KR101091204B1 - A method for intrusion detection by pattern search - Google Patents

Abstract

The present invention relates to an intrusion detection method using a bulk pattern search, and more particularly, to define specific strings as a prohibited string set, and to display a generalized suffix tree by displaying a substring of the defined prohibited string set as vertices and edges. Creating a generalized suffix tree, using the generalized suffix tree to represent vertices as a set of suffixes of the set of forbidden strings and indicating a direction structure with edges, where the forbidden string is included; Generating a directional graph that does not move, and determining the occurrence of a malicious pattern according to whether a string on a network passes through the directional graph to traverse vertices along the edges in the directional graph; It features.
According to the intrusion detection method through the pattern search and the recording medium proposed by the present invention, the pattern of known attack techniques or malicious codes are defined as prohibited strings, and then efficient determination of a prohibited string for a given input string is performed. can do. In particular, in order to improve the performance of the decision algorithm, by generating the efficient direction graph by preprocessing the forbidden strings, the judgment can be completed by only one process of the graph regardless of the number of forbidden strings.

Description

A METHOD FOR INTRUSION DETECTION BY PATTERN SEARCH}

The present invention relates to an intrusion detection method through a pattern search, and more particularly, to an intrusion detection method through a pattern search for efficiently detecting attack patterns on a computer system or a network.

With the spread of computers and the Internet, attempts to break into systems by illegal methods such as hacking and cracking are increasing, and these attack methods are becoming more intelligent and diversified. Therefore, various means for preventing attacks such as anti-virus software, firewall, intrusion detection system, etc. have been developed and used, and these are mainly known malicious codes or attack techniques. We use a lot of methods to construct a database of patterns or rules that we have to check whether packets going to and from the current network correspond to patterns or rules stored in this database.

In other words, if the shape of the packet currently being inspected is similar to a known attack pattern or a known malicious code, it operates by taking appropriate measures such as generating a warning or removing the packet. However, as the attack techniques become more diverse, the pattern database to be examined increases in size, while the network speed increases, and the number of targets to be scanned in unit time increases exponentially.

In particular, it is very important to provide a method for retrieving a large amount of patterns in real time because the part of pattern checking should not be a bottleneck and affect the performance of the entire network. It is difficult to satisfy these requirements with the known pattern search method, and a lot of methods for attaching additional hardware to satisfy the performance are used, but this has a problem in terms of cost.

The present invention has been proposed to solve the above problems of the conventionally proposed methods, and after defining a pattern of known attack techniques or malicious codes as prohibited strings, efficiently determining whether the prohibited string is given to a given input string. It is for that purpose. In particular, in order to improve the performance of the decision algorithm, by generating the efficient direction graph by preprocessing the prohibited strings, it provides an intrusion detection method through the pattern search that allows the determination to be completed by only one processing of the graph regardless of the number of prohibited strings. For that purpose.

Intrusion detection method through a pattern search, according to a feature of the present invention for achieving the above object,

(1) defining specific strings as a prohibited string set;

(2) generating a generalized suffix tree by displaying the defined substring of the forbidden string set as vertices and edges;

(3) using the generalized suffix tree to display vertices as a set of true suffixes of the forbidden string set and a direction structure with an edge, thereby generating a direction graph that does not move to another vertex when the forbidden string is included; And

And (4) determining the occurrence of the malicious pattern according to whether or not the character string on the network is passed through the direction graph to traverse the vertices along the edge in the direction graph.

Preferably, the step of defining a forbidden string set,

In the finite alphabet set, a string in which one or more characters of a known attack pattern and a malicious code are connected may be defined as the forbidden string set.

Preferably, the step of generating a generalized suffix tree,

A character string concatenating the characters of the edges in the path from the starting vertex to the terminal vertex is the set of prohibited strings defined above. By displaying the same as the suffix of the character string, the same number of terminal vertices of the suffix of the forbidden string set may be generated in a linear time.

Preferably, the step of generating a direction graph,

Displaying vertices in the set of pseudo-suffixes of the forbidden string set,

Calculating the nearest suffix ancestor vertices of the vertices of the generalized suffix tree;

Calculating an existing vertex that is the same as a string formed by prefixing any character of the alphabet to the string of the nearest suffix ancestor vertex, and

And displaying an edge between the displayed vertices from the computed vertex in the direction of the nearest suffix ancestor vertex prior to prefix formation.

Preferably, the step of determining the occurrence of a malicious pattern,

The direction graph by passing a character string on the network through the direction graph When traversing the vertices within, the strings of the forbidden string set are not included, and when it is no longer possible to move to another vertex, the occurrence of the malicious pattern may be determined by including the strings of the forbidden string set.

According to the intrusion detection method through the pattern search and the recording medium proposed by the present invention, the pattern of known attack techniques or malicious codes are defined as prohibited strings, and then efficient determination of a prohibited string for a given input string is performed. can do. In particular, in order to increase the performance of such a decision algorithm, by generating the efficient direction graph by preprocessing the forbidden strings, the decision is completed by only one process of the graph regardless of the number of forbidden strings.

1 is a block diagram of an intrusion detection method using a pattern search according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a generalized suffix tree in which a prohibition string set of an intrusion detection method using pattern search according to an embodiment of the present invention is F = {aaa, aba, abb, bbb}. FIG.
Figure 3 is a flow chart of the step of generating a direction graph of the intrusion detection method through a pattern search according to an embodiment of the present invention.
4 is a diagram illustrating a direction graph in which a set of forbidden strings of an intrusion detection method through pattern search according to an embodiment of the present invention is F = {aaa, aba, abb, bbb};
5 is a block diagram of a step of determining the occurrence of a malicious pattern of the intrusion detection method through the pattern search according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an intrusion detection method using a pattern search according to an embodiment of the present invention. Intrusion detection method using a pattern search, as shown in Figure 1, defining a specific string as a set of prohibited string (200), the substring of the defined forbidden string set is displayed as a vertex and the edge to the generalized suffix tree ( Creating a generalized suffix tree (300), using the generalized suffix tree to mark the vertices as a set of suffixes of the forbidden string set, and to indicate the direction structure as the edges, and to include other forbidden strings. Generating a direction graph that does not move (400) and determining a malicious pattern occurrence according to whether to traverse the vertices along an edge in the direction graph by passing a string on the network through the direction graph; It is characterized by the configuration thereof. By defining the patterns of known attack techniques or malicious codes as prohibited strings, it is possible to efficiently determine whether a prohibited string is provided for a given input string. In particular, in order to improve the performance of the decision algorithm, by generating the efficient direction graph by preprocessing the forbidden strings, the determination can be completed by only one process of the graph regardless of the number of the forbidden strings.

The defining step 200 may be defined as a set of forbidden strings, as shown in FIG. 1, as a set of forbidden strings, as shown in FIG. . A string is formed by concatenating zero or more characters from the finite alphabet set Σ. An empty string can be represented by ε. In constant size alphabets, a set of forbidden strings F = {f1, f2,... , fm}, if the string x does not contain the forbidden string fi, then x is a nonsuperstring of fi and if the string x does not contain all the forbidden strings fi (1≤i≤m) in F Otherwise, x is called the common nonsuperstring of F. Also, if the string x is of finite length and the longest string of the common emergency strings of F, then x is called the longest common nonsuperstring of F. For convenience, it is assumed that the following is satisfied for the forbidden string set F coming into the input. First, the forbidden string fi is not a substring of another forbidden string fj (i ≠ j). If the above condition is not satisfied, a prohibited string set may be generated to generate the same common emergency string set in a linear time which is O (∥F∥) time.

FIG. 2 is a diagram illustrating a generalized suffix tree in which a prohibition string set is F = {aaa, aba, abb, bbb} of the intrusion detection method through pattern search according to an embodiment of the present invention. Generating a generalized suffix tree (300), as shown in Fig. 2, is a prohibition in which a character string concatenating the characters of the edges in the path from the starting vertex to the terminal vertex, as shown in FIG. String set By displaying the same as the suffix of the string, the same number of terminal vertices of the suffix of the forbidden string set can be generated in a linear time. When the concatennation of two strings α and β is denoted by αβ, the length of the string α is denoted by | α |, and the i-th character of α is denoted by α [i], the length of the empty string is | ε | = 0. The character string β is alpha [i] alpha [i + 1]... When [alpha] [j] is connected, β is represented by α [i…]. j] and β is called a substring of α. In contrast, α is called the superstring of β. Α [i…] when i ≦ | α | j] is called the prefix of α, and when i <| α | j] is called the prefix prefix of α. Similarly, when i≥1, α [i... | α |] is referred to as the suffix of α, and when i> 1, α [i... | α |] is called the proper suffix of α.

The number at the terminal vertex is the index of the suffix, and the string displayed on the edge is a substring represented by each edge, and the terminal vertex of the suffix tree has one-to-one correspondence with each suffix. Thus, the number of terminal vertices is equal to the number of suffixes. And since every internal vertex has more than one child, the total number of vertices is no more than twice the number of suffixes. Each vertex stores its start and end positions to represent the string, so the storage space for holding the suffix tree is proportional to the length of the string. Therefore, since the generalized suffix tree may be generated in linear time, the step 300 of generating the generalized suffix tree may be completed at O (∥F∥).

3 is a flowchart of a step of generating a direction graph of the intrusion detection method through the pattern search according to an embodiment of the present invention and FIG. 4 is a set of prohibition strings of the intrusion detection method through the pattern search according to an embodiment of the present invention. It is a figure which shows the direction graph which F = {aaa, aba, abb, bbb}. In step 400 of generating a direction graph, as shown in Figs. Calculating step 420, calculating an existing vertex that is identical to a string that is prefixed with any letter of the alphabet in the string of the nearest suffix ancestor vertex, and between the displayed vertices from the calculated vertex before the prefix formation. And displaying the edge in the direction of the nearest suffix ancestor apex (440).

Marking the vertices as a set of forbidden strings of the forbidden string set 410 assumes that the set of all of the forbidden strings of forbidden string fi (1 ≦ i ≦ m) in F is S and that there are n different elements in S; , S = {s ₁ ,.. , s _n } and the set of vertices V corresponds to a new vertex vi for each s _i ∈S (1 ≦ _i ≦ n). Therefore, the vertex set V and the pseudo-similar set S correspond to 1: 1.

Computing the closest suffix ancestor vertexes of the vertices of the generalized suffix tree is vertex x in the generalized suffix tree. When L (x) ∈S∪F is satisfied, vertex x is called a suffix-node. Thus, if x is a suffix vertex, then label (x, y) = $ is satisfied for the leaf vertex y of x. The leaf y is called the suffix-node of x. The nearest suffix-ancestor z of vertex x means the nearest vertex that satisfies the suffix vertex among the x ancestors.

Computing an existing vertex that is identical to a string prefixed with any one of the letters in the string of the nearest suffix ancestor vertex, step 430, links (l) for each pair of leaves l _i and each letter σ (∈Σ). _i , σ) is defined as String Assuming that the longest prefix belonging to S ∪ F of σstr (l _i ) is α, a leaf l _j satisfying str (l _j ) = α can be calculated. The generalized suffix tree represents all strings in S∪F, so l _j is always present. At this time, link (l _i , σ) = l _j is defined.

The set of edges E in step 440 of displaying the edges between the displayed vertices from the computed vertices to the nearest suffix ancestor vertex direction prior to the formation of a prefix are first defined for each si ∈ S (1 ≦ i ≦ n). P _i ^σ is defined as follows. P _i ^σ = {y | y∈S∪F and y is the prefix of σs _i } Also, when the longest string of the elements of P _i ^σ is s _j (∈S), the corresponding vertices v _j to v Define the edge leading to _i . That is, pairs of any two vertices <v _j, v _i> a means for, v should be a thin trunk exists in _j in v _i is the longest string of the element P _i ^{sj [1]} the s _j do. Also, when the longest string of the elements of P _i ^σ belongs to F, no edge is defined. For each si∈S and σ∈Σ, only one edge is defined, so for each vertex at most | Σ | Only as many incoming edges are defined. Thus, in constant size alphabets, the total number of edges is bound to O (∥F∥).

5 is a block diagram of a step of determining the occurrence of a malicious pattern of the intrusion detection method through the pattern search according to an embodiment of the present invention. Determining the occurrence of the malicious pattern 500, as shown in Figure 5, the direction graph by passing a character string on the network through the direction graph In the case of traversing the vertexes within 510, the strings of the forbidden string set are not included, and if it is impossible to move to another vertex 520, the vertices may be recognized as including the strings of the forbidden string set. have. Pass the entire x packet (string) of defined prohibited strings to the direction graph. The direction graph is a string by the definition and characteristics of the direction graph. If you are traversing vertices along the edges in the string, the string obtained by concatenating the characters of the edges in the path does not contain any forbidden strings. However, if a packet contains a prohibition pattern, it cannot be moved to another vertex in the direction graph at the moment that the pattern is generated.

The present invention described above may be variously modified or applied by those skilled in the art, and the scope of the technical idea according to the present invention should be defined by the following claims.

200: Define prohibited string
300: Create generalized suffix tree
400: Create Direction Graph
410: vertex as a set of close miss
420: Calculate nearest suffix ancestor vertexes
430: Calculate existing vertices equal to prefix-formed string
440: Show edges from computed vertices to nearest suffix ancestor vertices
500: Determination of malicious pattern occurrence
510: string on the network
520: directional graph traversal
530: Cannot move direction graph

Claims (5)

Intrusion detection method through pattern search on computer system or network,
(1) defining specific strings as a prohibited string set;
(2) generating a generalized suffix tree by displaying the defined substring of the forbidden string set as vertices and edges, where 'generalized suffix tree' is a data structure for a string set. Expands to-;
(3) using the generalized suffix tree to display vertices as a set of true suffixes of the forbidden string set and to indicate a direction structure with an edge, and generating a direction graph that does not move to another vertex when the forbidden string is included; Here, when i> 1, α [i... | α |] is referred to as the 'proper suffix' of α-; And
(4) passing a character string on a network through the direction graph to determine occurrence of a malicious pattern according to whether to traverse vertices along an edge in the direction graph,
The step of determining the occurrence of a malicious pattern,
The direction graph by passing a character string on the network through the direction graph When circulating the vertices in the pattern does not include the string of the set of prohibited string, if it is impossible to move to another vertex, it is recognized as including the string of the forbidden string set pattern, characterized in that determining the occurrence of a malicious pattern How to detect intrusions by searching.
The method of claim 1, wherein the defining of the forbidden string set includes:
Intrusion detection method using a pattern search, characterized in that the character string of the at least one character of the attack pattern and the malicious code in a set of finite alphabet set is defined as the set of the forbidden string.
The method of claim 1, wherein generating a generalized suffix tree comprises:
A character string concatenating the characters of the edges in the path from the starting vertex to the terminal vertex is the set of prohibited strings defined above. Displaying the same as the suffix of the character string, to generate the same number of terminal vertices in the linear time to the suffix of the forbidden string set, intrusion detection method through the pattern search.
The method of claim 1, wherein generating the direction graph comprises:
Displaying vertices in the set of pseudo-suffixes of the forbidden string set;
Calculating the nearest suffix ancestor vertexes of the vertices of the generalized suffix tree;
Calculating an existing vertex that is the same as a string formed by prefixing any character of the alphabet to the string of the nearest suffix ancestor vertex; And
And displaying an edge between the displayed vertices from the calculated vertex in the direction of the nearest suffix ancestor vertex prior to prefix formation. delete

Images