is executed in the active security node system 600, 620, 630 located at the access point of the network, and flows into the active security node system 600, 620, 630 located at the access point of the wide area network. It periodically monitors the change in traffic, and if the traffic change exceeding a preset threshold is detected, event information about the traffic is transmitted to the active security management system 610, 640, 650 through the traffic audit sensor. The reference value may be a traffic threshold configured for monthly, daily, and time zones, and is compared with the threshold.

The harmful traffic tracking management unit 710 is executed in the active security management system (610, 640, 650), and determines whether to track harmful traffic from the event information of the traffic audit sensor delivered to the active security management system, harmful traffic tracking The unit 720 is generated and transmitted to the active security node system 600 located in the management domain.

The harmful traffic tracking unit 720 may be implemented in a fixed type and a mobile type, and moves between the active security management systems 610, 640, and 650 and the active security node systems 600, 620, and 630 in the mobile type. The harmful traffic tracking unit 720 detects an IP address (a pair of a source IP address and a destination IP address) having a traffic component exceeding a preset reference value, and active security located in a network where the source IP address is located. After migrating to the node system 620, the traffic transmitted from the corresponding source IP address is analyzed for each session, and the session traffic exceeding the preset threshold is detected and blocked, and the harmful traffic detection and response results are stored in the security management area. Transfer to the active security management system 640.

The harmful traffic blocking report unit 730 notifies the active security management system 610 that initially requested harmful traffic tracking of harmful traffic detection and response results.

Next, FIG. 8 illustrates a procedure for explaining the operation of the harmful traffic detection and response system according to the present invention, and the operation thereof will be described with reference to FIG. 8. As illustrated in FIG. 8, the traffic monitoring unit 700 executed in the active security node system 800 located at an access point of the network periodically monitors the traffic flowing into the active security node system 800. As a result of comparing and analyzing the traffic threshold configured by monthly, daily and time zone, if the traffic variation exceeding the threshold is detected, event information about this is transmitted to the active security management system through the traffic audit sensor. The harmful traffic tracking management unit 710 running in the security management system determines whether to track harmful traffic through source address, network intrusion detection alert, and blacklist inquiry from the event information of the transmitted traffic audit sensor. 720 generated and transmitted to the active security node system 800 that delivered the traffic audit sensor (Step 2)

The harmful traffic tracking unit 710 transmitted to the active security node system 800 analyzes the traffic flowing into the active security node system 800 in IP address units (pair of source IP address and destination IP address), and the security manager. Detects harmful IP addresses exceeding the IP traffic threshold set by the PDU. In addition, by copying itself to each active security node system 820 located in the network of the harmful IP address with reference to the detected harmful IP address. The harmful traffic tracking unit 710, which is delivered to each active security node system by the function procedure, analyzes traffic from the corresponding harmful IP address in units of sessions, and then detects session traffic that exceeds a threshold set by the security manager. To block the corresponding session traffic. In addition, to notify the active security management system of the harmful traffic detection and response results, it moves to the active security management system 830. (3) The harmful traffic tracking management unit 710 running in the active security management system is the harmful traffic. When the harmful traffic detection and response result is received through the tracking unit 720, the harmful traffic blocking report unit 730 is generated and forwarded to the active security management system 810 that initially requested the harmful traffic tracking by referring to the sensor information. (Step 4)

On the other hand, the traffic monitoring unit 700, harmful traffic tracking management unit 710, harmful traffic tracking unit 720 and harmful traffic blocking report unit 730 may be implemented in software, for example, object-oriented programming When the language is implemented in Java, the traffic monitoring sensor 700, the harmful traffic tracking management sensor 710, the harmful traffic tracking sensor 720, and harmful traffic blocking report sensor 730 may be called.

As described above, the present invention can be embodied as computer readable codes on a computer readable recording medium. Computer-readable recording media include all types of recording systems in which data is stored that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage system, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Therefore, according to the present invention described above, system protection and network resources by providing a function to detect harmful traffic early, such as bandwidth-consuming distributed denial-of-service attacks that deplete network resources and services, and trace the source of harmful traffic. It can provide a function of protection.

1 illustrates an active security management framework and mechanism.

2 illustrates an active security system platform structure.

3 illustrates functional blocks of a mobile security sensor processing engine and an active security management engine.

4 illustrates a functional structure of an active security management sensor.

5 illustrates a spoofed IP reverse tracking mechanism and functional procedure in an active security management framework using an active network.

6 illustrates a network security framework and a network configuration using an active network for functioning a harmful traffic detection / response system according to the present invention.

7 is a block diagram illustrating a harmful traffic detection and response system according to the present invention.

8 shows a procedure for explaining the operation of the harmful traffic detection and response system according to the present invention.

Claims (9)

In the active network security framework comprising at least two security management areas distributed, The security management area includes a security node system located at an access point of a wide area network to perform a security function, and a security management system for responding to a security violation act occurring in the security management area and controlling a security state. A traffic monitoring unit that monitors a change in traffic flowing into the security node system and transmits event information about the traffic change exceeding a predetermined reference value to a security management system of the security management area; A harmful traffic tracking management unit for determining whether to track harmful traffic from the event information transmitted to the security management system and transmitting the harmful traffic to the security node system; And Detect the source IP address and the destination IP address having a traffic component exceeding a predetermined threshold, and analyze the traffic transmitted from the source IP address on the security node system located in the security management area where the source IP address is located. And a harmful traffic tracking unit for detecting and blocking traffic exceeding a predetermined threshold and transmitting harmful traffic detection and response results to a security management system in a corresponding security management area. The method of claim 1, A harmful traffic detection response system in the network, further comprising: a harmful traffic blocking report unit for notifying the active security management system that initially requested harmful traffic tracking results of harmful traffic detection and response. A first step of monitoring a change in traffic of the network and transmitting event information on a change in traffic exceeding a predetermined value; A second step of determining whether to track harmful traffic by receiving the event information; And If it is determined that tracking is necessary, detecting the source address of the traffic exceeding the predetermined threshold, analyzing the traffic transmitted from the source address, and blocking the traffic exceeding the predetermined threshold. A method for detecting and responding to harmful packets in a network. The method of claim 3, wherein the second step Detects the source IP address and the destination IP address of the traffic that exceeds a predetermined threshold, analyzes the traffic transmitted from the source IP address in a predetermined system on the network where the source IP address is located, and then exceeds the predetermined threshold. A harmful packet detection and response method for a network, characterized in that the step of blocking traffic. The method of claim 4, wherein And notifying the system that requested the harmful traffic tracking of the harmful traffic detection and response result of the third step. In the active network security framework comprising at least two security management areas distributed, When the security management area includes a security node system located at an access point of a wide area network to perform a security function, and a security management system that responds to security violations occurring in the security management area and controls the security state, Monitoring a change in traffic flowing into the security node system and transmitting event information on the change to the security management system when a change in traffic exceeding a predetermined threshold is detected; Determining whether harmful traffic is tracked from the event information delivered to the security management system, and generating a harmful traffic tracking sensor and transmitting the harmful traffic tracking sensor to a security node system located in the management domain; And After detecting the source IP address and the destination IP address having the traffic component exceeding the predetermined threshold value, and replicating itself to the security node systems on the local network where the source IP address is located, and migrating to the corresponding active security node system And a third step of analyzing traffic transmitted from the corresponding source IP address for each service port and detecting and blocking traffic exceeding a predetermined reference value. The method of claim 6, wherein the second step Determines whether to track harmful traffic from event information delivered to security management system, creates harmful traffic tracking sensor and sends it to the security node system located in the management domain and sends the result of harmful traffic detection and response to security management system within the relevant security management area. To pass to And transmitting the results of the harmful traffic detection and response to the security management system that initially requested the harmful traffic tracking. The method of claim 7, wherein the event information is A method for detecting and responding to harmful traffic in a network, characterized by transmitting to a security management system through a traffic audit sensor. A computer-readable recording medium having recorded thereon a program for executing the invention according to any one of claims 3 to 8.