KR101428721B1 - Method and system for detecting malicious traffic by analyzing traffic - Google Patents

Abstract

The present invention relates to a method and system to detect malicious traffic by analyzing traffic. The present invention collects the traffic transmitted and received between an external network and an internal network; obtains time information to collect the content information if there is content information by checking whether there is content information after extracting the traffic information, the content information, and session information about the corresponding traffic by analyzing the collected traffic; sets a web address as a check object by extracting the web address (URL) from the traffic information and the content information of the traffic collected within a check period based on the collected time information; and determines the malicious traffic by checking the URLs set as the check object.

Description

[0001] METHOD AND SYSTEM FOR DETECTING MALICIOUS TRAFFIC BY ANALYZING TRAFFIC [0002]

The present invention relates to a malicious traffic detection method and system for detecting a malicious URL by selecting only a suspicious URL as a malicious traffic (URL) through a traffic analysis.

In general, most malicious code infections are infected by the user when the user is using web surfing and social networking service (SNS). For example, malicious code visits a compromised Web site, which infects malicious code.

Conventionally, when malicious URL (uniform resource locator) checking technology is inputted, malicious code infection, infection path, malicious code and the like are automatically detected for the URL to be inspected, and the detection result is output.

In order to prevent the malicious code infection of the user terminal in the network, it is necessary to check all the URLs accessed within the organization, but when the user terminal visits one URL, several tens to several hundred URL visits are made. Conventionally, every time a user terminal accesses a specific web page by using a virtual machine to detect a malicious URL that distributes malicious code, the malicious URL is visited by directly visiting a corresponding page and a web page linked thereto, There is a problem that it takes time and it is difficult to respond quickly.

That is, according to the related art, since all the URLs transmitted / received between the external network and the internal network (the network) are checked, it takes a lot of resources and time to detect malicious URLs, which makes it difficult to quickly diagnose and deteriorate the inspection speed.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problems of the prior art, and it is an object of the present invention to collect all traffic transmitted and received between an external network and an internal network, analyze the collected traffic, The present invention aims to provide a method and system for detecting malicious traffic through traffic analysis capable of detecting malicious URLs quickly.

According to another aspect of the present invention, there is provided a malicious traffic detection method using traffic analysis, comprising: collecting all traffic transmitted / received between an external network and an internal network; analyzing the collected traffic; The method comprising the steps of: extracting session information, content information, and traffic information for the content information; checking whether the content information exists; acquiring time information when the content information is collected; Extracting a web address (hereinafter, referred to as URL) from content information and traffic information of traffic collected in the check period based on time information and setting the URL as a check target; And judging whether or not it is possible.

The malicious traffic detection system according to the present invention includes a traffic collecting device for collecting all traffic transmitted and received between an external network and an internal network, And an analysis server for selecting and analyzing URLs of the collected traffic, wherein the analysis server comprises: a communication unit for receiving the collected traffic transmitted from the traffic collecting apparatus; and a traffic information collecting unit for collecting session information, (Hereinafter, referred to as " Web address ") existing in the traffic collected within the inspection period based on the time information on which the information is collected when the content information exists, Quot; URL ") as an object to be checked, and a URL selection unit It characterized in that it comprises a check to determine whether a malicious party URL.

The present invention collects and analyzes all traffic transmitted and received between an external network and an internal network, selects only URLs suspected to be malicious URLs (web addresses) among the traffic collected through the traffic analysis, Can be reduced.

Accordingly, the present invention can quickly detect a malicious URL, and can confirm in real time whether malicious code is downloaded from a terminal, a server, or the like in a network.

Also, according to the present invention, it is possible to check whether a person who accesses a web server receives a malicious code by checking the outgoing traffic, not the internal incoming traffic, and detect abuse of the web server.

1 is a block diagram illustrating a malicious URL detection system through traffic analysis in accordance with an embodiment of the present invention;
FIG. 2 is a block diagram showing the configuration of the analysis server shown in FIG. 1. FIG.
3 is a flowchart illustrating a process of collecting traffic information in a session mode according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating a process of collecting traffic information in a non-session mode according to another embodiment of the present invention. FIG.
5 is a flowchart illustrating a malicious URL detection method through traffic analysis related to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention monitors traffic transmitted / received between an external network and an internal network (network) to select suspicious traffic as traffic that is likely to cause malicious action, and checks only the corresponding traffic for maliciousness.

FIG. 1 is a block diagram showing a malicious URL detection system through traffic analysis according to an embodiment of the present invention, and FIG. 2 is a block diagram showing the configuration of the analysis server shown in FIG.

As shown in FIG. 1, the inspection object sorting system through traffic analysis related to the present invention includes a traffic collecting apparatus 100, an analysis server 200, and a database (DB) 300.

The traffic collecting apparatus 100 is installed between the external network 10 and the internal network 20 and collects all traffic transmitted and received between the external network 10 and the internal network 20. That is, the traffic collecting apparatus 100 collects the traffic flowing into the internal network 20 from the external network 10 and the traffic flowing into the external network 10 from the internal network 20.

Also, the traffic collecting apparatus 100 is implemented as a tap apparatus (TAP), and transmits traffic collected through wired / wireless communication to an analyzing server 200 to be described later.

The analysis server 200 analyzes traffic collected by the traffic collecting apparatus 100 to select objects to be checked. 2, the analysis server 200 includes a communication unit 210, an information collecting unit 220, a check target sorting unit 230, and an inspection unit 240. [

The communication unit 210 performs communication with the traffic collecting apparatus 100 and receives collected traffic transmitted from the traffic collecting apparatus 100. The communication unit 210 may be implemented as a WiBro, a Wi-Fi, a Local Area Network (LAN), or the like.

The information collecting unit 220 analyzes the collected traffic and collects information on the corresponding traffic. At this time, the information collecting unit 220 collects the collected traffic as a transmission control protocol (hereinafter, referred to as 'TCP') traffic or a hyper text transfer protocol (hereinafter referred to as 'HTTP' And collects information on the traffic through the traffic analysis.

The information collecting unit 220 operates in a session mode or a non-session mode.

First, the operation of the information collecting unit 220 in the session mode will be described.

The information collecting unit 220 extracts the session information for the TCP session set from the traffic when the collected traffic (collected traffic) is HTTP request traffic generated for the first time after establishing (forming) the TCP session. Here, the session information includes a destination address (Destination IP), a destination port (Port), and a traffic collection time (time). The destination port is the port information used when establishing the session.

If the collected traffic is HTTP response traffic, the information collecting unit 220 confirms whether the content (file type) included in the traffic is an executable file. In other words, the information collecting unit 220 confirms whether the content type included in the HTTP response traffic is an executable file (e.g., an EXE file and a DLL file).

The information collection unit 220 extracts content information from the traffic if the content type is an executable file. The content information includes a source IP address, a destination address, a URL (Uniform Resource Locator), a file, and a traffic collection time.

If the HTTP request traffic is a GET request type, the information collecting unit 220 checks whether previous visit information exists in the corresponding traffic, and collects previous visit information together with information of the corresponding traffic when previous visit information exists. At this time, the information collection unit 220 collects previous visit information, source address, destination address, source port, and traffic collection time information included in the collected traffic as traffic information.

Meanwhile, the information collecting unit 220 collects the information of the corresponding traffic excluding the previous visit information if the previous visit information does not exist in the collected traffic. That is, the information collecting unit 220 collects the HOST, the GET URL, the source address, the destination address, the source port, and the traffic collection time as traffic information.

The information collecting unit 220 collects information of contents transmitted and received through the destination port stored in the session DB 310 in the content DB 320 together with the destination port information (port number) 320 and the traffic DB 330 in the result DB 340. The content database 340 stores the content information and the traffic information. In other words, when the session is formed, the information collection unit 220 analyzes the traffic transmitted through the formed session to collect the session information, the content information, and the traffic information, and when the session ends, the presence of the content information in the content DB 320 And stores the collected information in the result DB 340 as new result data if the content information exists.

When the contents information transmitted through the destination port of the session DB 310 does not exist in the contents DB 320, the information collecting unit 220 transmits the session DB 310, the contents DB 320, the traffic DB 330, Lt; / RTI >

Next, in the non-session mode, if the collected traffic is an HTTP request traffic, the information collection unit 220 extracts traffic information from the corresponding traffic and stores the extracted traffic information in the traffic DB 330. Here, the traffic information includes a source address, a destination address, a previous visit address, a GET URL, a host, and a traffic collection time.

If the collected traffic is an HTTP response traffic, the information collecting unit 220 checks whether the content type (file type) of the traffic is an execution file. If the collected content is an execution file, the information collecting unit 220 extracts a source address, (Contents) and the traffic collection time in the traffic DB 330 as traffic information.

When the new result data is stored in the result DB 340, the check target sorting unit 230 confirms whether the new result data is executable. That is, the check target sorting unit 230 confirms whether the content type of the new result data is an execution file. If the new result data is executable, the check target sorting unit 230 sets URL lists that exist within the check period in the same session as the session of the new result data as the check targets.

In other words, if the content type of the new result data is an execution file, the check target sorting unit 230 acquires the time information in which the new result data is collected in the result DB 340. Then, the check target sorting unit 230 adds the collected URL to the check target list based on the acquired collected time information. For example, the check target sorting unit 230 extracts a URL existing in the traffic collected in the same session in which new result data is collected between 10 minutes and 10 minutes after the collected new result data is collected Set it as a check target.

The checking unit 240 checks whether or not the URL set as the inspection target is the malicious URL by the inspection target sorting unit 230. In other words, the checking unit 240 checks whether the URL included in the check target list is malicious code or whether it is suspected to be malicious code, and checks whether the URL is malicious URL.

The DB 300 stores a session DB 310 for storing session information, a contents DB 320 for storing contents information, a traffic DB 330 for storing traffic information, a result database DB 330, 340).

The DB 300 may further include a blacklist DB (not shown) in which the URL determined by the checking unit 240 as a malicious URL is stored. The malicious URL list stored in the blacklist DB (not shown) may be used to block access to the malicious URL when the terminal in the network attempts to access the malicious URL.

3 is a flowchart illustrating a process of collecting traffic information in a session mode according to an embodiment of the present invention.

3, the analysis server 200 collects all traffic transmitted and received between the external network 10 and the internal network 20 through the traffic collecting apparatus 100 (S101). At this time, the communication unit 210 of the analysis server 200 receives the collection traffic transmitted from the traffic collection apparatus 100, and the information collection unit 220 determines whether the protocol used by the received collection traffic is TCP or HTTP Check.

If it is confirmed that the collected traffic is TCP traffic or HTTP traffic, the information collecting unit 220 confirms whether the session is terminated (S102).

If the session is not terminated, the information collection unit 220 checks whether a session is established (S103).

When the session is created, the information collection unit 220 stores the session information for the session in the session DB 310 (S104). Here, the session information includes a destination port (DST Port), a destination address (DST IP), and time information.

If a session is not created in step S103, the information collecting unit 220 confirms whether the collected traffic is an HTTP request (S114).

If the collected traffic is not an HTTP request, the information collecting unit 220 confirms whether the content (data type) is a file capable of receiving (S115). In other words, if the collected traffic is an HTTP response, the information collecting unit 220 stores the corresponding content information in the contents DB 320 if the content type of the HTTP response is an executable file. The content information includes a source IP address, a destination IP address, a URL, a time, a content, and a destination port.

In step S114, if the collected traffic is an HTTP request, the information collecting unit 220 determines whether the HTTP request method is a GET request (S124).

If the HTTP request method is a GET request, the information collecting unit 220 checks whether previous visit information exists (S125).

If the previous visit information exists, the information collecting unit 220 stores the traffic information including the previous visit information in the traffic DB 330 (S126). At this time, the information collection unit 220 stores the previous visit URL, the source address, the destination address, the source port (session information), and the time information in the traffic DB 330.

If the previous visited place information does not exist in the step S125, the information collecting unit 220 stores the traffic information in the traffic DB 330 (S127). Here, the traffic information includes a host (HOST), a GET URL, a source address, a destination address, a source port, and a time.

If the session is not terminated in step S102, the information collecting unit 220 confirms whether the content received in the destination port stored in the session DB 310 exists in the content DB 320 (S133).

The information collecting unit 220 collects the contents stored in the contents DB 320 and the contents of the traffic DB 330 together with the destination port number of the session DB 310, And stores information and traffic information in the result DB 340 (S134).

If there is no content received at the destination port stored in the session DB 310, the information collecting unit 220 stores the session DB 310, the content DB 320, The information stored in the DB 330 is deleted (S135).

4 is a flowchart illustrating a process of collecting traffic information in a non-session mode according to another embodiment of the present invention.

4, the information collecting unit 220 of the analysis server 200 receives the collected traffic transmitted from the traffic collecting apparatus 100 through the communication unit 210. [ At this time, the information collecting unit 220 confirms whether the received collected traffic is TCP traffic or HTTP traffic (S201).

If the collected traffic is a TCP traffic or an HTTP traffic, the information collecting unit 220 determines whether the collected traffic is an HTTP request (S202).

If the collected traffic is not an HTTP request, the information collecting unit 220 determines whether the content type of the collected traffic is an executable file (S203).

If the content type is an executable file (executable file), the information collection unit 220 stores information about the content in the content DB 320 (S204). At this time, the information collection unit 220 stores the source address, the destination address, the URL, the time, the content, and the destination port in the content DB 320 as content information.

In other words, the information collecting unit 220 collects the source address, destination time, time, URL, and file information if the content type of the HTTP response traffic is an executable file.

When inserting the content information into the content DB 320, the information collecting unit 220 stores the data of the content DB 320 and the traffic DB 330 in the result DB 340 (S205).

The information collecting unit 220 initializes the contents DB 320 and the traffic DB 330 when the collected information (data) in the contents DB 320 and the traffic DB 330 elapses (S206).

If the collected traffic is HTTP request traffic in step S202, the information collecting unit 220 determines whether the HTTP request method is a GET request (S213).

If the HTTP request method is a GET request, the information collection unit 220 checks whether previous visit information exists in the collected traffic (S214).

If the previous visit information exists, the information collecting unit 220 stores the collected traffic information including the previous visit information in the traffic DB 330 (S215). At this time, the information about the collected traffic includes a previous destination address, a source address, a destination address, a source port, and a time.

Meanwhile, if there is no previous visited information in the collected traffic in step S214, the information collecting unit 220 stores information on the collected traffic in the traffic DB 330 (S215). The traffic information includes the host, the GET URL (the address from which the content was downloaded), the source address, the destination address, the source port, and the time.

5 is a flowchart illustrating a malicious URL detection method through traffic analysis related to the present invention.

Referring to FIG. 5, the check target sorting unit 230 checks whether new result data exists in the result DB 340 (S301).

The check target sorting unit 230 confirms whether the content type of the new result data is an execution file (S302). That is, the check target sorting unit 230 confirms whether the new result data is an EXE file or a DLL file.

If the content type of the new result data is an execution file, the check target sorting unit 230 obtains the time information of the new result data collected in the result DB 340 (S303).

The check target sorting unit 230 sets a URL existing in the traffic collected within the check period as the check target list based on the acquisition time information (S304). The check target sorting unit 230 searches the result DB 340 for a URL included in the traffic transmitted within the check period from the same session or source address as the new result data and sets the search target.

The inspection target sorting unit 230 delivers the set inspection target list to the inspection unit 240, and the inspection unit 240 checks whether the malicious code is distributed to the URL included in the inspection target list (S305).

100: Traffic collecting device
200: Analysis server
210:
220: Information collecting section
230: check target sorting unit
240:
300: Database

Claims (7)

Collecting all traffic transmitted and received between the external network and the internal network,
Extracting session information, content information, and traffic information for the traffic through analysis of the collected traffic;
Confirming whether or not the content information exists;
Acquiring time information in which the content information is collected if the content information exists;
Extracting a web address (hereinafter referred to as URL) from content information and traffic information of traffic collected in the inspection period based on the collected time information, and setting the URL as a check target;
Checking URLs set as objects to be checked and determining whether the URLs are malicious,
In the information extracting step,
Confirming whether the collected traffic is a transmission control protocol (hereinafter referred to as TCP) traffic or a hypertext transmission protocol (hereinafter referred to as HTTP) traffic;
If the collected traffic is a TCP traffic or an HTTP traffic, checking the session state and extracting the session information, the content information, and the traffic information from the corresponding traffic through a traffic analysis if the session is not terminated;
And checking whether content information transmitted through the terminated session exists if the session state is the end of the session. delete The information processing method according to claim 1,
And storing the collected content information and traffic information together with the destination port information of the session information if the content information transmitted through the corresponding session is present. The method of claim 1,
And extracting from the HTTP request traffic generated for the first time after the session is formed. The information processing apparatus according to claim 1,
Wherein the HTTP response traffic of the collected traffic and the content type of the traffic are extracted from traffic that is an executable file. 2. The method of claim 1,
And the HTTP request method of the collected traffic is HTTP request information extracted from traffic that is a get (GET) request. A traffic collecting device for collecting all traffic transmitted and received between the external network and the internal network,
And an analysis server for analyzing the collected traffic and selecting and checking a web address (hereinafter, URL) suspected of maliciousness,
The analysis server,
A communication unit for receiving the collected traffic transmitted from the traffic collection device;
An information collecting unit for collecting session information, content information and traffic information from the collected traffic;
(Hereinafter referred to as " URL ") existing in the traffic collected in the inspection period on the basis of the collected time information when the content information exists, A check target sorting unit to be set as a check target,
And an inspection unit for checking the URL set as the inspection object and judging whether the URL is malicious or not,
The information collecting unit,
Checks whether the collected traffic is a transmission control protocol (hereinafter referred to as TCP) traffic or a hypertext transmission protocol (hereinafter referred to as HTTP) traffic,
If the collected traffic is a TCP traffic or an HTTP traffic, the session state is checked. If the collected traffic is not a session end, the session information, the content information, and the traffic information are extracted from the corresponding traffic through traffic analysis,
If the session state is a session end, checking whether content information transmitted through a session that has been terminated exists.

Images