KR101045332B1 - System for sharing information and method of irc and http botnet - Google Patents

Abstract

The present invention relates to an IRC and HTTP botnet information sharing system and a method thereof, and more particularly to an IRC and HTTP botnet information sharing system that can easily cope with by sharing information of botnets existing in a plurality of Internet service provider networks. It's about how. The present invention can provide an IRC and HTTP botnet information sharing system and a method for detecting and managing botnets by detecting botnets existing in a plurality of Internet service provider networks and sharing the information thereof.

IRC, HTTP, Botnets, Detection, Response, Management, Information, Sharing

Description

IRC and HPTT botnet information sharing system and method thereof {SYSTEM FOR SHARING INFORMATION AND METHOD OF IRC AND HTTP BOTNET}

The present invention relates to an IRC and HTTP botnet information sharing system and a method thereof, and more particularly to an IRC and HTTP botnet information sharing system that can easily cope with by sharing information of botnets existing in a plurality of Internet service provider networks. It's about how.

Bot stands for Robot, which means a personal computer (PC) infected with malicious intentional software. These botnets can be classified according to the protocol used by the botnet. That is, a communication protocol between a bot client and a C & C server forming a botnet may be classified as an IRC botnet in the case of the IRC protocol, and an HTTP botnet in the case of the HTTP protocol. At this time, a number of bots are infected by a personal computer and are connected to a network to form a botnet. The botnet thus formed is remotely controlled by a bot master and is used for various malicious activities such as DDoS attacks, personal information collection, phishing, malware distribution, and spam mailing.

As such, attacks through botnets continue to increase, methods are increasingly diversified, and criminalization aims at monetary gains. Unlike the case of causing Internet service failure through DDoS, there are bots that cause personal system failure or illegally acquire personal information, and illegal user information such as ID / password and financial information. Increasingly, cybercrime abuse is becoming more common. In addition, while the existing hacking attacks show the hacker's own ability or compete with the community, the botnet shows the hacker group intensively exploiting and cooperating for the purpose of financial gain.

However, botnets are becoming more sophisticated to detect and circumvent using advanced technologies such as periodic updates, execution compression techniques, coder changes, and command channel encryption. In addition, the source of the botnet is open source, and thousands of variants occur, and the bot code can be easily generated or controlled through the user interface, so people without specialized knowledge or skills can make and use the botnet. This is serious. Bot zombies that make up these botnets are distributed in Internet service provider networks around the world regardless of country, and bots Command & Control (C & C) that controls bot zombies can be migrated to other AS (Autonomous Systems). Therefore, although many studies have been made while cognizing the seriousness of the botnet, there is a problem that it is difficult to detect the overall configuration and distribution of the botnet by detecting only the botnet of a specific Internet service provider network.

An object of the present invention is to provide an IRC and HTTP botnet information sharing system and a method for easily detecting and managing botnets existing in various Internet service provider networks.

In order to achieve the above object, the present invention provides an IRC and HTTP botnet information sharing system that detects and shares botnet information of a plurality of Internet service provider networks, the botnet information sharing request module for requesting sharing of the botnet information; It provides an IRC and HTTP botnet information sharing system comprising a botnet information sharing module having a shared botnet information processing module for processing the shared botnet information.

The botnet information sharing request module includes: a sharing request classification module for classifying a sharing request object for the botnet information, a sharing information generating module for generating sharing information according to the sharing request object for the botnet information, and the plurality of Internet services. It includes a botnet information sharing message transmission module for transmitting the botnet information to the Internet service provider network requesting the botnet information of the provider network.

The shared botnet information processing module checks whether a shared botnet information collection and parser module collects and parses shared botnet information from the Internet service provider network and sets a corresponding policy corresponding to the shared botnet information. And a response policy check module for generating a botnet C & C access blocking response setting request if the response policy is not set. The interface of the botnet information sharing module may be operated by an administrator through a web browser using HTTP.

The present invention also provides an IRC and HTTP botnet information sharing method of detecting botnet information of a plurality of Internet service provider networks, storing them in a botnet information database, and sharing each other, the method comprising: processing a sharing request for the botnet information; It provides an IRC and HTTP botnet information sharing method comprising the step of processing the shared botnet information.

Processing the share request for botnet information includes processing a share request from a management console graphical user interface setup timer, or processing a share request from a SEC, MMBOA, MMBBA, or administrator console graphical user interface. .

Processing the sharing request from the management console graphical user interface configuration timer includes retrieving newly detected botnet information from when the botnet detection expired previously to the latest expiration time to generate shared botnet information. In addition, processing the sharing request from the SEC, MMBOA, MMBBA, Administrator Console graphical user interface includes searching the botnet information database to obtain botnet information. The botnet information may include a botnet C & C IP address, a port number used, and malicious behavior.

The processing of the shared botnet information may include: setting an automatic response policy for the shared botnet information; setting a botnet C & C access blocking response policy based on the shared botnet information; And establishing a botnet malicious behavior response policy based on the botnet information. In the setting of the automatic response policy for the shared botnet information, if the automatic response policy establishment for the shared botnet information is not set, the request for generating a black list sharing response policy including the detected botnet C & C list is requested. The step of setting a botnet C & C access blocking response policy based on the shared botnet information may include domain name system sinkholes, BGP feeding, and HTTP-based C & C URLs if a response policy for blocking access to the shared botnet C & C is not established. Request blocking rule setting. The step of establishing a botnet malicious behavior response policy based on the shared botnet information requests BGP feeding based on the shared botnet information.

The present invention can provide an IRC and HTTP botnet information sharing system and a method for detecting and managing botnets by detecting botnets existing in a plurality of Internet service provider networks and sharing the information thereof.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an IRC and HTTP botnet information sharing system according to the present invention, Figure 2 is a view showing a connection relationship between the botnet detection system of the IRC and HTTP botnet information sharing system according to the present invention. 3 is a stack of an IRC and HTTP botnet information sharing system according to the present invention, and FIG. 4 is a block diagram of a botnet information sharing module of the IRC and HTTP botnet information sharing system according to the present invention.

As shown in FIG. 1, the IRC and HTTP botnet information sharing system according to the present invention includes a botnet detection system provided in an internet service provider network, and a bonnet control / security management system that collects information of the botnet detection system. In this case, an Internet Service Provider (ISP) network refers to a service network including a line through which an individual or a group can access the Internet, and the present embodiment includes three Internet service providers. Illustrate your network. Also, accordingly, the internet service provider network includes first to third internet service provider networks. However, the present invention is not limited thereto and may be applied to a network including at least one internet service provider network.

The botnet detection system is installed in an internet service provider network and detects a botnet operating in the corresponding internet service provider network based on the traffic information collected by the traffic collection sensor. There may be m such botnet detection systems in the Internet service provider network. It also detects botnets and analyzes malicious behaviors using collected traffic information. The detected botnet information is sent to the botnet control and security management system. Meanwhile, policies of the traffic collection sensor and the botnet detection system may be set in the management system. The botnet detection system is connected with a traffic information collection sensor, a management system for managing the setting and status information of the traffic information collection sensor and the botnet detection system as shown in FIG.

The traffic collection sensor collects traffic of the internet service provider network for botnet detection. In this case, the number of traffic collection sensors may exist in the corresponding Internet service provider network (m) x the number (n) of traffic collection sensors provided in the botnet detection system. In addition, the traffic collection sensor collects Domain Name System (DNS) traffic and traffic information according to a collection policy set by the botnet control and security management system. At this time, the collected traffic information is periodically transmitted to the botnet detection system.

Host-level active bot infection detection system is a stand-alone system that analyzes actively infected malicious bots and provides bot information used by botnets.

Botnet Management Security Management System (BMSM) provides the function to visualize the botnet information of the relevant internet service provider network and set the response policy. In addition, the Botnet Management Security Management System (BMSM) performs a function of organically sharing the detected botnet information for botnet response between Internet service provider networks or countries, similarly to the control system. In this case, there is generally one botnet control and security management system in the Internet service provider network. As shown in FIG. 3, the botnet control and security management system (BMSM) is an interface for botnet response, botnet information sharing statistics reporting, system management, botnet structure / malicious behavior visualization, policy management, and HTTP. Using it, the administrator can operate through a web browser.

In addition, the botnet control and security management system includes the Security Event Collector (SEC), the Anomaly Organization Log Analysis (AOA), and the Unclassified Behavior Log Analysis (UBA). ), Botnet Information Share (BIS), Botnet Against Technology (BAT), Static Reporting Management (SRM), Botnet Monitoring (Botnet Monitoring) BM), detection log management module (Detection Log Management (DLM)), policy management module (Policy Management, PM), and system management module (System Management, SM).

The Security Event Collector (SEC) receives a security event consisting of a detection log, a classification behavior log, and an abnormal configuration log from a detection system. At this time, the received detection log and classification behavior log are stored in a database and a botnet response policy such as a domain name system sinkhole is established. In addition, the abnormal configuration log is forwarded to Anomaly Organization Log Analysis (AOA), and the unclassified behavior log is forwarded to an unclassified behavior log analysis module (UBA).

Anomaly Organization Log Analysis (AOA) collects and analyzes abnormal logs from multiple detection systems. To this end, the detection system analyzes domain similarity, IP / Port similarity, and Uniform Resource Locator (URL) similarity, and sends abnormal logs whose similarity is above the minimum threshold and below the trust threshold to the Botnet Management Security Management System (BMSM). send. In this case, the botnet management security management system (Botnet Management Security Management, BMSM) collects and analyzes abnormal logs from a plurality of detection systems.

Unclassified Behavior Log Analysis (UBA) receives unclassified behavior log and classifies it and sets response policy. To this end, the detection system sends unclassified behavior logs to the Botnet Management Security Management System (BMSM), and the Botnet Management Security Management System (BMSM) can Classify by receiving unclassified behavior log.

The Botnet Against Technology (BAT) establishes a response policy for detected botnets. In addition, it establishes a policy for sharing blacklists based on detected botnets, applying domain name system sinkholes, BGP feeding (Border Gateway Protocol feeding), and blocking HTTP botnet C & C access URLs using web firewalls.

Static Reporting Management (SRM) generates botnet information and malicious behavior information such as various graphs and tables. In addition, a reporting function is provided for the generated statistical data, and this static reporting manager can be used through a web-based user interface (UI).

Botnet Monitoring (BM) provides a monitoring function to easily check the botnet structure and malicious behavior. In addition, reporting function is provided for the generated statistical data.

Detection Log Management (DLM) is a processor for managing botnet information, botnet malicious activity information, system information, policy information, and botnet response policy information.

The Policy Management Module (PM) sets policies for modules running inside the Botnet Management Security Management System (BMSM). In addition, the policy supervision module sets the detection policy of the detection system registered in the Botnet Management Security Management System (BMSM). In addition, the traffic collection sensor policy through the registered detection system is set.

The System Management Module (SM) is a botnet management security management system (BMSM) for detection systems, traffic collection sensors, domain name system sinkhole servers, BGP routers, domain name system servers, and web firewalls. Provides the ability to register with. In addition, it provides monitoring and on / off function of registered detection system, traffic collection sensor.

Referring to FIG. 4, the botnet information sharing module (BIS) shares botnet information detected in an internet service provider network with a botnet control and security management system (BMSM) of another internet service provider network. do. In addition, it generates botnet information by receiving botnet information detected from botnet control and security management system (BMSM) of other Internet service provider networks. The botnet information sharing module (BIS) includes a botnet information sharing request module and a botnet information processing module.

The botnet information sharing request module is for processing a sharing request for botnet information, and includes a sharing request classification module, a sharing information generating module, and a botnet information sharing message transmission module.

The sharing request classification module classifies the sharing request according to the configuration that requested the sharing of botnet information. The botnet information sharing request may be generated from a security event collector (SEC), an MMBOA, an MMBBA, a management console graphical user interface (GUI), and a management console graphical user interface setting timer. At this time, the MMBOA collects a security event suspected of abnormal botnet traffic, which is suspected as a botnet in the configuration of the traffic, but not assured, from the detection system. At this time, the abnormal botnet traffic is passed to the Anomaly Organization Log Analysis module (AOA), and the Anomaly Organization Log Analysis module (AOA) is used only for suspicious traffic having the same C & C information from multiple detection systems. It is reassembled and finally checked for botnets. In addition, the MMBBA collects security events that are suspected of botnet traffic, which is suspected of botnet traffic in the behavior of traffic from the detection system, but of unreliable traffic. At this time, the abnormal botnet traffic is passed to the Unclassified Behavior Log Analysis (UBA), and the Unclassified Behavior Log Analysis (UBA) receives traffic similar to the corresponding MMBBA from various detection systems. Collect and finally check for botnets.

The request for sharing botnet information from the management console graphical user interface may be performed by an administrator, and the botnet information stored in the database may be selected and shared through the management console graphical user interface. In addition, sharing the botnet information using the management console graphical user interface setting timer may share newly detected botnet information during the time that the timer is running. In addition, the Security Event Collector (SEC), MMBOA, and MMBBA can automatically share new botnet information detected only when the administrator has enabled the automatic sharing of detected botnet information. At this time, the sharing request from the Security Event Collector (SEC), MMBOA, MMBBA, Management Console Graphical User Interface includes botnet information to share the request message, but is shared from the Management Console Graphical User Interface Setting Timer. Since the request message does not have the necessary botnet information, it must be classified and generate shared botnet information. In addition, sharing requests from the Security Event Collector (SEC), MMBOA, MMBBA, Management Console Graphical User Interface, and Management Console Graphical User Interface Settings Timer may be classified by reference to the type bits of the Botnet Information Sharing Request message. have.

The sharing information generation module generates sharing information to correspond to the classified botnet sharing request. In this case, the sharing information may include malicious behavior, botnet information, botnet correspondence information, and system information.

The botnet information sharing message transmission module generates the shared information as a shared message and transmits the generated shared information to a control system of another internet service provider network or a botnet control and security management system (BMSM) of another internet service provider network. In addition, the shared information is transmitted to the botnet control and security management system of another Internet service provider network registered by the System Management (SM). In this case, the transmission of the shared information may use socket communication.

The botnet information processing module is for processing shared botnet information, and includes a shared botnet information collection and parser module, a response policy check module, and a response policy generation request message generation module.

The shared botnet information collection and parser module collects shared botnet information from a control system of another internet service provider network or a botnet control and security management system (BMSM) of another internet service provider network. In addition, the shared botnet information collection and parser module parses and classifies the collected shared botnet information. If the automatic response policy for the shared botnet information is not set, the blacklist sharing response policy is performed. Of course, when the automatic response policy function for the shared botnet information is set, the response policy check is performed.

The response policy check module checks whether a response policy corresponding to the shared botnet information is set. At this time, it is checked whether a blocking response policy for botnet C & C included in the shared botnet information is set.

If the response policy generation request message generation module does not set the response policy, the module generates a botnet C & C access blocking response setup request and transmits the request to the botnet against technology module (BAT).

As described above, the network-based IRC and HTTP botnet information sharing system according to the present invention detects botnets existing in a plurality of Internet service provider networks and shares the information thereof to facilitate network-based detection and management of botnets. Provides detection and response systems and methods of IRC and HTTP botnets.

Next, an IRC and HTTP botnet information sharing method according to the present invention will be described with reference to the accompanying drawings. Among the contents to be described later, descriptions overlapping with the description of the IRC and HTTP botnet information sharing system according to the present invention will be omitted or briefly described.

5 is a flowchart illustrating a process of processing a sharing request for botnet information in an IRC and HTTP botnet information sharing method according to the present invention, and FIG. 6 illustrates processing of botnet information shared in an IRC and HTTP botnet information sharing method according to the present invention. This is a flow chart of the steps. FIG. 7 is a botnet information sharing sequence diagram of the IRC and HTTP botnet information sharing method according to the present invention, and FIG. 8 is a shared botnet information processing sequence diagram of the IRC and HTTP botnet information sharing method according to the present invention. 9 is a flowchart of a method for sharing IRC and HTTP botnet information according to the present invention.

In the method of sharing IRC and HTTP botnet information according to the present invention, as illustrated in FIGS. 5 to 9, a process (S ₁ ) of processing a sharing request for botnet information and a process of processing shared botnet information (S ₂₎ ).

5 and 7 and 9, the step S ₁ of processing a sharing request for botnet information processes a sharing request for botnet information. At this time, the botnet information sharing request processing is a step of processing a sharing request from the management console graphical user interface setting timer (S _1-1 ) or SEC, MMBOA, MMBBA, administrator console depending on whether the botnet information is included in the sharing request. Processing (S _1-2 ) of the sharing request from the graphical user interface.

In step S _1-1 of processing the sharing request from the management console graphical user interface setting timer, the administrator may share information about a newly detected botnet through a management console graphical user interface setting timer. At this time, since the sharing request from the management console graphical user interface setting timer does not include the information on the botnet in the request message, the newly detected botnet information is generated from the previous expiration time to the latest expiration time, thereby creating the shared botnet information. It is desirable to. In addition, the sharing of botnet information generates the generated shared botnet information as a shared message and transmits it to a control system of another registered internet service provider network or a botnet control and security management system (BMSM).

In the process of processing a share request from the SEC, MMBOA, MMBBA, Administrator Console graphical user interface (S _1-2 ), the share request from this configuration contains the botnet information to share in the request message, so the information contained in the request message You can search the Bot Information Database (BIDB) to get additional information (botnet C & C IP address, port number used, etc.). In addition, the sharing of botnet information generates the generated shared botnet information as a shared message and transmits it to a control system of another registered internet service provider network or a botnet control and security management system (BMSM).

6, 8, and 9, in the processing of shared botnet information (S ₂ ), after parsing the shared message, the botnet is classified by botnet and then an automatic response policy for the shared botnet information is set. Step (S _2-1 ), the step of setting the botnet C & C access blocking response policy (S _2-2 ), and the step of establishing a botnet malicious behavior response policy (S _2-3 ).

In the step of setting an automatic response policy for shared botnet information (S _2-1 ), the botnet management security management system (BMSM) is a botnet control and security management system of another Internet service provider network. When receiving information about botnets detected by Security Management (BMSM), set whether to establish a response policy automatically. In this case, if automatic response policy establishment is not set, a black list sharing response policy generation is generated by a botnet against technology (BAT) to generate a black list including the detected botnet C & C list and transmit it to the detection system. request.

If a response policy for blocking access to the shared botnet C & C is not established in the step _S2-2 of setting the botnet C & C access blocking response policy, domain name system sinkhole, BGP feeding, HTTP-based C & C URL blocking Sends a request to create a botnet response policy for a rule.

Establishing a botnet malicious behavior response policy (S _2-3 ) transmits a request for creating a botnet response policy such as BGP feeding to cope with malicious behavior of a shared botnet.

As described above, the present invention can easily detect and manage botnets by detecting botnets existing in a plurality of Internet service provider networks and sharing their information.

Although described above with reference to the drawings and embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit of the invention described in the claims below. I can understand.

1 is an IRC and HTTP botnet information sharing system according to the present invention.

2 is a diagram illustrating a connection relationship between an IRC and a botnet detection system of an HTTP botnet information sharing system according to the present invention.

3 is a diagram illustrating a stack of an IRC and HTTP botnet information sharing system according to the present invention.

4 is a block diagram of a botnet information sharing module of the IRC and HTTP botnet information sharing system according to the present invention.

5 is a flowchart illustrating a process of processing a sharing request for botnet information in an IRC and HTTP botnet information sharing method according to the present invention.

6 is a flowchart illustrating a process of processing shared botnet information in an IRC and HTTP botnet information sharing method according to the present invention.

7 is a botnet information sharing sequence diagram of an IRC and HTTP botnet information sharing method according to the present invention.

8 is a shared botnet information processing sequence diagram of the IRC and HTTP botnet information sharing method according to the present invention.

9 is a flowchart illustrating a method of sharing IRC and HTTP botnet information according to the present invention.

Claims (13)

In the IRC and HTTP botnet information sharing system that detects and shares botnet information of multiple internet service provider networks, A botnet information sharing request module for requesting sharing of the botnet information; A botnet information sharing module having a shared botnet information processing module for processing the shared botnet information, The shared botnet information processing module is configured to collect and parse shared botnet information from the internet service provider network and classify the shared botnet information collection and parser module, and whether to set a corresponding policy corresponding to the shared botnet information. And a response policy check module for checking and a response policy generation request message generation module for generating a botnet C & C access blocking response setting request if the response policy is not set. The method of claim 1, The botnet information sharing request module, A sharing request classification module for classifying a sharing request object for the botnet information; A sharing information generation module configured to generate sharing information according to a sharing request object for the botnet information; And a botnet information sharing message transmission module for transmitting botnet information to an internet service provider network that has requested botnet information from among the plurality of internet service provider networks. delete The method of claim 1, The interface of the botnet information sharing module is an IRC and HTTP botnet information sharing system, characterized in that the administrator operates through a web browser using HTTP. In the IRC and HTTP botnet information sharing method of detecting botnet information of a plurality of Internet service provider networks, storing them in a botnet information database and sharing them with each other, Processing a sharing request for the botnet information, and Processing the shared botnet information; The processing of the shared botnet information may include: setting an automatic response policy for the shared botnet information; setting a botnet C & C access blocking response policy based on the shared botnet information; IRC and HTTP botnet information sharing method comprising the step of establishing a botnet malicious behavior response policy based on the botnet information. The method of claim 5, Processing the sharing request for the botnet information, Processing a share request from an administrative console graphical user interface setup timer, or A method for sharing IRC and HTTP botnet information comprising processing a share request from a SEC, MMBOA, MMBBA, or Admin Console graphical user interface. The method of claim 6, Processing the share request from the management console graphical user interface setup timer may include: And searching for newly detected botnet information from the time when the botnet detection expired to the latest expiration time to generate shared botnet information. The method of claim 6, Processing the sharing request from the SEC, MMBOA, MMBBA, administrator console graphical user interface, And searching for the botnet information database to obtain botnet information. The method of claim 8, The botnet information sharing method of the IRC and HTTP botnet information, characterized in that it includes a botnet C & C IP address and port number and malicious behavior. delete The method of claim 5, Setting an automatic response policy for the shared botnet information, When the automatic response policy establishment for the shared botnet information is not set, requesting generation of a black list sharing response policy including a detected botnet C & C list is requested. The method of claim 5, Setting the botnet C & C access blocking response policy based on the shared botnet information, If the corresponding policy for blocking access to the shared botnet C & C is not established, IRC and HTTP botnet information sharing method, characterized in that requesting domain name system sinkhole, BGP feeding, HTTP-based C & C URL blocking rule settings. The method of claim 5, The step of establishing a botnet malicious behavior response policy based on the shared botnet information, Method for sharing IRC and HTTP botnet information, characterized in that for requesting BGP feeding based on the shared botnet information.

Images