KR100819049B1 - Apparatus for detecting and analyzing alert of intrusion and method for displaying it by graph in n-dimensions using the same - Google Patents

Abstract

An apparatus for analyzing and coping with an intrusion situation and a method for expressing attack detection alarms as an N-dimensional correlation graph are provided to enable a manager to intuitively recognize and cope with an intrusion situation by expressing an attack situation, its stages, and correlated attacks as a two or three-dimensional graph. An apparatus for analyzing and coping with an intrusion situation comprises the first analysis part(107) and the second analysis part(109). The first analysis part collects attack detection alarms from network alarm devices, classifies them, and expresses results as a three-dimensional graph. The second analysis part receives the results, executes vector conversion to project the three-dimensional graph onto a two-dimensional graph, and analyzes the correlations of attacks. The first analysis part comprises an attack detection alarm collection part, a classification part, and an N-dimensional express analysis part. The attack detection alarm collection part collects attack detection alarms. The classification part classifies the collected attack detection alarms according to attack stages and attack situations. The N-dimensional express analysis part outputs each classified attack stage as a three-dimensional graph.

Description

Apparatus for detecting and analyzing alert of intrusion and method for displaying it by graph in N-dimensions using the same}

1 is a block diagram illustrating a connection relationship between an intrusion situation analysis and response device and interworking devices according to the present invention.

FIG. 2A is a block diagram illustrating a detailed configuration of the first analyzer 107 illustrated in FIG. 1.

FIG. 2B is a block diagram illustrating a detailed configuration of the second analyzer 109 shown in FIG. 1.

FIG. 3 is a flowchart illustrating a process of classifying an attack according to stages and situations and expressing the N-difference in the first analysis unit 107 illustrated in FIG. 1.

4 is a flowchart illustrating a process performed by the second analyzer 109 shown in FIG. 1.

5A is a diagram illustrating an example of dividing into N-order quadrants.

FIG. 5B is a diagram illustrating an example of an attack stage and situation for information used when classifying an attack alert for each stage / situation or storing it in an attack stage classification database.

FIG. 6 is a diagram illustrating a three-dimensional graph of alarms belonging to the fourth-order quadrant of the N-th order quadrant of FIG. 5.

7 to 8 are diagrams showing an example of projecting the three-dimensional graph of FIG. 6 in two dimensions.

9 is a view showing the results expressed to show the correlation between the alarms.

The present invention provides a device for analyzing and responding to an intrusion situation, and the device provides an N-order quadrant for attack detection alert. As a method of expressing as an associative graph, more specifically, it collects attack detection alerts generated by each detection system on the network, analyzes the attack situation and the high level of correlation, and displays the graph as an intuitive intrusion analysis and timely analysis for the administrator. An apparatus and a method for helping to cope with the same.

Recently, the development of network technology based on the high-speed Internet environment and the corresponding attack forms are becoming larger, more diverse, and more complex, and it is becoming increasingly difficult to detect and respond effectively to them. The scale of damage caused by attacks such as denial of service (DoS), distributed denial of service (DDoS), worm, bot, and virus, which are the main causes of abnormal traffic in internal and external network environments The increasing number of detection and prevention technologies such as firewalls, virtual private networks, vulnerability analysis, antivirus vaccines, and intrusion detection and prevention systems are being introduced.

Intrusion detection alerts that occur on the network are represented in the form of lines in the three-dimensional rectangular coordinate system to identify the correlation between events, and based on this, techniques for analyzing and understanding the current security situation on the network have been developed. Existing analysis techniques mainly used the network technology to collect the information and the linkage with the security equipment for detection alarm collection, and the graph technology to express in three dimensions based on this. In case of exceeding a certain value based on the traffic volume, there was a limit in analyzing the abnormal state by identifying the stability effect of the network and the correlation between the traffic attributes. And based on alarms from security system, it analyzes based on specific patterns that constitute attack, analyzes false positive rate and correlates between detected alarms. Insufficient processing in Esau, and only analysis of correlation of detection alerts, insufficient information analysis on the direction of future attack.

The technical problem to be solved by the present invention was devised to solve the above problems, and analyzes the attack situation and the high level correlation with the attack detection alerts generated by each detection system on the network, and graphically expresses the intrusion to the administrator. The present invention provides an intrusion situation analysis and response device that provides a means for responding to situation analysis and timely, and a device expressing an attack detection alert in an N-order quadrant correlation graph.

In order to achieve the above technical problem, the intrusion situation analysis and response apparatus according to the present invention comprises: a first analysis unit for collecting and classifying attack detection alerts from network alerting apparatuses and expressing the results in a three-dimensional graph; And a second analysis unit which receives the result and performs a vector transformation for projecting the 3D graph in 2D and analyzes the association of the attacks.

In order to achieve the above technical problem, the intrusion situation analysis and response apparatus according to the present invention comprises: an attack detection and maintenance unit for collecting the attack detection alert by the first analysis unit; A classification unit for distinguishing the collected attack detection alerts according to at least one attack step and the situation of the attack step; And an N-th order representation analysis unit outputting the classified attack stage as a three-dimensional graph of the corresponding quadrant among the N quadrants allocated according to the attack stage.

In order to achieve the above technical problem, the intrusion situation analysis and response apparatus according to the present invention performs a predetermined vector conversion on the attack alert expressed in three dimensions in one of the Nth-order quadrants by performing a predetermined vector conversion. 2D plane projection analysis unit for projecting; And a conversion and association analysis unit for determining the interconnection possibility of the set of the attack alerts projected in the 2D and expressing the attack alerts that form related relations as a single line.

In order to achieve the above technical problem, a method of expressing an intrusion alert as an N-order quadrant association graph by the intrusion situation analysis and response apparatus according to the present invention includes an attack detection alert as an N-order quadrant association graph in the device for intrusion situation analysis and response. A method of expression, comprising: setting a criterion for classifying an attack situation and an attack stage, and classifying the attack stage in order of risk, and setting a criterion for determining the attack stage; Collecting attack detection alerts from network alerting apparatuses and applying the criteria to the criteria to generate a three-dimensional graph of the results; And analyzing the association of the attacks after receiving the result and performing a vector transformation that projects the three-dimensional graph in two dimensions.

In order to achieve the above technical problem, the intrusion situation analysis and response device according to the present invention expresses the intrusion alert in the N-order quadrant correlation graph, the step of generating the result as a three-dimensional graph collecting the attack detection alert step; Distinguishing the attack detection alert collected in the alert collection step according to at least one attack stage and the situation of the attack stage; And outputting the classified attack step as a three-dimensional graph of the corresponding quadrant among the N quadrants assigned to each of the attack stages.

In order to achieve the above technical problem, the intrusion situation analysis and response apparatus according to the present invention expresses an intrusion alert in an N-order quadrant association graph. The step of analyzing the association of the attacks is expressed in three dimensions on the N-order quadrant. Projecting the attack alert in two dimensions by performing a predetermined vector transformation; And judging interconnectability with respect to the set of the attack alerts projected in the two-dimensional manner, and expressing attack alerts that form related relations as one connected line.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. For ease of explanation and ease of understanding, the device and method are described together. 1 is a block diagram illustrating a connection relationship between an intrusion situation analysis and response device and interworking devices according to the present invention. 2A is a block diagram illustrating a detailed configuration of the first analyzer 107 illustrated in FIG. 1, and FIG. 2B is a block diagram illustrating a detailed configuration of the second analyzer 109 illustrated in FIG. 1. FIG. 3 is a flowchart illustrating a process of classifying an attack according to stages and situations in the first analysis unit 107 illustrated in FIG. 1 and expressing it in an N-difference quadrature. FIG. 4 is a second analysis unit illustrated in FIG. 109) is a flowchart showing the process performed. Meanwhile, FIG. 5A is a diagram illustrating an example of dividing into N-order quadrants, and FIG. 5B is an example of an attack stage and situation for information used when classifying an attack alert for each stage / situation or storing it in an attack stage classification database. Figure showing. FIG. 6 is a diagram showing a three-dimensional graph of an alarm belonging to a fourth-order quadrant of the N-order quadrant of FIG. 5, and FIGS. 7 to 8 show examples of projecting the three-dimensional graph of FIG. 6 in two dimensions. Drawing. Finally, Figure 9 is a view showing the results expressed to show the correlation between the alarms.

Reference is first made to FIG. 1. After receiving the result and performing a vector transformation for projecting the 3D graph in two dimensions, the second analysis unit first analyzing unit 107 for analyzing the association of the attacks is the host IPS 101, the network IPS 102, Various attack detection alerts are collected from antivirus service provider 103, firewall 104, and other security devices 105. The second analysis unit 110 receives the first analysis unit 107 collects and classifies attack detection alerts from the network alarm devices and expresses the result in a three-dimensional graph. After performing the vector transformation projecting to the target, we analyze the association of the attacks. In FIG. 1, the first analysis unit is output to the visualization device # 1 106 and the second analysis unit is output to the visualization device # 2 110, but this is for ease of understanding and may be actual display devices. Alternatively, the display may output a result by selection on one display device. On the other hand, the attack stage classification DB 108 stores the result in association with the first analysis unit and performs a function of providing and updating on request.

2A, a more detailed configuration will now be described with reference to the drawings. First, the functions of the first analyzer are described with reference to FIGS. 2A and 3. Attack detection and repair collection unit 201 collects an attack detection alert from the network security equipment (S301). The classification unit 203 distinguishes the collected attack detection alerts according to at least one attack step and the situation of the attack step. To this end, the detection alarms collected for each attack are judged by the presence of a keyword belonging to the classification criteria, and then the detection alarms are checked to see whether they belong to the classification criteria (step S303). By classifying the attack alert for each step / situation (step S305), and if there is no classification criteria are classified into suitable steps to be described below (step S309) and stored in the attack stage classification database 108 (step S311). The classified attack alarm is transmitted to the N-order quadrant expression analysis unit 205.

FIG. 5B is a diagram illustrating a stage and a situation of an attack on information used when classifying an attack alert for each stage / situation or storing it in an attack stage classification database. The stage defines a sequential flow of an attack. The situation defines the type of attack that can occur at that stage. For example, step 1 defines the situation of collecting information on which service is being used in which network, and refers to the act of collecting information by scanning any IP address or service port in a network. In order to classify the alarms generated by each step, it compares with the user-defined keyword such as the classification keyword example of FIG. Machine learning-based algorithms, such as Vector Machine, are used to classify them into the most similar stages. The newly classified keywords are used as the classification criteria together with the keywords of the corresponding stage.

The Nth order expression analyzing unit 205 outputs the attack stages classified as described above as a three-dimensional graph of the corresponding quadrants among the N quadrants (see FIG. 5A) allocated to each attack stage (step S307). At this time, each quadrant corresponds to one of the attack stages as illustrated in FIG. 5B, and the higher the quadrant, the more severe the attack stage.

5A and 6, it will be easier to understand. FIG. 4 is a view for explaining the function of the N-order representation analyzing unit 205. The plan view of the sixth order quadrant, that is, the view of the graph shown in three dimensions as shown in FIG. As a figure, it divides into a 1st quadrant, a 2nd quadrant, a 3rd quadrant, a 4th quadrant, a 5th quadrant, and a 6th quadrant in the counterclockwise direction from the right side. As such, the plan view of the N-order quadrant can be divided into N-order quadrants, each of which represents a stage of attack. That is, the first quadrant means collecting information for a dictionary attack, and the second quadrant means collecting information in more detail. In this way, the third quadrant, the fourth quadrant, and the fifth quadrant follow the same steps as in FIG. 3, and the last sixth quadrant refers to a serious activity such as data destruction or a dangerous activity stage for post-attack.

FIG. 6 illustrates the flow of the alarm belonging to the quadratic quadrant of FIG. 5, in which the alarm is expressed in a three-dimensional coordinate system, and each arrow is expressed by converting the attack detection alarm into a vector format. Here, IPa and IPb of each coordinate axis mean IP addresses of the source and destination, and Port means a port. The vector has a magnitude and direction, in which the magnitude represents the relationship between the source and destination IP addresses as a line and the arrow represents the direction of attack between the source and destination.

Now, the function of the second analyzer 109 will be described with reference to the related drawings (FIGS. 2B, 4, 7, and 9). The two-dimensional plane projection analysis unit 207 projects the attack alert (eg, FIG. 6) expressed in three dimensions in one of the N-order quadrants as shown in FIG. 5A in two dimensions by performing a predetermined vector conversion. do. In addition, the transformation and association analysis unit 209 determines the interconnection of each of the attack alerts for the set of the two-dimensionally projected attack alerts, and connects the attack alerts that form related relationships as one as shown in FIG. 9. Express as It demonstrates concretely below.

First, the 2D plane analysis unit 207 forms a set by projecting the attack alert to a 2D plane as shown in FIGS. 7 and 8 (step S401). This is a projection of two-dimensional planes to see if the attack phase is linked among the many alerts that have occurred. 8 shows a vector conversion method for projecting a vector V. When the vector V is projected on a two-dimensional plane composed of the X-axis and the Y-axis to become the vector V ", the vector V is not converted to the angle θ formed by the Y-axis. Is translated to the origin of the Z axis and becomes the vector V ', it only converts the vector into the angle θ' consisting of the two-dimensional planes of the X and Y axes and the Z axis. In this way, the transformation and concatenation can show the flow information of the attack, for example, in Fig. 7, the progress vector of the attack can be expressed by concatenating the transformation vector of the first quadrant and the transformation vector of the second quadrant. In the first quadrant, IPa and IPb represent the source and destination IP addresses, and in the second quadrant, IPb is the source IP address and (-) IPa is the destination IP address (where (-) In this way, the relationship between the third and fourth quadrants and the fourth and first quadrants can be related.

The transformation and association analysis unit 209 consequently performs a function of deriving a result as shown in FIG. 9. To this end, it is determined whether attack alerts can be interconnected based on whether the source IP address and the destination IP address match within the boundary axis (step S403). If the result is the same, the attack alerts are connected to each other for the set of attack alerts projected on the two-dimensional plane. If possible, the associated steps are represented by one connection (step S405). If there is more information to be connected, this process is repeated (step S407), and even if the intermediate step is not connected, all steps are connected to visualize future attack step and situation information and inform the administrator. In other words, it is visualized as shown in FIG. 9, which illustrates the result of inferring the attacks related to the sixth-order quadrant, in which the solid arrow indicates the association of the generated alarms and the dotted arrow. Does not appear in the alerts that have occurred, but it is an attack situation that is likely to have occurred throughout the flow. As shown in the embodiment, the information collected by the attacker was performed in the first and second stages, and thus the analysis result that the vulnerable attack in the fourth stage was successful, and the administrator authority in the fifth stage was acquired and performed.

The response determination unit 211 notifies the administrator that the attacker may damage the data of the system in such an attack situation through the visualization device 106, 110, etc., and if the administrator instructs the appropriate action, the system checks and blocks accordingly. The corresponding correspondence can be determined (step S409).

The method of the intrusion situation analysis and response device according to the present invention expressing the attack detection alert in the N-order quadrant correlation graph may also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and also carrier waves (eg transmission over the Internet). It is also included to be implemented in the form of. The computer readable recording medium can also be distributed over computer systems connected over a computer network so that the computer readable code is stored and executed in a distributed fashion. Also, the font ROM data structure according to the present invention can be read by a computer on a recording medium such as a computer readable ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and the like. It can be implemented as code.

As described above, the present invention has been described based on the preferred embodiments, but these embodiments are intended to illustrate the present invention, not to limit the present invention, and those skilled in the art to which the present invention pertains should be practiced without departing from the spirit of the present invention. It will be apparent that various changes, modifications, or adjustments to the examples are possible. Therefore, the protection scope of the present invention will be limited only by the appended claims, and should be construed as including all such changes, modifications or adjustments.

As described above, the intrusion situation analysis and response device according to the present invention, and the method in which the device expresses the attack detection alert in the N-order quadrant association graph, the attack type for the attack detection alerts generated by each detection system on the network are described. By automatically classifying and presenting the criteria, there is an effect that can present an unknown attack combination.

In addition, by expressing attacks related to the analyzed situation and stage of attack in 3D or 2D graphs, the administrator can intuitively determine the intrusion situation and respond to it, minimizing false responses.

In addition, it is possible to predict the progress and direction of the future attack to be able to respond in advance.

Claims (15)

A first analyzer configured to collect and classify attack detection alerts from the network alerters and to express the results in a three-dimensional graph; And And a second analysis unit which receives the result and performs a vector transformation for projecting the 3D graph in 2D and analyzes the association of the attacks. The first analysis unit An attack detection warning maintenance unit for collecting the attack detection alarm; A classification unit for distinguishing the collected attack detection alerts according to at least one attack step and the situation of the attack step; And And an N-th order representation analysis unit outputting the classified attack stages as a three-dimensional graph of the corresponding quadrants among the N quadrants assigned to each stage of the attack. The classification unit Intrusion situation analysis and response device, characterized in that if the detection alert is a keyword belonging to the classification criteria classified as the attack stage belonging to the classification criteria, if not the classification to the nearest attack stage. delete delete The method of claim 1, wherein the classification unit In the absence of the keyword, intrusion situation analysis and response device, characterized in that to classify to the nearest attack stage using a machine learning method including a SVM (Support Vector Machine). The method of claim 1, wherein the N-th representation analysis unit Each quadrant of the N quadrants corresponds to one of the attack stages, and a higher order quadrant expresses a greater attack stage. The method of claim 5, wherein the N-th representation analysis unit The IP address of the source of the attack alert, the IP address of the destination, and the port are each represented by one axis, and the detection alert is expressed in a vector format, wherein the magnitude represents the relationship between the source and destination IP addresses, and the direction is the source and the destination. An intrusion situation analysis and response device, characterized in that represented by a three-dimensional graph to indicate the direction of attack between the destination. The method of claim 1, wherein the second analysis unit A two-dimensional plane projection analysis unit projecting the attack alert represented in three dimensions in one of the N-order quadrants to perform two-dimensional projection by performing a predetermined vector conversion; And Intrusion situation characterized in that it comprises a; and the transformation and association analysis unit for representing the attack alert to form a related relationship by determining the interconnectability of the set consisting of the attack alert projected in the two-dimensional as a connecting line; Analysis and response device. The method of claim 7, wherein the two-dimensional plane analysis unit Intrusion situation analysis and response apparatus, characterized in that the direction of the attack by performing the vector conversion to indicate the angle formed by the straight line indicating the attack alert on each X axis and Z axis forming the IP address and port. In the method for representing the attack detection alarm in the N-order quadrant correlation graph in the device for intrusion situation analysis and response, (a) setting a criterion to classify the attack situation and the attack stage, and setting the criterion by classifying the attack stage in order of risk; (b) collecting attack detection alerts from network alerting apparatuses and applying the criteria to the criterion to generate a three-dimensional graph of the results; And (c) receiving the result and performing a vector transformation to project the three-dimensional graph in two dimensions, and then analyzing the association of the attacks; Step (b) is (b1) collecting the attack detection alert; (b2) distinguishing the attack detection alert collected in step (b1) according to at least one attack step and the situation of the attack step; And (b3) outputting the classified attack stages as a three-dimensional graph of the corresponding quadrants among the N quadrants assigned to the attack stages; Step (b2) is If the attack detection alert includes a keyword belonging to a classification criteria, classify it as an attack stage to which the classification criteria belong. If not, classify the attack detection alert as the nearest attack stage by applying a machine learning method including an SVM. Method for representing the attack detection alarm of the intrusion situation analysis and the response device characterized by the N-order quadrant correlation graph. delete delete The method of claim 9, Each of the N quadrants corresponds to one of the attack stages, and the higher the order of the quadrants, the more severe the attack stage is and the higher the risk is. How to represent the quadrant association graph. The method of claim 9, wherein step (b3) The IP address of the source of the attack alert, the IP address of the destination, and the port are each represented by one axis, and the detection alert is expressed in a vector format, wherein the magnitude represents the relationship between the source and destination IP addresses, and the direction is the source and the destination. An intrusion situation analysis and a method of expressing an attack detection alert of a corresponding device as an N-order quadrant association graph, characterized by generating a three-dimensional graph to indicate an attack direction between destinations. The method of claim 9, wherein step (c) (c1) projecting the attack alert expressed in three dimensions on the Nth quadrature in two dimensions by performing a predetermined vector transformation; And (c2) determining an interconnectability of the set of the attack alerts projected in the two-dimensional manner and expressing attack alerts that form related relations as a single connecting line; And expressing an attack detection alarm of the corresponding device in an N-order quadrant association graph. The method of claim 14, wherein step (c1) Attack detection alert of the intrusion situation analysis and corresponding device, characterized in that the direction of the attack by performing the vector conversion to the angle formed by the straight line representing the attack alert on each X axis and Z axis forming the IP address and port To represent an N-order quadrant association graph.

Images