KR100632204B1 - Attack detection device on network and method - Google Patents

Abstract

The present invention relates to an apparatus and method for detecting an attack when a server system configured by interconnecting one or more servers in a grid or a network is attacked by one or more clients connected to the network. It is an object of the present invention to provide an apparatus and method for quickly detecting an attack on a server system. One aspect for achieving the above object of the present invention is an attack detection apparatus for detecting an attack on a server system on a network, wherein the amount of request data or the amount of request data generated when a known worm virus attacks the server An attack type database for classifying information including the same IP address ratio by the type of the worm virus and storing the attack type data, and the same rate as the amount of request data per hour or the IP address of the request data of the server system. And analyzing the information, and comparing the analysis result with the attack type data classified and stored in the attack type database for each type of the worm virus to determine whether a server system is under attack. It relates to an attack detection device.

Worm virus, qualitative analysis, quantitative analysis, stack overflow, overwrite.

Description

Attack detection device on network and its method {ATTACK DETECTING SYSTEM IN NETWORK AND METHOD THE SAME}

1 is a schematic diagram illustrating a server system according to an embodiment of the present invention.

2 is a schematic diagram visualizing a module and a database included in each server in a server system according to an embodiment of the present invention;

Figure 3 is a state diagram showing a state in which the server system is attacked by a worm virus in the embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: network

200: terminal

300: server system

310: server 1

311: System Definition Database

312: Attack Type Database

313: First attack data database

314: Quantitative Analysis Module

315: First qualitative analysis module

316: first attack recovery module

317: data transmission / reception module

The present invention relates to an apparatus and method for detecting an attack when one or more servers are interconnected by a grid or a network and are attacked by one or more clients connected to the network.

Conventional attack detection methods include qualitative analysis methods such as examining the request data sent from the client to the server or examining the code of the data flowing into the server.

In the past, when the server system was attacked, there have been many studies of detection and response methods based on actual attack experience, rather than the original research on attack methods. In general, most of the detection and countermeasures will be detected after the attack has progressed considerably and cannot be recovered. In this case, the attack detection uses the above-mentioned qualitative analysis method that detects an attack by analyzing packet information of a small amount of request data collected in a server system for a short time. This qualitative analysis is a method of detecting and responding to a specific location rather than an entire network.

Countermeasures against server systems can be classified into three categories. The first is the analysis of the attack on the server system, the second is the actual defense method according to the characteristics of the attack on the server system acquired from experience, and the last is the improvement of the server system. In particular, in the early stages of attack research on server systems, researches focused mainly on security system architecture and detection of attacks, but recently, distinguished the flow of attacks or attack data packets from normal packets rather than detection of attack occurrence itself. Research on attack detection and the countermeasures that can be used in connection with these are the mainstream.

However, these detection and countermeasures have been difficult to distinguish from attacks and normal data flows. In particular, it is difficult to detect an attack while an attack is in progress.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems of the prior art, and to provide an apparatus and method for rapidly detecting an attack on a server system on a network by quantitative analysis of data.

One aspect for achieving the above object of the present invention is an attack detection apparatus for detecting an attack on a server system on a network, wherein the amount of request data or the amount of request data generated when a known worm virus attacks the server The attack type database which classifies the information including the same IP address ratio by the type of the worm virus and stores the information as the attack type data, and the ratio of the amount of request data per hour or the IP address of the request data of the server system is the same. And a quantitative analysis module for determining whether a server system is under attack by comparing the analysis result and comparing the analysis result with the attack type data classified and stored in the attack type database for each type of the worm virus. It relates to an attack detection device .
The quantitative analysis module may analyze information including the system resource usage rate and the amount of request data per hour to calculate the probability that the server system can continue to operate during an attack and the remaining time of the operation.
The attack detection apparatus may further include a qualitative analysis module for inspecting request data sent from a client on the network to the server or inspecting a code of data flowing into the server.

delete

The qualitative analysis module detects an open port by scanning a port on the corresponding server and checks how much data is introduced from the corresponding port, and when the data coming from the corresponding port in the operating system is stored and processed in a stack, the data is The qualitative analysis module can detect a worm virus by checking whether it overwrites other data, and the qualitative analysis module divides the number of attack types that can detect the attack by the number of servers in the server system, and provides a predetermined qualitative analysis module for each server. Can be placed.

When the attack cannot be specified in the qualitative analysis module, data suspected of attack data may be sent to another server to analyze whether the attack data is attack data.
Another aspect for achieving the above object of the present invention is an attack detection method for detecting an attack on a server system on a network, wherein the amount or amount of incoming data per hour that occurs when a known worm virus attacks the server A data storage step of classifying information including the same ratio of data IP addresses by types of the worm virus and storing the information as attack type data in an attack type database; and the amount of request data per hour of the server system or the IP address of the request data. Is an attack determination step of determining whether a server system is under attack by analyzing information including the same ratio, and comparing the analysis result with the attack type data classified and stored in the attack type database for each type of the worm virus. Com characterized in that it comprises a Emitter is a recording medium that is recorded reading programs.
In the attack determination step, the information including the system resource usage rate and the amount of request data per hour may be analyzed to calculate a probability that the server system can continue to operate even during an attack and the remaining time of the operation.

When the program is determined to be an attack in the attack detection step, the program may further include an attack specifying step of specifying an attack by examining request data sent from a client on a network to a server or examining a code of data flowing into the server. have.

delete

The attack specifying step detects an open port by scanning a port on a corresponding server, examines how much data flows in the corresponding port, and also when data coming from the corresponding port in an operating system is stored and processed on a stack, You can detect worm viruses by checking whether they overwrite other data.

Another aspect for achieving the above object of the present invention is an attack detection method for detecting an attack on a server system on a network, wherein the amount of data flowing in per hour or the amount of incoming data is known when a known worm virus attacks the server. A data storage step of classifying the information including the same IP address ratio by the type of the worm virus and storing the information in an attack type database; and the same rate as the amount of request data per hour or the IP address of the request data of the server system. Analyzes the information and determines whether the server system is under attack by comparing the information such as the amount of request data or the IP address of the request data when attacked by a known worm virus stored in the attack type database Characterized in that it comprises a determining step Relates to a recording medium in which computer programs are recorded reading.

The attack determining step may analyze the information including the system resource utilization rate and the amount of request data per hour to calculate the probability that the server system can continue to operate during the attack and the remaining time of the operation. When determined, the method may further include an attack specifying step of examining the request data sent from the client on the network to the server or checking the code of the data flowing into the server to specify the attack.

The attack specifying step detects an open port by scanning a port on a corresponding server, examines how much data flows in the corresponding port, and also when data coming from the corresponding port in an operating system is stored and processed on a stack, You can detect worm viruses by checking whether they overwrite other data.

1 illustrates a server system according to an embodiment of the present invention, in which one or more servers are interconnected in a grid or a network. In the server system 300, one or more servers 310 to 390 may be physically connected to each other to perform any service alone or in cooperation with each other.

Figure 2 is a visualization of the module and database included in each server in the server system according to an embodiment of the present invention.

The system definition database 311 includes physical information such as a processing speed of a CPU, a memory size, a disk capacity, a number of servers, and a connection relationship between servers, and a request data processing capacity per hour calculated based on the physical information. A database that stores information about serviceable capacity, such as network bandwidth.

The attack type database 312 is a database that stores information such as the amount of request data per hour or the same IP address of the request data when the known worm virus attacks the server, and stores the information by classifying the worm virus.

The first attack data database 313 is a database that analyzes attack data and files and stores the information according to various attacks that the server system may encounter. The first attack data database 313 is disposed on the server 1, the second attack material database is located on the server 2, the third attack data database is located on the server 3, in this way, the first, second, etc. You can prefix it with a name. The first attack qualitative analysis module 315 and the first attack recovery module 316, which will be described later, may also be named in this manner.

The quantitative analysis module 314 analyzes information such as the amount of request data per hour or the ratio of IP addresses of the request data, such as the amount of request data when attacked by a known worm virus stored in the attack type database 312 or This module determines whether the server system is under attack by comparing the IP address of the request data with the same ratio. If it is determined that the quantitative analysis module 314 is an attack, the first qualitative analysis module 315, which will be described later, operates as quickly as possible.

In addition, by analyzing the information such as the system resource usage rate and the amount of request data per hour, and calculates the probability that the server system 300 can continue to operate during the attack and the remaining time of the operation to inform the system administrator.

FIG. 3 is a state diagram showing a state in which a server system is attacked by a worm virus in an embodiment of the present invention. The state of the system is represented by a pair of (number of infected servers, attack stages), and the initial and normal states are (0 , 0). λ _i is the attack rate, μ _i is the attack stage success rate, and μ _r is the service rate that the infected server needs for treatment. However, in the middle stage of the attack of the worm virus, it is assumed that it is impossible to determine whether the server is malfunctioning or the server does not operate as intended by the attacker. In FIG. 3, a balance equation when all states are steady-state is obtained as follows.

Solving a system of equations that combines the above equilibrium equation and a conservation equation where the sum of probabilities of staying in each state is 1, we can obtain the probability of staying in each state when the system is equilibrium as: In other words, P _{n, i} is the probability that the server system can continue to operate.

The first qualitative analysis module 315 is a module for inspecting request data sent from the client to the server, or checking a code of data flowing into the server. That is, the first qualitative analysis module 315 detects an attack by comparing the attack data information in the first attack data database 313 with the code of the data packet or data flowing into the server. Even if the first qualitative analysis module 315 operates at a predetermined frequency at normal times, but if it is determined that the server system is under attack by the quantitative analysis module 314, the first qualitative analysis is performed as quickly as possible as described above. Module 315 is activated. When the attack cannot be specified in the first qualitative analysis module, the data suspected of attack data is sent to the qualitative analysis module of another server by the data transmission / reception module 317 which will be described later. Conversely, the first qualitative analysis module may analyze the attack by receiving data requested for analysis from another server.

In addition, the qualitative analysis module may detect a worm virus.

Worm viruses typically send stacks of long request data to the attacking server to cause parameter stack overflows, and invalid code present in the request data can cause the code in other request data in the stack to fail. The overwriting step and the request data changed into the other code (worm virus) are executed by the code execution step executed by the server system.

Here, the qualitative analysis module detects an attack by checking a stack overflow step or an overwrite step. The check of the stack overflow step detects an open port by port scanning in the corresponding server, examines how much data flows from the corresponding port, and also stores data coming from the corresponding port in the operating system in the stack. When processed, the worm virus is checked during the stack overflow and overwrite phases by checking whether the data overwrites other data.

The qualitative analysis module may allow the entire module to enter each server, but preferably, the qualitative analysis module may be divided by the number of servers so that the attack detection may be distributed by distributing a different qualitative analysis module for each server. That is, in this embodiment, the qualitative analysis module disposed on the server 1 will be referred to as a first qualitative analysis module 315.

In response to the first qualitative analysis module 315, the first attack recovery module 316 is a module that defends the attack and restores the system when it is determined that the attack on the server system 300 is a known attack. In other words, if the attack is a computer virus, the process of the virus file may be stopped and the file may be cleaned or deleted. In addition, if the attack is a worm virus, a method such as blocking a port into which data is introduced or restricting the amount of incoming data may be taken.

In addition, when the first qualitative analysis module 315 determines that the data requested for analysis by another server is attack data, the first attack recovery module 316 may be transmitted to the other server to restore the server.

When the first qualitative analysis module 315 cannot detect the attack, the data transmission / reception module 317 may transmit predetermined data to another server to be analyzed by the qualitative analysis module of the server and analyze the result. Can be received. In addition, when the data requested to be analyzed by another server is determined to be attack data by the first qualitative analysis module 315, the first attack recovery module 316 is transmitted to the other server by the data transmission / reception module 317. .

The attack detection of the attack detection device of this configuration goes through the following three steps.

The first step is the data storage step, where information such as the amount of incoming data per hour or the same IP address ratio of incoming data when the known worm virus attacks the server is classified by the type of the worm virus and the attack type database ( 312).

The second step is an attack determination step, which analyzes information including the amount of incoming data per hour or the ratio of incoming IP addresses, and compares it with the attack characteristics of known worm viruses stored in the attack type database 312. It is a step of determining whether the system 300 is under attack.

In the attack determination step, information such as the system resource usage rate and the amount of request data per hour may be analyzed to calculate a probability that the server system 300 can continue to operate during an attack and the remaining time of the operation.

The third step is an attack specifying step. When it is determined that the attack is detected in the attack detecting step, the attack can be specified by examining the request data sent from the client on the network to the server or by examining the code of the data flowing into the server.

Here, in the attack specifying step, an attack is detected by checking a stack overflow step or an overwrite step in a server attack by a worm virus. The check of the stack overflow step detects an open port by port scanning in the corresponding server, examines how much data flows from the corresponding port, and also stores data coming from the corresponding port in the operating system in the stack. When processed, the stack overflow step and the overwrite step are checked by checking whether the data overwrites other data.

The series of processes described above can also be executed by software. The software is stored on a computer-readable recording medium such as a magnetic disk (including a flexible disk), an optical disk (CD-ROM), a DVD, and a magneto-optical disk (MD). In addition, the character input device of the present invention may be embedded in a joy pad or a computer system.

As described above, according to the present invention, quantitative analysis can be used to quickly detect an attack on a server system on a network. In addition, since the probability that the server system can continue to operate even during an attack and the remaining time of the operation can be calculated, the server system can respond appropriately.

In particular, in a server attack by a worm virus, in the past, the worm virus can be detected only when the malicious code is executed, but according to the present invention, the worm virus is executed in the stack overflow phase or the overwrite phase before the malicious code is executed. Can be detected and responded appropriately.

Claims (14)

 In the attack detection device for detecting an attack on the server system on the network, An attack type database that stores information including the amount of request data per hour or the same IP address of the request data generated when a known worm virus attacks the server by the type of the worm virus, and stores the information as attack type data; Analyze the information including the same amount of request data per hour or the IP address of the request data of the server system, and compare the analysis result with the attack type data classified and stored in the attack type database by the type of the worm virus And a quantitative analysis module for determining whether the server system is under attack. The method of claim 1, wherein the quantitative analysis module analyzes information including the system resource utilization rate and the amount of request data per hour, and calculates a probability that the server system can continue to operate during an attack and the remaining time of the operation. Attack detection device. The attack detection apparatus of claim 1, further comprising a qualitative analysis module that examines request data sent from a client on the network to the server or examines a code of data flowing into the server. The method of claim 3, wherein the qualitative analysis module detects an open port by scanning a port on a corresponding server and examines how much data is introduced from the corresponding port, and further, data coming from the corresponding port in an operating system is stored and processed on a stack. And when the data overwrites other data, detects a worm virus. The apparatus of claim 3, wherein the qualitative analysis module divides the number of types of attacks capable of detecting an attack by the number of servers in a server system, and arranges a predetermined qualitative analysis module for each server. The attack detection apparatus according to claim 4 or 5, wherein when the attack cannot be specified in the qualitative analysis module, data suspected of attack data is sent to another server to analyze whether the attack data is attack data. In the attack detection method for detecting an attack on the server system on the network, When the known worm virus attacks the server, information including the amount of incoming data per hour or the same IP address of the incoming data is classified by the type of the worm virus and stored as attack type data in the attack type database. Data storage steps, Analyze the information including the same amount of request data per hour or the IP address of the request data of the server system, and compare the analysis result with the attack type data classified and stored in the attack type database by the type of the worm virus And an attack determination step of determining whether the server system is being attacked. The method of claim 7, wherein the determining of the attack comprises analyzing the information including the system resource usage rate and the amount of request data per hour, and calculating a probability that the server system can continue to operate during the attack and the remaining time of the operation. Attack detection method. The method according to claim 7, further comprising an attack specifying step of specifying the attack by examining the request data sent from the client on the network to the server, or by inspecting the code of the data flowing into the server when it is determined that the attack in the attack detection step; Attack detection method, characterized in that. The method of claim 9, wherein the attack specifying step detects an open port by scanning a port on a corresponding server, examines how much data flows from the corresponding port, and further stores data coming from the corresponding port in an operating system on a stack. When processed, attack detection method characterized in that it detects a worm virus by checking whether the data overwrites other data. In the attack detection method for detecting an attack on the server system on the network, When the known worm virus attacks the server, information including the amount of incoming data per hour or the same IP address of the incoming data is classified by the type of the worm virus and stored as attack type data in the attack type database. Data storage steps, Analyze the information including the same amount of request data per hour or the IP address of the request data of the server system, and compare the analysis result with the attack type data classified and stored in the attack type database by the type of the worm virus And an attack determination step of determining whether or not the server system is under attack. The method of claim 11, wherein the determining of the attack comprises analyzing the information including the system resource usage rate and the amount of request data per hour to calculate the probability that the server system can continue to operate during the attack and the remaining time of the operation. A recording medium that records a computer readable program. The method of claim 11, further comprising an attack specifying step of specifying an attack by examining request data sent from a client on a network to a server or examining a code of data flowing into the server when the attack is determined to be an attack. And a recording medium having a computer readable program recorded thereon. The method of claim 13, wherein the attack specifying step detects an open port by scanning a port on a corresponding server, examines how much data flows from the corresponding port, and also stores and processes data coming from the corresponding port in an operating system on a stack. And a worm virus is detected by checking whether the data overwrites the other data.

Images