KR101248601B1 - Security system for distributed denial of service and method for finding zombie terminal - Google Patents

Abstract

The present invention provides a security device against a distributed denial of service attack that can prevent traffic exceeding at the router and switch, and provides information on the zombie terminal infected with the access point, so that traffic of the zombie terminal flows into the network You can block it from being original.
The distributed service attack security apparatus according to the present invention comprises: a connection port connected to an access point and a switch and providing a communication path equal to or greater than the number of access points; A traffic collector configured to collect inflow traffic from the different access points; A traffic controller for filtering data introduced from a zombie terminal among the inflow traffic; A traffic analyzer configured to analyze the filtered traffic from the traffic controller, detect the zombie terminal, and provide the detected zombie terminal information to the traffic controller; And a traffic distributing unit for providing the filtered traffic to the switch using the different communication paths for each of the inflowed access points.

Description

Distributed service denial attack security device and detection method of zombie terminal {SECURITY SYSTEM FOR DISTRIBUTED DENIAL OF SERVICE AND METHOD FOR FINDING ZOMBIE TERMINAL}

The present invention relates to a distributed service denial attack security device and a method for detecting a zombie terminal, and specifically, to detect a distributed service denial attack zombie terminal and to prevent a distributed service denial attack by blocking the data flowing from the zombie terminal at its source. An apparatus and method for the same.

Distributed Denial of Service (DDoS) attacks are when an attacker infects a PC with malicious code and infects it, then uses the infected PC to send a large amount of traffic to a specific site or server to exhaust resources or network. By occupying bandwidth, it is a technology that paralyzes servers or networks.

Distributed denial-of-service attacks are the most serious of the types of attacks on the Internet and are frequent. In recent years, the trend of developing a service or network failure from the attack method to attack the Internet service provider's router or DNS (Domain Name Server) server directly to the trend of completely paralyzing the trend.

As a way to counter distributed service denial attacks, the company uses the intrusion prevention system (IPS), the intrusion detection system (IDS), or expensive DDoS-specific security equipment to protect itself. The existing defense system detects and blocks inflow traffic of zombie terminals at the back of the switch or router, and there is a problem in that it is impossible to prevent the traffic from exceeding the switch or router or the access point.

As a result, blocking traffic from zombie terminals is the most fundamental to minimize the impact at each communication stage due to distributed denial of service attacks, and the necessity of research and development on such devices and methods is gradually increasing. I'm doing it.

It is an object of the present invention to provide a security apparatus against a distributed service denial attack that can prevent traffic overflow at router and switch stages.

It is another object of the present invention to provide a security device capable of providing a source of information on a zombie terminal infected with an access point, thereby preventing the traffic of the zombie terminal from flowing on the network.

The distributed service attack security apparatus according to the present invention is located between an access point and a switch, detects a zombie terminal for traffic flowing from an access point, and transmits detected zombie terminal information to the access point to the access point. Block the influx of data from the zombie terminal.

In more detail, the distributed service attack security apparatus includes a connection port connected to an access point and a switch and providing a communication path of the number of access points or more; A traffic collector configured to collect inflow traffic from the different access points; A traffic controller for filtering data introduced from a zombie terminal among the inflow traffic; A traffic analyzer configured to analyze the filtered traffic from the traffic controller, detect the zombie terminal, and provide the detected zombie terminal information to the traffic controller; And a traffic distributing unit for providing the filtered traffic to the switch using the different communication paths for each of the inflowed access points.

Preferably, the apparatus may further include an AP controller to provide the zombie terminal information to the access point to which the zombie terminal is connected, so that data of the zombie terminal may be blocked at the access point.

Zombie terminal detection method according to the invention, the abnormal traffic detection step for detecting the traffic suspected to be transmitted from the zombie terminal to the traffic introduced from the access point;

A detection vector generator extracting a similarity vector from the abnormal traffic; Counting, by a vector map manager, the number of packet inflows of the terminal into which the abnormal traffic flows based on the similarity vector; And

A zombie terminal detection unit includes a zombie terminal detection step of detecting whether the inflow number is a predetermined number or more, and detects the zombie terminal.

According to the present invention according to the above configuration, by blocking the traffic flowing into the network from the zombie terminal at the source, there is an effect that can prevent the traffic excess phenomenon in the router and switch stage.

In addition, it is possible to provide a device capable of preventing a distributed denial of service attack without changing traffic between the access point and the switch by providing a distributed denial of service attack security device having an transparent address.

Furthermore, by managing the information of the zombie terminal in the access point, there is an effect that can block the traffic flowing from the zombie terminal at the source.

1 is a block diagram of a network including a distributed service denial attack security device according to an embodiment of the present invention;
2 is a block diagram of a distributed service denial attack security device according to an embodiment of the present invention;
3 is a block diagram of a traffic analysis unit;
4A and 4B are exemplary diagrams of a vector map using a table;
5A and 5B are exemplary views of vector maps utilizing stereoscopic graphs, and
6 is a flowchart illustrating a zombie terminal detection method according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principle that can be defined, it should be interpreted as meaning and concept corresponding to the technical idea of the present invention. Therefore, the embodiments described in this specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and do not represent all the technical ideas of the present invention. Therefore, It is to be understood that equivalents and modifications are possible.

1 is a block diagram illustrating a network including a distributed service denial attack security device according to an embodiment of the present invention.

The distributed denial of service attack security apparatus 100 according to the present invention is located between an access point 20 (AP) and a switch 30. The distributed denial of service attack security apparatus 100 determines whether the terminal 10 connected to each access point 20 is infected by the zombie terminal, targeting the traffic introduced from the plurality of access points 20, and from the zombie terminal. Blocking the incoming traffic to prevent traffic overload in the switch (30). Furthermore, by transmitting the detected IP address or MAC address of the zombie terminal to the access point 20, it is possible to block the incoming traffic from the access point 20 to the zombie terminal, thereby overloading the traffic at the access point 20 Should not happen. In order to transmit the zombie terminal information such as the IP address or MAC address of the zombie terminal to the access point 20, the distributed service denial attack security device 100 may include an AP controller. The AP controller will be described in detail with reference to FIG. 2.

As a result, when the distributed denial of service attack security device 100 according to the present invention is used, the data packet flowing from the zombie terminal at the access point 20 can be blocked, unlike the existing, the access point 20 Since the traffic overload phenomenon does not occur in the switch 30, it is possible to provide a communication environment that can fundamentally block a distributed service denial attack.

2 is a block diagram of a distributed denial of service attack security device according to an embodiment of the present invention. Referring to FIG. 2, the distributed service rejection attack security device 100 is connected to an access point 20 and a switch 30 to provide a plurality of communication paths, a connection port 110, a traffic collector 120, and a traffic. The controller 130, the traffic analyzer 140, and the traffic distributor 150 are included. The distributed service denial attack security apparatus 100 according to the present invention may further include an AP controller 160.

The connection port 110 connects the distributed service denial attack security device 100 with the access point 20 and the switch 30. The access point 20 and the switch 30 are connected by the connection port 110 to transmit data through the distributed service denial attack security device 100. In this case, the connection port 110 of the distributed service attack security device 100 provides a communication path of the number of access points 20 or more. As a result, while traffic of the plurality of access points 20 flows into the distributed service attack security device 100 and flows out to the switch 30, the traffic may be distributed without being concentrated in one communication path, The communication overload problem may be solved between the service attack security device 100 and the switch 30.

That is, as many cables as the number of cables between the access point 20 and the distributed service attack security device 100 are inserted between the switch 30 and the distributed service attack security device 100, and traffic is transmitted to any one communication path. It can prevent concentration.

The traffic collecting unit 120 collects the inflowing traffic flowing from different access points 20 and provides it to the traffic control unit 130. The traffic flowing from the different access points 20 through the traffic collector 120 may be processed by one traffic controller 130 and the traffic analyzer 140. The traffic collector 120 tags the identification information to the traffic introduced from the plurality of access points 20 and provides it to the traffic controller 130. The identification information may include information of the access point 20, information of the terminal 10 connected to each access point 20, and information for identifying each packet.

For example, when the distributed denial of service attack security device 100 is connected to a plurality of access points 20, tagging a source of each data (information of the transmitted access point 20 and / or the terminal 10). By identifying the incoming traffic, each data packet may be sequentially tagged with an identification number and then provided to the traffic controller 130.

Through the traffic control unit 130, the filtered traffic filtering the data introduced from the zombie terminal is transmitted to the switch 30 through the traffic distribution unit 150. The traffic distributing unit 150 distributes traffic so that data flowing from different access points 20 is leaked to different connection ports 110 based on tag information in the traffic collecting unit 120. Play a role.

In this embodiment, the case where data is transmitted from the access point 20 is described as an example, but it should be appreciated that the present invention can be applied even when the data is transmitted from the switch 30 to the access point 20. .

The traffic controller 130 filters data of the zombie terminal among the traffic introduced from the access point 20, and provides the filtered traffic to the traffic analyzer 140. The traffic controller 130 receives and stores information about the zombie terminal from the traffic analyzer 140, for example, a MAC address or an IP address of the zombie terminal, and the data introduced from the zombie terminal is transferred to the switch 30. Prevent transmission. When the traffic analyzer 140 detects the zombie terminal, the traffic analyzer 140 extracts information about the zombie terminal and transmits the information to the traffic controller 130 in real time.

The traffic analysis unit 140 analyzes the traffic filtered by the data of the zombie terminal, detects the data introduced from the infected zombie terminal, and provides the detected zombie terminal information to the traffic controller 130. In detail, the traffic analyzer 140 detects abnormal traffic from the filtered traffic, generates a detection vector from the detected abnormal traffic, and counts the number of packets introduced by the access point 20 and the terminal 10. To determine if it is a zombie terminal.

Specifically, referring to FIG. 3, the traffic analyzer 140 includes an abnormal traffic detector 142, a detection vector generator 144, a vector map manager 146, and a zombie terminal detector 148. The abnormal traffic detector 142 extracts a data packet suspected to be generated by the zombie terminal, targeting a series of packets included in the filtered traffic. For example, the following case may be regarded as abnormal traffic.

When the destination address and the source address of the data packet are the same packet

When a packet of the same data flows from one or multiple terminals 10

SYN packet, which is an initial signal of a 3-way handshake for activating a TCP session, is continuously introduced from one or more terminals 10

-When packets with the same sequence number flow in succession

The abnormal traffic detector 142 detects abnormal traffic by storing a series of data packets introduced from the traffic controller 130 and comparing and analyzing the header and payload of each data packet.

When abnormal traffic is detected, the detection vector generator 144 extracts a similarity vector from the abnormal traffic. The similarity vector is for classifying the abnormal traffic that is introduced by checking whether the abnormal traffic has the same destination (DST) or the same data packet.

In detail, the similarity vector may include at least one of an address, a communication protocol, and a signature of a destination. The destination address is a concept including the final destination IP address and the destination port of the incoming packet, to determine whether the incoming traffic is a packet transmitted to the same destination. The communication protocol means a communication protocol in an application layer such as HTTP or FTP, or a communication protocol in a transport layer such as TCP or UDP. In each communication layer such as traffic attack such as SYN, TCP, UDP, ICMP flooding using communication protocol, flooding of Get Reques packet of HTTP, CC attack attacking by changing Cache-Control value of HTTP header To classify distributed denial of service attacks that occur.

The signature means a feature value or garbage data repeatedly derived in the payload of a series of data packets, or a sequence number or Cache-Control value repeatedly derived in a header of the series of data packets. do. That is, the signature refers to data or garbage data repeatedly appearing in abnormal traffic flowing from the same terminal 10 or the plurality of terminals 10.

The traffic analyzer 140 may analyze the inflow traffic for each type of distributed denial of service attack using the similarity vector.

The vector map manager 146 may detect an infected zombie terminal by counting packets introduced for a predetermined time based on the similarity vector. The counting count of the incoming packet of the vector map manager 146 is reset at predetermined time intervals, so that the zombie terminal can be searched based on the traffic trend for a predetermined time.

Specifically, the vector map manager 146 generates a vector map partitioned by the number of the access point 20 and the terminal 10 connected to the access point 20 for each similarity vector, and counts the number of inflows of packets on the vector map. do.

That is, the vector map manager 146 generates a new vector map if the similarity vector is new, and uses the existing vector map in the case of the similarity vector previously experienced. Creating a vector map for each similarity vector is to identify a distributed service denial attack when a certain pattern is repeatedly performed on a series of packets, such as when the destination IP and port address, communication protocol, or signature are the same for each packet. It is for.

Hereinafter, to easily explain the present invention, a vector map will be described using a table and a graph. 4A and 4B are exemplary views of a vector map using a table, and FIGS. 5A and 5B are exemplary views of a vector map using a stereoscopic graph. The vector map manager 146 generates, according to the similarity vectors, the vector map partitioned into the number of the access point 20 and the terminal 10 connected to the access point 20, and the number of inflows of packets having the same similarity vector on the vector map. Will be displayed.

At this time, the access point 20 information of each incoming packet and the information of the terminal 10 can be identified using the tag information attached to each packet by the traffic collection unit 120, and the identification information of the packet included in the tag information. Can be used to prevent the same packet from being counted more than once.

4A and 4B, each column is partitioned by the access point 20, and each row is partitioned by the terminal 10. Accordingly, since each matrix represents a specific terminal 10 connected to a specific access point 20, the number of inflows of packets having the same similarity vector may be displayed for each terminal 10.

5A and 5B show the planar table of FIGS. 4A and 4B, respectively, in a three-dimensional stereoscopic graph, where the x-axis denotes identification information of the access point 20, and the y-axis denotes a terminal connected to the access point 20 ( 10) means identification information. The z axis represents the number of inflows of packets having the same similarity vector in each terminal 10. That is, the vector map manager 146 performs a function of counting the number of inflows of packets having the same similarity vector for each access point 20 and each terminal 10 for a predetermined time and displaying the same on the vector map.

The zombie terminal detector 148 detects a zombie terminal based on the number of packet inflows of the vector map manager 146, and provides the detected zombie terminal information to the traffic controller 130. The zombie terminal detector 148 may detect the zombie terminal based on the detection rule. For example, the zombie terminal detection unit 148 determines the terminal 10 to which a packet having the same similarity vector is introduced a predetermined number or more as a zombie terminal using the following detection rule.

When a packet having the same similarity vector is introduced from the same terminal 10 more than a predetermined number of times

When a packet having the same similarity vector is introduced a predetermined number of times from a predetermined number of different terminals 10 of the same access point 20

When a packet having the same similarity vector is introduced more than a predetermined number of times from a predetermined number of different terminals 10 of different access points 20

The detection rule may be determined by the network administrator, and the similarity vector may be determined in consideration of the number of detection of the same packet, the degree of variance, and the like.

For example, in FIG. 4A, when a terminal having five or more packets having the same similarity vector is determined as a zombie terminal, all terminals connected to the first access point of FIG. 4A may be determined as a zombie terminal, and FIG. 4B. As shown in the following description, when a terminal in which 10 or more packets with the same similarity vector are introduced from two or more access points is determined as a zombie terminal, a tenth terminal connected to a first access point, a fourth terminal connected to a fifth access point, and a sixth terminal The zombie terminal determines the second terminal connected to the access point, the fifth terminal connected to the seventh access point, the eighth terminal connected to the eighth access point, and the ninth terminal connected to the tenth access point.

The AP controller 160 transmits the information of the zombie terminal to the access point 20 based on the information of the zombie terminal detected by the traffic analyzer 140, and thus, the incoming packet of the zombie terminal at the access point 20. To block. The AP controller 160 may transmit information of the zombie terminal by using a wired communication path between the distributed service denial attack security device 100 and the access point 20. However, when providing zombie terminal information to each access point 20 using wired communication, the distributed service denial attack security device 100 should recognize the wired communication method of each access point 20. Since the access point 20 adopts a different communication method for each manufacturer, in order for each access point 20 and the AP control unit 160 to perform wired communication, the AP control unit 160 is suitable for each access point 20. You must provide a communication method.

The AP controller 160 may provide information of the zombie terminal using a wireless communication method. Since the access point 20 uses a standardized wireless communication method of 802.11b / g / n, unlike the wired communication method, it is not necessary to consider the communication method for each access point 20.

That is, the distributed denial of service attack security device 100 may first provide zombie terminal information to the AP stage to filter the incoming packets of the zombie terminal, and secondly, the data control unit may filter the incoming packets of the zombie terminal. .

The distributed denial of service attack security apparatus 100 according to the present invention is operated as a transparent IP address, it is preferable that a separate address is not assigned.

6 is a flowchart illustrating a zombie terminal detection method according to an embodiment of the present invention.

According to the zombie terminal detection method, the traffic collector attaches a tag for distinguishing data packets coming from a plurality of access points, and transmits the tag to the traffic controller (S610). The traffic controller blocks the traffic from the zombie terminal. (S620). The abnormal traffic detection unit detects data suspected of being transmitted from the zombie terminal, targeting the remaining traffic filtered by the traffic introduced from the zombie terminal (S630). If abnormal traffic is detected, the detection vector generator extracts a similarity vector from the abnormal traffic (S640). If the similarity vector is new (S650), the vector map manager generates a new vector map (S655), and if the similarity vector is previously stored, the number of inflows of packets having the same similarity vector for each terminal using the existing vector map is provided. Counting (S660). The zombie terminal detector determines whether a packet having the same similarity vector has been introduced more than a predetermined number of times on the vector map to determine a zombie terminal (S670), and when a zombie terminal is detected (S675), the zombie terminal detector is a traffic control unit. By sending information, traffic from the zombie terminal can be blocked. Furthermore, the AP controller transmits the information of the zombie terminal to the access point connected to the zombie terminal, thereby blocking communication with the zombie terminal.

Residual traffic that blocks the traffic introduced from the zombie terminal is leaked through different communication paths through the traffic distribution unit (S680).

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise.

Although the present invention has been described by way of limited embodiments and drawings, the present invention is not limited thereto, and the technical spirit of the present invention and the claims to be described below by those skilled in the art to which the present invention pertains. Various modifications and variations are possible within the scope of equivalents.

10: Terminal
20: access point
30: switch
100: distributed service denial attack security device
110: connection port
120: traffic collector
130: traffic control
140: traffic analysis unit
150: traffic distribution unit
160: AP control unit

Claims (17)

delete delete A connection port connected to an access point and a switch and providing a communication path of the number of the access points;
The first identification information of the access point, the second identification information of the terminal connected to the access point, and the third identification information for identifying the packet flowing from the terminal are included in each packet of the inflow traffic flowing from the different access points. A traffic collecting unit for tagging and collecting identification information including;
A traffic controller for filtering data introduced from a zombie terminal among the inflow traffic;
A traffic analyzer configured to analyze the traffic filtered by the traffic controller, detect the zombie terminal, and provide the detected zombie terminal information to the traffic controller; And
The traffic distributing unit provides the filtered traffic to the switch using the different communication paths for each of the access points based on the identification information.
Distributed service denial attack security device comprising a.
delete delete The method of claim 3, wherein the traffic analysis unit,
An abnormal traffic detector configured to detect abnormal traffic with respect to the filtered traffic;
A detection vector generator for extracting a similarity vector of the abnormal traffic;
A vector map manager that counts the number of packet inflows of the terminal into which the abnormal traffic flows based on the similarity vector; And
A zombie terminal detector for detecting the zombie terminal by determining whether the inflow number is a predetermined number or more.
Distributed service denial attack security device comprising a.
The method of claim 6, wherein the abnormal traffic detection unit,
Distributed service denial attack security device, characterized in that for detecting abnormal traffic by comparing and analyzing a series of packets included in the filtered traffic.
The method of claim 6, wherein the similarity vector,
And at least one of a destination address, a communication protocol, and a signature of each packet included in the abnormal traffic.
The method of claim 8, wherein the destination address,
Distributed service denial attack security device, characterized in that the destination IP address of the packet.
The method of claim 9, wherein the destination address,
Distributed service denial attack security device further comprises a destination port of the packet.
The method of claim 8, wherein the communication protocol,
Distributed service denial attack security device, characterized in that at least one of the communication protocol of the application layer (transport layer).
The method of claim 8, wherein the signature is,
Distributed service denial attack security device, characterized in that the data repeatedly appearing in the series of packets included in the abnormal traffic.
The method of claim 6, wherein the vector map management unit,
And generating the vector map partitioned by the access point and the number of terminals connected to the access point for each similarity vector, and displaying the inflow number on the vector map.
The method of claim 13, wherein the vector map management unit,
And if the similarity vector is new, generate a new vector map, and, in the case of the similarity vector previously experienced, use an existing vector map.
The method of claim 3, wherein
And ap controller for providing the zombie terminal information to the access point to which the zombie terminal is connected, so as to block data of the zombie terminal at the access point.
The method of claim 15,
Distributed service denial attack security device, characterized in that the communication method between the AP control unit and the access point is wireless communication.
delete

Images