KR101078851B1 - Botnet group detecting system using group behavior matrix based on network and botnet group detecting method using group behavior matrix based on network - Google Patents

Abstract

The present invention relates to a botnet group detection system using a network-based group behavior matrix and a botnet group detection method using a network-based group behavior matrix. The present invention relates to a set of clients having the same destination based on a destination IP / Port. The present invention relates to a botnet group detection system using a network-based group behavior matrix based on the similarity between groups of collected traffic, and a botnet group detection method using a network-based group behavior matrix. The present invention provides a group information management function for generating a group matrix based on group data and a network-based group behavior matrix capable of detecting botnet groups through mutual similarity analysis for groups suspected of botnets among group information. It can provide a botnet group detection system using botnet group detection system and a botnet group detection method using a network-based group behavior matrix.

Botnet, detection, network, traffic, activity, pattern, group, matrix

Description

BOTNET GROUP DETECTING SYSTEM USING GROUP BEHAVIOR MATRIX BASED ON NETWORK AND BOTNET GROUP DETECTING METHOD USING GROUP BEHAVIOR MATRIX BASED ON NETWORK}

The present invention relates to a botnet group detection system using a network-based group behavior matrix and a botnet group detection method using a network-based group behavior matrix. The present invention relates to a set of clients having the same destination based on a destination IP / Port. The present invention relates to a botnet group detection system using a network-based group behavior matrix based on the similarity between groups of collected traffic, and a botnet group detection method using a network-based group behavior matrix.

Bot is short for robot and means a personal computer (PC) infected with malicious intention software. And a botnet is a type of network in which many computers infected with these bots are connected. The botnet is remotely controlled by the Bot Master, which is used for various malicious activities such as DDoS attacks, personal information collection, phishing, malware distribution, and spam mailing. These botnets can be classified according to the protocol used by the botnet.

Attacks through these botnets continue to increase, and methods are increasingly diversified. Unlike the case of causing Internet service failure through DDoS, there are bots that cause personal system failure or illegally acquire personal information, and illegal user information such as ID / Password and financial information. Increasingly, cybercrime abuse is becoming more common. In addition, while the existing hacking attacks show the hacker's own ability or compete with the community, the botnet shows the hacker group intensively exploiting and cooperating for the purpose of financial gain.

However, botnets are becoming more sophisticated to detect and circumvent using advanced technologies such as periodic updates, execution compression techniques, coder changes, and command channel encryption. In addition, the source of the botnet is open to thousands of variants, and the bot code can be easily generated or controlled through the user interface, making it possible for people without specialized knowledge or skills to create and use the botnet. The problem is serious. The bot zombies that make up these botnets are distributed in Internet service provider networks all over the world, and bots that control bot zombies can be migrated to other networks.

Therefore, the seriousness of the botnet is well known and many studies are being made. However, it is difficult to determine the overall configuration and distribution of botnets by detecting only the botnets of a specific internet service provider network, and there is a need for a method for easily detecting botnets due to many variants.

An object of the present invention is to provide a botnet group detection system using a network-based group behavior matrix that can effectively detect botnets and a botnet group detection method using a network-based group behavior matrix.

In order to achieve the above object, the present invention provides a botnet traffic collection sensor for collecting traffic in a network and classifying the traffic by destination, and grouping the traffic classified by the destination according to a time interval, where a specific connection pattern exceeds a number of times above a threshold. It provides a botnet group detection system using a network-based group behavior matrix characterized in that it comprises a botnet detection system for detecting a botnet group. The botnet traffic collecting sensor may classify the information received from the traffic information collecting / classifying module and the traffic information collecting / classifying module to collect the traffic by capturing packets of the monitoring network according to a collection policy using a packet capture tool. Traffic information management module for receiving and parsing traffic information and processing group data, and storing / managing the traffic information in a database, and transmitting the traffic information parsed by the traffic information management module to a transmission header and transmission data. The traffic information transmission module for dividing the data into packages and transmitting the data through the transmission channel, and the traffic information collection / classification module and the traffic information management module for classifying tool, traffic information management tool, and setting / status information of data transmission cycle information. And a sensor policy management module that sends to the traffic information transmission module. It should. The traffic information management module classifies the collected pattern of network traffic into a transmission control protocol (TCP) and a user datagram protocol (UDP). At this time, the traffic information management module uses the Transmission Control Protocol (TCP) as a HyperText Transport Protocol (HTTP), a Simple Mail Transfer Protocol (SMTP), and the hyper. The traffic information management module classifies the user datagram protocol (UDP) into a domain name server (DNS) and a hypertext communication protocol other than the text communication protocol and the simple e-mail transmission protocol. It is classified into a domain name server other than the domain name server. The botnet detection system includes a botnet group analyzer (BGA) for determining a botnet group for group data transmitted from the botnet traffic collection sensor, and a botnet group determined by the botnet group analysis module. Botnet Organization Analyzer (BOA), which analyzes typical connection patterns of each botnet group with respect to group groups, and Botnet Behavior Analysis Module (Botnet), which analyzes the attack behavior of the botnet group and whether the botnet group spreads or migrates. Behavior Analyzer (BBA), and a detection log management module (Detection Log Management, DLM) for managing the log of the configuration information and behavior information of the botnet group. The botnet group analysis module includes a group information management module for storing group data received from the botnet traffic collection sensor in the botnet detection system and generating a group matrix according to the group information managed by the group information management module. A suspicious group selection module for generating a zombie list by selecting suspicious groups of botnets, a suspicious group comparison analysis module for determining a botnet group by comparing and analyzing mutual similarities with respect to the groups of the zombie list, and the suspicious group And a detection information generation module for generating information on the botnet group determined by the comparison analysis module. The group information management module includes a group data management module for managing group data received from the botnet traffic collection sensor in the botnet detection system and an IP count according to a connection behavior pattern generated from the group data. And a group matrix management module for managing groups of matrices. The group data is data having a plurality of source information based on a single destination, and the group matrix is a group of matrices which are data stored by analyzing a count of IP according to a connection behavior pattern generated from group data. Data and the group matrix.

In addition, the present invention includes the steps of collecting traffic, generating group information for the collected traffic, and determining a botnet group based on the group information. Provides a method for detecting botnet groups using the matrix. Generating group information on the collected traffic includes classifying the collected traffic by protocol. The classifying the collected traffic for each protocol includes configuring the collected traffic into a client set for each destination. The determining of the botnet group based on the group information may include managing a group matrix and selecting a group as an analysis target group when a specific access pattern exceeds a number of times greater than or equal to a threshold value for each group matrix. It includes. The managing of the group matrix may include generating a group matrix if the group matrix does not exist, updating the group matrix if the group matrix exists, and updating the group matrix for a predetermined period or a predetermined ratio or more. If not, deleting the group matrix. The method may further include analyzing client similarity with respect to a specific access pattern of the group matrices selected as the analysis target. In this case, analyzing the client similarity with respect to a specific access pattern of the group matrices selected as the analysis target, the client similarity with respect to the specific access pattern of the group matrices compared the similarity among the group matrices selected as the analysis target If the value is greater than or equal to the value, the group matrices with which the similarity is compared are determined as the same botnet group.

The present invention provides a group information management function for generating a group matrix based on group data and a network-based group behavior matrix capable of detecting botnet groups through mutual similarity analysis for groups suspected of botnets among group information. It can provide a botnet group detection system using botnet group detection system and a botnet group detection method using a network-based group behavior matrix.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

It will be apparent to those skilled in the art that the present invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, It is provided to let you know. Like reference numerals in the drawings refer to like elements.

1 is a conceptual diagram of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 2 is a block diagram of a botnet group detection system using a network-based group behavior matrix according to the present invention. 3 is a conceptual diagram of a botnet traffic collection sensor of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 4 is a collection of traffic information of a botnet group detection system using a network-based group behavior matrix according to the present invention. Module configuration diagram. 5 is a block diagram of a traffic information management module of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 6 is a management of a botnet group detection system using a network-based group behavior matrix according to the present invention. Communication module configuration diagram. 7 is a block diagram of a policy management module of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 8 is a botnet detection system of a botnet group detection system using a network-based group behavior matrix according to the present invention. It is a block diagram. 9 is a structural diagram of a botnet detection system of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 10 is a botnet group analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention. It is a block diagram. 11 is a flowchart illustrating an operation of a botnet group analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 12 is a group information of a botnet group detection system using a network-based group behavior matrix according to the present invention. Management module operation flowchart. 13 is a flowchart illustrating a group data management module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 14 is a group matrix of a botnet group detection system using a network-based group behavior matrix according to the present invention. Management module operation flowchart. 15 is a flowchart illustrating a suspicious group selection module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 16 is a suspicious group of a botnet group detection system using a network-based group behavior matrix according to the present invention. Comparative analysis module operation flowchart. 17 is a block diagram of a botnet configuration analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention, and FIG. 18 is a botnet of a botnet group detection system using a network-based group behavior matrix according to the present invention. A flowchart of the configuration analysis module operation.

In the botnet group detection system using the network-based group behavior matrix according to the present invention, as shown in FIGS. 1 and 2, the botnet traffic detection sensor and the botnet traffic detection system are detected based on the botnet traffic collected by the botnet traffic collection sensor. Botnet detection system.

The botnet traffic collection sensor is for collecting traffic of the corresponding internet service provider network for botnet detection. As shown in FIG. 3, the botnet traffic collection sensor, a traffic information management module, a traffic information management module, a traffic information transmission module, and a sensor policy are provided. Contains a management module.

The traffic information collection module collects traffic by capturing packets of the monitoring network according to a collection policy using a packet capture tool, as shown in FIG. 4. The collected traffic information is stored in the temporary storage of the traffic information storage, and the collected information stored in the temporary storage is processed again by the traffic information management module.

As shown in FIG. 5, the traffic information management module classifies the information received from the traffic information collection module, receives and parses the traffic information, and then processes the grouped behavior information, that is, group data and peer bot information. It stores and manages the traffic information in the database. In this case, classifying and grouping traffic according to a pattern may be performed as follows.

As shown in FIG. 6, the traffic information transmission module classifies the traffic information parsed by the traffic information management module into a transmission header and transmission data, and then packages the data and transmits the data to the botnet detection system through a transmission channel.

As shown in FIG. 7, the sensor policy management module has overall configuration management and control functions of the botnet traffic collection sensor and interacts with all modules. The configuration management module of the policy management module manages the state database, and the administrative command channel updates and manages the rule database and the peer database. The information in the rule database and peer database is received and applied by the management communication module (COMM), and the traffic database, the traffic information management module (TIM), and the management communication module (COMM) access the state database to work. Record the log for

The botnet detection system is installed in an internet service provider network and detects a botnet operating in the corresponding internet service provider network based on the traffic information collected by the traffic collection sensor. One or more such botnet detection systems may exist in the Internet service provider network. 8 and 9, the botnet detection system includes a botnet group analyzer (BGA), a botnet organization analyzer (BOA), and a botnet behavior analyzer (Botnet Behavior Analyzer). , BBA), Detection Log Management Module (DLM), Event Transfer Module (ET), and Policy Management Module (Policy Management, PM).

As shown in FIG. 10, the botnet group analysis module (BGA) determines a botnet group with respect to group data transmitted from a botnet traffic collection sensor. Group data transmitted from the botnet traffic collection sensor generates / updates a matrix for the group, and updating and deleting the group matrix are performed according to the group management algorithm. At this time, if there is no update for more than 50% of the clients in the group, it is deleted according to step-by-step management. In addition, the botnet group analysis module manages a matrix for group data. Update the matrix for existing groups and create new ones for new groups. For updates, the group matrix is deleted if there is no activity of the client for a certain time according to the group matrix management algorithm. In addition, after the group matrix is updated, if the specific connection pattern exceeds the number of times of the threshold or more for each group matrix, the corresponding group is determined as the analysis target group. Then, the client similarity is analyzed for the group group determined as the analysis target group. If the similarity is a certain number, for example, 80% or more, the similarity is analyzed for a detailed client list for a specific connection pattern that is represented. At this time, if the client similarity degree for a particular connection pattern is a certain value, for example, 80% or more, the two botnets are determined as the same botnet. In addition, the analysis results of each module are aggregated and sent to the log manager. From the analysis results, a trigger message to be used in a later policy is generated and transmitted to an event trigger. The botnet group analysis module includes a group information management module, a doubt group selection module, a doubt group comparison analysis module, and detection information generation module to perform the above-described function. This will be described with reference to FIG. 11.

The group information management module stores the group data received from the sensor inside the detection system and generates a group matrix accordingly. The group information management module manages the number of group information stored in the system, and manages each update with respect to the group data and the group matrix in detail. At this time, if the management of the group data and the group matrix is for reflecting the corresponding update, managing the number of all group information is for managing the number of group information stored exponentially in the system.

Referring to FIG. 12, group information may have various levels, and this embodiment illustrates black, red, and blue. In this case, black may be group information detected by a botnet, red may be inactive group information, and blue may mean general group information. Group information management may use a method of comparing the difference between a recent client access time and a current analysis time on the basis of the threshold time, and then lowering the step if no access is made during the threshold time. In addition, it is desirable to delete the inactive red group when there is no client connection beyond the threshold time. Such a group information management module includes a group data management module and a group matrix management module.

Referring to FIG. 13, the group data management module manages group data received from the botnet traffic collection sensor in the botnet detection system. Because botnet detection systems manage the data received from multiple sensors, there is a need to efficiently operate a significant amount of group data received. Thus, data is managed only for a specific time period, which can vary fluidly depending on the amount of data collected. For example, it is possible to manage the time intervals of several times (it does not mean much but modified to a general expression because it is an example in the specification) about the managed group data. Afterwards, the latest update can be maintained by reflecting the latest update and deleting the oldest update.

Referring to FIG. 14, the group matrix management module manages a group of the matrix, that is, a group matrix of the stored matrix by analyzing the count of IP according to the access behavior pattern generated in the group. Like the group data management module described above, the group matrix management module also manages data only for a specific time interval.

Referring to FIG. 15, the suspicious group selection module selects a suspicious group from the managed group information and generates a list. In other words, a group suspected by a botnet is selected from the group information possessed by the botnet detection system, and a suspect group is selected based on the size of the client regarding the behavior of the largest number of clients in the group's behavior matrix to select the suspect group. Determine.

Referring to FIG. 16, the suspicious group comparison analysis module determines a botnet group by comparing and analyzing similarities with respect to groups classified as suspicious groups. For this purpose, the target group to be compared should be selected from the suspect group. In addition, since all comparisons between groups should be performed on the comparison target groups, the comparison order between groups may be determined by sorting based on ID values of groups without having a specific order. For the two groups selected for comparison, the IP lists of the clients who showed the behaviors are compared with respect to the behaviors in which the most clients participate among the behavior patterns of each group. In this case, since the size of the client IP set of each group may be different, it is preferable to analyze the small set based on the small set so that the small set may be a subset of the large set.

The detection information generation module generates information about the botnet group determined by the suspicious group comparison analysis module. In this case, the information on the botnet group may include the IP of the client and the behavior of the botnet.

Botnet Organization Analyzer (BOA), as shown in Figure 17, to analyze the role of the C & C and extract the zombie list, a representative connection pattern of each group to the group of botnets detected as botnets Analyze In addition, the role of each server participating in the botnet is classified based on the group information according to the access pattern. In this case, referring to FIG. 18, the classification result may be classified into a command control server, a download server, an upload server, and a spam server. For each group of botnets detected, we extract the IP list of each group, that is, the zombie list. The final update time is analyzed for each zombie list, and if the final update time has connectivity below the threshold, it is determined as a zombie. At this time, the information is configured to analyze the evolution of the botnet according to each server role by analyzing the final server access time for each zombie. In addition, the results analyzed in each module are aggregated and sent to the log manager. In the analysis result, a trigger message to be used in a later policy is generated and transmitted to an event trigger.

The Botnet Behavior Analyzer (BBA) analyzes the attack behavior of botnet groups and whether they have spread or migrated.

The detection log management module (DLM) manages a log of configuration information and behavior information of a botnet group, and includes a configuration information database of a botnet group and a behavior information database of a botnet group.

The Policy Management Module (PM) sets policies for modules running inside the botnet control / security management system. In addition, the policy supervisor sets the detection policy of the botnet detection system registered in the botnet control / security management system. In addition, the traffic information collection sensor policy through the registered botnet detection system is set.

The botnet control / security management system sends and receives various settings and status information with the control system, receives group behavior information and peer bot information about the botnet from the botnet traffic collection sensor, classifies the traffic, analyzes the configuration and conducts it, and stores it in the database. do. In addition, the configuration and behavior analysis information stored in the database is transmitted back to the control system.

As described above, the present invention provides a group information management function for generating a group matrix based on behavior data based on group data, and a network-based network capable of detecting botnet groups through mutual similarity analysis for groups suspected of botnets among group information. It is possible to provide a botnet group detection system using a group behavior matrix of.

Next, a behavior pattern modeling method of network traffic for botnet detection according to the present invention will be described with reference to the accompanying drawings. In the following description, the description overlapping with the description of the behavior pattern modeling system of the network traffic for botnet detection according to the present invention will be omitted or briefly described.

19 is a flowchart illustrating a behavior pattern modeling method of network traffic for botnet detection according to the present invention.

The behavior pattern modeling method of network traffic for botnet detection according to the present invention comprises the steps of collecting traffic (S ₁ ), generating group information (S ₂ ), and a botnet group as shown in FIG. 19. And determining step S ₃ .

In the step of collecting traffic (S ₁ ), traffic data of the network is collected using a packet capture tool according to a collection policy. For this purpose, a traffic information collection sensor is provided in a plurality of networks, and traffic information is collected according to a traffic collection policy set by a botnet control and security management system.

Generating group information (S ₂ ) groups the collected traffic. Generating group information for this purpose includes classifying protocols (S _2-1 ).

In the step of classifying the protocol (S _2-1 ), the traffic collected in the step of collecting traffic is classified by protocol. Categorizing the protocol includes configuring a set of destination-specific clients (S _2-1-1 ).

In the step _S2-1-1 of configuring a client set for each destination, the protocols collected in the step of collecting traffic are analyzed to configure a client set having the same destination. The step (S _2-1 ) of configuring the destination-specific client set includes storing the collected access records (S _2-1-1-1 ) and configuring the client set (S _{2-1-1-). 2} ).

In the storing of the collected access record (S _2-1-1-1 ), the access record collected through the traffic information collecting sensor is stored, and at the same time, all of the access records collected for a certain time interval are stored.

In step _S2-1-1-2 , the collected traffic information is analyzed and classified into protocols, and then the client sets are configured. The classification of protocol is largely divided into TCP and UDP like the behavior pattern modeling system of network traffic for botnet detection according to the present invention described above, and TCP is classified into HTTP, SMTP and other HTTP. Also, UDP is classified into DNS and other DNS. At this time, the analysis of the protocol is to analyze the content of the actual traffic, and the group data is configured based on the IP and port, that is, the destination address.

In step S ₃ , the botnet group is determined by comparing and analyzing similarities with respect to groups classified as suspicious groups. The determining of the botnet group includes managing the group matrix (S _3-1 ), selecting an analysis target (S _3-2 ), and analyzing the group similarity (S _3-3 ). do.

The managing of the group matrix (S _3-1 ) manages a matrix for group data transmitted from the traffic information collecting module, that is, a group matrix. Here, managing the group matrix means creating, updating, and deleting a group matrix. Accordingly, managing the group matrix may include generating a group matrix (S _3-1-1 ), and Updating (S _3-1-2 ), and deleting the group matrix (S _3-1-3 ).

Generating the group matrix (S _3-1-1 ) generates a group matrix for the new group. That is, in the case of a new group that does not exist previously, since the group matrix does not exist, a group matrix is generated.

In the updating of the group matrix (S _3-1-2 ), if the group is an existing group, the matrix is updated for the existing group.

The step S _3-1-3 of deleting the group matrix deletes the group matrix when there is no activity of the client for a predetermined time according to the group matrix management algorithm.

In the selecting of the analysis target (S _3-2 ), after the group matrix is updated, when the specific access pattern exceeds the number of times of the threshold or more for each group matrix, the corresponding group is selected as the analysis target group.

In analyzing the group similarity (S _3-3 ), the similarity of the client with respect to the group group of the analysis target is analyzed. In this case, when the similarity is more than a predetermined level, for example, 80% or more, the similarity is analyzed with respect to a detailed client list for a specific specific access pattern. In addition, if the client similarity degree for a particular connection pattern is a certain level or more, for example, 80% or more, the two groups are determined to be the same botnet.

As described above, the present invention provides a group information management function for generating a group matrix based on behavior data based on group data, and a network-based network capable of detecting botnet groups through mutual similarity analysis for groups suspected of botnets among group information. It can provide a botnet group detection method using the group behavior matrix of.

Although described above with reference to the drawings and embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit of the invention described in the claims below. I can understand.

1 is a conceptual diagram of a botnet group detection system using a network-based group behavior matrix according to the present invention.

2 is a block diagram of a botnet group detection system using a network-based group behavior matrix according to the present invention.

3 is a conceptual diagram of a botnet traffic collection sensor of a botnet group detection system using a network-based group behavior matrix according to the present invention.

Figure 4 is a block diagram of a traffic information collection module of the botnet group detection system using a network-based group behavior matrix according to the present invention.

5 is a block diagram of a traffic information management module of a botnet group detection system using a network-based group behavior matrix according to the present invention;

6 is a block diagram of a management communication module of a botnet group detection system using a network-based group behavior matrix according to the present invention;

7 is a block diagram of a policy management module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

8 is a block diagram of a botnet detection system of a botnet group detection system using a network-based group behavior matrix according to the present invention.

9 is a structural diagram of a botnet detection system of a botnet group detection system using a network-based group behavior matrix according to the present invention.

10 is a block diagram of a botnet group analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

11 is a flowchart illustrating the operation of a botnet group analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

12 is a flowchart illustrating a group information management module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention.

13 is a flowchart illustrating a group data management module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention.

14 is a flowchart illustrating a group matrix management module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention.

15 is a flowchart illustrating a suspicious group selection module operation of a botnet group detection system using a network-based group behavior matrix according to the present invention.

16 is a flowchart of a suspicious group comparison analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

17 is a block diagram of a botnet configuration analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

18 is a flowchart illustrating the operation of a botnet configuration analysis module of a botnet group detection system using a network-based group behavior matrix according to the present invention.

19 is a flow chart of a behavior pattern modeling method of network traffic for botnet detection in accordance with the present invention.

Claims (15)

A botnet traffic collection sensor that collects traffic in the network and classifies it by destination; And a botnet detection system for grouping traffic classified by destinations according to time intervals and detecting a botnet group in which a specific access pattern exceeds a number of times above a threshold value. The botnet traffic collection sensor, A traffic information collection / classification module that uses a packet capture tool to capture traffic from the monitoring network according to a collection policy to collect traffic; A traffic information management module for classifying the information received from the traffic information collection / classification module, receiving and parsing the traffic information, processing the group data, and storing / managing the traffic information in a database; A traffic information transmission module for dividing the traffic information parsed by the traffic information management module into a transmission header and transmission data and packaging the data to transmit data through a transmission channel; and A botnet detection method comprising a classification tool, a traffic information management tool, and a sensor policy management module for transmitting setting / status information of data transmission period information to a traffic information collection / classification module, a traffic information management module, and a traffic information transmission module. Behavior pattern modeling system of network traffic for network. delete The method according to claim 1, The traffic information management module classifies the collected pattern of network traffic into a transmission control protocol (TCP) and a user datagram protocol (UDP). Behavior pattern modeling system. The method of claim 3, The traffic information management module converts the Transmission Control Protocol (TCP) into a HyperText Transport Protocol (HTTP), a Simple Mail Transfer Protocol (SMTP), and the hypertext communication. Protocols and hypertext communication protocols other than the simple e-mail transmission protocol, The traffic information management module classifies the user datagram protocol (UDP) into a domain name server (DNS) and a domain name server other than the domain name server. Behavior pattern modeling system for network traffic. The method according to claim 1, The botnet detection system, A botnet group analyzer (BGA) for determining a botnet group with respect to group data transmitted from the botnet traffic collection sensor; A botnet organization analyzer (BOA) for analyzing a typical connection pattern of each botnet group for the botnet group group determined by the botnet group analysis module; A botnet behavior analyzer (BBA) for analyzing the attack behavior of the botnet group and whether the botnet group is spread or migrated; And a detection log management module (DLM) for managing logs of configuration information and behavior information of the botnet group. The method according to claim 5, The botnet group analysis module, A group information management module for storing group data received from the botnet traffic collecting sensor in the botnet detection system and generating a group matrix accordingly; A suspicious group selection module for generating a zombie list by selecting a suspicious group from a group information managed by the group information management module; A suspicious group comparison analysis module for determining a botnet group by comparing and analyzing mutual similarities with respect to groups of the zombie list, and And a detection information generation module for generating information on the botnet group determined by the suspicious group comparison analysis module. The method according to claim 6, The group information management module, A group data management module for managing group data received from the botnet traffic collection sensor in the botnet detection system; And a group matrix management module configured to manage a group of stored matrices by analyzing the count of the IP according to the access behavior pattern generated in the group data. The method of claim 7, The group data is data having a plurality of source information on a single destination base, The group matrix is a group of matrices which are data stored by analyzing the count of IP according to the access behavior pattern generated from the group data. The group information includes the group data and the group matrix, behavior pattern modeling system for network traffic for botnet detection. Collecting traffic, Generating group information on the collected traffic, and Determining a botnet group based on the group information, The group information includes group data having a plurality of source information based on a single destination, and a group matrix which is data stored by analyzing a count of IP according to a connection behavior pattern generated from the group data. How to detect botnet groups using behavior matrices. The method according to claim 9, Generating group information on the collected traffic, And classifying the collected traffic according to protocols. The method according to claim 10, The step of classifying the collected traffic for each protocol, Botnet group detection method using the network-based group behavior matrix comprising the step of configuring the collected traffic as a client set for each destination. The method according to claim 9, Determining the botnet group based on the group information, Managing the group matrix, and And selecting a group as an analysis target group when a specific access pattern exceeds a number of times greater than or equal to a threshold value for each of the group matrices. The method according to claim 12, Managing the group matrix, Generating a group matrix if the group matrix does not exist; Updating the group matrix if the group matrix exists, and And deleting the group matrix if the group matrix is not updated for a predetermined period or a predetermined ratio. The method according to claim 9, And analyzing the client similarity with respect to a specific access pattern of the group matrices selected as the analysis targets. The method according to claim 14, Analyzing the client similarity with respect to a specific access pattern of the group matrices selected as the analysis target, If the client similarity with respect to a specific access pattern of the group matrices whose similarities are compared among the group matrices selected as the analysis targets is greater than or equal to a predetermined value, the group matrices with which the similarities are compared are determined to be the same botnet group. How to detect botnet groups using the group behavior matrix.

Images