KR101464367B1 - Apparatus and method for detecting local network attacks - Google Patents

Abstract

A session log collecting unit for collecting session information generated between internal network communication devices and external network communication devices as a detection device for detecting an internal network attack by an external network communication device, An analysis unit for extracting a detection target session generated in each analysis unit time based on the session information collected in a unit time and managing a detection target session generated for each analysis unit time, And a determination unit for accumulating the generation frequencies of the detection target sessions and detecting the command control channel among the detection target sessions based on the generation frequency of each detection target session.

Description

[0001] APPARATUS AND METHOD FOR DETECTING LOCAL NETWORK ATTACKS [0002]

The present invention relates to an internal network attack detection apparatus and method.

Recently, various target attacks such as denial of service attack, personal information hacking, financial institution hacking, and cyber terror have been increasing from the distributed denial of service attack. There are many subjects and attack methods that perform such attacks, but there is a common point that attacks outside the attack target network and inside the attack target network are connected to the command control channel.

Attack through command control channel is in the form of Advanced Persistent attacks. The attacker stays in the target network for several months and performs actions such as gathering information, downloading attack tools, attacking the internal network, destroying the system, and leaking information. Most attacked networks are protected by firewalls and intrusion detection devices, so an attacker can send an initial intrusion path through various methods such as sending mail with attached malicious code, downloading malicious files without knowing the user while surfing the Internet, .

In particular, in recent years, an internal network device infected by an attacker periodically attempts to access an attacker located outside, instead of maintaining a command control channel continuously, thereby generating a command control channel. The infected device periodically connects to an external attacker through various methods such as unregistered protocol communication through regular port, unauthorized port use, and use of external cloud service to avoid detection of internal network security administrator.

So far, the internal network attack detection apparatus detects the command control channel based on the technical characteristics of the command control channel. That is, the internal network attack detection apparatus detects the command control channel using known information such as a specific signature or a malicious Internet address. However, since this detection method detects already known malicious behavior, it is difficult to detect an attacker using the command control channel of the new technique only in detecting a low-level attacker that simulates an already used attack method. Therefore, a new detection method capable of coping with recent attack methods is required.

An object of the present invention is to provide an internal network attack detection apparatus and method for monitoring sessions generated between an internal network and an external network at every unit time and detecting a command control channel based on the generation frequency of each session .

A detection apparatus for detecting an internal network attack by an external network communication apparatus according to an embodiment of the present invention includes a session log collection unit for collecting session information generated between internal network communication apparatuses and external network communication apparatuses, An analysis unit for setting a unit time, extracting a detection target session generated at each analysis unit time based on the session information collected at each analysis unit time, managing a detection target session generated for each analysis unit time, And a determination unit for accumulating the generation frequencies of the detection target sessions during the detection time configured to detect the command control channel among the detection target sessions based on the generation frequency of each detection target session.

The determination unit may set the reference frequency based on the number of analysis unit time included in the detection time, and may detect the detection target session having the generation frequency equal to or greater than the reference frequency as an instruction control channel.

The analyzer may identify the session based on the source information and the destination information included in the session information, and manage the identified session as a detection target session.

The analyzing unit may determine the detection target session by filtering the session identified based on the session information.

The determination unit may increase the frequency of generation of the first detection target session when the first detection target session is generated in the first analysis unit time.

Wherein the determination unit detects the first detection target session as a command control channel when the first detection target session is continuously generated in a predetermined number or more of consecutive analysis unit times based on the generation frequency of the first detection target session can do.

The determination unit may configure the detection time as the analysis unit time corresponding to the activity time of the internal network communication device.

The determination unit may detect an external network communication apparatus transmitting an internal network attack command based on the session information of the command control channel.

A method for detecting an internal network attack by an external network communication apparatus, the method comprising: collecting session information generated between internal network communication apparatuses and external network communication apparatuses according to another embodiment of the present invention Determining a session to be detected by specifying a session to a source and a destination, determining whether each session to be detected is periodically generated, and detecting a command-control channel of a periodically generated session to be detected.

The step of detecting the command control channel may determine whether each detection target session is periodically generated based on whether or not each detection target session is created during each analysis unit time.

The step of detecting the command control channel includes the steps of setting an analysis unit time, extracting a detection target session generated in each analysis unit time based on the session information collected in each analysis unit time, Accumulating the generation frequency of each detection target session during the detection time, and extracting the command control channel from the detection target sessions based on the generation frequency of each detection target session.

The step of extracting the command control channel may include setting a reference frequency based on the number of analysis unit time included in the detection time and extracting a detection target session having the generation frequency equal to or greater than the reference frequency as an instruction control channel.

The internal network attack detection method may further include updating the analysis unit time based on the generation frequency of each detection target session.

The step of determining a session to be detected may identify a session based on the source information and the destination information included in the session information, and manage the identified session as a session to be detected.

The step of extracting the command control channel may detect the first detection target session as a command control channel when the first detection target session is continuously generated in a predetermined number of consecutive analysis unit times.

According to the embodiment of the present invention, it is possible to detect various types of internal network attacks because it detects a command control channel that must be generated for an internal network attack, on the basis of a session, from a method of detecting an attacker based on known information . According to the embodiment of the present invention, it is possible to effectively cope with an internal network attack pattern that is gradually and gradually evolving. According to the embodiment of the present invention, since it is possible to detect a modified attack or encrypted traffic, it is possible to detect an internal network attack without depending on a communication protocol.

FIG. 1 is a view for schematically explaining a network related to an internal network attack according to an embodiment of the present invention.
2 is a block diagram of a detection apparatus according to an embodiment of the present invention.
3 is a flowchart of an internal network attack detection method according to an embodiment of the present invention.
4 is a flowchart of an internal network attack detection method according to another embodiment of the present invention.
5 is a flowchart of an internal network attack detection method according to another embodiment of the present invention.
6 is an illustration of an analysis screen according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

An internal network attack detection apparatus and method according to an embodiment of the present invention will now be described with reference to the drawings.

FIG. 1 is a view for schematically explaining a network related to an internal network attack according to an embodiment of the present invention.

Referring to FIG. 1, the communication network includes a network device 10, an internal network 20, an external network 30, and an internal network attack detection device (hereinafter referred to as a "detection device ") 100. The network device 10 is a gateway to the internal network 20 and separates the internal network 20 and the external network 30. [ The network device 10 may be a gateway, a switch, or the like. The detection device 100 is located between the inner network 20 and the outer network 30. The detection device 100 may be implemented in the network device 10, or may be implemented separately from the network device 10.

The attacker apparatus 200 is located in the external network 30. [ The internal network 20 includes a plurality of communication devices 300, 400, 500, and 600.

The network device 10 is prevented from directly connecting from the outside to the internal assets through a firewall or the like. Accordingly, the attacker apparatus 200 accesses the internal network 20 in various ways, thereby making the communication apparatus of the internal network 20 an attack performing apparatus. For example, the attacker device 200 can infect internal network communication devices through various methods such as sending mail with a malicious code attached thereto, downloading a malicious file without knowing the user while surfing the Internet, and attacking a computer resource of an installed program provider. The infected device is an attack performing device that periodically connects with the attacker device 200 to receive an instruction and perform an operation according to the instruction. Here, the attack performing device may be the communication device 300-600.

The attack execution device 300-600 periodically accesses the attacker device 200. [ Then, a command control channel is generated between each attack performing device 300-600 and the attacker device 200. [

The attacker device 200 transmits the command to each of the attack performing devices 300-600 through the command control channel and receives the information. The connection period may be a period during which the attacker can deliver the command. If the command cycle is sparse and the command control channel is sparsely generated, it may be difficult for the network device 10 or the detection device 100 to find the command control channel, but this may cause the attacker to delay command delivery time . Therefore, most attacker devices shorten the connection period. For example, an attacking device may connect to an attacker device several times a minute. Also, if the command control channel is maintained for a long time, the attacker apparatus can take a lot of information at a time, but the detection apparatus 100 can easily detect it. Therefore, most attacker devices instruct the attacking device to connect periodically for a certain period while keeping the command control channel short.

As described above, the attack execution device 300-600 is a communication device connected to the internal network and connects to the attacker device 200 of the external network, such as connecting to the normal server. Thus, existing methods for detecting command control channels using information such as specific signatures or known malicious Internet addresses are difficult to detect command control channels that are continuously generated for a period of time while keeping the session short. In addition, since the existing method detects an indication that malicious activity occurs at a certain point in time, it is difficult to detect an attack to be carried out for a long period of time. To solve this problem, the detection apparatus 100 detects the command control channel by analyzing the session information that must be generated to connect the command control channel.

The detection apparatus 100 monitors sessions generated between the internal network 20 and the external network 30. [ The detection apparatus 100 collects session information generated for each communication apparatus in the internal network. The session information is various communication logs related to the session, including the source information of the session, the destination information, the traffic information, and the like.

The detection apparatus 100 can allocate session identification information for each session. Sessions can be distinguished by source and destination. Specifically, the session can be divided into a source address (IP), a source port, a destination address, a destination port, and time information.

The detection apparatus 100 determines whether a session corresponding to each session identification information is generated at least once for each analysis unit time. When the session corresponding to the session identification information is continuously found for each analysis unit time, the detection apparatus 100 determines the session as a command control channel.

2 is a block diagram of a detection apparatus according to an embodiment of the present invention.

Referring to FIG. 2, the detection apparatus 100 includes a session log collection unit 110, an analysis unit 130, and a determination unit 150.

The session log collecting unit 110 collects session information generated between the internal network communication device and the external network communication device. The session information includes the source information of the session and the destination information, the source is the internal network communication device, and the destination is the external network communication device. The session information may include information as shown in Table 1.

Session Information Explanation ts Time of connection occurrence uid Identification value id.orig_h Source address (IP) (string) id.orig_p Source port number id.resp_h Destination Address (IP) value (string) id.resp_p Destination port number proto Protocol type of transport layer (tcp / udp / icmp etc.) service The protocol type of the application layer duration Time difference between connection type and reconnection orig_bytes Number of payload bytes sent from origin resp_bytes The number of payload bytes sent from the destination conn_state TCP connection status codes local_orig T if connection was done locally, F if not missed_bytes Packets lost bytes history List history of connection status orig_pkts Number of packets sent from origin orig_ip_bytes The total number of bytes including the IP header sent from the origin resp_pkts Number of packets sent from destination resp_ip_bytes The total number of bytes, including the IP header sent from the destination. tunnel_parents Tunnel inner connection uid

The analysis unit 130 sets the analysis unit time. The analysis unit time can be set and changed based on the connection characteristics of the attacking device continuously connected. If the analysis unit time is shorter than the connection period of the attacker apparatus, the session corresponding to the command control channel may not be found at a certain analysis unit time even though the attacker apparatus periodically attacks. Accordingly, the analysis unit 130 sets the analysis unit time so as to detect the command control channel generated periodically. For example, the analysis unit time may be set to a time sufficiently longer than the connection period, for example, 30 minutes or 1 hour.

The analysis unit 130 analyzes the session information for each analysis unit time.

The analysis unit 130 generates a session list generated at each analysis unit time based on the session information collected at each analysis unit time. The analysis unit 130 generates a meta log including analysis unit time stamp, source information, destination information, and the like to normalize each session. At this time, since it is important for the analysis unit 130 to detect whether or not a session is created, a duplicated session can be removed.

The analysis unit 130 determines a session to be detected by identifying a session to a source and a destination. To this end, the analysis unit 130 may allocate session identification information to the detection target session. At this time, the analyzer 130 excludes the session having a low possibility of the command control channel from the detection target session based on the session information. For example, if the verified server is a destination, the analysis unit 130 does not assign session identification information to the session including the corresponding destination. That is, the analyzer 130 does not need to monitor sessions with low command control channel possibilities. The analysis unit 130 may allocate session identification information as shown in Table 2. The communication device 300 generates a session corresponding to the session identification information S1 and the communication device 400 generates a session corresponding to the session identification information S2 and S3 and the communication device 500 generates a session corresponding to the session identification information S5 , And the communication apparatus 600 creates a session corresponding to the session identification information S4.

Session identification information From address Destination address S1 192.168.1.245  74.125.128.101 S2 192.168.1.241  17.172.232.158 S3 192.168.1.241  157.56.141.102 S4 192.168.1.115 17.83.253.7 S5 192.168.1.222  74.125.128.139

The analyzer 130 checks whether each detection target session is generated during each analysis unit time. The analysis unit 130 determines that the session is generated even once even during the analysis unit time, that is, "generated ". For example, when the analysis unit time is one hour, the analysis unit 130 manages the generation of each detection target session by the analysis unit time as shown in Table 3. The analyzer 130 can accumulate and manage the number of times the session is generated during the analysis unit time in addition to the "generated" or the "not generated ".

Session identification information 2013-6-25
12:00 2013-6-25
13:00 2013-6-25
14:00 2013-6-25
15:00 2013-6-25
16:00 2013-6-25
17:00 S1 produce produce produce produce produce produce S2 produce produce produce produce produce produce S3 produce produce produce produce produce produce S4 produce Not generated Not generated Not generated produce Not generated S5 produce produce produce produce produce produce

The determination unit 150 detects the command control channel based on the generation information of each detection target session during the detection time composed of the analysis unit times. The generation information may be a generation frequency, a generation frequency rate, a generation pattern, and the like.

The determination unit 150 analyzes the generation frequency during the detection time as shown in Table 4. The detection time is the time from the first analysis unit time at which the session was created to the analysis time. For example, the communication device 300 corresponding to the session identification information S1 first accesses the destination device 72 analysis units before the analysis time. And the communication device 300 corresponding to the session identification information S1 has connected to the destination device more than once every analysis unit time. The communication device 600 corresponding to the session identification information S4 first accesses the external network communication device corresponding to the destination address 71 seconds before the analysis time from the analysis time. And the communication device 600 corresponding to the session identification information S4 connects to the destination device only for 10 analysis unit hours for 71 analysis unit hours.

Session identification information Detection time
(Unit: Analysis unit time) Generation frequency
(Unit: number of times) Frequency rate
(unit: %) S1 72 72 100 S2 71 71 100 S3 71 71 100 S4 71 10 14 S5 30 30 100

The determination unit 150 may determine an activity time at which the internal network communication device can create a session as the detection time. That is, the internal network communication device can not create a session at a pause time such as a power-off time. Therefore, the analyzer 130 can exclude the idle time of each internal network communication device from the detection time. For example, the communication device 500 corresponding to the session identification information S5 initially accesses the destination device 72 analysis units before the analysis time. However, the communication device 500 corresponding to the session identification information S5 was idle for 42 analysis unit hours. Then, the analysis unit 130 changes the detection time of the session identification information S5 to 30 analysis unit time. For this, the analysis unit 130 monitors the pause time of each internal network communication device. The analyzer 130 may monitor whether each internal network communication device transmits or receives a packet to determine whether it is idle time or active time.

The determination unit 150 detects the command control channel based on the generation frequency of each session identification information during the detection time. The command control channel is periodically generated for a certain period of time. Accordingly, the determination unit 150 can determine a session generated over the reference frequency as the command control channel during the detection time. Alternatively, the determination unit 150 may determine a session whose frequency rate is equal to or greater than the reference frequency rate as an instruction control channel. For example, in the detection target sessions S1, S2, S3, and S5, the determination unit 150 detects the target sessions S1, S2, S3, and S5 as the command control channel . The determination unit 150 determines the destination addresses of the detection target sessions S1, S2, S3, and S5 as the addresses of the attacker apparatuses. The determination unit 150 determines the source address of the detection target sessions S1, S2, S3, and S5 as the address of the attack execution device, that is, the infection device.

The determination unit 150 may filter the remaining sessions based on the session information detected by the command control channel. For example, the determination unit 150 may determine a session including a destination address determined as an address of the attacker apparatus as an instruction control channel.

The determination unit 150 may detect the command control channel based on the standard deviation related to the generation frequency of each session identification information. If a session is steadily generated during the detection time, the standard deviation of this session has a value close to zero. Therefore, the determination unit 150 can determine a session whose standard deviation is close to 0 as the command control channel.

3 is a flowchart of an internal network attack detection method according to an embodiment of the present invention.

Referring to FIG. 3, the detection apparatus 100 collects session information generated between the internal network communication apparatus and the external network communication apparatus (S110).

The detection apparatus 100 determines a session to be detected by specifying a session to a source and a destination (S120). The detection apparatus 100 can exclude a session with a low possibility of command control channel from the detection target session based on the session information.

The detection apparatus 100 confirms whether each detection target session is created during each analysis unit time (S130). The detection apparatus 100 judges that it is "generated" when the detection target session is created even once during the analysis unit time.

The detection apparatus 100 analyzes the generation frequency during the detection time for each session to be detected (S140). The detection time is the time from the first analysis unit time that the detection target session was created to the analysis time. At this time, the detection apparatus 100 can set the detection time to the time excluding the pause time of each internal network communication apparatus from the initial analysis unit time from the generation of the detection target session to the analysis time.

The detection apparatus 100 detects the command control channel among the detection target sessions based on the generation frequency (S150). The detection apparatus 100 may determine a session that is generated over the reference frequency during the detection time or a session whose frequency rate is equal to or higher than the reference frequency rate as the command control channel.

4 is a flowchart of an internal network attack detection method according to another embodiment of the present invention.

Referring to FIG. 4, the detection apparatus 100 collects session information collected during an analysis unit time in a log bucket (S210). A log bucket is a unit of storage that stores a log of analysis units per hour.

The detection apparatus 100 creates a session list generated in the analysis unit time (N = n) based on the session information contained in the log bucket (N = n) (S220).

The detection apparatus 100 determines a detection target session based on the session list (S230). The detection target session may be a session found from the previous analysis unit time, or may be the session that was first generated at the current analysis unit time.

The detection apparatus 100 increases the generation frequency of each detection target session (S240).

The detection apparatus 100 proceeds to the next analysis unit time (N = n + 1) (S250). The detection apparatus 100 creates a session list generated in the analysis unit time (N = n + 1) based on the session information contained in the next log bucket (N = n + 1).

As a result, the generation frequency of each session to be detected increases over time. Then, the detection apparatus 100 detects the command control channel based on the generation frequency of each detection target session.

5 is a flowchart of an internal network attack detection method according to another embodiment of the present invention.

Referring to FIG. 5, the detection apparatus 100 sets an analysis unit time (S310).

The detection apparatus 100 accumulates the number of analysis unit hours in which the detection target session is generated for each detection target session (S320).

The detection apparatus 100 updates the analysis unit time based on the accumulated analysis unit time count for each session to be detected (S330). The detection apparatus 100 can not know the connection period of the command control channel. Therefore, if the analysis unit time is shorter than the connection period, the session to be detected may appear to be sparse. Thus, the detection apparatus 100 can increase the analysis unit time based on the number of analysis unit hours accumulated during the detection time. Or the analysis unit time is too long relative to the connection period, the detection apparatus 100 may take a long time to detect the command control channel. Thus, the detection apparatus 100 may calculate the detection time based on the number of analysis unit hours accumulated during the detection time The analysis unit time can be reduced.

The attacker device must communicate with the target device to control the target device of the internal network. The connection cycle and attack precision are in a trade-off relationship. Therefore, the attacker device must periodically communicate with the target device of the internal network in order to maintain a certain level of precision. The attacker device can enhance the concealment and take the connection cycle at random or longer. Even in this case, the detection apparatus 100 can increase the analysis unit time and grasp the continuous connection.

6 is an illustration of an analysis screen according to an embodiment of the present invention.

Referring to FIG. 6, the detection apparatus 100 provides a screen 50 showing whether a detection target session is generated every time when the analysis unit time is one hour.

The user can see through the screen 50 that the device with the source address of 192.168.1.245 accesses the device with the destination address of 74.125.128.101 every three days throughout the day.

As described above, according to the embodiment of the present invention, since the command control channel which must be generated for the internal network attack is detected based on the session based on the detection of the attacker on the basis of known information, can do. According to the embodiment of the present invention, it is possible to effectively cope with an internal network attack pattern that is gradually and gradually evolving. According to the embodiment of the present invention, since it is possible to detect a modified attack or encrypted traffic, it is possible to detect an internal network attack without depending on a communication protocol.

The embodiments of the present invention described above are not implemented only by the apparatus and method, but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

Claims (15)

A detection device for detecting an internal network attack by an external network communication device,
A session log collecting unit for collecting session information generated between internal network communication devices and external network communication devices,
An analyzing unit for setting an analysis unit time, extracting a detection target session generated at each analysis unit time based on session information collected at each analysis unit time, and managing a detection target session generated for each analysis unit time, and
And a determination unit for accumulating the generation frequencies of the detection target sessions during the detection time composed of the analysis unit times and detecting the command control channel among the detection target sessions based on the generation frequency of each detection target session,
Wherein the determination unit increases the generation frequency of the random detection target session when at least one random detection target session is generated in a random analysis unit time. The method of claim 1,
The determination unit
A reference frequency is set based on the number of analysis unit time included in the detection time, and a detection target session whose creation frequency is equal to or higher than the reference frequency is detected as an instruction control channel. The method of claim 1,
The analyzer
An internal network attack detection device for identifying a session based on the source information and the destination information included in the session information, and managing the identified session as a detection target session. The method of claim 1,
The analyzer
And determines the session to be detected by filtering the session identified based on the session information. The method of claim 1,
The determination unit
And if the first detection target session is generated in the first analysis unit time, increases the generation frequency of the first detection target session. The method of claim 5,
The determination unit
The method of claim 1, wherein if the first detection target session is continuously generated in a predetermined number or more of consecutive analysis unit times based on the generation frequency of the first detection target session, Attack detection device. The method of claim 1,
The determination unit
An internal network attack detection device that configures a detection time with the analysis unit time corresponding to the activity time of the internal network communication device. The method of claim 1,
The determination unit
And detecting an external network communication device transmitting an internal network attack command based on session information of the command control channel. A method for detecting an internal network attack by an external network communication apparatus,
Collecting session information generated between internal network communication devices and external network communication devices,
Determining a session to be detected by specifying a session as a source and a destination, and
Determining whether each session to be detected is periodically generated, and detecting an instruction control channel among the sessions to be detected,
The step of detecting the command control channel
Determining whether each detection target session is periodically generated based on whether each detection target session is created during each analysis unit time, and detecting a periodically generated detection target session with an instruction control channel. delete The method of claim 9,
The step of detecting the command control channel
Setting an analysis unit time,
Extracting a detection target session generated in each analysis unit time based on the session information collected in each analysis unit time,
Accumulating the generation frequency of each detection target session during the detection time composed of the analysis unit times, and
Extracting an instruction control channel from the detection target sessions based on the generation frequency of each detection target session
And detecting an internal network attack. 12. The method of claim 11,
The step of extracting the command control channel
And setting a reference frequency based on the number of analysis unit time included in the detection time and extracting a detection target session having a generation frequency equal to or higher than the reference frequency as an instruction control channel. 12. The method of claim 11,
Updating the analysis unit time based on the generation frequency of each detection target session
Further comprising detecting an internal network attack. The method of claim 9,
The step of determining the session to be detected
A method for detecting an internal network attack in which a session is identified based on source information and destination information included in the session information, and the identified session is managed as a detection target session. The method of claim 9,
The step of detecting the command control channel
And detecting the first detection target session as a command control channel when the first detection target session is continuously generated in a predetermined number of consecutive analysis unit times.

Images