KR101006372B1 - System and method for sifting out the malicious traffic - Google Patents

Abstract

PURPOSE: A harmfulness traffic isolating system and a method are provided to isolate traffic of botnet and DDoS traffic of zombie PC, thereby steadily providing an internet service. CONSTITUTION: An agent unit(250) sets policy of reaction according to an event. The agent unit performs inspection and discrimination about traffic. An isolation management unit(210) manages event information of a control system(100). The isolation management unit transfers intercepted target policy information to the agent unit. An isolation unit(220) stores a harmful traffic discriminated in the agent unit.

Description

Hazardous Traffic Isolation System and Methods {SYSTEM AND METHOD FOR SIFTING OUT THE MALICIOUS TRAFFIC}

The present invention relates to a system and method for quarantining harmful traffic, and is capable of stably providing Internet services by bypassing traffic generated from a botnet and distributed denial of service attack (DDoS) traffic generated from a zombie PC. To a harmful traffic isolation system and method.

In response to the recent surge of the Internet, the path of transmission of malicious software or malicious code through a communication network is diversified, and the damage caused by this is increasing every year. Malware is software that is intentionally designed to perform malicious activities, such as destroying the system or leaking information, contrary to the user's intentions and interests. Such malicious code types include hacking tools such as viruses, worms, trojans, backdoors, logic bombs, and trap doors, and malicious spywares. spyware and ad-ware. They are equipped with self-replicating or auto-propagating functions, leaking personal information such as user IDs and passwords, controlling target systems, changing / deleting files, destroying systems, denying services of applications / systems, leaking critical data, installing other hacking programs, etc. The problem is that the damage is very diverse and serious.

Recently, damage caused by DDoS (Distribute Denial of Service) has been seriously caused by damage caused by malicious software or malware. This is a hacking method in which multiple attackers are distributed and Denial of Service attack (DoS) is made so that the system can no longer provide normal service.

It is also known as a distributed denial of service attack or a distributed denial of service attack. It is a hacking method that attacks a specific site by distributing and operating several attackers at the same time. Tools for attacking services can be placed on multiple computers, flooding the network with massive amounts of packets that cannot be handled by the site's computer system. This can lead to users not being able to connect normally and, in severe cases, to serious damage to the functionality of the host computer. Many computer systems can also be used as hosts for hacking without the operator knowing. In general, an attack is carried out at a specific time through the control of a botnet Command & Control (C & C) server by infecting a general user's PC through malware or e-mail to make a so-called zombie PC.

In preparation for such network damage, recently, various measures have been taken to prevent distributed service denial attacks.

Representative technologies for preventing such distributed denial of service attacks include DNS Sinkhole technology and Honey-wall technology.

To explain this in detail, DNS Sinkhole technology is a system technology that detects mediators that control malicious bots and prevents secondary damage by blocking access between infected PCs and mediators. When the data is transmitted, the data is not transmitted to the corresponding address, and the sinkhole network responds instead so that the packet is not transmitted to the outside, and this method is applied to the DNS (Domain Name System).

In other words, in order to access the C & C server, the PC infected with the malicious bot needs to obtain the IP of the domain of the malicious bot server. When this is queried, the DNS server receives the IP from the DNS server in charge of the domain. It takes a way to inform your PC that is infected with malicious bots. In this case, if a domain known as C & C server of malicious bot receives DNS query from infected PC in advance by using DNS sinkhole technology, it directly responds to specific IP (set on DNS sinkhole server) without querying DNS that controls the domain. do. Therefore, PCs infected with malicious bots are connected to the IP received from the DNS sinkhole server. Therefore, malicious bots are blocked by C & C servers and prevent malicious actions.

However, this DNS Sinkhole technology only blocks C & C communication traffic and does not block harmful traffic other than communication traffic. In addition, if a user attempts to connect to the IP itself without performing a DNS query, there is a disadvantage that the harmful traffic cannot be blocked.

Honey-wall technology is a system technology for selecting, collecting, analyzing and monitoring the necessary information from the information flowing into the honey pot. In other words, Honey-wall technology is composed of traffic collection, analysis, control, and monitoring module, and it is a technology that can conduct behavior analysis through monitoring of malicious codes using it.

The traffic collection module collects the incoming traffic, and the traffic analysis and control module analyzes the traffic and forwards it for normal traffic according to a predetermined policy, and delivers it to the honey pot for abnormal traffic. In addition, traffic may be blocked so that secondary infection does not occur due to abnormal traffic. In addition, the actions performed by the abnormal traffic delivered to the honey pot can be delivered to the monitoring module so that the abnormal behavior can be analyzed.

However, this honey-wall technology requires a large-scale system equipped with traffic collection, analysis, control and monitoring functions. In addition, the server / system having the same function as the server to be protected must be built separately, and the fundamental problem that the determination of abnormal traffic is relatively accurate, but the time required for analysis is not real time, makes it difficult to effectively deal with the spread of damage. Have.

An object of the present invention is to ensure the stable provision of Internet services by bypass isolation of traffic generated from botnets and DDoS traffic generated from zombie PCs.

The present invention is a means for solving the above problems, is connected to the edge router for routing traffic in the network to be monitored and receives the traffic by BGP command (BGP Feeding) to the edge router, and inspects the incoming traffic botnet Or it provides a harmful traffic isolation system characterized by identifying harmful traffic generated in the zombie fish to bypass the internal containment (isolation, sifter) and forward the normal traffic to the destination.

The harmful traffic isolation system may include an agent configured to set a corresponding policy when an event occurs and to inspect and determine traffic by receiving traffic; An isolation management unit for managing event information provided from the control system and transferring the blocking target policy information to the agent unit to apply a corresponding policy; And an isolation office for storing harmful traffic determined from the agent unit. It is preferable to include.

The blocking policy information is periodically transmitted from the control system, and preferably includes an IP of a botnet C & C server and an IP of a zombie PC.

The quarantine is preferably a storage device for storing traffic determined as harmful traffic or suspicious traffic.

The agent unit may include a policy setting unit for setting a policy for a router; A virtual router that receives traffic from the router; A firewall for inspecting and filtering incoming traffic; And a forwarding unit for forwarding normal traffic to the destination. It is preferable to include.

The firewall filters and isolates traffic based on the IP of the zombie fish or IP of the botnet C & C server, and filters the traffic from the unknown IP to the source IP of the zombie fish or IP of the botnet C & C server. A primary filter for filtering and isolating traffic destined for the destination IP and treating it as a suspicious IP; Based on the repeatability of the traffic, comparing the payload size with a predetermined blocking rule to filter and isolate matching traffic, and process it as a suspicious IP; Based on the traffic threshold, it compares with the allowed traffic threshold of the protected safe area and the allowable traffic threshold of each source IP within the time window set for incoming traffic, and isolates and exceeds the suspected IP as suspicious IP. A third order filter to process; And checking the session table of the transmitted packet based on the connection state of the transmitted packet to determine and quarantine quarantined traffic according to the state of the session table, and to treat the IP of the traffic as a suspicious IP. 4th order filter; It is preferably configured to include at least one.

In order to reduce the false positive rate in the filtering process through the secondary filter, the firewall compares the content of the inspected content with the harmful content of the actual event and filters and isolates the corresponding traffic if it matches and suspects the IP. A second-first filter treated with; It is preferable to further include.

It is preferable that the administrator manages and inquires the isolation policy by accessing the monitoring server through the web page by transmitting the isolation situation made through the agent to the monitoring server.

On the other hand, according to another aspect of the present invention, the method comprising the steps of: (a) receiving event information about the harmful traffic generation event from the control system; (b) receiving and registering information on the monitored network and the safe area, and information on the IP of the zombie fish and the IP of the botnet C & C server; (c) inducing traffic to the virtual router through the edge router by performing a BGP command (BGP Feeding) to the router of the monitoring network; (d) inspecting the incoming traffic through the internal firewall to determine whether harmful traffic is present; And (e) forwarding traffic determined as normal traffic to the destination, and quarantining and storing traffic determined as harmful or suspicious traffic to an quarantine station. Provided is a harmful traffic isolation method comprising a.

The IP of the suspicious traffic determined in step (e) is preferably transmitted to the firewall as a suspicious IP and registered as a quarantine target IP.

In step (d), the traffic is filtered based on the IP of the zombie fish or the IP of the botnet C & C server, and is isolated. The unknown IP is the source IP and the zombie fish's IP or botnet. A first filter step of filtering, isolating, and treating a traffic having a C & C server as a destination IP as a suspect IP; Based on the repeatability of the traffic, comparing the payload size with a predetermined blocking rule to filter, isolate, and process the matching traffic as a suspicious IP; Based on the traffic threshold, it compares with the allowed traffic threshold of the protected safe area and the allowable traffic threshold of each source IP within the time window set for incoming traffic, and isolates and exceeds the suspected IP as suspicious IP. A third order filter step of processing; And checking the session table of the transmitted packet based on the connection state of the transmitted packet to determine and quarantine quarantined traffic according to the state of the session table, and to treat the IP of the traffic as a suspicious IP. Fourth order filter stage; It is preferred to perform at least one of the steps.

In step (d), in order to reduce the false positive rate during the filtering through the secondary filter, if the content of the inspected content is compared with the harmful content of the actual event, the corresponding traffic is filtered and isolated and the corresponding IP is filtered. A second-first filter step of treating the IP as a suspect IP; It is preferable to further include.

The harmful traffic isolation situation made through step (d) is delivered to the monitoring server so that the administrator can access the monitoring server through a web page to manage and query the isolation policy.

The harmful traffic isolation system and method according to the present invention has an effect of ensuring stable provision of an Internet service by bypassing DDoS traffic generated from a botnet and a DDoS traffic generated from a zombie PC.

In addition, the use of existing routers and the introduction of small new isolation systems, including router and firewall functions, can be applied to the protected network / server without any network change.

In addition, by contributing to the prevention of DDoS damage and the spread of zombie PCs, it is possible to obtain economic and intangible benefits, and to stably cope with the leakage of confidential information (personal information, management information, etc.) using botnet, and stable Internet service. It can increase the credibility of the site by guaranteeing the quality of information, and it can also minimize the scope of harmful traffic by sharing information (infringement incident response / investigation / management agency, etc.).

1 is a conceptual diagram of a harmful traffic isolation system according to the present invention;
2 and 3 is a schematic diagram for explaining the network application structure of the harmful traffic isolation system according to the present invention.
4 is an internal functional block diagram of a harmful traffic isolation system according to the present invention;
5 is a view for explaining an example of a suspicious IP blocking scheme according to the present invention.
6 is a view for explaining a system driving principle when the harmful traffic isolation system according to the present invention is located inside the monitored network.
7 is a view illustrating a system driving principle when the harmful traffic isolation system according to the present invention is located outside the monitored network.
8 is a view for explaining the principle of operation of the third order filter in accordance with the present invention.
9 is a view for explaining the principle of operation of the fourth order filter according to the present invention.
10 is a view for explaining the overall policy application process of the harmful traffic isolation system according to the present invention.
11 to 17 is a reference diagram for explaining a harmful traffic isolation monitoring process according to the present invention.
18 is an overall flow chart of a malicious traffic isolation method in accordance with the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram of a harmful traffic isolation system according to the present invention.

The harmful traffic isolation system according to the present invention enables stable provision of Internet services by extracting only harmful traffic and bypassing it. That is, by simply adding the harmful traffic isolation system to the network without changing the existing network, it separates harmful traffic from normal traffic by its own multi-order filter, bypasses C & C communication and DDoS traffic to a separate harmful traffic quarantine, and blocks normal traffic. By allowing only bays to be routed to the Safety Zone within the network, it can prevent DDoS damage and the spread of zombie fish.

The structure of applying the harmful traffic isolation system of the present invention to an existing network will be described with reference to FIG.

2 and 3 are schematic diagrams for explaining the network application structure of the harmful traffic isolation system according to the present invention.

Referring to FIG. 2, the harmful traffic isolation system may be located inside the monitored AS AS1 on a network in which multiple autonomous systems are connected to each other by an edge router. In this case, the harmful traffic isolation system communicates with the edge router of the monitored AS (AS1), and at the same time, is physically connected to the internal default router to bypass traffic between the ASs using the Border Gateway Protocol (BGP). . At this time, the internal routing protocol uses Open Shortest Path First (OSPF), which is generally used. The IGP (OSPF) table in the BGP table is the same as the redistribution setting between the existing IGPs, and IGP (OSP) in the IGP (OSPF) table. OSPF) tables do not require configuration because the malicious traffic isolation system does not need to know internal routing information. In this way, it is simply applied to the existing network to bypass traffic between ASs, and defaults to the edge router of AS1 in case the corresponding SIFter System (SS) is abnormally operated or stopped (SS abnormality). A router can be set up.

Here, the monitoring target AS (AS1) may exist at least two edge routers (Edge Router1, Edge Router2) according to the network state, as shown in Figure 3, in this case, shown in the drawing when applying the harmful traffic isolation system As can be seen, the connection between edge routers can be easily applied by using internal BGP (iBGP) and OSPF between other routers.

Referring now to Figure 4, looks at the specific internal configuration of the harmful traffic isolation system according to the present invention.

4 is an internal functional block diagram of a harmful traffic isolation system according to the present invention.

Referring to FIG. 4, the harmful traffic isolation system 200 sets a response policy when an event occurs, receives an inflow of traffic, isolates harmful traffic, and forwards normal traffic, and manages the agent 250. And an isolation management unit 210 for managing event information including the C & C IP and the zombie IP provided from the control system 100, and an isolation office 220 for storing harmful traffic.

The quarantine management unit 210 receives the blocking target policy information from the control system 100 and stores it in the information storage unit 211 and transmits the policy information to the agent unit 250 to apply it.

As such, the blocking target policy information periodically transmitted from the control system 100 includes the IP of the botnet Command & Control (C & C) server and the IP of the zombie PC. The botnet C & C server is a server that manages and delivers commands to the bots, which are subordinate processes that perform malicious activities, and the zombie fish is a fish that has a bot installed and coordinated by the corresponding botnet C & C server. If the IP is the IP of the botnet C & C server or the IP of the zombie fish, the quarantine management unit 210 sets the response policy to isolate and determine that the agent unit 250 is harmful traffic. In addition, the quarantine management unit 210 is notified of the event occurrence from the control system 100 when an event such as DDoS to update the IP of the botnet C & C server and the zombie fish stored in the information storage unit 211.

Meanwhile, the agent unit 250 includes a policy setting unit 260 for setting a policy for a router, a virtual router 270 that receives traffic, a firewall 280 that inspects and filters incoming traffic, and normal And a forwarding unit 290 for forwarding the traffic to the safe area.

When the DDoS event occurs, the policy setting unit 260 updates the router BGP table by BGP command to the router of the corresponding monitoring target AS to bypass traffic to the virtual router 270. Traffic is delivered to the firewall 280 through the virtual router 270.

The firewall 280 performs inspection and determination on incoming traffic and determines whether to quarantine to isolate the quarantine office 220 or forward the forwarding unit 290 to a destination within a safe zone. At this time, the traffic inspected through the firewall 280 and determined to be harmful traffic or suspicious traffic is not immediately dropped and is isolated and stored in the quarantine 220 so that analysis and preparation of statistical data on the corresponding traffic can be performed. Make it possible. The traffic inspection method of the firewall 280 will be described later in detail.

The quarantine 220 stores traffic determined as harmful traffic or suspicious traffic through the firewall 280. Such quarantine 220 may be implemented through a separate storage device. Suspicious traffic will be used for later statistics and analysis. At this time, harmful traffic or suspicious traffic stored in the quarantine 220 may be managed in an external separate storage device using a network transmission protocol.

On the other hand, the monitoring server 300 receives the quarantine information through the quarantine management unit 210 to provide to the administrator, as shown in FIG. It will support policy setting.

Referring now to Figures 6 and 7, look at the positional relationship between the harmful traffic isolation system and the monitored network AS.

6 is a view illustrating a system driving principle when the harmful traffic isolation system according to the present invention is located inside the monitored network, and FIG. 7 shows the harmful traffic isolation system according to the present invention outside the monitored network. It is a figure for demonstrating the system drive principle in case of positioning.

Referring to FIG. 6, when the harmful traffic isolation system is located inside the monitored network, the policy setting unit 260 (not shown) issues a BGP command (BGP feeding) to the edge router to update the BGP table of the edge router. The traffic is diverted to the virtual router 270 through the first interface NIC1. This bypassed traffic is inspected and determined by the internal firewall 280 (not shown), and if determined to be quarantined, the traffic is quarantined to the quarantine 220. It is forwarded to the destination through the second interface (NIC2) connected to the default router.

Similarly, referring to FIG. 7, even when the harmful traffic isolation system is located outside of the monitored network, the policy setting unit 260 (not shown) performs a BGP command (BGP feeding) to the corresponding edge router. The BGP table of the edge router is updated to divert traffic to the virtual router 270 through the first interface NIC1. This bypassed traffic is inspected and determined by the internal firewall 280 (not shown), and if determined to be quarantined, the traffic is quarantined to the quarantine 220. It is forwarded to the destination in the safe area by forwarding to the default router physically connected via the second interface (NIC2) connected to the network.

In this case, unlike the case where the harmful traffic isolation system is located inside the network to be monitored, as shown in FIGS. 6 and 7, since the harmful traffic isolation system is located outside the network to be monitored, the internal network transmission is not used. The command information including the policy information to be blocked may be received from the control system 100 through the interface NIC3, and the monitoring information according to the policy application may be transmitted to the control system 100 through the third interface NIC3.

Now, a detailed traffic inspection method of the firewall 280 that bypasses and receives and processes traffic will be described.

The firewall 280 may be configured with first to fourth filters according to a method of inspecting traffic, and the order of applying the filters may be configured differently according to the environment of the network.

The firewall 280 may be isolated and forwarded to the traffic flowing into the monitored network (AS) in which the harmful traffic isolation system is installed from the outside, and conversely, for the traffic emitted from the monitored network (AS) to the outside. Isolation and forwarding can be made.

First, isolation and forwarding operations for traffic flowing into the monitoring target network (AS) where the harmful traffic isolation system is installed from the outside will be described.

In this case, the first filter of the firewall 280 is a filtering method based on the IP of the traffic, and the IP of the zombie fish or the IP of the botnet C & C server is used as the source IP in the traffic flowing into the monitored network AS. To filter and isolate traffic. In addition, the first filter of the firewall 280 is isolated by filtering the traffic to the internal botnet C & C server from the traffic flowing into the network to be monitored (AS) zombie fish IP or unknown IP as the source IP Let's go. At this time, such unknown IP is registered as a suspect IP.

In this first order filter, the source IP starts from the assumption that it is not a spoofed IP.

In addition, the second filter of the firewall 280 is a filtering method based on the repeatability of traffic, and compares the traffic load size with a predetermined blocking rule and filters and isolates the traffic when the second filter is matched. .

In fact, since DDoS traffic exchanged when an event such as DDoS occurs has a certain size, harmful traffic is extracted by extracting the packet length of the traffic and comparing it with the packet length of the DDoS event provided by the control system 100. Judging by this will have considerable accuracy. At this time, the IP transmitting harmful traffic through the secondary filter is registered as a suspicious IP.

In this secondary filter, the source IP starts from the assumption that it is not a spoofed IP.

In this case, a separate 2-1 filter may be applied to reduce a false positive rate in the filtering process through the secondary filter. The 2-1 filter compares the content of the inspected content with the content of the DDoS event provided by the actual control system 100 and filters and isolates the corresponding traffic. At this time, since the content comparison process of the 2-1 filter may place a load on the system, it is preferable to apply the option as an option and selectively apply it according to the environment.

At this time, the source IP and the destination IP related to the traffic filtered through the second filter and the second-first filter are registered in the information storage unit 211 as a separate suspicious IP and used as data for the first filter. It may also be reported to the control system 100 through the quarantine management unit 210 may be used as data for future policy setting.

In addition, the third filter of the firewall 280 is a filtering method based on the traffic threshold, and allows traffic thresholds and source IPs of the safe zone to be protected within the time window set for incoming traffic. Compared with the allowed traffic threshold, the IP exceeding it is isolated or registered as a suspect IP.

This third order filter will be described in more detail with reference to FIG. 8 as follows.

Referring to the figures, the set time interval (Time Windows) of t _i interconnector IP (from IP) list in an interval of t _i + t is from _{0 ip 1, ip 2, ip 3} .... a _n ip, the drawings In the table, the threshold of the safe zone (protected server group) in the monitored network, the destination of the traffic, and the threshold for each accessor IP are displayed.

Herein, when the target IP to be isolated satisfies the following Equation 1, the corresponding ip _j is determined as the isolation target IP.

In addition, the target IP to be registered as the suspect IP registers a new ip _j as the suspect IP when the following equation (2) is satisfied.

는 시간 구간 내 접속자 IP(출발지 IP)별로 안전구역 내부(보호대상 서버군)로 접근하는 트래픽의 건수를 의미하고,

는 시간 구간 내에서 안전구역 내부(보호대상 서버군)로 접근하는 모든 트래픽 건수의 합을 의미하고,

는 m 개의 시간 구간(Time Windows) 내에서 안전구역 내부(보호대상 서버군)로 접근하는 허용(평균) 트래픽의 건수를 의미하며,

은 m 개의 시간 구간(Time Windows) 내에서 접속자 IP(출발지 IP)별 허용(평균) 트래픽 건수를 의미한다. 또한, σ는 시간 구간 내에서 안전구역 내부(보호대상 서버군)로 접근하는 트래픽에 대한 표준편차이다. From here,

Means the number of traffic accessing inside the safe area (group of protected servers) by accessor IP (origin IP) within the time interval,

Means the sum of all traffics approaching the inside of the safety zone (protected server group) within the time interval,

Is the number of allowed (average) traffic to access the inside of the safe area (group of protected servers) within m time windows.

Is the number of allowed (average) traffic per visitor IP (origin IP) within m time windows. In addition, σ is a standard deviation for traffic approaching the inside of the safety zone (protected server group) within a time interval.

In this case, it is preferable that the file transfer is selectively selected when the third order filter is applied.

Therefore, if a large amount of traffic flows even through the above-described primary filter and secondary filter, by applying such a third filter, the source IP is directly acted as an isolation IP or registered as a suspect IP by comparing with the threshold. By doing so, it is possible to prevent network paralysis caused by the influx of a large amount of traffic.

In addition, the fourth filter of the firewall 280 is a filtering method based on the connection state of the transmitted packet. The fourth filter of the firewall 280 checks the session table of the packet transmitted to the network and according to the state of the corresponding session table. Isolate the IP.

This fourth order filter will be described in more detail with reference to FIG. 9 as follows.

Referring to the figure, when the fourth filter receives a packet transmitted to the network, the fourth filter checks the session table of the packet to check the state of the session table. At this time, the state of the session table may be 'INVALID', 'EATABLISHED', 'NEW', 'RELATED', etc. according to the connection state. As such, the method of determining whether to isolate packets using the state information of the current connection state is relatively simple to implement, which can greatly improve the speed of the firewall.

Here, the state 'NEW' means a new connection or a packet not shown in the previous connection tracking table, the state 'ESTABLISHED' appears when a connection is normally established, and the state 'RELATED' tries to start a new connection. Appears when there is already an entry related to the connection in the connection tracking table. Status 'INVALID' appears when the connection status is unknown or has an invalid header.

Therefore, the fourth filter determines the state of the session table of the identified packet and isolates the packet if the session state has 'INVALID'. ) If the number exceeds the allowable number, the packet for the corresponding source IP is also isolated, and if the other session state ('EATABLISHED', 'RELATED', etc.) is forwarded, the packet is forwarded. Here, the allowable number may be defined as the average number of sessions by source IP for the safe zone in the monitored network, and the standard deviation of the number of sessions by source IP for the safe zone may be added.

As such, when the DDoS event occurs in the control system 100, the harmful traffic isolation system issues a BGP command to the edge router, bypasses the traffic to the firewall 280, and removes the first to fourth filters of the firewall 280. Through this, DDoS traffic from outside is identified and isolated or forwarded to original address.

Meanwhile, the isolation and forwarding operations for botnet-related server communication traffic such as C & C generated from the inside of the monitored network AS will be described as follows.

In this case, the filter module of the firewall 280 is also driven, and only the first filter and the second filter are assuming that the security environment of the monitored network AS is basically relatively stable compared to the outside. It is desirable to make it work.

In this case, the first filter of the firewall 280 is a filtering method based on the IP of the traffic, and the IP of the zombie fish or the IP of the botnet C & C server in the outbound traffic from the network to be monitored (AS) is the destination IP. This will filter the traffic.

More specifically, if traffic from the IP of the botnet C & C server or the IP of the zombie fish is the IP of the known zombie fish or the IP of the botnet C & C server, the traffic is immediately isolated and the botnet C & C server If the source IP of the traffic whose IP is the IP of the zombie fish or the destination IP is unknown, the second filter, which will be described later, is applied to the corresponding traffic.

In other words, if the source IP of the traffic is not the IP of the zombie fish or the IP of the botnet C & C server, the traffic destined for the IP of the botnet C & C server or the IP of the zombie fish is assumed to be botnet traffic and is not immediately isolated. Apply a filter.

In this first order filter, the starting IP is assumed to be not a spoofing IP.

The second filter of the firewall 280 is a filtering method based on the repeatability of traffic. As described above, the source IP of the traffic is not known as the IP of the zombie fish or the IP of the botnet C & C server, but the For traffic destined for an IP or zombie fish IP, the payload size is compared with a predetermined blocking rule and, if a match is found, the traffic is filtered and isolated and registered as a new zombie IP at the same time. Be notified.

In this secondary filter, the source IP starts from the assumption that it is not a spoofed IP.

In this case, a separate 2-1 filter may be applied to reduce a false positive rate in the filtering process through the secondary filter. The 2-1 filter compares the content of the inspected content with the content of the DDoS event provided by the actual control system 100 and filters and isolates the corresponding traffic. At this time, since the content comparison process of the 2-1 filter may place a load on the system, it is preferable to apply the option as an option and selectively apply it according to the environment.

At this time, the source IP and the destination IP related to the traffic filtered through the second filter and the second-first filter are registered in the information storage unit 211 as a separate suspicious IP and used as data for the first filter. It may also be reported to the control system 100 through the quarantine management unit 210 may be used as data for future policy setting.

Now, with reference to FIG. 10, the overall policy application process of the above-described harmful traffic isolation system will be described.

Referring to FIG. 10, the control system 100 transmits a quarantine policy to the quarantine management unit 210 of the harmful traffic isolation system 200, and the quarantine management unit 210 receiving the quarantine policy transmits the quarantine policy to an internal information storage unit ( 211) to store the policy information. As described above, the policy information stored in the information storage unit 211 can be added, modified, or deleted, and the log is also stored.

The quarantine management unit 210 storing the policy information transmits the quarantine policy information to the agent unit 250 including the virtual router 270 and the firewall 280 so that the corresponding policy is applied to induce the above-mentioned traffic bypass. And traffic inspection and filtering, isolation of harmful traffic and forwarding of normal traffic.

When the agent unit 250 transmits the quarantine policy to the quarantine management unit 210 as status information, the quarantine management unit 210 stores the log and transmits the policy to the control system 100 as a response. You will be notified.

This policy protocol will now be described in detail.

The policy protocol defines a response policy generation request message protocol based on a common protocol, and is used when a policy is applied to the harmful traffic isolation system 200, the Domain Name System (DNS), and the Web firewall.

Such a common protocol may be defined as a structure as shown in Table 1 below.

STX CODE DATA ETX [^ & @!%] 7777 DATAS [%! @ & ^] ＼N

For example, such a common protocol may be configured as follows.

[^ & @!%} 7000DATAS {%! @ & ^] ＼N

Here, STX indicates the start of the data, it can be represented by the string [^ & @!%}. CODE indicates the type of data and has a 4-digit string. DATA represents the contents of the data and can be separated by! N% S & T @ when there are multiple items in the data. ETX signals the end of data, represented by the string {%! @ & ^] \ N.

Meanwhile, the communication protocol transmitted from the control system 100 to the harmful traffic isolation system 200 may be defined as a structure as shown in Table 2 below.

Item Example Policy transfer unique number 156 Generation request type 00 Correspondence policy type 10 BOTNET_INFO_TLB GLOBAL ID 23 Botnet Domain Name bot.er.net Botnet C & C IP akkress 10.1.1.199 Botnet C & C Locator / kbot BGP C & C FLAG 01 Response Policy Enforcement System Count 02 Response policy enforcement system IP1 10.1.1.191 Response policy enforcement system IP2 ... 10.1.1.192 Target Server Count 01 Target Server IP1 10.3.1.23 Target Server IP1 count limit 4000 Target Server IP1 Payload Size Count 02 Target Server IP1 Payload Size 1 456 Target Server IP1 Payload Size 2 ... 234 Target Server IP1 Detect Str Count 01 Target Server IP1 Detect Str1 /load.exe Target Server IP1 Drop Dst Port Count 01 Target Server IP1 Drop Dst Port1 4000 Target Server IP1 Drop Src IP Count 01 Target Server IP1 Drop Src IP1 10.2.1.55

Here, the item division of the data portion may be made up of Code 7777 and the delimiter character! N% S & T @.

For example, the communication protocol transmitted from the control system 100 to the harmful traffic isolation system 200 may be configured as in the following example.

[^ & @!%} 7777156! N% S & T @ 00! N% S & T @ 10! N% S & T @ 23! N%S&T@bot.er.net! N%S&T@10.1.1.199! N% S & T @ / kbot! N% S & T @ 01! N% S & T @ 02! N%S&T@10.1.1.191! N%S&T@10.1.1.192! N% S & T @ 01! N%S&T@10.3.1.23! N% S & T @ 4000! N% S & T @ 02! N% S & T @ 456! N% S & T @ 234! N% S & T @ 01! N%S&T@/load.exe! N% S & T @ 01! N% S & T @ 4000! N% S & T @ 01 !N%S&T@10.2.1.55 {%! @ & ^] ＼N

Here, the unique number of the transmission policy is a unique number for distinguishing the transmission policy, and the corresponding unique number can be used when responding to the policy normal processing.

The definition of the creation request type is 00 for auto creation (policy creation), 01 for requests from the management console GUI (policy creation), 02 for auto creation (policy deletion), and 03 for requests (policy deletion) from the management console GUI. Can be defined.

The definition of the corresponding policy type may be defined as 01 applying DNS sinkhole, 10 as a Sifter policy, and 11 as a public web firewall rule setting.

The BOTNET_INFO_TLB GLOBAL ID is a GLOBAL ID value of the botnet information table and may be used when referring to the information of the isolation management unit 210 in the control UI.

For BGP C & C FLAG, 00 can be defined as Botnet C & C NULL routing and 01 as Botnet C & C NULL routing.

The response policy application system IP may be an IP of the agent unit 250.

Target Server IP is applicable only if it is a quarantine policy. This is a server IP of interest, which injects traffic to that server into the quarantine system.

The threshold setting using the time window for the target server IP and the source IP may be configured by setting the threshold of the number of accesses of the server IP of interest and the threshold of the number of accesses of the IP accessing the server of interest. .

Target Server IP Payload Size is blocked by payload size value of traffic of server IP of interest.

Target Server IP Detect Str blocks the specific string of traffic from the target server IP.

Target Server IP Drop Dst Port blocks the traffic of the server IP of interest to a specific destination port.

Target Server IP1 Drop Src IP blocks the traffic of server IP of interest to specific source IP.

Next, the communication protocol transmitted from the harmful traffic isolation system 200 to the control system 100 may be defined as a structure as shown in Table 3 below.

Item Example Policy transfer unique number 156 Policy normal setting TRUE

Here, the item division of the data portion may be made up of Code 7777 and the delimiter character! N% S & T @.

For example, the communication protocol transmitted from the harmful traffic isolation system 200 to the control system 100 may be configured as in the following example.

[^ & @!%} 7777156! N% S & T @ TURE! {%! @ & ^] ＼N

Here, the definition of whether the policy is normally set may be defined as TRUE when the harmful traffic isolation system 200 sets the policy normally, and FALSE may be defined when the harmful traffic isolation system 200 sets the policy abnormally. have.

On the other hand, such a harmful traffic isolation system monitoring server 300 is connected to the monitoring system to provide a management web page that allows the administrator to access through the web to manage the isolation policy and to identify the quarantine situation of harmful traffic.

Such a management web page may register and manage the IP of the zombie fish as shown in FIG. 11. That is, the IP information of the zombie fish received from the control system 100 or the harmful traffic isolation system 200 can be registered and managed.

In addition, the management web page may register and manage the IP of the botnet C & C server as shown in FIG. This also can register and manage the IP information of the botnet C & C server received from the control system 100 or harmful traffic isolation system 200.

In addition, the management web page may register and manage the DDoS target IP as shown in FIG. This also can register and manage the DDoS target IP information received from the control system 100 or harmful traffic isolation system 200.

In addition, the management web page may manage the quarantine log as shown in FIG. That is, the harmful traffic isolation system 200 provides the administrator with IP information isolated through the quarantine policy to check the actual quarantine IP status.

In addition, the management web page may monitor the quarantine status in real time as shown in FIG. That is, the harmful traffic quarantine system 200 can monitor the quarantine status in real time by displaying the number of quarantine status by time of the quarantined traffic through the quarantine policy.

In addition, the management web page can query the quarantine status in the harmful traffic isolation system as statistical data, as shown in FIG. That is, the harmful traffic isolation system 200 analyzes the log isolated through the quarantine policy according to the source IP, the destination IP, and the port according to a period selected by the administrator, so that the log can be viewed as statistical data.

In addition, as shown in FIG. 17, the management web page may look at a variety of information about the quarantine status in the harmful traffic isolation system through a single screen. That is, the real-time situation can be identified at a glance by showing the comprehensive situation that is isolated through the isolation policy in the harmful traffic isolation system 200 in various ways.

Now, with reference to Figure 18 looks at the harmful traffic isolation method according to the present invention.

The harmful traffic isolation system receives event information regarding a harmful traffic occurrence event such as DDoS from the control system 100 (S10), and receives information (including band information) about a monitored network and a safe area by using an information storage unit ( 211), and receives information about the IP of the zombie fish and the IP of the botnet C & C server to register in the information storage unit 211 (S14).

In addition, the harmful traffic isolation system performs a BGP command (BGP Feeding) to the router of the monitoring target AS to update the BGP table of the router, thereby inducing botnet communication traffic and DDoS traffic to the virtual router 270 and bypassing it ( S16).

The harmful traffic isolation system performs the inspection process on the traffic by passing through the first to fourth filters through the internal firewall 280 for the traffic flowing through the process (S18).

At this time, the traffic inspection process may be configured to be flexible according to the environment of the network, but preferably all the first to fourth filters are operated and monitored for traffic flowing into the monitored network from the outside. For the outgoing traffic from the target network AS, it is preferable to operate only the first and second filters to increase the efficiency of the operation.

Through the traffic inspection process of the firewall 280, the quarantine target traffic and the forwarding target traffic can be determined, together with the information on the suspicious IP (S20).

Therefore, the traffic determined to be normal traffic is forwarded through the forwarding unit 290 to the destination in the safe zone (S22). The traffic inspected through the firewall 280 and determined as harmful traffic or suspicious traffic is not immediately dropped and is isolated and stored in the quarantine 220 (S24).

At this time, harmful traffic or suspicious traffic stored in the quarantine 220 may be stored and managed in an external separate storage using a network transmission protocol.

The suspicious IP of such suspicious traffic is registered in the information storage unit 211 as the IP of the new zombie fish or the IP of the botnet C & C server and used as data for the first filter, and also controlled through the quarantine management unit 210. As reported to the system 100 is used as data for future policy setting (S26).

In addition, the harmful traffic isolation system transmits information and logs on quarantine target traffic to the monitoring server 300 to support the administrator to query the quarantine status in the harmful traffic isolation system as statistical data (S28). . That is, the harmful traffic isolation system 200 analyzes the log isolated through the quarantine policy according to the source IP, the destination IP, and the port according to a period selected by the administrator, so that the log can be viewed as statistical data.

The harmful traffic isolation operation of the harmful traffic isolation system may be terminated by direct control, but preferably, the isolation operation according to the occurrence of harmful traffic such as DDoS event is terminated by receiving the event termination notification of the control system 100. It becomes possible (S30). As a result of the termination of the isolation operation, the isolation policy set in the router and the harmful traffic isolation system is released, and normal traffic delivery through the corresponding edge router is performed as usual (S32).

As described above, an optimal embodiment has been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

100: control system 200: harmful traffic isolation system
300: monitoring server

Claims (13)

It communicates with the edge router that routes traffic in the monitored network, receives traffic by BGP command (BGP feeding) to the edge router, and examines the incoming traffic to determine harmful traffic from botnets or zombies To isolate and bypass normal traffic and forward normal traffic to the destination,
The harmful traffic isolation system,
An agent unit for setting a corresponding policy when an event occurs and inspecting and determining the traffic by receiving the traffic;
An isolation management unit for managing event information provided from the control system and transferring the blocking target policy information to the agent unit to apply a corresponding policy; And
An quarantine for storing harmful traffic determined from the agent unit; Including,
The agent unit,
A policy setting unit for setting a policy for a router;
A virtual router that receives traffic from the router;
A firewall for inspecting and filtering incoming traffic; And
A forwarding unit for forwarding normal traffic to the destination; Including;
The firewall,
Based on the IP of the traffic, the Zombie Fish IP or the botnet C & C server's IP is filtered and isolated, and the unknown IP is the source IP and the Zombie Fish's IP or Botnet C & C server's IP is the destination IP. A primary filter for filtering, isolating, and processing traffic into suspicious IPs;
Based on the repeatability of the traffic, comparing the payload size with the size of harmful traffic exchanged at the event occurrence, filtering a second traffic, isolating the matching traffic, and treating the suspected IP as a second filter;
Based on the traffic threshold, it compares with the allowed traffic threshold of the protected safe area and the allowable traffic threshold of each source IP within the time window set for incoming traffic, and isolates and exceeds the suspected IP as suspicious IP. A third order filter to process; And
Check the session table of the packet being sent, and if the link state information of the session table is unknown or invalid header, or if a new connection is made or the packet is not shown in the previous connection tracking table, the corresponding traffic A fourth order filter which discriminates and isolates the traffic as quarantine target traffic and treats the IP of the traffic as a suspicious IP; Harmful traffic isolation system, characterized in that it comprises at least one of.
delete The method of claim 1,
The blocking target policy information is periodically transmitted from the control system, and harmful traffic isolation system, characterized in that the IP of the botnet Command & Control (C & C) server and the IP of the zombie fish (Zombie PC).
The method of claim 1,
The quarantine is a harmful traffic isolation system, characterized in that the storage device for storing traffic determined as harmful traffic or suspicious traffic.
delete delete The method of claim 1,
The firewall,
In order to reduce the false positive rate during the filtering through the secondary filter, if the content of the inspected content is compared with the harmful content of the actual event, the traffic is filtered and quarantined, and the corresponding IP is treated as a suspicious IP. 2nd order filter; Hazardous traffic isolation system further comprising.
The method of claim 1,
Harmful traffic isolation system, characterized in that the administrator by the quarantine management through the agent unit to the monitoring server to connect to the monitoring server through a web page to manage and query the quarantine policy.
(a) receiving event information regarding a harmful traffic occurrence event from the control system;
(b) receiving and registering information on the monitored network and the safe area, and information on the IP of the zombie fish and the IP of the botnet C & C server;
(c) inducing traffic to the edge router of the corresponding network to be monitored by BGP feeding (BGP Feeding) to induce traffic through the virtual router;
(d) inspecting the incoming traffic through the internal firewall to determine whether harmful traffic is present; And
(e) forwarding traffic determined to be normal traffic to the destination and quarantining and storing traffic identified as harmful or suspicious traffic to an quarantine; Including but not limited to:
In step (d),
Based on the IP of the traffic, the Zombie Fish IP or the botnet C & C server's IP is filtered and isolated, and the unknown IP is the source IP and the Zombie Fish's IP or Botnet C & C server's IP is the destination IP. Filtering the traffic to be isolated and processing it as a suspect IP;
Based on the repeatability of the traffic, comparing the payload size with the size of harmful traffic exchanged when an event occurs, and filtering and isolating matching traffic and treating it as a suspect IP;
Based on the traffic threshold, it compares with the allowed traffic threshold of the protected safe area and the allowable traffic threshold of each source IP within the time window set for incoming traffic, and isolates and exceeds the suspected IP as suspicious IP. A third order filter step of processing; And
Check the session table of the packet being sent, and if the link state information of the session table is unknown or invalid header, or if a new connection is made or the packet is not shown in the previous connection tracking table, the corresponding traffic A fourth order filter step of discriminating and quarantining the traffic as quarantine target traffic and treating the traffic IP as a suspect IP; At least one of the above steps.
The method of claim 9,
The malicious traffic isolation method according to claim (e), wherein the IP of the suspicious traffic determined in step (e) is transmitted to the firewall as a suspicious IP and registered as a quarantine target IP.
delete The method of claim 9,
In step (d),
In order to reduce the false positive rate during the filtering through the secondary filter, if the content of the inspected content is compared with the harmful content of the actual event, the traffic is filtered and quarantined, and the corresponding IP is treated as a suspicious IP. 2-1st filter step; The harmful traffic isolation method further comprising.
The method of claim 9,
The harmful traffic isolation situation made through the step (d) is delivered to the monitoring server so that the administrator can access the monitoring server through the web page and manage and query the isolation policy.

Images