KR101290036B1 - Apparatus and method of network security for dynamic attack - Google Patents

Abstract

The present invention relates to a network security device and a method for detecting a dynamic attack that may occur in the Internet Protocol version 6 (Dynamic Protocol version 6) and to deal with it. The present invention is a header analysis unit for verifying the key value by analyzing the header information of the version determination unit 10 and the packet data transmitted from the version determination unit 10 to check the Internet protocol version information of the packet data introduced from the network And a map table manager 40 for accumulating or generating a count for the packet data in the map table 30 for each protocol according to the 20 and the key value, and a count set for the packet data and a threshold preset by the administrator. And a packet processor 50 for blocking or passing the packet data according to the result of the comparison of the values. According to the present invention configured as described above, the dynamic attack detection applied in the IPv4 environment can be applied to the IPv6 environment to detect the dynamic attack based on the IPv6, especially the dynamic attack that can be newly generated only in the IPv6 addressing system. There is an advantage that can be detected and blocked.

Internet protocol version, dynamic attack, security system, header

Description

Apparatus and method of network security for dynamic attack

1 is a block diagram of a network security device according to a first embodiment of the present invention.

2 is a flowchart illustrating a dynamic attack detection process using a network security device according to a first embodiment of the present invention.

3A to 3C are flowcharts illustrating processing methods according to protocols based on packet data header information analysis of FIG. 2.

Figure 4 is a block diagram of a network security device according to a second embodiment of the present invention.

5 is a flowchart illustrating a dynamic attack detection process using a network security device according to a second embodiment of the present invention.

Description of the Related Art [0002]

10: version judgment unit 20: header analysis unit

30: map table 40: map table management unit

50: packet processing unit 60: log analysis unit

The present invention relates to a network security system, and more particularly, to a network security device and a method for detecting a dynamic attack that can occur in Internet Protocol version 6 (hereinafter referred to as IPv6) and for dealing with the dynamic attack. will be.

In today's information age, the exchange of information through the internet network is increasing as it is integrated into the ubiquitous society. As a result, the importance of Internet security is increasing. As the range of the Internet network is increased, the number of attacks is increasing day by day, and the technique is also highly intelligent.

One of the most recent attack techniques for network traffic is dynamic attack types such as Denial of Service (DoS), which can determine whether an attack is needed by analyzing packet streams collected for a certain period of time. to be. This dynamic attack is an attack technique that sends a large amount of data for the purpose of interfering with the normal service of the system, thereby rapidly degrading the performance of the target network or the system, so that the services provided by the target system cannot be used.

Network security systems are being developed in preparation for various traffic attacks including such dynamic attacks. A network security system is a preventive approach among network security technologies that monitors network traffic, recognizes potential threats, and responds to them immediately.Intrusion Prevention System (IPS), Intrusion Detection System ( Intrusion Detection System (IDS).

The network security systems provide security work based on Internet Protocol version 4 (hereinafter referred to as IPv4) because the Internet is built on the IPv4 protocol. However, due to the limitations of the IPv4 protocol, it is expected that there will be a problem in the continuous development of the Internet, and as an alternative, the IPv6 protocol was enacted. IPv6 is included as part of IP support in many products, including major computer operating systems, and has improved IP addresses, simplified IP header formats, extended IP headers and options, authentication and security features over IPv4. To provide.

However, current network security systems support the IPv4 environment, which causes a problem in that dynamic attacks on illegal packet data in the IPv6 environment cannot be detected.

For example, in the IPv4 environment, the dynamic attack is detected in the application area of the network security system, but the detection of the dynamic attack based on the IPv6 cannot be performed.

Therefore, at the time of the transition to the IPv6 environment, which is designed to meet the demand of new IP addresses in consideration of the exponentially increasing user demand, if the IPv6-based dynamic attack cannot be detected, even if the packet is invalid, the IP ( The inability to block IP) addresses or incoming traffic can reduce overall network service performance.

Accordingly, an object of the present invention is to solve the problems of the prior art as described above, and to provide a network security device for dynamic attack, which enables dynamic attack detection applied in an IPv4 environment to be applied in an IPv6 environment.

Another object of the present invention is to enable detection of dynamic attack types that can occur only in an IPv6 environment.

Another object of the present invention is to enable dynamic attack detection in the kernel domain.

According to a feature of the present invention for achieving the above object, the present invention provides a version determination unit for confirming the Internet protocol version information of the packet data introduced from the network, and the header information of the packet data transferred from the version determination unit A header analysis unit for checking a key value for the packet data by analyzing the data, a map table manager for accumulating or generating a count for the packet data in a map table for each protocol according to the key value, and storing the count for the packet data by the count and the manager. And a packet processing unit for blocking or passing the packet data according to a comparison result of a preset threshold.

The version determining unit, the header analyzing unit, the map table managing unit, and the packet processing unit are provided in the kernel region of the security system, and the version determining unit delivers only IPv6 based packet data to the header analyzing unit. In addition, the header analyzer identifies a protocol of the packet data from the header information, and identifies key values such as a source IP address, a destination IP address, and a dynamic attack name for each protocol.

According to another aspect of the present invention, the present invention provides a key value for the packet data by analyzing a version determination unit for checking the Internet protocol version information of the packet data flowing from the network, and the log information recorded at the time of generating the log of the packet data A log analysis unit for verifying the data; a map table manager for accumulating or generating a count for the packet data in a map table according to the protocol according to the key value; and according to a comparison result between the count and a threshold preset by the administrator. And a packet processing unit for blocking or passing the packet data.

The version determining unit, the log analyzing unit, the map table managing unit, and the packet processing unit are provided in the kernel area of the security system, and the log analyzing unit classifies the protocol of the packet data from the log information, and the source IP address and the destination IP for each protocol. Check key values such as address and dynamic attack name. In addition, the version determining unit delivers only IPv6 based packet data to the header analyzing unit.

On the other hand, the map table is configured in the form of a table that stores the number of times that the packet flows for each protocol. The map table management unit searches the map table to check whether a key value is stored for packet data, and if the key value is already stored in the map table, increases the count of the map table, and the key value is determined by the map table. If the map table does not exist, the key value is added to the map table.

According to still another aspect of the present invention, the present invention provides a version determination step of checking an Internet protocol version of incoming packet data and a header analysis step of checking a key value for the packet data with reference to the header information of the packet data. A count acquiring step of accumulating or generating a count for the packet data in a map table for each protocol according to a key value, and a packet processing step of blocking or passing the packet data according to a result of comparing the count with a threshold preset by an administrator. It is configured to include.

The version determination step, header analysis step, count acquisition step, and packet processing step are executed in the kernel region of the security system, and the header analysis step analyzes header information of the packet data identified based on IPv6 in the version determination step.

The key value of the header analysis step includes a dynamic attack name that can be generated for each protocol separated from the header information.

The packet processing step blocks the packet data by a dynamic attack when the count value exceeds the threshold value, and delivers the packet data to an application area when the count value is less than the threshold value.

According to another feature of the present invention, the present invention is to determine the key value for the packet data by analyzing the version determination step of checking the Internet protocol version of the incoming packet data and the log information recorded at the log generation of the packet data A packet acquisition step of accumulating or generating a count for the packet data in a map table for each protocol according to a log analysis step and the key value, and blocking or blocking the packet data according to a comparison result between the count and a threshold preset by an administrator. It includes a packet processing step to pass.

The version determining step, the log analyzing step, the count acquiring step, and the packet processing step are executed in the kernel region of the security system, and the log analyzing step analyzes log information of packet data identified based on IPv6 in the version determining step. .

The key value of the log analysis step includes a dynamic attack name that can be generated for each protocol separated from the log information.

When the count value exceeds the threshold, the packet processing step determines that the attack is a dynamic attack, blocks the packet data from the system where the packet data is generated for a predetermined time, and provides a service for the packet data that has already been transferred to the application area. Dispose of not provided.

On the other hand, the count acquiring step increases the count stored in the map table when the key value is already stored in the map table, and adds the key value to the map table when the key value does not exist in the map table. Add and generate counts together. In particular, the key value includes a destination port number when the protocol included in the packet data is a transmission control protocol.

If the dynamic attack is a DAD-NA message floating attack, the packet processing step ë ", if the NA count value exceeds both the threshold value and the NS count value, determines that the dynamic attack blocks the packet data, and the NA If the count value is less than or equal to the threshold value or less than the NS count value, the packet data is transferred to the application area.

On the other hand, if the NA count value exceeds both the threshold value and the NS count value, it is determined as a dynamic attack to block the packet data from the system where the packet data is generated for a predetermined time, and the service for the packet data that has already been transferred to the application area. Treat the switch as not provided.

In this case, the NA count is a count for packet data whose type field value of the Internet control message protocol header is 136, and the NS count is a count for packet data whose type field value of the Internet control message protocol header is 135.

According to the present invention having such a configuration, the dynamic attack detection applied in the IPv4 environment can be applied to the IPv6 environment to detect the dynamic attack based on the IPv6, and especially the dynamic attack that can be newly generated only in the IPv6 addressing system. There is an advantage that can be detected and blocked.

Hereinafter, a network security apparatus and method for dynamic attack according to the present invention will be described in detail with reference to a preferred embodiment shown in the accompanying drawings.

1 is a block diagram of a network security device according to a first embodiment of the present invention.

Referring to FIG. 1, a version determining unit 10 confirms version information of packet data introduced from a network. The version determining unit 10 determines the IPv4 or IPv6, if the packet data based on IPv4, and transmits to a separate system (not shown) that can process the packet data related to IPv4, IPv6-based packets Receive only data.

The header analyzing unit 20 receives the IPv6-based packet data determined by the version determining unit 10 and analyzes the IP header information with reference to the header of the packet data. The header analysis unit 20 controls the protocol of the packet data, that is, a transmission control protocol (hereinafter referred to as TCP) / user datagram protocol (hereinafter referred to as UDP) / IPv6. Message protocols (Internet Control Message Protocol for IPv6, hereinafter referred to as ICMPv6) are distinguished and key values such as source IP address, destination IP address, and dynamic attack name are checked for each protocol.

A map table manager 40 is provided for accumulating or generating a count for the packet data in the map table 30 for each protocol according to the identified key value. The map table 30 stores the number of times that the packet data has been introduced for each protocol in the form of a table. That is, each time the packet data flows is configured to generate a traffic count for each protocol. At this time, the map table 30 is preferably composed of a hash table (hash table).

And by comparing the count for each protocol of the incoming packet data with the threshold value preset by the administrator with reference to the map table 30 to determine whether the dynamic attack, and as a result of blocking the packet data for a certain time or A packet processor 50 for delivering to the application area is provided.

In the first embodiment of the present invention, the version determining unit 10, the header analyzing unit 20, the map table managing unit 40, and the packet processing unit 50 that determine whether the packet data is dynamically attacked are configured. It is provided in the kernel area of the security system. In other words, the detection module for detecting whether the conventional dynamic attack is provided in the application area is different.

Next, a process of detecting a dynamic attack of packet data configured with an IPv6 address system in the network security device configured as described above will be described with reference to the accompanying drawings.

2 is a flowchart illustrating a dynamic attack detection process using a network security device according to a first embodiment of the present invention.

Packet data is generated from another system in order to transmit predetermined data to a server or a system. Then, it is introduced into the security apparatus according to the first embodiment of the present invention to determine whether the generated packet data is a dynamic attack (S100).

The introduced packet data is first transmitted to the version determining unit 10.

The version determining unit 10 checks the packet data based on the IPv4 or IPv6 address (S110), which is to determine the dynamic attack on the packet data based on the IPv6. Therefore, if the address system of the incoming packet data is IPv4, it is transmitted to another security device that can handle it (S112). However, if the address system of the incoming packet data is IPv6, it is transmitted to the header analyzer 20 to determine whether the packet data is a dynamic attack.

The header analyzing unit 20 analyzes an IP header area of the packet data (S120) and checks key values such as a source IP address, a destination IP address, and a dynamic attack name with reference to the header information (S122). The key value is transmitted to the map table manager 40 so that the key value is managed in the map table 30. At this time, the dynamic attack name is confirmed from the protocol method of the packet data shown in the Next Header field value included in the IP header area. Most packet data has protocols such as TCP / UDP / ICMPv6 depending on the network transmission method. If a standardized protocol other than the protocol currently being used is newly developed and used, it is only necessary that the map table 30 provides the protocol type.

The map table manager 40 accesses the map table 30 by referring to the transmitted key value and checks whether the same packet data exists (S130). If packet data having the same key value already exists in the map table 30 as a result of the check, the count of the corresponding packet data is increased (S132). If packet data with the same key value is continuously introduced, only the corresponding packet data will continue to be counted up. In contrast, when the key value does not exist in the map table 30, packet data of the key value is newly stored (S134). Of course, the newly stored count of the packet data preferably has an initial value determined as 1.

Next, the packet processing unit 50 continuously accesses the map table 30 and monitors whether the packet data currently being introduced is packet data corresponding to a dynamic attack. The dynamic attack determination is determined by comparing a count value of the packet data with a threshold value set by an administrator (S140). That is, the count value of the packet data is compared with the threshold value, and if the count value exceeds the threshold value, it is determined as a dynamic attack to block the packet data from being delivered to the application area (S150). Therefore, the service for the packet data is not provided.

However, if the count value does not exceed the threshold value, the packet processing unit 50 determines that the packet data is secure and transfers the packet data to the application area so as to provide a service thereof (S152).

Meanwhile, the processing of the packet data according to the protocol type of the packet data will be described in detail as follows. This will be described with reference to FIGS. 3A to 3C which show a flowchart of a protocol-specific processing method according to the packet data header information analysis of FIG. 2.

3A illustrates a case where packet data is TCP packet data.

First, the header analyzer 20 receives the IPv6 packet data (S200) and checks the protocol type of the packet data by referring to a next header field value included in the IP header area of the packet data. If the next header field value is 6, the protocol of the packet data is a TCP method (S210).

The header analyzer 20 sets a dynamic attack name to be detected among the dynamic attack types that can occur when the TCP method is used. Take the SYN floating attack, a representative dynamic attack that can occur at this time. The SYN floating attack is a denial of service attack using a loophole of the connection-oriented protocol TCP. The SYN floating attack proceeds only with sending a SYN (Synchronizing Segment) signal from the attacker's computer to the target computer, and omits the process of sending a FIN (FINish flag) signal so that the target computer continues to wait for an ACK (ACKnowledgement) signal. Is a dynamic attack. The case where the value of the SYN flag is 1 among the control bits included in the TCP header area may correspond to this (S220). For reference, the header analyzer 20 may set a dynamic attack name that may occur by referring to field values included in the TCP header area.

Thus, the header analyzer 20 checks the key value including the source IP address, the destination IP address, and the SYN flooding, and hands it over to the map table manager 40 (S222).

The map table manager 40 accesses the map table 30 and checks whether packet data corresponding to the key value is stored in the map table 30 (S230).

When packet data corresponding to the key value is already stored in the map table 30, the map table manager 40 is introduced with reference to a destination port number among values stored in the map table 30. Check whether the packet data is the same as the destination port number (S232). The destination port number is used to distinguish which application program should receive the packet data. Therefore, even if the key value is stored in the map table 30, if the destination port number is different, the packet data and the packet data previously introduced cannot be the same packet.

If the destination port number is the same, the map table manager 40 increases the count of the map table 30 (S240).

On the other hand, if the key value does not exist in the map table 30 as a result of performing step 230 or if the destination port number does not match in step 232, the map table manager 40 determines the map table ( In step S242, the key value is added. Of course, the count according to the added packet data is stored in the map table 30 with a predetermined initial value. In this case, it is preferable that the destination port number is stored in the map table 30 together with the key value.

In step 250, the packet processing unit 50 compares the count value with a threshold value and determines whether the packet data is a dynamic attack. According to the determination result, the packet data is blocked (S252) or passed (S254).

On the other hand, if the next header value is not 6 in step 210 or the SYN flag value is not 1 in step 220, the packet data is processed through logic for detecting a dynamic attack other than the SYN floating attack (S260). .

3B illustrates a case where the packet data is UDP packet data.

First, the header analyzer 20 receives the IPv6 packet data (S300) and checks the protocol type of the packet data. When the next header field value is 17, the protocol of the packet data is UDP (S310).

The header analyzer 20 sets a dynamic attack name to be detected among dynamic attack types that can occur when the UDP method is used (S320). For example, consider UDP floating attack, a typical dynamic attack that can occur. The UDP floating attack also belongs to the same service denial attack as the SYN floating attack. This is a dynamic attack that uses UDP to send virtual data to the server continuously, causing server load and network overload to prevent normal service.

In step 322, the header analyzer 20 checks a key value including a source IP address, a destination IP address, and UDP flooding, and hands it over to the map table manager 40.

The map table manager 40 accesses the map table 30 and checks whether packet data corresponding to the key value is stored in the map table 30 (S330).

If packet data corresponding to the key value is already stored in the map table 30, the map table manager 40 increments the count of the map table 30 (S332).

On the other hand, if the key value does not exist in the map table 30 as a result of the search, the map table manager 40 adds the key value to the map table 30 (S334). Of course, the count according to the added packet data is stored in the map table 30 with a predetermined initial value.

The packet processing unit 50 compares the count value with a threshold value and determines whether the packet data is a dynamic attack (S340). According to the determination result, the packet data is blocked (S342) or passed (S344).

On the other hand, if the next header value is not 17 in step 310, the packet data is processed through logic for detecting a dynamic attack other than the UDP floating attack (S350).

3C shows a case where the packet data is ICMPv6 packet data. The ICMPv6 is an improved control protocol than the existing ICMPv4, and is used for displaying information or transmitting errors occurring during communication. In FIG. 3C, examples of a dynamic attack that may occur include a DAD (Duplicate Address Detection) -NA message floating attack and a PING floating attack.

The header analyzer 20 receives the IPv6 packet data (S400) and checks the protocol method of the packet data. If the next header field value is 58, the protocol of the packet data is ICMPv6 (S410).

The DAD-NA message floating attack and the PING floating attack may be distinguished through a type field value included in the ICMPv6 header area (S412).

First, when the type field value is 136, the DAD-NA floating attack is set as a dynamic attack name (S420).

The DAD-NA message floating attack can only occur in IPv6 packet data. It is an attack that degrades the performance of routers or gateways by exploiting the vulnerability when autonomous address autoconfiguration is performed through neighbor solicitation (hereinafter referred to as NS) message and neighbor advertisement (hereinafter referred to as NA) message.

In this case, the NS message is a message for requesting whether the host generating the address writes the address to all the internal hosts in order to detect a host using the same address, and the NA message corresponds to the NS message. The reply message says you are using an address.

The header analyzer 20 checks a key value including a type field value and DAD-NA flooding, and passes it to the map table manager 40 (S422).

The map table manager 40 accesses the map table 30 and checks whether packet data corresponding to the key value is stored in the map table 30 (S430).

If the key value is already stored in the map table 30, the NA count of the map table 30 is increased (S432). If the key value does not exist in the map table 30, the map table 30 is increased. In step S434, the key value is added. Of course, the NA count according to the added packet data is stored in the map table 30 with a predetermined initial value. In this case, the NA count preferably represents a count of packet data having the type field value of 136.

The packet processor 50 compares the NA count value with a threshold value (S436) and then compares the NA count value with an NS count value when the NA count value exceeds the threshold value (S438). In this case, the NS count preferably represents a count for packet data having the type field value of 135.

The packet processing unit 50 blocks the packet data when the NA count value exceeds both the threshold value and the NS count value (S450). This is because the number of NS messages becomes significantly smaller than the number of NA messages in the DAD-NA floating attack.

On the other hand, when the NA count value does not exceed the threshold value or the NS count value does not exceed even if the threshold value is exceeded, the packet processing unit 50 passes the packet data (S452).

Next, when the type field value is 128 (S460), the PING floating attack is set as a dynamic attack name (S462).

The PING floating attack, which maliciously uses a ping test to check whether it is operating normally, is also a denial of service attack. Packet InterNet Groper (PING) sends echo request messages to specific hosts or routers and receives echo reply messages to determine connectivity and round trip time (RTT). Command. The PING floating attack is a dynamic attack that continuously sends a packet containing the echo request message to a target system so that the target system does not do anything else in response.

As a result, the header analyzer 20 checks the key value including the type field value and the PING flooding, and hands it to the map table manager 40 (S464).

The map table manager 40 increases the count for the packet data (S472) or adds the key value (S474) according to the presence or absence of the key value (S470).

The packet processing unit 50 blocks (S480) or passes (S482) the packet data according to the comparison result of the count value and the threshold value (S476).

On the other hand, if the next header value is not 58 in step 410 or the type field value is not 128 in step 460, the packet data may be a dynamic attack other than a DAD-NA message floating attack and the PING floating attack. It is processed through the logic to detect (S490).

4 is a block diagram of a network security device according to a second embodiment of the present invention.

The second embodiment is almost the same as the configuration of the first embodiment except that the dynamic attack is detected by analyzing log information of the packet data. That is, the configuration of the version determining unit 10, the map table 30, the map table management unit 40, and the packet processing unit 50 is the same, and analyzes the log information recorded when generating a log of packet data passing to the application area. It is provided with a log analysis unit 60 to check the key value.

5 is a flowchart illustrating a dynamic attack detection process using a network security device according to a second embodiment of the present invention.

In order to determine whether a dynamic attack of packet data generated from another system is introduced into the security apparatus according to the second embodiment of the present invention (S500).

The introduced packet data is first transmitted to the version determining unit 10 (S510).

If the address system of the incoming packet data is not IPv6, it is transmitted to another security device capable of processing the data (S512).

However, if the address system of the incoming packet data is IPv6, the packet data is transferred to the application area. At this time, log information of the packet data is generated, and the log analyzer 60 analyzes the generated log information (S520).

The log analyzer 60 analyzes the log information and checks key values such as a source IP address, a destination IP address, a dynamic attack name, etc. related to the packet data (S522). The key value is transmitted to the map table manager 40 so that the key value is managed in the map table 30.

The map table manager 40 accesses the map table 30 by referring to the transmitted key value and checks whether the same packet data exists (S530), and increases the count for the packet data according to the result ( S532) or the key value is added to the map table 30 together with the count of the initial value (S534).

The packet processor 50 compares the count value with a threshold value (S540).

If the count exceeds the threshold, the packet processing unit 50 blocks the packet data from the system where the packet data is generated for a predetermined time and processes the packet data already transferred to the application area (S542). That is, the service for the packet data is no longer provided. For example, a temporary storage unit (not shown) for temporarily storing packet data delivered to the application region is provided in the application region, and when the packet data stored in the temporary storage corresponds to a dynamic attack, the packet processing unit 50 Drop it.

On the other hand, if the count does not exceed the threshold value is repeated from step 500.

It is to be understood that the invention is not limited to the disclosed embodiments, but is capable of many modifications and alterations, all of which are within the scope of the appended claims. It is self-evident.

That is, a logic for detecting a predictable dynamic attack by referring to a protocol included in the incoming packet data and header information of the corresponding protocol may be added in various ways.

In the network security device and method for dynamic attack according to the present invention as described in detail above, the following effects can be obtained.

First, in the present invention, the dynamic attack detection applied in the IPv4 environment can be applied in the IPv6 environment, and thus there is an advantage in that the dynamic attack based on the IPv6 can be detected.

In addition, it is possible to detect dynamic attack types that can only occur in IPv6 environment, and it is easy to add dynamic attack detection logic that is discovered later.

In addition, in the present invention, the detection of the dynamic attack is performed in the kernel region, thereby improving the processing speed.

Claims (27)

A version determining unit which checks Internet protocol version information of the packet data introduced from the network; A header analyzing unit which analyzes header information of the packet data transmitted from the version determining unit and confirms a key value for the packet data; A map table manager configured to accumulate or generate a count for the packet data for each protocol according to the key value in a map table configured to form a table in which the number of times of inflow of the packet data for each protocol is stored; And And a packet processing unit for blocking or passing the packet data according to a result of comparing the count with a threshold preset by an administrator. The method of claim 1, The version determining unit, the header analyzing unit, the map table management unit, and the packet processing unit are provided in the kernel region of the security system. The method according to claim 1 or 2, The version determination unit, Network security device for dynamic attack, characterized in that the forwarding only IPv6 (Internet Protocol version 6) -based packet data to the header analysis unit. The method according to claim 1 or 2, The header analysis unit, And classifying a protocol of the packet data from the header information, and identifying key values such as a source IP address, a destination IP address, and a dynamic attack name for each protocol. A version determining unit which checks Internet protocol version information of the packet data introduced from the network; A log analysis unit for analyzing the log information recorded when generating the log of the packet data and checking a key value for the packet data; A map table manager configured to accumulate or generate a count for the packet data for each protocol according to the key value in a map table configured to form a table in which the number of times of inflow of the packet data for each protocol is stored; And And a packet processing unit for blocking or passing the packet data according to a result of comparing the count with a threshold preset by an administrator. 6. The method of claim 5, The version determining unit, the log analyzer, the map table manager, and the packet processor are provided in the kernel region of the security system. The method according to claim 5 or 6, The log analysis unit, Distinguishing protocols of the packet data from the log information, and identifying key values such as a source IP address, a destination IP address, and a dynamic attack name for each protocol. The method according to claim 5 or 6, The version determination unit, Network security device for dynamic attack, characterized in that for transmitting only the IPv6-based packet data to the log analysis unit. delete The method according to claim 1 or 5, The map table management unit, And retrieving whether the key value for the packet data is stored by searching the map table. The method of claim 10, The map table management unit, If the key value is already stored in the map table, the count of the map table is increased, and if the key value does not exist in the map table, the dynamic value is added to the map table. Network security device for. A version determining step of checking an internet protocol version of incoming packet data; A header analysis step of identifying a key value for the packet data by referring to the header information of the packet data; A count acquiring step of accumulating or generating a count for the packet data for each protocol according to the key value in a map table configured to form a table in which the number of times of inflow of the packet data for each protocol is stored; And And a packet processing step of blocking or passing the packet data according to a result of comparing the count with a threshold preset by an administrator. 13. The method of claim 12, And the version determining step, header analysis step, count acquisition step, and packet processing step are executed in the kernel region of the security system. 13. The method of claim 12, The header analysis step, Network security method for dynamic attack, characterized in that for analyzing the header information of the packet data identified in the version determination step based on IPv6. 13. The method of claim 12, The key value of the header analysis step, And a dynamic attack name that can be generated for each protocol separated from the header information. 13. The method of claim 12, The packet processing step, When the count value exceeds the threshold, the packet data is blocked by a dynamic attack, and when the count value is less than or equal to the threshold value, the packet data is transmitted to an application area. . A version determining step of checking an internet protocol version of incoming packet data; A log analysis step of analyzing log information recorded when generating the log of the packet data to check a key value for the packet data; A count acquiring step of accumulating or generating a count for the packet data for each protocol according to the key value in a map table configured to form a table in which the number of times of inflow of the packet data for each protocol is stored; And And a packet processing step of blocking or passing the packet data according to a result of comparing the count with a threshold preset by an administrator. 18. The method of claim 17, Wherein the version determining step, log analysis step, count acquisition step, and packet processing step are executed in the kernel region of a security system. 18. The method of claim 17, The log analysis step, Network security method for a dynamic attack, characterized in that for analyzing the log information of the packet data confirmed on the basis of IPv6 in the version determination step. 18. The method of claim 17, The key value of the log analysis step, And a dynamic attack name that can be generated for each protocol separated from the log information. 18. The method of claim 17, The packet processing step, If the count value exceeds the threshold value, it is determined as a dynamic attack to block the packet data from the system where the packet data is generated for a predetermined time and to provide a service for the packet data that has already been transferred to the application area. How to secure your network against dynamic attacks. delete The method according to claim 12 or 17, wherein The count acquisition step, If the key value is already stored in the map table, the count stored in the map table is increased, and if the key value does not exist in the map table, the key value is added to the map table and the count is generated together. Network security method for dynamic attack, characterized in that. The method of claim 15 or 20, The key value is, If the protocol included in the packet data is a transmission control protocol (TCP), a destination port number is included. 16. The method of claim 15, If the dynamic attack is a DAD (Duplicate Address Detection) -NA message floating attack, the packet processing step includes: If the NA (Neighbor Advertisement) count value exceeds both the threshold value and the NS (Neighbor Solicitation) count value, the packet data is determined to be a dynamic attack, and the packet data is blocked even if the NA count value is less than or above the threshold value. The network security method for a dynamic attack, characterized in that for transmitting the packet data to the application area if less than the count value. 21. The method of claim 20, The packet processing step when the dynamic attack is a DAD-NA message floating attack, If the NA count value exceeds both the threshold value and the NS count value, it is determined as a dynamic attack to block the packet data from the system where the packet data is generated for a predetermined time, and the service for the packet data that has already been transferred to the application area is not provided. Network security method for dynamic attack, characterized in that for processing. The method of claim 25 or 26, The NA count is a count for packet data whose type field value of the Internet Control Message Protocol for IPv6 (ICMPv6) header is 136, and the NS count is a packet whose type field value of the Internet control message protocol header is 135. A method of network security against dynamic attacks, characterized by representing a count of data.

Images