KR101268104B1 - Intrusion prevention system and controlling method - Google Patents

Abstract

The present invention relates to an intrusion prevention system and a control method thereof that minimize the possibility of false detection of a normal packet as an attack packet. In the present invention, an attack rule for detecting an attack packet is preset. The attack rule includes false detection level, rule application level, content analysis level, and corresponding mode information for each false detection level. Only when the automatic response mode is set during the detection of the attack rule, the attack packet for the traffic flowing from the network is detected again by software, and the attack rule generation information for the detected attack packet is accumulated and managed. The attack rule generation information is continuously accumulated and managed by the corresponding module, and is continuously compared with a threshold set by the administrator. According to the comparison result, if any attack rule generation information exceeds the threshold, the attack packet is automatically blocked. Accordingly, the present invention does not immediately block the attack packet even if it is detected, and selectively blocks the attack packet according to the automatic response mode after detecting the attack packet according to the comparison result with the threshold value, thereby minimizing the inability to provide normal service by false positives. There is an advantage to this. In addition, since attack rule information is continuously managed, the possibility of harmful traffic can be recognized in advance and prevented.

Intrusion Prevention System, False Detection, Attack Rule, Detection Rule, Software / Hardware Filtering

Description

Intrusion Prevention System and Control Method {INTRUSION PREVENTION SYSTEM AND CONTROLLING METHOD}

1 is a block diagram of a general intrusion prevention system.

Figure 2 is a block diagram of an intrusion prevention system according to a preferred embodiment of the present invention.

3 is a flowchart illustrating a software detection of an attack packet and applying a predefined response policy according to an exemplary embodiment of the present invention.

Description of the Related Art [0002]

100: dedicated packet processing unit 102: detection / blocking module

104: memory 120: software engine

122: packet processing unit 124: S / W detection unit

126: response analysis unit 128: management map

130: operation module

The present invention relates to an intrusion prevention system, and more particularly, to an intrusion prevention system and its control method for minimizing the probability of false positive for normal packet information flowing into the network.

With the rapid spread of computers and the general use of the Internet, the importance of security issues is increasing with the spread of services through the Internet. In order to solve this security problem, an intrusion prevention system or intrusion prevention system for harmful traffic has been developed. The intrusion prevention / intrusion blocking system effectively prevents and blocks electronic infringement, and detects an abnormality of traffic that is input / output by installing an access point between a subscriber network and a public network or inside a subscriber network to detect harmful traffic. Blocking

The intrusion prevention system is designed to have the ability to take immediate action based on a set of rules (security policy) set by the network administrator. To this end, most intrusion prevention systems inspect a packet and, if determined to be an invalid packet, block the IP address or incoming traffic while forwarding it to the receiving party without any interruption or service delay for legitimate traffic. It is configured to.

In addition, a configuration has been proposed to improve the service performance by detecting the invalid packet as well as detecting a normal packet as an attack packet again.

That is, an intrusion prevention system (security system) that performs filtering on network traffic first and secondly on software again is provided to protect the internal network more safely.

1 is a block diagram of a general intrusion prevention system for filtering an attack packet in a multi-step as described above.

As shown, the intrusion prevention system includes a memory (SRAM) 1 for loading a security policy (attack rule) for an attack packet and a detection / blocking module 3 for filtering the attack packet by applying the security policy. The provided ASIC-based packet dedicated processing unit 5 is provided. The packet-dedicated processor 5 primarily filters whether the attack is a static attack, that is, an attack capable of determining an attack characteristic based on only a unit packet.

Provided is a software engine 7 for selectively filtering the attack packets by analyzing the packet streams generated for a predetermined time and receiving the results processed by the packet-only processing unit 5. The software engine 7 includes blocking result information for the packet introduced as a result of the processing, primary filtered packet information, and a packet introduced from the packet-only processing unit 5 (ie, all packets, normal packets, and arbitrary conditions). Packet information (header information, etc.) selectively received by user setting, and the packet processing unit 9 performs an administrator alert function, and pattern matching is performed for normal packets among the incoming packet information. S / W detection unit 11 for performing attack detection is provided again.

In addition, the operation module unit 13 is configured to receive the detection result information on the attack packet, generate an attack rule, and apply the attack rule to detection of the attack packet. The operation module unit 13 transmits the attack rule online to the packet dedicated processor 5 and the software engine 7.

According to this configuration, the packet-dedicated processor 5 first determines whether the packet information is attacked and applies a corresponding policy, and IP and TPC among the packet information flowed from the packet-dedicated processor 5. The software engine 7 performs second detection again by performing pattern matching on all packets transmitted by splitting into the (TCP) stage. Therefore, if the software engine 7 determines that the packet information is an attack packet, the software engine 7 transmits the response policy to the packet-only processing unit 5 again. It blocks all packet information coming from IP (attack IP). At this time, the detection result for the packet access and blocking is displayed in real time so that the administrator can check.

However, there have been the following problems in performing filtering on attack packets in the conventional intrusion prevention system.

Conventionally, in detecting the attack on the packet, it is determined based on the attack rules defined in the following [Table 1].

[Table 1]

Applicability Rule Identifier SRC IP SRC PORT DST IP DST PORT Packet header details (e.g. TCP Flag, IP Totlen, etc.) Packet Payload Information (Attack Content Information) Response Policy (Block / Access / Warning, etc.)

However, the attack rule defined in [Table 1] detects packet information and includes only corresponding policy information such as blocking / access according to the detection result.

Therefore, when the attack rule is transmitted to the conventional intrusion prevention system and applied, the attack packet is detected only by the attack rule, and after the detection, only general response policies such as blocking / access / warning are performed. In this case, when a false positive that a normal packet is detected as an attack packet is generated, since the response policy for the packet corresponding to the false positive has already been set and processed, even if the normal packet is a normal web access service in the network service. May cause a service failure such as blocking or normal mail transmission and reception.

As described above, in case of detecting a normal packet incorrectly, if the attack policy is set to the detection mode only in the response policy of the attack rule, it cannot actively cope with the actual attack packet detected in the detection mode. In other words, in the conventional intrusion prevention system, the response policy for false positives is provided only after the detection / blocking / connection state, so that the intrusion prevention for the attack packet could not be properly applied.

Accordingly, the present invention has been made to solve the above problems, and separately manages the attack rule information applied to the secondary detected attack, and referring to the cumulative information result of the attack rule, the normal packet together with the prediction of harmful traffic occurrence It is an object of the present invention to provide an intrusion prevention system and a control method thereof to minimize false positives.

In order to achieve the above object, intrusion prevention system according to the present invention, the intrusion prevention system, a detection unit for detecting the packet information by software according to the application of a predetermined attack rule, the detection result detected according to the characteristics of the attack rule A storage unit for storing attack rule generation information for the attack packet, and an analysis response module for comparing the attack rule generation information with a preset threshold and providing a response mode to selectively block the attack packet when the threshold is exceeded. Characterized in that it comprises a.

The present invention further comprises an operation module unit for receiving and analyzing the detection result of the detection unit and generating and providing the attack rule applied to the detection unit.

The present invention is configured to receive the packet information from the packet processing module for performing the hardware filtering to perform an administrator alert function, and further comprises a packet processing unit for transmitting the packet information to the detection unit according to the attack rule characteristics.

The packet processing unit of the present invention distributes a part of the packet processing module to the detection unit when there is a limitation in detecting an attack on packet information flowing into the network.

In addition, in order to achieve the above object, the intrusion prevention system according to another embodiment of the present invention, in the intrusion prevention system, a packet-only processing module for performing hardware filtering on the packet information first, and the packet-only processing module And a software detection module which performs software filtering on the packet information transmitted from the second hand, manages attack rule information on the detected attack packet, and applies a response policy.

The software detection module of the present invention includes: a packet processing unit for receiving packet information from the packet dedicated processing module and classifying packet information according to the attack rule characteristics, and a detection unit receiving packet information from the packet processing unit and software-detecting the packet information. A storage unit for storing attack rule generation information on the attack packet detected according to the characteristics of the attack result, and comparing the attack rule generation information with a threshold value and selectively blocking the attack packet when the threshold value is exceeded. It is configured to include a corresponding module.

In the present invention, the attack rule includes a false detection level, rule application level, content analysis level, and corresponding mode information for each false detection level.

In the present invention, the false positive detection level can be arbitrarily set according to the false positive probability of the normal packet.

In the rule application level of the present invention, an attack rule is applied by hardware or / and software according to the false detection level.

The content analysis level of the present invention allows to determine whether to detect by packet-based, session-based, AP-based.

Corresponding mode for each false level of the present invention, the automatic analysis corresponding mode is provided after blocking, detecting, and detecting.

The corresponding module of the present invention counts and manages the attack rule generation information.

It is preferable that the attack rule characteristic of the present invention is an automatic analysis response mode after detection for packet information. The attack rule occurrence information is an attack rule identification number, a cumulative number, and an occurrence interval.

In addition, the control method of the intrusion prevention system according to the present invention, the step of receiving the packet information, the hardware filtering is performed, the step of performing an attack detection in software on the packet information, if the attack is detected the attack rule Registering the occurrence information for the; comparing the accumulated number of occurrences of the registered occurrence information with a threshold value; and blocking the attack packet when the threshold value is exceeded according to the comparison result.

In the present invention, the packet information transmission is performed when the attack rule is applied to software filtering.

In the present invention, when an attack packet is detected by the attack detection, it is preferable to perform an automatic analysis response mode.

In the present invention, the occurrence information of the attack rule is an attack rule identification number, cumulative number, occurrence interval for the detected attack packet.

The threshold value provided by the present invention is set in advance to block the attack packet according to the occurrence information of the attack rule detecting the attack packet.

The attack rule of the present invention includes a false detection level, a rule application level, a content analysis level, and corresponding mode information for each false detection level.

In the present invention, the false detection level is arbitrarily set according to the probability of false detection of a normal packet, and the rule application level applies an attack rule by hardware or / and software method according to the false detection level, and the content analysis level is: The packet-based, session-based, and AP-based analysis can be selectively performed. The false-correspondence mode corresponding to the false detection level allows the automatic analysis response mode to be applied after blocking, detecting, and detecting.

The present invention selectively applies the corresponding mode for each false detection level according to the false detection level of the attack rule.

The present invention recognizes harmful traffic based on the accumulated number of registered information and applies the automatic analysis response mode.

In addition, another technical feature according to the present invention is the step of generating traffic from the network, performing hardware filtering on the packet information of the generated traffic, packet information filtered by the hardware filtering or the And distributedly providing software to detect packet information for which hardware filtering has not been performed.

According to the present invention having such a configuration, when detecting an attack packet in the inflowed traffic, it can be seen that the attack rule for the attack is separately managed and the attack packet is blocked based on the accumulated result. You can predict whether it will happen.

Hereinafter, an intrusion prevention system and a control method thereof according to the present invention will be described in detail with reference to a preferred embodiment shown in the accompanying drawings.

2 is a block diagram of an intrusion prevention system according to a preferred embodiment of the present invention.

The configuration of the intrusion prevention system of the present invention is similar to that of the conventional intrusion prevention system, and the different configuration will be mainly described.

Referring to the drawings, a packet-only processing unit 100 that performs hardware filtering to block traffic attacks coming from an external network and a software engine unit 120 that performs software filtering are provided. In addition, an operation module 130 for generating an attack rule as a countermeasure against the attack packet and transmitting the attack rule to the packet dedicated processing unit 100 and the software engine unit 120 is provided. In general, the attack rule is transmitted from the operation module unit 130 in an online manner.

The software engine unit 120 may include blocking result information about packets introduced as a result of processing by the packet-only processing unit 100, packet information primarily filtered, and packets introduced from the packet-only processing unit (ie, entire packets, Normal packet, part information of the packet according to an arbitrary condition-header information, etc.) is selectively received by the user setting, and the packet processor 122 performs an administrator alert function, and the attack transmitted to the packet processor 122. The S / W detector 124 is provided to detect the packet again. When the S / W detection unit 124 detects an attack packet, the management map 128 stores the occurrence information on the detected attack to accumulate and reanalyze attack rule occurrence information on the attack packet. It is provided. An analysis response unit 126 is provided to refer to the management map 128 and transmit a response policy to the packet processing unit 122 according to a comparison with a preset threshold to block the detected packet IP. The management map 128 is cleared by unit time.

In addition, the reanalysis is not applied to every response mode of the attack rule, but is limited to a case in which the attack rule characteristic is an automatic analysis response target and a detection mode.

On the other hand, the attack rule applied to the present invention is defined as follows [Table 2]. The attack rule is information to which the corresponding detection information for false detection level / rule application level / content analysis level / error level is added to the security policy information described in the prior art. These attack rules are also preset and provided from the operation module unit 130 at the time of loading the intrusion prevention system to provide a detection mode for packet information. The added attack rule is defined as shown in the following [Table 2].

[Table 2]

Existing Rule Information False positive level Rule application level Content Analysis Level Correspondence mode by false positive level Table 1 1: 5% or less false positive
2: 5% or more false positive probability
3: 50% false positive probability 0: H / W only
1: S / W only
3: Apply to both H / W and S / W 0: packet
1: Session
2: AP analysis block
Automatic analysis after detection
Detection

Here, the false detection level may be divided into a plurality of stages according to the possibility of false positive for normal packets. In the present invention, this is defined as three steps. In the first stage, the probability of false positives is 5% or less, in the second stage, the probability of false positives is 5% or more, and in the third stage, the probability of false positives is 50% or more. The second step is to block incoming packets after monitoring the likelihood of false positive detection, and the third step is to include headers such as IP and port, which are attributes of the attack rule of the packet information. And content information should be operated only in the detection mode. Of course, each% of the false positives can be adjusted to the requirements according to each site.

The level of false positive detection determines the level of application of the attack rule. The application level applies only the packet-only processing unit 100 or only the software engine unit 120 or the packet-only processing unit 100 and the software engine unit 120 according to the false positive level. The decision is made.

In addition, the content analysis level may be detected by any one of packet-based, session-based, and AP-based analysis.

It also determines the response by false positive level. In response to the false detection level, it is provided that the automatic analysis response mode is performed on the attack packet after the detection, instead of being set only as blocking / connection when it is detected as an attack packet. The automatic analysis response mode allows to separately manage and analyze an attack rule having a high probability of false detection, and apply a preset response mode according to the analysis result.

Next, the control method of the intrusion prevention system according to the present invention having the configuration as described above will be described in detail with reference to FIGS. 2 and 3.

First, it is determined how to apply an attack rule to the packet information flowing into the intrusion prevention system of the present invention (step 200). The attack rule includes a misdetection level, a rule application level, a content analysis level, and a correspondence mode for each misdetection level in addition to the security policy (Table 1) provided in the related art. Accordingly, in the embodiment of the present invention, the rule application level is set to detect both hardware and software in detecting packet information flowing from the packet dedicated processing unit 100. In addition, when the attack packet is detected by the software engine unit 120, an automatic analysis response mode after detection is set as a response mode. Of course, the false detection level and content analysis level are also determined by user setting. The attack rule determined as described above is transmitted from the operation module unit 130 at the time of loading when the intrusion prevention system is driven to be applied to the detection operation.

Next, a large amount of traffic is generated in the state that the attack rule is applied to the packet-only processing unit 100. Then, in step 202, the packet-only processing unit 100 detects whether the packet information is attacked and applies a response policy according to the detection result. That is, in case of a normal packet, the service is normally performed. In addition, as in step 204, the packet processing unit 122 includes the packet (i.e., all packets, normal packets, and partial information of headers according to a certain condition) introduced into the packet dedicated processing unit 100 together with the detection result information. Information, etc.) is selectively received by a user setting, the detection result information is transmitted to the operation module unit 130, or the incoming packet according to the attack rule characteristics received from the operation module unit 130 S / W delivers to the detection unit 124. This is a case where the attack rule characteristic is set to detect an attack packet by applying both hardware and software to the incoming packet. If the detection mode is set only by hardware, it is determined whether the packet is attacked and blocked / connected according to the response policy.

Next, the S / W detection unit 124 secondly performs attack detection on the incoming packets by an attack rule (steps 206 and 208). If it is determined that the packet is not detected according to the detection of the attack as in step 210, that is, the packet is provided as the normal packet (step 222). Of course, if detected and determined to be an attack packet, the packet connection is blocked.

However, in the present invention, instead of blocking the detected attack packet immediately, it is separately managed by the automatic analysis response mode described later as in step 212. This is because a normal packet may be incorrectly detected as an attack packet, and a problem may occur in providing a service if a service block as a response policy is immediately applied according to such a false positive.

Therefore, when an attack packet is detected according to the detection result of the S / W detector 124, when the corresponding mode is an automatic analysis response mode, the S / W detector 124 first detects the detected packet. The rule identification number (ID), the cumulative number, the occurrence interval, and the like, as occurrence information of the attack rule for the attack packet, are registered in the management map 128 (step 214).

The management map 128 accumulates and registers attack rule generation information for packet information determined as an attack packet by software. In other words, even if the packet information of any service request is an attack packet, the attack rule that detects the packet is separately managed without blocking the packet immediately.

Next, the analysis response unit 126 counts the attack rule generation information transmitted from the S / W detection unit 124 in the management map (128). If the attack rule occurrence information is already registered in the management map 128, the attack rule occurrence information is counted and accumulated, and in the case of the initial attack rule information, the counting process is performed while registering it.

In step 216, the analysis response unit 126 compares the number of times the attack rule generation information is counted with a predetermined threshold. The threshold value is set in advance to determine whether to apply the blocking mode according to the occurrence information of the attack rule detecting the attack packet. As such, when the analysis response unit 126 compares with the threshold while counting, if the comparison result does not reach the threshold value, the analysis response unit 126 generates the operation information on the attack rule. Only the unit 130 is notified (step 217).

However, if the threshold value is exceeded, the analysis response unit 126 automatically applies the blocking mode to block the corresponding packet IP through the packet processing unit 122 or to the operation module unit 130 within a predetermined time. The notification may be made to change the attack rule (steps 218 and 220). Here, in the management map 128 storing the attack rule generation information, the accumulated counter is cleared for each unit time (step 219).

Meanwhile, the present invention may predict the possibility of harmful traffic based on the detection result when the detection rule is applied and applied to the attack packet. Since random packets continue to be generated and the attack rule determines that the attack packet is an attack packet, the occurrence information of the attack rule is accumulated and managed.

As described above, it has been described with reference to the illustrated embodiment of the present invention, which is merely exemplary, those skilled in the art to which the present invention pertains without departing from the spirit and scope of the invention It will be apparent that other variations, modifications and equivalents are possible. Therefore, the true scope of the present invention should be determined by the technical idea of the appended claims.

As described above, according to the intrusion prevention system of the present invention and the control method thereof, a threshold that separately accumulates and manages an attack rule that may incorrectly detect a normal packet as an attack packet, and sets the accumulated attack rule information in advance. Since the attack packet is blocked only when the threshold value is exceeded after comparing with the value, it is possible to minimize the case in which the normal packet directly blocks the service due to false detection, thus providing an effective network service. have.

In addition, the present invention can predict and defend the possibility of harmful traffic according to the attack rule information.

In addition, the present invention can distribute the attack rules to the incoming traffic in hardware or software can improve the service speed.

Claims (24)

In intrusion prevention system, Detecting unit for detecting packet information in accordance with the application of a predetermined attack rule, A storage unit for storing attack rule generation information on the attack packet detected according to the characteristic of the attack result; An analysis response module for comparing the attack rule generation information with a preset threshold value and providing a corresponding mode to selectively block the attack packet when the threshold value is exceeded; And Intrusion prevention system, characterized in that the packet processing module for performing a hardware filtering includes a packet processing unit for providing a distributed portion to the detection unit when there is a limit to the detection of the attack on the packet information flowing into the network. The method of claim 1, Intrusion prevention system characterized in that it further comprises the operation module unit for receiving and analyzing the detection result of the detection unit, generating and providing the attack rule applied to the detection unit. The method of claim 1, wherein the packet processing unit Intrusion prevention system, characterized in that for receiving the packet information from the packet processing module to perform an administrator alarm function, and transmits the packet information to the detection unit according to the attack rule characteristics. delete In intrusion prevention system, A packet dedicated processing module for performing hardware filtering on packet information first, and And a software detection module for performing software filtering on the packet information delivered from the packet dedicated processing module, managing attack rule information on the detected attack packet, and applying a corresponding policy. The attack rule includes at least one of a misdetection level, a rule application level, a content analysis level, and corresponding mode information for each misdetection level. 6. The method of claim 5, The software detection module, A packet processor which receives the packet information from the packet dedicated processing module and classifies the packet information according to the characteristic of the attack rule; Detecting unit for receiving the packet information from the packet processing unit for software detection, A storage unit for storing attack rule generation information on the attack packet detected according to the characteristic of the attack result; And an analysis response module for comparing the attack rule generation information with a threshold value and selectively blocking the attack packet when the threshold value is exceeded. delete 6. The method of claim 5, The false positive detection level is arbitrarily set according to the probability of false detection of the normal packet. 6. The method of claim 5, The rule application level, intrusion prevention system, characterized in that the attack rule is applied by at least one of the hardware and software methods according to the false detection level. 6. The method of claim 5, The content analysis level is, Intrusion prevention system, characterized in that any one of a packet-based, session-based, AP-based method. 6. The method of claim 5, Corresponding mode for each false positive level is, Intrusion prevention system, characterized in that the blocking, detection and automatic detection after detection mode. 7. The method according to claim 1 or 6, The analysis response module is an intrusion prevention system, characterized in that the cumulative management by counting the attack rule generation information. The method according to claim 6, The attack rule characteristic is an intrusion prevention system, characterized in that the automatic analysis corresponding mode after detecting the packet information. 13. The method of claim 12, The attack rule generation information is an attack rule identification number, cumulative number, occurrence intrusion prevention system characterized in that the interval. Receiving packet information on which hardware filtering is performed; Performing attack detection in software on the packet information; Registering the occurrence information on the attack rule when the attack is detected; and Comparing the accumulated number of occurrences of the registered occurrence information with a threshold value and blocking an attack packet when the threshold value is exceeded according to a comparison result; The attack rule is a control method of the intrusion prevention system, characterized in that it comprises at least one of the error detection level, rule application level, content analysis level and corresponding mode information for each false detection level. 16. The method of claim 15, The packet information transmission is executed when the attack rule is applied to software filtering. 16. The method of claim 15, If the attack packet is detected by the attack detection control method of the intrusion prevention system, characterized in that to perform an automatic analysis response mode. 16. The method of claim 15, The occurrence information of the attack rule is an attack rule identification number, cumulative number, occurrence interval for the detected attack packet control method of the intrusion prevention system. 16. The method of claim 15, The threshold value is a control method of the intrusion prevention system, characterized in that provided in advance to block the attack packet in accordance with the occurrence information of the attack rule for detecting the attack packet. 16. The method of claim 15, The attack rule, Control method of the intrusion prevention system, characterized in that comprises a false detection level, rule application level, content analysis level, and corresponding mode information for each false detection level. 21. The method of claim 20, The false detection level is arbitrarily set according to the probability of false detection of a normal packet, The rule application level applies an attack rule by at least one of hardware and software methods according to the false detection level, The content analysis level is to select any one of the packet-based, session-based, AP-based, Corresponding mode for each of the false detection level, the method of controlling the intrusion prevention system, characterized in that the automatic analysis response mode is applied after blocking, detection, and detection. The method of claim 20 or 21, Control method of the intrusion prevention system, characterized in that for applying the corresponding mode for each false detection level according to the false detection level of the attack rule. The method of claim 15 or 21, Recognizing the occurrence of harmful traffic based on the accumulated number of registered information and applying the automatic analysis response mode, characterized in that for controlling the intrusion prevention system. Generating traffic from the network, Performing hardware filtering on the packet information of the generated traffic; And providing distributed distribution of software to detect a part of the attack on the packet information flowing into the network by the hardware filtering.

Images