KR100578506B1 - Intrusion Detection Method for Inferring Risk Level - Google Patents

Abstract

The risk inference detection method according to the present invention comprises the steps of a packet collector collecting a network packet, analyzing the packets collected by the packet collector, IP and packet data of a destination system (packet data is an ultimate attempt by a hacker). General information), and comparing the packet data with the intrusion type DB, which stores information on various intrusion types, to determine whether the packet corresponds to a predetermined intrusion type. And if the packet corresponds to a predetermined intrusion type, inferring a risk by inferring and comparing the separated destination system IP with the destination system usage DB.

Intrusion Detection Method, Packet, Hack

Description

Inference Detection Method for Inferring Risk Level

1 is a block diagram showing a system implementing a conventional intrusion detection method.

2 is a block diagram illustrating a system for implementing a risk inference intrusion detection method according to the present invention.

3 is a flowchart showing an intrusion detection method according to the present invention;

4 is a structural diagram showing a hierarchical structure of a database mounted on a hacking pattern DB of a system implementing the intrusion detection method according to the present invention;

The present invention relates to an intrusion detection method, and more particularly, to a risk inference intrusion detection method that analyzes a network packet and infers a risk to inform an administrator.

 The Internet, a combination of the word International and the word Network, can be found in the ARPANET, which was established in 1969 with the support of the US Department of Defense to link four universities in the United States. It was initially introduced for military purposes, but recently, due to the wave of commercialization, millions of people around the world are using the Internet and based on it, e-mail, remote computer connection (telnet), and file transfer (FTP). Usenet News, Usenet News, Internet Information Retrieval (Gopher), Internet Conversation and Discussion (IRC), Electronic Bulletin Board (BBS), Hypertext Information Viewing (WWW: World Wide Web), Online Games, Movies or Voice Data New services such as video broadcasting and video conferencing were developed and available in turn. As the commercialization of the Internet spreads rapidly, the whole world is connected to one Internet network, and the convenience of modern people's life by the Internet is increasing day by day. However, there are risk factors such as information leakage other than the convenience of modern people on the other side of the Internet, which can be easily disrupted and destroyed by criminals called hackers, information leakage, and illegal intrusion. Problems have arisen. In order to prevent such hacking, an intrusion detection method that detects and informs a user in advance of unauthorized intrusion by an insider or an outsider is used.

Intrusion detection method is a system that detects intrusion or suspicious behavior in network environment and classifies risk according to detected pattern and informs user of detected result.

As shown in FIG. 1, the conventional intrusion detection method includes a step of collecting a network packet by a packet collector 22, a step of analyzing a packet collected by the packet collector 22, and a packet analyzer 24. Compares the packet contents analyzed by the packet analyzer 24 with the intrusion types stored in the intrusion type DB, which stores information on various intrusion types. It consists of informing the administrator whether or not it is a type.

However, such a conventional intrusion detection method only uses the destination system which attempts to intrude in the process of comparing the analyzed packet contents with the intrusion type DB (eg, whether the system is a file server, a web server, a mail server, or a DB server). It does not compare whether there are any vulnerabilities, but simply compares the intrusion type DB, and if the collected packet matches the intrusion type of the DB, it generates a risk alarm regardless of the actual risk. And the risk is low, or on the contrary, even though it is not a dangerous packet, it has a problem of high risk. In addition, this problem becomes more serious when it is common to generate thousands of packets in a short time.

The present invention has been made to solve the problems of the conventional detection method, an object of the present invention is to infer the detection of risk inference detection that can inform after analyzing the packet and infer the risk in consideration of the purpose of the destination system of the detected packet To provide a way.

Another object of the present invention is to make a hacking pattern for each hacking pattern by DB, and if the analyzed packet has a high actual risk, the hacking that is to be generated later will be reported by indicating whether the packet corresponds to which stage of the hacking. It is to provide a risk inference detection method that can be prevented.

The present invention consists of the following steps to achieve the above object.

The risk inference detection method according to the present invention comprises the steps of a packet collector collecting a network packet, analyzing the packets collected by the packet collector, IP and packet data of a destination system (packet data is an ultimate attempt by a hacker). General information), and comparing the packet data with the intrusion type DB, which stores information on various intrusion types, to determine whether the packet corresponds to a predetermined intrusion type. And information about a destination system obtained from the IP of the destination system and the intrusion type DB (for example, the OS of the system and the purpose of the system (Web server, Mail server, FTP) if the packet corresponds to a predetermined intrusion type. Server, name of the server program used, etc., hereinafter, referred to as 'characteristic information of the destination system') and the destination system use DB. It is composed of the steps of inferring and notifying the risk by comparing the search

In addition, the risk reasoning intrusion detection method according to the present invention compares the analyzed packet data with the hierarchical structure of the hacking pattern DB, which loads the hierarchical structure patterning the step that the packet analyzer is hacked to inform the hacking level It may further include.

Inference detection intrusion detection method according to the present invention is a packet collector to collect the packets generated on the Internet, the packet analyzer separates the packets into the packet data and the IP of the destination system, the separated packet data and the intrusion type DB By comparison, it is determined whether or not it corresponds to the intrusion type on the DB, and if it is the intrusion type, it compares the IP of the separated destination system and the characteristic information of the destination system identified from the intrusion type DB with the destination system usage DB, and thus the actual dangerous intrusion. It will determine if it is an attempt and alert or inform the administrator.

Further, the intrusion detection method according to the present invention uses the hacking pattern DB equipped with a hierarchical structure patterning the process of hacking when the packet analyzer determines that the packet corresponds to an actual dangerous intrusion attempt. Compared with the hacking pattern DB, the hacking can be blocked in advance by alerting or notifying which stage of the hacking step the hacking step and the hacking that will occur in the future.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

2, an intrusion detection system implementing the intrusion tower method of the present invention is a packet collector 42, a packet analyzer 44, intrusion with the destination system use DB 45 interoperating with the packet analyzer 44 Type DB (48) and hacking pattern DB (47), and the user interface 46 that is responsible for alarm and notification of the analyzed content.

The packet collector 42 intercepts and collects all packets transmitted / received through an internet network or a network, and thus a description thereof will be omitted.

Since the intrusion type DB 48 classifies intrusion types by category and stores information on the intrusion types, new intrusion types as well as existing intrusion types may be added at any time. For example, the DB for the intrusion type mounted on the DB 48 may have a structure defined conceptually on the basis of large classification and medium classification as shown in the following table. Of course, the structure is not limited to this. As described above, since all intrusion types mounted on the intrusion type DB 48 are loaded by analyzing intrusion cases that have already occurred, the packet analyzer 44 of the destination system vulnerable to the intrusion type in the process of analyzing the intrusion type. Characteristic information can be grasped automatically.

    Table 1: Major Category

Major Category Explanation Information gathering attack It is an attack that collects network or system vulnerabilities before hacking is performed. Through this attack, you can see the version of the application used by the OS of the system or open ports. This is the type of attack that can lead to hacking. Intrusion attack In fact, the type of attack is underway. These types include buffer overflows when leaking or illegal operation of information inside the system such as backdoors, attempting to gain unauthorized access, attempting to interpret the protocol to view mail or user IDs / passwords, and so on. This type of attack requires immediate action, such as attempting an intrusion using a vulnerability. Denial of Service Attack A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a particular server. It does not leak internal information, but it can be fatal to business due to a malfunction. Etc Although not a pattern of hacking, this is a classification type that requires attention or is necessary for administrative statistics, and is used for applications (e.g. ICQ, IRC, etc.) It includes.

Table 2: Mid Category

Main Category Category Explanation Information gathering attack Aggression probe It is a type of attack that collects proactive information for attempting unauthorized access (attack), and this type includes scans using Satan, ports, and IP scans. Suspicious behavior In general, the action is performed after the pre-attack probe, which requires more attention than the pre-attack probe, and an attempt is made to check open ports at the previous stage and to obtain more detailed information through the port. Intrusion attack Backdoor It exists in the form of a virus, and there are various types from leaking various information to the outside to be able to illegally take control of the system from outside and monitor the communication port connected to the outside. The backdoor used must be deleted. Buffer overflow It is an attack that exploits a vulnerability that occurs when the buffer used by the system and application internal code overflows, and it must be implemented considering such risks when all programs are written, but it can be a major target if it does not. In the case of system programs, a patch program that fixes known vulnerabilities should be installed. IP spoofing It is an attack type to deceive a firewall that controls access based on an IP address. It is an attack that uses the passive protection method of a firewall to infiltrate the IP address of a computer attempting hacking as accessible. Even after analyzing the log, it may be misleading. Protocol analysis attempt It is an attempt to analyze a protocol by intercepting a network packet, and if each packet is not encrypted, it is a type of attack that may expose sensitive information such as a user ID and a password, and leak the contents of an exchanged mail. . Unauthorized access attempt It is a serious type of attack that attempts to intrude into the internal network or system without authorization or the information inside can be leaked to the outside. In this case, immediate action must be taken to minimize the damage. Denial of Service Attack DOS A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a server. There are patterns of attacks from one location or from several distributed locations simultaneously. Etc application Information about the application patterns used, and may be vulnerable to known hacking attacks against these applications. In particular, attention should be paid to the messenger program. Misuse Detects information about misuse that is connected regardless of work, and may be necessary for internal management purposes but is not related to hacking. These types include pornography, gambling, sports, and securities. Web information This is a type of information used to connect to internal web server from outside, and some of them may require attention depending on the type and version of web server. Other information Although it cannot be classified as an attack pattern, it shows various other information detected by intrusion detection.

The destination system use DB 45 is the IP of the destination system, the OS (window NT, Solaris, Linux, etc.) used for the system, the purpose of the system (FTP server, Web server, Mail server, DB server, etc.), Server program name used in the system (e.g., Web server uses lls or Aparch, FTP server uses wu-ftpd or proftpd, Mail server uses Msexchange or Lotusnotes, DB server uses Oracle, MsSQL SERVER, etc.) (Hereinafter referred to as 'purpose system usage information').

As illustrated in FIG. 4, the hacking pattern DB 47 stores the hacking pattern structure DB hierarchically structured by subdividing the hacking step by hacking type.

Referring to FIG. 3, the packet analyzer 44 separates the collected packets from the destination system's IP and packet data (52, 54), and compares the analyzed packet data with the intrusion type DB 48. It is determined whether or not the intrusion type of the (56), and if it does not correspond to the predetermined intrusion type is terminated analysis (66). Furthermore, if the collected packet corresponds to a predetermined intrusion type, the packet analyzer 44 has destination system usage information that is the same as the IP of the separated destination system and destination system characteristic information identified from the intrusion type DB 47. Search the destination system usage database 45 to determine whether the destination system exists (58), and if it is present, determine that the packet is dangerous to affect the destination system and alert the user; (64) otherwise end the analysis (66). In addition, the packet analyzer 44 determines that the packet is an intrusion to harm the system (60), and then searches for the hacking pattern structure DB mounted on the DB 47 in association with the hacking pattern DB 47 (62). The packet may be further alerted or notified at which stage of the hack and in which direction it will develop (64).

The operation of the intrusion detection method according to the embodiment of the present invention as described above will be described as follows.

"Code Red" is a type of worm that enters through windowNT's IIS web server and infects windowNT's IIS web server by making packets in very short cycles. As soon as IIS receives the packet created by "Code Red", it becomes infected with Code Red. However, "Code Red" does not affect mail server or FTP server other than web server because it only infects web server whose window system is windowNT and IIS is IIS. It has no effect on web servers that do not use.

Thus, although "Code Red" only infects the IIS web server of windowNT, the conventional intrusion detection system only detects packets made by "Code Red" and examines whether the destination system is a web server or a mail server. If the destination system is a mail server, the alarm is triggered, and the user may be insensitive to the warning message about the danger and cannot respond quickly.

However, according to the intrusion detection method according to the present invention, the packet collector 42 collects packets made by "Code Red". The packet analyzer 54 then separates the packet into IP and packet data of the destination system (52, 54), and determines whether the packet corresponds to a predetermined intrusion type mounted in the intrusion type DB 48. If the packet corresponds to a predetermined intrusion type (56), the destination system use DB 45 is retrieved (58), and as a result, the IP separated from the packet and the intrusion type DB 47 are identified. If there is a destination system with the destination system usage information (OS is windowNT, the server program is IIS), and the destination system matches the characteristic information of the destination system (OS is windowNT, the server program is IIS), Alerts or informs you that it is high (60, 64), and in other cases (for example, if the server program is Aparch even if the OS is Solaris, Linux, or if the purpose is an FTP server, a mail server, or a web server). Without proceeding And it terminates the analysis (66).

In addition, when it is determined that the risk is high, the packet analyzer 44 determines which stage of the hierarchical structure of the hacking pattern DB 47 in which the packet is loaded with a hacking pattern having a hierarchical structure as shown in FIG. It may determine whether or not to further inform or warn the user of the steps (62, 64). As shown in Fig. 4, the attack by “code red” is a kind of denial of service attack by a virus, and the attack phase may be divided into an initial denial of service, an intermediate denial of service, and a denial of service attack step. Each stage is distinguished by the number of denial of service attack packets generated per unit time. The hierarchical structure of the hacking pattern DB 47 is classified based on the number of packets generated by " code red " per unit time. For example, the number of packets is less than 10 for 30 seconds. Less than 100 are structured as intermediate denial of service, and less than 200 are denial-of-service attacks during 10 seconds and are mounted on the DB 47. Accordingly, the packet analyzer 44, in conjunction with the hacking pattern DB 47, notifies the user of the initial stage of denial of service if the number of packets generated by "code red" is less than 10 per 30 seconds. Alerts that there is a possibility to proceed to the stage and service attack phase, alerts that the service is in the middle of service if it is within 100 per 10 seconds, alerts that there is a possibility of proceeding to the service attack phase in the future, and alerts to the service attack if it is within 200 per 10 seconds. .

The above embodiments are merely examples of the present invention, and the present invention may be changed and modified without exceeding its technical scope.

By the above configuration, the present invention can achieve the following effects.

Since the present invention can infer and inform the risk by analyzing the packet in consideration of the purpose of the destination system of the detected packet, it is possible to prevent the intrusion detection system from being ineffective due to the false alarm. We can plan.

According to the present invention, if a hacking pattern is processed by DB, the hacking process is made into a DB, and if the analyzed packet has a high risk, the step of hacking is notified. The effect can be aimed at.

Claims (2)

A packet collector collecting network packets, a packet separator separating IP and packet data of a destination system of a packet collected by the packet collector, and the packet analyzer stores information about various intrusion types Comparing the intrusion type DB with the packet data to determine whether the packet corresponds to a predetermined intrusion type; and if the packet corresponds to a predetermined intrusion type, identifying the IP of the separated destination system and the intrusion type DB. Inferring risk inference including the step of inferring the risk by determining the existence of the destination system having the usage information matching the IP and the characteristic information by searching and comparing the characteristic information of the destination system with the usage system DB. Detection method. The method of claim 1, further comprising the step of the packet analyzer comparing the packet data with the hierarchical structure of the hacking pattern DB that loads the hierarchical structure patterning the hacking process to indicate the level to which the packet belongs. Risk Reasoning Intrusion Detection Method.

Images