KR101322692B1 - Method and system for detecting botnet transmitting spam mail - Google Patents

Abstract

PURPOSE: A method for detecting botnet transmitting a spam mail and a system thereof are provided to detect the botnet from received mails, thereby preventing the damage caused by the botnet. CONSTITUTION: When a mail is received, mail monitoring servers (30-1~30-m) upload the mail and an internet protocol of a transmitting terminal. A main server (50) compares mails which are uploaded from the mail monitoring servers. When the number of countries according to internet protocols of the number of monitoring object transmitting terminals, which transmits the same mail, exceeds a constant number, the main server processes the monitoring object transmitting terminals by using botnet. The main server processes the whole transmitting terminals which transmits the same mail by using the botnet and provides related information to the mail monitoring servers. [Reference numerals] (50) Main server; (AA) Network

Description

Method and system for detecting botnet transmitting spam mail

The present invention relates to botnet detection, and more particularly, to a method and system for detecting botnets that send spam.

In cyber space, a lot of threats are emerging. Threats on the Internet are scattered, such as harassing or collecting personal information of third parties, exploiting towards the unspecified majority, distributing advertising mails, monetary gain, or preventing competitors' services of information devices. As cyber damage is prominent, new threats are dominating the Internet, which is BotNet. Botnets, which are recognized as the most serious network threats with distributed denial of service attacks (DDoS), are a network of computers infected with malicious software bots.

Although botnets are badly affected in many ways, catching them is no easy task. This is due to the core characteristics of botnets-dispersibility and user dependence. If one or a few PCs perform the same task repeatedly, it's not difficult to find them. But if millions of PCs perform the same task once or twice, it will be very difficult to find out who is doing it. You may not even know whether such malicious tasks are being performed. Another thing to consider is that the bots used for the task are the personal PCs of the average user. Because they do not voluntarily participate in the task, they only participate in the task if the computer is turned on at the moment the operator gives the command. Simply put, no one can predict when each bot will be on (participate) and when (off) it will be off.

Accordingly, the present invention has been made to solve the above-described problem, and to provide a method and system for detecting the botnet by analyzing spam mails sent by the botnet.

Other objects of the present invention will become more apparent through the following preferred embodiments.

According to an aspect of the present invention, when the mail is received, mail monitoring server for uploading the mail and the IP of the sending terminal; And a main server that processes the monitored target sending terminal as a bot when a country corresponding to IPs of a specific number of monitored target sending terminals sending the same mail by comparing mails uploaded from the mail monitoring servers with each other is a preset number. There is provided a botnet detection system comprising a.

Here, the main server may check whether one or more of a URL, an attached file, a specific character, and a phone number are included in the mail, and determine the specific number according to the confirmed contents.

In addition, the main server may review the country for other sending terminals if the countries according to the IPs of the monitoring target sending terminal are all the same but different regions are more than a certain number.

In addition, the main server may process all sending terminals that have sent the same mail as the mails from the monitoring target sending terminals processed by the bot to the bot, and provide related information to each mail monitoring server.

In addition, the mail monitoring server may send a reply mail notifying the bot infection to the sending terminal when the sending terminal receiving the mail is processed by the bot.

In addition, the mail monitoring servers may upload information about the mail and the IP only when the received mail is recognized as spam mail.

According to another aspect of the present invention, in a botnet detection method in a server device connected to a mail monitoring server via a communication network, collecting information on the mail received from the mail monitoring server and the IP of the sending terminal that sent the mail. Making; Selecting a specific number of sending terminals sending the same mail based on the collected information; And determining whether the number of countries corresponding to each IP of the selected monitoring target sending terminals is greater than or equal to a number, thereby processing the sending terminals sending the same mail as a bot, and a program for executing the method. Recorded recording media are provided for the computer to read.

Here, it is possible to check whether one or more of a URL, an attached file, a specific character, and a phone number are included in the mail, and determine a specific number of monitoring target dispatch terminals selected according to the confirmed contents.

In addition, if the countries according to the IPs of the monitoring target sending terminal are all the same but different areas are a certain number, may further comprise the step of reviewing the country for the other sending terminal that sent the same mail.

According to the present invention, by detecting the botnet using the received mails, it is possible to prevent damage caused by the botnet.

Figure 1 is a schematic diagram showing a botnet detection system according to an embodiment of the present invention.
2 is a flow diagram illustrating a schematic process of botnet detection in accordance with an embodiment of the present invention.
3 is a flowchart illustrating a process of determining whether or not to send bots that send the same mail according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout the specification and claims. The description will be omitted.

Figure 1 is a schematic diagram showing a botnet detection system according to an embodiment of the present invention.

Referring to Figure 1, the entire system according to the present embodiment is a computer device constituting a bot net bot devices (10-1, 10-2, ..., 10-n: collectively referred to as 10 below), mail monitoring server Fields 30-1, 30-2, ..., 30-m: collectively referred to as 30 below and the main server 50.

The botnet refers to a form in which a plurality of computers infected by malicious software bots are connected to a network, and the bot device 10 is a computing device infected with the bots described above and sending spam mail.

The mail monitoring server 30 is a server device for monitoring mail delivered to users having a managed mail account. For example, the mail monitoring server 30 may be a general mail server or a separate server for monitoring mail delivered to mail servers. It may be a monitoring device.

The mail monitoring server 30 sends mail received from a terminal (hereinafter referred to as a sending terminal) including the bot device 10 and information on an IP address of the corresponding sending terminal to the main server 50. Upload. For example, the mail monitoring server 30 may have a function for filtering spam mails by itself, and when a mail suspected to be spam mail is received by such filtering function, related information (mail content and The IP of the sender (that is, the sending terminal) is uploaded to the main server 50. Of course, this is only an example, and the mail monitoring server 30 may upload relevant information to the main server 50 for all mails without the above-described filtering function.

According to another example, the mail monitoring server 30 uses a list of bot devices identified as terminals forming a botnet infected with the bot obtained from the main server 50, so that the received mail is sent from the bot. If it is determined first, and if it is determined that the bot is filtered by itself, the information related to the mail may be uploaded to the main server 50 only if the bot.

The main server 50 determines whether the corresponding sending terminal is a bot device constituting the botnet based on the mail related information uploaded from the mail monitoring servers 30.

The main server 50 uses the IP of a specific number of sending terminals (hereinafter referred to as monitoring target sending terminals) that have sent mail having the same content, based on each mail related information collected from the mail monitoring servers 30. . In other words, when the mails collected from the k mail monitoring servers 30 are identical to each other, it is determined whether the monitoring target sending terminal is a bot using the IP of the monitoring target sending terminal that sent the mail.

If the number of countries according to IP of each monitored sending terminal is more than a preset number (for example, two, etc.), the monitored sending terminals may be recognized as bots, and of course, the same mail as the monitored sending terminals is sent. All sending terminals can also be treated as bots.

In general, the IP address system has an address band assigned to each country, so the IP address alone can identify the country. Therefore, the main server 50 can check which countries the mail is sent to by using the IP of each monitored sending terminal, and if it is sent from various countries, the monitored sending terminals are recognized as bots. . In general, botnets take advantage of the fact that thousands and tens of thousands of bots are distributed in many countries.

Hereinafter, a botnet detection process through collaboration between the mail monitoring server 30 and the main server 50 according to FIG. 1 will be described.

2 is a flowchart illustrating a schematic process of botnet detection according to an embodiment of the present invention.

Referring to FIG. 2, when the received mail is recognized as spam mail (S210), the mail monitoring server 30 may display information on the IP of the mail and the sending terminal (hereinafter referred to as report information) on the main server 50. Upload to (S220). In the present exemplary embodiment, the mail monitoring server 30 determines whether the received mail is spam and uploads the report information to the main server 50 only when the mail is spam. However, this is only an example and according to another example, It is also possible to upload the IP information of the mail and the sending terminal to the main server 50 for all the mail. Alternatively, as described above, the mail monitoring server 30 has information about the botnet in advance, and determines whether the received mail is a mail by the botnet, and reports only when it is determined that the mail is not a botnet (new botnet). Information can also be uploaded to the main server 50.

When the main server 50 uploads the report information according to the same spam mail from the other mail monitoring server 30, a specific number of the report information, that is, a specific number (hereinafter, referred to as "k") of sending terminals are monitored. It is selected as (S230). That is to say, bots can typically be thousands or tens of thousands, so select only some of them as monitored sending terminals.

The main server 50 checks the countries according to the IPs of the k monitored target sending terminals (S240), and determines whether or not the bots are based on whether the countries are greater than or equal to a preset number (S250). As an easy example, if some or all of the k monitored sending terminals are in different countries, all sending terminals sending the same spam mail, including the monitored sending terminals, can be recognized as bots. Here, the k values described above may be fixed values, but may be set variably according to various conditions. A method thereof will be described later with reference to FIG. 3.

If the monitored sending terminals are determined to be bots, the main server 50 processes all sending terminals that send the same mail as the mails from the monitored sending terminals processed by the bots, and processes the relevant information for each mail. Provided as surveillance servers.

Therefore, the mail monitoring server 30 receives information on whether or not the bots of the sending terminal that sent the spam mail from the main server 50 (S260), and processes the mail accordingly (S270). As an easy example, if the sending terminal is recognized as a bot, the mail monitoring server 30 spams the corresponding mail and does not process the delivery to the mail receiving account, but the information about the sending terminal (IP, etc.) on the botnet list. Register. On the other hand, if it is determined that the sending terminal is not a bot, the mail may be processed normally, or may be spam because it is recognized as spam in S210.

And, according to an example, the mail monitoring server 30 may send a reply mail notifying the bot infection to the sending terminal when the sending terminal receiving the mail is processed by the bot. That is, the user of the sending terminal may not know that its terminal is infected with the bot, so it informs it by reply mail.

In the present embodiment, the main server 50 recognizes the country according to the IP of the monitored sending terminal to determine whether or not the bot. According to another embodiment, in addition to the country can also recognize and utilize the area according to the IP.

3 is a flowchart illustrating a process of determining whether or not to send bots that send the same mail according to an embodiment of the present invention.

Referring to FIG. 3, the main server 50 analyzes the mail content and determines the number k of monitoring target sending terminals to check a country according to IP (S310). The main server 50 checks whether the mail includes one or more of a URL, an attached file, a specific character, and a phone number, and determines the k value according to the confirmed contents. As an easy example, if there is no suspicious content as described above, the k value is determined as a preset value (for example, 10), and if there is an attachment, a URL, etc., it is more likely that the attack is caused by a botnet. Since it is high, the k value can be set lower (e.g., 3 or 5 or less). As another example, even if a specific character includes a keyword related to personal information (e.g. social security number, address, etc.), abusive keyword (e.g. adult content, etc.), the k value is likely to be lower because the attack is likely caused by a botnet. Can be set.

The main server 50 determines whether there are a plurality of countries according to the IPs of the determined k monitoring target sending terminals (S320), and processes the monitored target sending terminals sending the corresponding mail as bots (S370).

On the other hand, if there is only one country, it is determined whether the regions according to the IP are different (S330). In general, the IP address can be used to determine the approximate location.

If the regions are the same, the mail is treated as non-spam by the botnet if the regions are the same (S340), and if different, select other monitoring target terminals to review the country according to the IP (S350). In general, because botnets are spread over a wide range, the area of the monitored sending terminals is somewhat different because the botnets are more likely to be botnets.

The main server 50 checks whether there are a plurality of countries as a result of the review (S360), and if there are a plurality of countries as a result of the review, proceeds to S370, or, if there is one country, goes to S340.

The botnet detection method for sending spam mail according to the present invention described above may be embodied as computer readable codes on a computer readable recording medium. Computer-readable recording media include all kinds of recording media having data stored thereon that can be decrypted by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that various modifications and changes may be made.

10-1, 10-2, ..., 10-n: Bot Device
30-1, 30-2, ..., 30-m: mail monitoring server
50: main server

Claims (9)

When the mail is received, the IP of the sending terminal and the mail monitoring server for uploading the mail; And
If the number of countries according to IPs of a certain number of monitored target sending terminals that have sent the same mail by comparing mails uploaded from the mail monitoring servers with each other is greater than a predetermined number, the monitored target sending terminal is treated as a bot, A botnet detection system comprising a main server for processing all sending terminals that have sent the same mail as the mail from the monitored target sending terminal, and providing related information to each mail monitoring server.
When the mail is received, the IP of the sending terminal and the mail monitoring server for uploading the mail; And
Comparing the uploaded mails from the mail monitoring servers with each other, the main server processing the monitored sending terminal as a bot when the number of countries according to the IPs of the specific number of monitored sending terminals sending the same mail is more than a preset number; Including,
The main server checks whether one or more of a URL, an attached file, a specific character, and a phone number is included in the mail, and determines the specific number according to the checked contents.
The method according to claim 1,
The main server is a botnet detection system, if the country according to the IP of the monitoring target sending terminal is the same, but different areas more than a certain number, review the country for the other sending terminal.
delete The method according to claim 1,
The mail monitoring server is a botnet detection system characterized in that when the sending terminal receiving the mail is processed by the bot, sending a reply mail notifying the bot infection to the sending terminal.
The method according to claim 1,
The mail monitoring server is a botnet detection system, characterized in that for uploading information about the mail and IP only if the received mail is recognized as spam mail.
A botnet detection method in a server device connected to a mail monitoring server through a communication network,
Collecting information on the mails received from the mail monitoring servers and the IP of the sending terminal that sent the mails;
Based on the collected information, select a specific number of sending terminals sending the same mail, and check whether the mail includes at least one of a URL, an attached file, a specific character, and a phone number. Determining a specific number; And
And determining whether the number of countries corresponding to each IP of the selected monitoring target sending terminals is greater than or equal to a certain number, thereby processing the sending terminals sending the same mail to the bot.
delete The method of claim 7,
If the countries according to the IPs of the monitored sending terminal are all the same but different regions are more than a certain number, botnet detection method further comprising the step of reviewing the country for the other sending terminal that sent the same mail.

Images