KR101518852B1 - Security system including ips device and ids device and operating method thereof - Google Patents

Abstract

According to an embodiment of the present invention, a security system includes: an intrusion prevention system (IPS) device including a first database storing a first signature group; and an intrusion detection system (IDS) device including a second database storing a second signature group. The IPS device includes: a first security unit which determines whether a packet is malicious or not according to signatures of the first signature group and blocks the packet based on the results of determination; a load sensing unit that detects a load signature, which causes overload on the first security unit, among the signatures of the first signature group by using a threshold value; and a first data base managing unit formed to eliminate the load signature from the first signature group. The IDS device updates the second signature group by adding the load signature into the second signature group and executes security inspection according to the updated second signature group.

Description

TECHNICAL FIELD [0001] The present invention relates to a security system including an IPS device and an IDS device, and a security system including the IPS device and the IDS device.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an electronic device, and more particularly, to a security system including an IPS device and an IDS device and a method of operating the same.

Web services have exploded with the development of Internet network technology, making it the infrastructure of information that nearly everyone using the Internet searches and collects information through Web services. However, due to this widespread use, Web services are becoming a major path for most attacks, such as viruses, malware, and vulnerability attacks. In particular, most viruses, malware, and vulnerability attacks spread through a particular category of sites. For example, viruses, malware and vulnerability attacks can spread through gambling, adult sites, etc., which stimulate people's curiosity.

Various security devices are being provided to cope with attacks through such a network. Various security devices such as IDS (Intrusion Detection System) device, IPS (Intrusion Protection System) device, and Unified Threat Management (UTM) providing integration function can be used according to characteristics of each point on the network.

An IDS (Intrusion Detection System) device performs attack detection without affecting actual traffic. The IDS device has a database for storing signatures, and compares packets with each of the signatures upon packet entry to detect attacks. An IDS device primarily targets a copy of a packet, and therefore does not affect actual traffic. Regardless of the time it takes for the IDS device to detect the attack, the packets on the traffic are delivered immediately, and thus no service delays occur. However, the IDS device has a problem that if an attack is detected, the packet can not be blocked and passed.

The IPS (Intrusion Protection System) device detects the attack and actually blocks the packet according to the detection result. The IPS device has a database that stores signatures, and compares the packets and signatures to detect attacks. The IPS device detects an attack based on the original of the received packet, and blocks the packet when it is determined that the attack is an actual attack. Until the pattern matching for detecting the attack is completed, the packet is held in the IPS device and is sent only after pattern matching is completed. Therefore, IPS devices are vulnerable to signatures that cause excessive load in comparing packets and signatures.

On the other hand, when a plurality of signatures are mounted on the IDS device or the IPS device, the plurality of signatures must be compared with the packets, so that the time required for the security check may be long. In addition, when each signature provided to the IDS device or the IPS device is described inefficiently with respect to the packet (for example, when the pattern includes a character string that is long enough to be used for pattern matching), each signature is compared with the packet The time required can be long. For example, a single signature may cause an overload in pattern matching with a packet, causing an overload in the IDS device and an IPS device, and delaying the time required.

Ultimately, the performance of the IDS device and the IPS device depends on the number of signatures mounted on it and the degree of optimization of each of the mounted signatures.

It is an object of the present invention to improve the operation speed of a security system including an IDS device and an IPS device.

A security system according to an embodiment of the present invention includes an Intrusion Protection System (IPS) device including a first database for storing a first signature group; And an IDS (Intrusion Detection System) device including a second database for storing a second signature group. The IPS device includes a first security unit configured to determine whether a packet is malicious according to the signatures of the first signature group and to block the packet according to the determination result; A load detection unit configured to detect a load signature that causes an overload in the first security unit of the signatures of the first signature group using a threshold value; And a first database management unit configured to exclude the load signature from the first signature group. The IDS device updates the second signature group so that the load signature is included in the second signature group, and performs the security check according to the updated second signature group.

In an embodiment, the IPS device further comprises a transmission unit configured to transmit the packet externally under the control of the first security unit, wherein the first security unit blocks the packet when the packet is malicious , And may transmit the packet to the outside through the transmission unit when the packet is not malicious.

As an embodiment, the load sensing unit may check the time required to determine whether the packet is malicious using each of the signatures of the first signature group, and if the required time is longer than the threshold, Can be detected as a load signature.

As an embodiment, the load sensing unit may check the time required to determine whether the packet is malicious using each of the signatures of the first signature group, and if the required time is longer than the reference value, Value can be increased.

In an embodiment, the load sensing unit may detect the signature as the load signature when the count value is greater than the threshold value.

As an embodiment, the first security unit may determine whether the second packet received after the packet is malicious according to the signatures of the first signature group excluding the load signature, Packets can be blocked.

In an embodiment, the IPS device further comprises a copying unit configured to copy the packet, and the copying unit may be transmitted to the IDS device.

In an embodiment, the IDS device comprises: a second database management unit configured to include the load signature in the second signature group to update the second signature group; And a second security unit configured to perform a security check according to the signatures of the updated second signature group.

Another aspect of the present invention relates to a method of operating a security system for managing a host connected to a network. The system includes an IDS (Intrusion Detection System) device including an Intrusion Prevention System (IPS) device including a first database storing a first signature group, and a second database storing a second signature group do. The method of operating a security system according to an exemplary embodiment of the present invention is characterized in that the IPS device determines whether a packet is malicious according to the signatures of the first signature group and blocks or blocks the packet according to the determination result ; Detecting, using a threshold value, a load signature that causes an overload in the determination of the signatures of the first signature group; And updating the first and second signature groups by excluding the load signature from the first signature group and including the load signature into the second signature group.

In an embodiment, the IDS device may perform a security check according to the signatures of the updated second signature group.

As an embodiment, the IPS device determines whether a second packet received after the packet is malicious according to the signatures of the updated first signature group, and the IDS device determines whether the signature of the updated second signature group The second packet may be checked for security.

As an embodiment, the step of detecting the load signature may comprise the steps of: checking the time required to determine whether the packet is malicious using each of the signatures of the first signature group; And detecting the signature as the load signature when the elapsed time is longer than the threshold value.

In an embodiment, the step of detecting the load signature may include: checking a time required to determine whether the packet is malicious using each of the signatures of the first signature group; Increasing the count value corresponding to the signature when the required time is longer than the reference value; And detecting the signature as the load signature when the count value is greater than the threshold value.

The operation speed of the security system including the IDS device and the IPS device is improved according to the embodiment of the present invention.

1 is a conceptual diagram showing a network system.
2 is a block diagram illustrating the security system of FIG.
3 is a flowchart showing a signature management method of the security system.
4 is a flowchart showing an operation method of the first security unit of FIG.
5 is a flowchart showing an operation method of the load sensing unit of FIG.
6 is a flowchart showing an operation method of the second database management unit of FIG.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and how to accomplish it, will be described with reference to the embodiments described in detail below with reference to the accompanying drawings. However, the present invention is not limited to the embodiments described herein but may be embodied in other forms. The embodiments are provided so that those skilled in the art can easily carry out the technical idea of the present invention to those skilled in the art.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "indirectly connected" . Throughout the specification, when an element is referred to as "comprising ", it means that it can include other elements as well, without excluding other elements unless specifically stated otherwise.

1 is a conceptual diagram showing a network system 10.

Referring to FIG. 1, a network system 10 includes a first host 110, a security system 120, a network 130, and a second host 140.

The first host 110 is connected to the second host 140 via the network 130 via the security system 120. [ The first host 110 may provide or receive various services by exchanging data packets with the second host 140. The first host 110 may provide or receive a web page while exchanging packets with the second host 140. Also, the first host 110 may provide or receive an application while exchanging packets with the second host 140. For example, the first host 110 installs an application provided from the second host 140, and communicates with the second host 140 as an installed application to receive content such as music and moving images. In addition, an installed application can communicate with the second host 140 to receive services such as animation and games.

The second host 140 is connected to the first host 110 through the security device 140 through the network 130 and can receive or provide various web services while communicating packets with the first host 110 have.

The security system 120 is configured to process packets communicated between the first host 110 and the second host 140. The security system 120 may monitor packets flowing into the first host 110 and may permit, block, or hold the packets according to the result. The security system 120 may monitor packets transmitted from the first host 110 to the network 120 and may permit, block, or hold the packets according to the result.

2 is a block diagram illustrating the security system 120 of FIG.

The security system 120 includes a receiving unit 121, an Intrusion Protection System (IPS) device, an Intrusion Detection System (IDS) device, and a transmission unit 122.

The receiving unit 121 is configured to receive packets transmitted from the first host 110 to the network 130 and packets transmitted from the network 130 to the first host 110. [ The receiving unit 121 transmits the received packet to the IPS device 200. [

The transmission unit 122 receives the packet from the IPS device 200 and transmits the received packet to the outside. The transmission unit 122 will transmit the packet to the network 130 when the packet is transmitted from the first host 110. [ The transmission unit 122 will send the packet to the first host 110 if the packet is received from the second host 140 over the network 130. [

The IPS device 200 includes a first signature database 210, a first security unit 220, a load sensing unit 230, a first database management unit 240 and a copy unit 250.

The first signature database 210 stores the first signature group SGG1. The signature describes the attack pattern. It is used to determine whether the packet (DP) is consistent with the attack pattern described in the signature when the packet (DP) is input. For example, it may be described as a single character string, or may be described in a plurality of character strings in order to increase the accuracy of detection. Further, the position, interval, etc. between the character strings may be described, and a regular expression (PCRE: Regular Expressions).

The first signature group SGG1 includes first through k-th signatures sg1_1 through sg1_k. The first to k-th signatures sg1_1 to sg1_k are provided to the first security unit 220 and used for security check.

The first security unit 220 is connected to the first signature database 210 and the receiving unit 121. The first security unit 220 receives the packet DP from the receiving unit 121 and receives the first to k-th signatures sg1_1 to sg1_k from the first signature database 210. [

2, the packets DP received via the receiving unit 121 are temporarily stored in a separate storage medium, and such a first security unit 220 removes packets DP Can be received. Such a storage medium may store packets in a first-in first-out (FIFO) manner, for example, and may be a volatile memory having a fast operating speed although the stored data is lost when the power supply is interrupted. For example, the storage medium may be implemented as SRAM (Static RAM), DRAM (Dynamic RAM), SDRAM (Synchronous DRAM), or the like.

The first security unit 220 is configured to determine whether the packet DP is malicious according to the first to k-th signatures sg1_1 to sg1_k, and to block or allow the packet DP according to the determination result. The first security unit 220 performs pattern matching on each of the first to k-th signatures sg1_1 to sg1_k and the packet DP to determine whether the packet DP includes the first to k-th signatures sg1_1 to sg1_k ≪ / RTI >

If the packet DP matches at least one of the first to k-th signatures sg1_1 to sg1_k, the first security unit 220 blocks the packet DP. The first security unit 220 allows the packet DP if the packet DP does not match any of the first through k-th signatures sg1_1 through sg1_k. The first security unit 220 will transmit the packet DP via the transmission unit 122. [

The load sensing unit 230 is connected to the security unit 220. According to the embodiment of the present invention, the load sensing unit 230 detects a load signature that causes an overload in the security check with the packet DP among the first to k-th signatures sg1_1 to sg1_k using the threshold value . As an embodiment, the load sensing unit 230 checks the time required to determine whether the packet DP is malicious according to each signature, and when the required time is longer than the reference value, the count value corresponding to the signature And when the count value is larger than the threshold value, the corresponding signature is detected as the load signature. As an embodiment, the load sensing unit 230 checks the time required to determine whether the packet DP is malicious using each of the first to k-th signatures sg1_1 to sg1_k, Is greater than the threshold value, the corresponding signature is detected as the load signature.

The first database management unit 240 excludes the load signature (e.g., sg1_2) of the first signature group SGG1 according to the detection result of the load detection unit 230. [ Then, the first database management unit 240 transmits information (sgi) about the load signature to the IDS device 300.

As the load signature is excluded from the first signature group SGG1, the first security unit 220 sends the first signature group SGG1 excluding the load signature (e.g., sg1_2) Is used for pattern matching.

The copying unit 250 copies the packet DP and provides the copied packet RDP to the IDS device 300. As a result, the IDS device 300 performs a security check on the packet DP using the copied packet RDP. In Figure 2, the copy unit 250 is shown receiving a packet DP via the first security unit 220. [ The copy unit 250 is shown as receiving the packet DP granted by the first security unit 220 and generating a copy packet RDP. However, it will be understood that the present invention is not limited thereto. For example, the copy packet RDP is connected between the first security unit 220 and the reception unit 121, and copies the packet DP received through the reception unit 121 to generate a copy packet RDP While providing the original packet DP to the first security unit 220. [

The IDS device 300 includes a second signature database 310, a second security unit 320 and a second database management unit 330. The second signature database 310 stores the second signature group SGG2. The signatures sg2_1 to sg2_m of the second signature group SGG2 are provided to the second security unit 320 and used for security check.

The second security unit 320 receives the copy packet RDP from the IPS device 200 and receives the signatures sg2_1 to sg2_m of the second signature group SGG2 from the second signature database 310 . The second security unit 320 performs a security check on the copy packet RDP according to the signatures sg2_1 through sg2_m of the second signature group SGG2. As an embodiment, the second security unit 320 performs pattern matching between each of the signatures sg2_1 through sg2_m and the copy packet RDP, and if the copy packet RDP includes at least one of the signatures sg2_1 through sg2_m Or not. If so, the copy packet (RDP) is malicious. If not, the copy packet (RDP) indicates that it is not malicious.

The second security unit 320 will report the result of the security check to the administrator of the security system 120, for example. Unlike the IPS device 200, even if the IDS device 300 is determined to be malicious, the IDS device 300 can not block the original packet DP because the IDS device 300 receives the copy packet RDP to perform the security check . However, as another aspect, since there is no blocking function for the original packet DP, the IDS device 300 can perform the security check on the various signatures sg2_1 to sg2_m without interfering with the traffic of the original packet DP have.

According to an embodiment of the present invention, the second database management unit 330 receives the information (sgi) about the load signature from the first database management unit 240, and accordingly stores the load signature in the second signature group SGG2 to update the second signature group SGG2. The updated second signature group SGG2 will contain the existing signatures sg2_1 through sg2_m and the load signature.

The second security unit 320 will perform security checks using the signatures (sg2_1 to sg2_m, load signatures) of the updated second signature group SGG2 when the next copy packet is received.

According to an embodiment of the present invention, the load signature is excluded from the signature group SGG1 of the IPS device 200. [ The speed of the security check of the IPS device 200 is improved because the signatures causing the overload are deleted. As a result, the processing speed for the received packet DP of the security system 120 is improved.

Further, according to an embodiment of the present invention, a load signature is included in the signature group SGG2 of the IDS device 300. [ Accordingly, pattern inspection between the missing load signature and the packet DP in the security check of the IPS device 200 can be performed in the IDS device 300, and the result is reported to the manager. Therefore, the security system 120 can maintain the reliability of the security check on the received packet DP.

FIG. 3 is a flowchart showing a signature management method of the security system 120. FIG.

1 to 3, in step S110, a packet DP is received from the first host 110 or from the second host 140.

In step S120, the security system 120 determines whether the packet DP is malicious according to the signatures sg1_1 to sg1_k of the first signature group SGG1 in the IPS device 200. [

In step S130, the security system 120 detects a load signature that causes an overload when determining whether the packet is malicious in step S120. As an embodiment, the security system 120 checks the time required to determine whether the packet DP is malicious by using each of the first to k-th signatures sg1_1 to sg1_k, And when the count value is greater than the threshold value, the signatures are detected as the load signatures. At this time, the threshold value is provided as an element for comparing with the count value. As an embodiment, the security system 120 checks the time required to determine whether the packet DP is malicious using each of the first to k-th signatures sg1_1 to sg1_k, When the signature is longer than the threshold value, the signature is detected as the load signature. At this time, the threshold value is provided as an element for comparing with the required time.

In step S140, the security system 120 excludes the load signature from the first signature group SGG1 and includes the load signature in the second signature group SGG2.

The IPS device 200 and the IDS device 300 operate according to the updated first and second signature groups SGG1 and SGG2, respectively.

4 is a flowchart illustrating an operation method of the first security unit 220 of FIG.

Referring to Figs. 2 and 4, in step S210, the signatures sg1_1 to sg1_k of the first signature group SGG1 and the packet DP are compared with each other. As an example, the first security unit 220 may compare each of the signatures sg1_1 through sg1_k and the packet DP in parallel. As an example, the first security unit 220 may sequentially compare each of the signatures sg1_1 through sg1_k and the packet DP.

In step S220, the first security unit 220 performs step S230 or step S240 depending on whether at least one signature sg1 of the first signature group SGG1 matches the packet DP.

In step S230, the first security unit 220 blocks the packet DP. In step S240, the first security unit 220 transmits the packet DP through the transmission unit 122 to the outside.

5 is a flowchart showing an operation method of the load sensing unit 230 of FIG.

Referring to FIG. 5, in step S310, the load sensing unit 230 checks the time required to compare packets with each of the signatures sg1_1 through sg1_k of the first signature group SGG1. The load sensing unit 230 will monitor the operation of step S210 performed by the first security unit 220 to check the elapsed time.

In step S320, the load sensing unit 230 performs step S330 according to whether there is a time longer than the reference value. For example, the reference value may be set by the administrator of the security system 120 and changed. These reference values may be defined differently depending on the type of signatures, the characteristics of the security system 120, and the characteristics of the network 10. [

In step S330, the load sensing unit 230 increases the count value of the signature sg1 of the first signature group SGG1 corresponding to the elapsed time longer than the reference value. As an embodiment, the load sensing unit 230 stores a count value corresponding to each signature of the first signature group SGG1, and increments the count value of the corresponding signature sg1 each time the step S330 is performed.

In step S340, the load sensing unit 230 determines whether or not the count value of the corresponding signature sg1 is larger than the threshold value. The threshold value is set by the administrator of the security system 120 and can be changed. These thresholds may be defined differently depending on the type of signature, the characteristics of the security system 120, and the characteristics of the network 10. [

In step S350, the load sensing unit 230 detects the corresponding signature sg1 as a load signature. Information on the detected load signature will be transmitted to the IDS device 300 by the first database management unit 240. [ The detected load signature will be removed from the first signature group SGG1 and added to the second signature group SGG2.

According to an embodiment of the present invention, the load signature is excluded from the signature group SGG1 of the IPS device 200. [ The speed of the security check of the IPS device 200 is improved because the signatures causing the overload are deleted.

Further, according to an embodiment of the present invention, a load signature is included in the signature group SGG2 of the IDS device 300. [ Accordingly, a pattern check between the missing load signature and the packet (DP) in the security check of the IPS device 200 can be performed in the IDS device 300.

FIG. 6 is a flowchart showing an operation method of the second database management unit 330 of FIG.

Referring to FIG. 6, in step S410, the second database management unit 330 determines whether the load signature is removed from the first signature group SGG1 and the time included in the second signature group SGG2 elapses after a predetermined time Or not. If so, step S420 is performed.

In step S420, the second database management unit 330 transmits the load signature information (sgi, see FIG. 2) to the first database management unit 240 so as to include the load signature in the first signature group SGG1 do. As an example, at this point, the second database management unit 330 may delete the load signature in the second signature group SGG2. As another example, the second database management unit 330 may keep the load signature in the first signature group SGG1.

According to the present embodiment, by adding the load signature again to the signature group SGG1 of the IPS device 200 after a certain period of time, even if the load signature is deleted from the signature group SGG1 of the IPS device 200, The administrator of the IPS device 200 provides an option to recover the signatures sg1_1 to sg1_k designated as the signature group SGG1 of the IPS device 200. [

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the above-described embodiments, but should be determined by the equivalents of the claims of the present invention as well as the claims of the following.

110: First host
120: Security system
130: Network
140: Second host
200: IPS device
210: first signature database
SGG1: First Signature Group
220: first security unit
230: Load sensing unit 230
240: a first database management unit
300: IDS device
310: second signature database
SGG2: Second Signature Group
320: second security unit
330: second database management unit

Claims (13)

A security system for managing a host connected to a network, comprising:
An Intrusion Protection System (IPS) device including a first database for storing a first signature group; And
And an IDS (Intrusion Detection System) device including a second database storing a second signature group,
The IPS device includes:
A first security unit configured to determine whether a packet is malicious according to the signatures of the first signature group and to block the packet according to a determination result;
A load detection unit configured to detect a load signature that causes an overload in the first security unit of the signatures of the first signature group using a threshold value; And
Further comprising a first database management unit configured to exclude the load signature from the first signature group,
The IDS device includes:
Updating the second signature group to include the load signature in the second signature group, performing a security check according to the updated second signature group,
The load detecting unit checks the time required to determine whether the packet is malicious using each of the signatures of the first signature group, and when the required time is longer than the threshold value, detecting the signature as the load signature Security system. The method according to claim 1,
Wherein the IPS device further comprises a transmission unit configured to transmit the packet to the outside according to a control of the first security unit,
The first security unit blocks the packet when the packet is malicious and transmits the packet to the outside via the transmission unit when the packet is not malicious. delete The method according to claim 1,
The load detection unit checks the time required to determine whether the packet is malicious using each of the signatures of the first signature group and increases the count value corresponding to the signature when the required time is longer than the reference value Security system. 5. The method of claim 4,
And the load detection unit detects the corresponding signature as the load signature when the count value is greater than the threshold value. The method according to claim 1,
The first security unit determines whether the second packet received after the packet is malicious according to the signatures of the first signature group excluding the load signature, and blocks the second packet according to the determination result Security system. The method according to claim 1,
Wherein the IPS device further comprises a copying unit configured to copy the packet,
Wherein the copying unit is transmitted to the IDS device. 8. The method of claim 7,
The IDS device includes:
A second database management unit configured to update the second signature group by including the load signature in the second signature group; And
And a second security unit configured to perform a security check according to the signatures of the updated second signature group. A method of operating a security system for managing a host connected to a network,
The security system includes an IDS (Intrusion Detection System) device including an Intrusion Prevention System (IPS) device including a first database for storing a first signature group and a second database for storing a second signature group However,
The operating method comprises:
Determining whether the packet is malicious according to the signatures of the first signature group in the IPS device, blocking the packet or transmitting the packet to the outside according to the determination result;
Detecting, using a threshold value, a load signature that causes an overload in the determination of the signatures of the first signature group; And
Updating the first and second signature groups by excluding the load signature from the first signature group and including the load signature into the second signature group,
Wherein detecting the load signature comprises:
Checking the time required to determine whether the packet is malicious using each of the signatures of the first signature group;
Increasing the count value corresponding to the signature when the required time is longer than the reference value; And
And detecting the signature as the load signature when the count value is greater than the threshold value. 10. The method of claim 9,
Wherein the IDS device performs a security check according to the signatures of the updated second signature group. 10. The method of claim 9,
The IPS device determines whether the second packet received after the packet is malicious according to the signatures of the updated first signature group,
And the IDS device performs a security check on the second packet according to the signatures of the updated second signature group. 10. The method of claim 9,
Wherein detecting the load signature comprises:
Checking the time required to determine whether the packet is malicious using each of the signatures of the first signature group; And
And detecting the signature as the load signature when the elapsed time is longer than the threshold. delete

Images