KR100745613B1 - Apparatus and recording medium storing program for monitoring network - Google Patents

Abstract

A device for monitoring the network and a recording medium storing a program thereof are provided to enable a user to manage worm by detecting worm attacks of the network if a rank value of a matrix reflecting property of inbound traffic exceeds a normal range. An inbound traffic matrix generator represents the property of the inbound traffic to the first/second inbound traffic matrix in the first/second time section. An outbound traffic matrix generator represents the property of the outbound traffic to the first/second outbound traffic matrix in the first/second time section. A normal traffic eraser(130) generates a normal inbound/outbound traffic erasing matrix by performing XOR for the first and second inbound/outbound traffic matrix. A rank value calculator(140) calculates an influence/outbound rank value, which is the rank value of the normal inbound/outbound traffic erasing matrix. A network state determiner(150) determines that the network is attacked by the worm if the inbound rank value is bigger than a predetermined value, and determines that the network is infected by the worm if the outbound rank value is bigger than the predetermined value.

Description

A recording medium storing a device and a program for performing network monitoring {APPARATUS AND RECORDING MEDIUM STORING PROGRAM FOR MONITORING NETWORK}

1 is a block diagram showing a network monitoring apparatus according to a first embodiment of the present invention.

2 is a diagram illustrating a traffic matrix generated through an IP address according to an embodiment of the present invention.

3 is a graph showing a probability distribution of rank values of a random matrix.

4 is a block diagram showing a network monitoring apparatus according to a second embodiment of the present invention.

5 illustrates network state determination criteria according to an embodiment of the present invention.

6 is a block diagram showing a network monitoring apparatus according to a third embodiment of the present invention.

FIG. 7 is a graph illustrating a trend of rank values of networks for each subnetwork as time passes.

The present invention relates to a recording medium storing an apparatus and a program for performing network monitoring. In particular, the present invention relates to a recording medium storing an apparatus and a program for determining whether a network is infected with a worm.

Since the Morris worm first appeared in 1988, the damage caused by worms on the Internet has been constantly increasing. The Code Red and Nimda worms have infected hundreds of thousands of computers on the Internet, causing millions of dollars in damage from the public sector to personal systems. These worms are independent programs that replicate themselves and infect computers on a network. Worms automatically perform network investigations, vulnerability scans, and self-replicating to infect thousands of computers on the Internet. The SQL_Overflow worm, the fastest reported worm reported to date, infected 90% of vulnerable servers around the world in just 10 minutes, and the number of infected servers doubled every 8.5 seconds. It is easy to see that the SQL_Overflow worm infects computers at a tremendous rate, compared to a server that was previously infected with the Code Red worm doubled every 37 minutes. In order to cope with the rapid spread of Internet worms, it is most important to prevent the spread of worms by detecting the early stages of worms infecting computers on the network.

There are two major techniques for detecting worms. There are methods of using traffic thresholds and methods of detecting using worm behavior. The methods that use the threshold of traffic cannot detect the difference between normal traffic and abnormal traffic, so the rate of false detection is high. On the other hand, as the emergence cycle of new worms becomes shorter and more diverse, the detection of worms using the behavior of existing worms is no longer sufficient in protecting the network.

It is an object of the present invention to provide a recording medium storing an apparatus and a program for determining whether a network is infected with a worm.

A network monitoring apparatus according to an aspect of the present invention includes a traffic collector, an inflow traffic matrix generator, an outflow traffic matrix generator, a normal traffic canceller, a rank value calculator, and a network state determiner. At this time, the traffic collection unit collects inflow traffic flowing into the network and outflow traffic flowing out of the network. And the inflow traffic matrix generator indicates the property of the inflow traffic in the first inflow traffic matrix in the first time domain and the property of the inflow traffic in the second inflow traffic matrix in the second time domain, and the outflow traffic matrix generator in the first time domain. The characteristics of the outgoing traffic in the time domain are represented in a first outflow traffic matrix and the characteristics of the outflow traffic in a second time domain are shown in a second outflow traffic matrix. A normal traffic canceling unit generates a normal inflow traffic cancellation matrix by XORing the first inflow traffic matrix and the second inflow traffic matrix, and XORs the first outflow traffic matrix and the second outflow traffic matrix to generate a normal outflow traffic cancellation matrix. And a rank value calculation unit calculates an inflow rank value that is a rank value of the normal inflow traffic cancellation matrix and an outflow rank value that is a rank value of the normal outflow traffic cancellation matrix, and a network state determination unit defines a small inflow rank value. If it is greater than the value, it is determined that the network is attacked by the worm. If the leak rank value is greater than a predetermined value, it is determined that the network is infected with the worm.

A network monitoring apparatus according to another aspect of the present invention is a device for monitoring a network including a plurality of sub-networks, the traffic collecting unit for collecting the traffic of the network, and the sub-address IP address of the traffic in the first time domain A traffic matrix generator for representing traffic matrices of a first time for each network and representing an IP address of the traffic in a second time domain for traffic matrices of a second time for each subnetwork; A normal traffic cancellation unit for generating a plurality of normal traffic cancellation matrices by XORing the traffic matrices and the traffic matrices of the second time, and a rank value calculation unit for calculating rank values of the plurality of normal traffic cancellation matrices for each subnetwork. Searching for whether a rank value larger than a predetermined value exists among the plurality of rank values Group is infected with a sub-network is a worm, which corresponds to the largest rank value than the predetermined value, or includes portions infection subnetwork determining determines that being attacked by the worm.

According to an aspect of the present invention, a recording medium having a program stored therein is a recording medium storing a program for monitoring a network, and has a function of collecting inflow traffic flowing into and out of the network; A function of representing the characteristic of the incoming traffic in a first inflow traffic matrix and a characteristic of the inflow traffic in a second inflow traffic matrix in a second time domain; and a characteristic of the outflow traffic in a first time domain in a first outflow traffic matrix. And a function of representing the characteristics of the outgoing traffic in a second outflow traffic matrix in a second time domain, and generating a normal inflow traffic cancellation matrix by XORing the first inflow traffic matrix and the second inflow traffic matrix. XOR the 1 outgoing traffic matrix and the second outgoing traffic matrix to normal traffic flow Generating a pick cancellation matrix; calculating an intake rank value that is a rank value of the normal inflow traffic cancellation matrix; and an outgoing rank value that is a rank value of the normal outflow traffic cancellation matrix; and the inflow rank value being a first value. A function that determines that the network is under attack from a worm if greater and less than the second rank value, and the network is a worm if the inflow rank value is less than a third value and the outflow rank value is greater than a fourth value. Includes the ability to determine that it is infected.

According to another aspect of the present invention, a recording medium having a program stored therein is a recording medium storing a program for monitoring a network including a plurality of subnetworks. A function of indicating an address to traffic matrices of a first time for each subnetwork, a function of indicating an IP address of the traffic to second traffic matrices of a second time for each subnetwork in a second time domain, and the per network Generating a plurality of normal traffic cancellation matrices by XORing the traffic matrices of the first time and the traffic matrices of the second time, calculating a rank value of the plurality of normal traffic cancellation matrices for each of the sub-networks, and Search for the existence of a rank value greater than a predetermined value among the plurality of rank values; It includes a function that determines that the subnetwork corresponding to the rank value larger than the defined value is infected by the worm or is attacked by the worm.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated.

The worm randomly generates an IP address to determine the target of infection. Therefore, there is a lot of traffic with random IP on the network that is infected or attacked by the worm. Worm detection sign according to an embodiment of the present invention utilizes the features of such a worm.

Next, a worm detection apparatus according to various embodiments of the present disclosure will be described with reference to FIGS. 1 to 7.

1 is a block diagram showing a network monitoring apparatus 100 according to a first embodiment of the present invention.

As shown in FIG. 1, the network monitoring apparatus 100 according to the first embodiment of the present invention interworks with the first network 10, and includes a traffic collector 110, a traffic matrix generator 120, and normal traffic. The eraser 130, the rank value calculator 140, and the worm existence determiner 150 are included.

The traffic collector 110 collects traffic on the first network 10.

The traffic matrix generator 120 expresses the characteristics of the traffic collected by the traffic collector 110 in a matrix. The traffic matrix generator 120 may generate a matrix from an IP (Internet Protocol) address included in the traffic. A matrix generation method using an IP address will be described with reference to FIG. 2.

2 is a diagram illustrating a traffic matrix generated through an IP address according to an embodiment of the present invention.

Although it is not necessary to use IPv4 for the practice of the present invention, IPv4 will be used to describe the embodiment of the present invention. In IPv4, an IP address is composed of 32 bits and is usually divided into 8 bits. For convenience of description, each 8 bit of an IP address is referred to as IP ₁ , IP ₂ , IP ₃ , and IP ₄ . IP ₁ is the upper 8 bits of the IP address and IP ₄ is the lower 8 bits of the IP address.

The traffic matrix has 64 rows and 64 columns, and each element of the traffic matrix has a size of 1 bit. The traffic matrix may be represented by 256 submatrices having a size of 4 * 4. The position of (1, 1) of each partial matrix becomes (i, j) of the traffic matrix, and (i, j) is determined by the following equation (1).

_{i = (IP 4/16)} * 4

j = (IP ₄ mod 16) * 4

The equation (IP ₄ mod 16) is the remainder of IP ₄ divided by 16. Meanwhile, the partial matrix located at (i, j) of the traffic matrix is denoted by M _{i, j} .

The k-th column m _k of the partial matrix M _{i, j} is determined by Equation 2 below.

m ₁ = first 4 bit of IP ₃

m ₂ = first 4 bit of IP ₃

m ₃ = first 4 bit of IP ₄

m ₄ = first 4 bit of IP ₄

1 will be described again.

The traffic matrix generator 120 displays the traffic between t-1 seconds and t seconds collected by the traffic collector 110 in the traffic matrix M (t) according to the method illustrated in FIG. 2. If the traffic to be located in (i, j) of the traffic matrix is collected two or more times between t-1 seconds and t seconds, the traffic matrix generator 120 repeats overwriting with the collected traffic later. Meanwhile, the traffic matrix generator 120 displays the traffic between t-2 seconds and t-1 seconds in the traffic matrix M (t-1).

The normal traffic canceller 130 cancels the normal traffic characteristic from the traffic matrix generated by the traffic matrix generator 120. The normal traffic canceller 130 performs an exclusive OR (XOR) on two matrices M (t-1) and M (t) generated by the traffic matrix generator 120 as shown in Equation 3 below. By generating M '(t), the normal traffic characteristic can be easily canceled.

Since the IP address of the normal traffic is unlikely to change between t-2 seconds and t-1 seconds and between t-1 seconds and t seconds, the traffic matrix generator 120 generates M (t-1) and M ( When M '(t) is generated by performing an exclusive OR for t), most of normal traffic is removed from M' (t). Hereinafter, M '(t) is referred to as a normal traffic cancellation matrix.

The rank value calculator 140 calculates a rank value in order to calculate the degree of randomness of the normal traffic cancellation matrix M '(t).

The rank value of the random m * n binary matrix has r = 1, 2, ..., min (m, n) with probability according to the following equation (4).

3 is a graph showing Equation 4 as a graph.

3 is a graph showing a probability distribution of rank values of a random matrix.

According to the result of Equation 4 and FIG. 3, a random 64 * 64 binary matrix has a rank value of 60 or more with a probability of 99.999%.

According to this result, the worm existence determination unit 150 determines whether the rank value of the normal traffic cancellation matrix M '(t) is 60 or more. If the rank of the normal traffic cancellation matrix M '(t) is 60 or more, the normal traffic cancellation matrix M' (t) has a 99.999% probability of being a random binary matrix, and thus the probability that a worm exists on the first network 10. This becomes very high. Therefore, in this case, the worm existence determining unit 150 may determine that the worm exists on the first network 10.

Next, a network monitoring apparatus 200 according to a second embodiment of the present invention will be described with reference to FIG. 4.

4 is a block diagram showing a network monitoring apparatus 200 according to a second embodiment of the present invention.

As shown in FIG. 4, the network monitoring apparatus 200 according to the second exemplary embodiment of the present invention is connected to the gateway 40 existing between the second network 20 and the third network 30 to connect to the third network. A state 30 is monitored and includes a traffic collecting unit 210, a traffic matrix generating unit 220, a normal traffic canceling unit 230, a rank value calculating unit 240, and a network state determining unit 250. . The network monitoring apparatus 200 may be connected to a firewall or the like instead of the gateway 40.

The traffic collector 220 includes an inflow traffic collector 211 and an outflow traffic collector 212. The inflow traffic collector 211 collects the inflow traffic flowing from the second network 20 to the third network 30, and the outflow traffic collector 212 collects the second network (from the third network 30). Collect outgoing traffic, which is the outgoing traffic.

The traffic matrix generator 220 includes an inflow traffic matrix generator 221 and an outflow traffic matrix generator 222. The inflow traffic matrix generator 221 generates an inflow traffic matrix M _I (t) with inflow traffic between t-1 seconds and t seconds and inflow traffic matrix with inflow traffic between t-2 seconds and t-1 seconds. Produce M _I (t-1). The outflow traffic matrix generator 222 generates an outflow traffic matrix M _O (t) as outflow traffic between t-1 seconds and t seconds, and outflow traffic matrix with outflow traffic between t-2 seconds and t-1 seconds. Produce M _O (t-1).

The normal traffic canceller 230 includes a normal inflow traffic canceller 231 and a normal outflow traffic canceller 232. The normal inflow traffic canceller 231 performs XOR on M _I (t-1) and M _I (t) to generate M _I '(t) in which normal inflow traffic is canceled, and the normal outflow traffic canceller ( 232) generates M _O (t-1) and M _O (t) is performed by the XOR normal outflow traffic cancellation with respect to the M _O '(t). This is represented by Equation 5 below.

The rank value calculator 240 includes an inflow rank value calculator 241 and an outflow rank value calculator 242. Flowing a rank value calculation unit 241, a rank value of inflow rank value (R _I), the calculation and outlet rank value calculation section 242 is M _O a (t), a rank value of outflow of the (t) M _I Calculate the rank value R _O. This is represented by Equation 6 below.

The network state determination unit 250 determines the state of the network according to the values of the inflow rank value R _I and the outgoing rank value R _O. If the inflow rank value R _I and the outgoing rank value R _O are both lower than a predetermined value (for example, 20), the network state determination unit 250 affects the worm. I judge that I am not receiving it. In addition, if the inflow rank value R _I is greater than a predetermined value (for example, 60) and the outflow rank value R _O is less than 20, the network state determination unit 250 may warm the third network 30. Judging by the attack. When the inflow rank value R _I is less than 20 and the outflow rank value R _O is greater than 60, the network state determination unit 250 determines that the third network 30 is infected with the worm. On the other hand, when the inflow rank value R _I and the outflow rank value R _O are greater than 60, the network state determination unit 250 is infected with the worm, and the third network 30 is infected with the worm from the second network 20. Judging by the attack. 5 illustrates a network state determination standard of the network state determination unit 250.

5 illustrates network state determination criteria according to an embodiment of the present invention. In FIG. 5, R _{I, min} and R _{O, min} are rank values of the matrix M _I '(t) and the matrix M _O ' (t) indicating that the incoming traffic and the outgoing traffic are not mixed with the worm traffic, respectively. R _{I, max} and R _{O, max} are rank values of the matrix M _I '(t) and the matrix M _O ' (t) indicating that the incoming and outgoing traffic are mixed with the worm traffic.

6 is a block diagram showing a network monitoring apparatus 300 according to a third embodiment of the present invention.

As shown in FIG. 6, the network monitoring apparatus 300 according to the third embodiment of the present invention monitors the activity of the worm of the fourth network 50, and includes a traffic collector 310 and a traffic matrix generator 320. ), A normal traffic canceller 330, a rank value calculator 340, and an infected subnetwork determiner 350.

The fourth network 50 includes a plurality of subnetworks 51. For example, the fourth network 50 may be a / 16 network and the subnetwork 51 may be a / 24 network. Here, the / 16 network is a network whose address is determined by the upper 16 bits of the 32-bit IP address, and the / 24 network is a network whose address is determined by the upper 24 bits of the 32-bit IP address. Thus / network 16 may include the network node 2 ^{to 16,} or 2 may include an ^8/24 Network. The / 24 network may include 2 ⁸ network nodes.

The traffic collector 310 collects traffic on the fourth network 50.

The traffic matrix generator 320 may generate a subnetwork at a first time (eg, a time between t-2 seconds and t-1 seconds) and a second time (eg, a time between t-1 seconds and t seconds). Each traffic matrix is generated for each (51). If the fourth network 50 is a / 16 network and the subnetwork 51 is a / 24 network, the fourth network 50 includes 256 subnetworks 51, so that the traffic matrix generation unit 320 is the first time. Generate 256 traffic matrices, and generate 256 traffic matrices at a second time.

The normal traffic canceller 330 performs an XOR on the traffic matrix at the first time and the traffic matrix at the second time generated by the track kick matrix generator 320 to perform a normal traffic cancellation matrix for each subnetwork 51. Create That is, when the fourth network 50 is the / 16 network and the subnetwork 51 is the / 24 network, the normal traffic canceller 330 generates 256 normal traffic cancellation matrices.

The rank value calculator 340 calculates a rank value of the normal traffic cancellation matrix generated for each subnetwork 51.

If there is a rank value exceeding a predetermined value (for example, 60) among the plurality of rank values calculated by the rank value calculator 340, the infected subnetwork determination unit 350 transmits the corresponding subnetwork 51 to the worm. It is determined that it is infected or under attack by worms.

FIG. 7 is a graph illustrating a trend of rank values of networks for each subnetwork as time passes.

According to Figure 7, it can be seen that the 48th subnetwork is infected with the worm.

The embodiments of the present invention described above are not implemented only through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

According to the present invention, the network monitoring apparatus can grasp the specific state of the network by using the rank value of the matrix reflecting the characteristics of the incoming traffic and the rank value of the matrix reflecting the characteristics of the outgoing traffic. In particular, when the rank value of the matrix reflecting the characteristics of the incoming traffic exceeds the normal range, the network monitoring device may detect that the network is attacked by the worm and respond to the worm early.

In addition, according to the present invention, the network monitoring apparatus may identify an infected subnetwork by using a rank value of a matrix in which IP addresses of traffic are reflected for each subnetwork.

Claims (8)

In the apparatus for monitoring a network, A traffic collector configured to collect inflow traffic flowing into the network and outflow traffic flowing out of the network; An inflow traffic matrix generator for indicating a property of the inflow traffic in a first inflow traffic matrix in a first time domain and a property of the inflow traffic in a second inflow traffic matrix in a second time domain; An outgoing traffic matrix generator configured to display a characteristic of the outgoing traffic in a first outflow traffic matrix in the first time domain and a characteristic of the outgoing traffic in a second outflow traffic matrix in the second time domain; XOR of the first inflow traffic matrix and the second inflow traffic matrix to generate a normal inflow traffic cancellation matrix and XOR of the first and second outflow traffic matrices to generate a normal outflow traffic cancellation matrix. An eraser; A rank value calculation unit for calculating an inflow rank value that is a rank value of the normal inflow traffic cancellation matrix and an outflow rank value that is a rank value of the normal outflow traffic cancellation matrix; And a network state determining unit determining that the network is under attack by a worm when the inflow rank value is greater than a predetermined value, and determining that the network is infected by a worm when the outflow rank value is greater than a predetermined value. The method of claim 1, The inflow traffic matrix generator displays an IP (Internet Protocol) address of the inflow traffic in the first inflow traffic matrix and the second inflow traffic matrix. And the outflow traffic matrix generator is configured to represent an Internet Protocol (IP) address of the outflow traffic in the first outflow traffic matrix and the second outflow traffic matrix. The method according to claim 1 or 2, The network state determination unit Determining that the network is stable when the inflow rank value is less than the first value and the outflow rank value is less than the second value, If the inflow rank value is greater than the third value and the outflow rank value is less than the second value, it is determined that the network is attacked by a worm, If the inflow rank value is less than the first value and the outflow rank value is greater than a fourth value, it is determined that the network is infected with a worm, And if the inflow rank value is greater than the third value and the outflow rank value is greater than a fourth value, determining that the network is attacked by a worm and infected with a worm. A recording medium storing a program for monitoring a network, In the apparatus for monitoring a network, Collecting inflow traffic flowing into the network and outflow traffic flowing out of the network; Displaying a characteristic of the incoming traffic in a first inbound traffic matrix in a first time domain and a characteristic of the incoming traffic in a second inbound traffic matrix in a second time domain; Displaying a characteristic of the outgoing traffic in a first outflow traffic matrix in the first time domain and a characteristic of the outgoing traffic in a second outflow traffic matrix in the second time domain; Generating a normal outflow traffic cancellation matrix by XORing the first inflow traffic matrix and the second inflow traffic matrix and generating a normal outflow traffic cancellation matrix by XORing the first outflow traffic matrix and the second outflow traffic matrix; Calculating an inflow rank value that is a rank value of the normal inflow traffic cancellation matrix and an outflow rank value that is a rank value of the normal outflow traffic cancellation matrix; Determining that the network is under attack from a worm if the inflow rank value is greater than a first value and the outflow rank value is less than a second value; And And determining that the network is infected by a worm when the inflow rank value is less than a third value and the outflow rank value is greater than a fourth value. The method of claim 4, wherein Determining that the network is stable if the inflow rank value is less than the third value and the outflow rank value is less than the second value; And And storing the program if the inflow rank value is greater than the first value and the outflow rank value is greater than the fourth value, wherein the network is attacked by a worm and infected by a worm. The method according to claim 4 or 5, And a characteristic of the incoming traffic and the characteristic of the outgoing traffic is an Internet Protocol (IP) address. An apparatus for monitoring a network including a plurality of subnetworks, the apparatus comprising: A traffic collector configured to collect traffic of the network; A traffic matrix representing an IP address of the traffic in the first time traffic matrices for each subnetwork in a first time domain and an IP address of the traffic in a second time traffic matrices for a second time per subnetwork in a second time domain Generation unit; A normal traffic cancellation unit for generating a plurality of normal traffic cancellation matrices by XORing the traffic matrices of the first time and the traffic matrices of the second time for each subnetwork; A rank value calculator configured to calculate rank values of the plurality of normal traffic cancellation matrices for each subnetwork; And Determination of an infected subnetwork that determines whether a subnetwork corresponding to a rank value greater than the predetermined value is infected by or is attacked by the worm by searching whether a rank value larger than a predetermined value exists among the plurality of rank values. A device comprising a wealth. A recording medium in which a program for monitoring a network including a plurality of subnetwork is stored, Collecting traffic of the network; Indicating an IP address of the traffic in a first time domain in traffic matrices of a first time per subnetwork; Indicating the IP address of the traffic in a second time domain in traffic matrices of a second time per subnetwork; Generating a plurality of normal traffic cancellation matrices by XORing the traffic matrices of the first time and the traffic matrices of the second time for each subnetwork; Calculating rank values of the plurality of normal traffic cancellation matrices for each subnetwork; And A function of searching whether a rank value larger than a predetermined value exists among the plurality of rank values and determining that a subnetwork corresponding to a rank value larger than the predetermined value is infected with or is being attacked by the worm. The recording medium on which the program is stored.

Images