KR101860642B1 - Apparatus and method for watching illegality using source code modification effect assessment - Google Patents

Abstract

The present invention relates to an illegal behavior monitoring apparatus and method using source code change impact evaluation, and an illegal behavior monitoring apparatus using source code change impact evaluation according to an embodiment of the present invention, A surveillance zone information generating unit for generating surveillance zone information indicating an area of interest associated with the surveillance zone information; And a monitoring unit monitoring the source code or the process using the monitoring area information.

Description

[0001] APPARATUS AND METHOD FOR WATCHING ILLEGALITY USING SOURCE CODE MODIFICATION EFFECT ASSESSMENT [0002]

The present invention relates to an illegal behavior monitoring apparatus and method using source code change impact evaluation, and more particularly, to a 'SW change impact analysis' as a static monitoring for monitoring source code by analyzing the degree of influence of software change , Which can detect illegal activity against insiders who are authorized to make changes to the software (modify, create, delete, etc.) by performing "business logic tracking" as part of dynamic monitoring that tracks business logic and processes. The present invention relates to an illegal behavior monitoring apparatus and method using source code change impact evaluation.

Information security in the enterprise means protecting information from various threats. In other words, information security means management and technical methods to prevent information from being damaged, altered, or leaked during collection, processing, storage, retrieval, transmission and reception of information. Information security can be understood from the provider side and the user side that provide information. The supplier side represents a series of actions to safely protect and operate information assets such as network, system hardware, database, communication, and computer facilities from internal and external threat factors. The user side is to prevent leakage and abuse of personal information Represents a series of actions.

In recent years, it has expanded the scope of information security monitoring, not only for hacking offenses by unspecified hackers outside the enterprise, but also for hacking crimes against insiders (ie internal programmers, contract / subcontractor programmers) inside the company . In particular, some companies are investigating business logic monitoring technology at the level of the Fraud Detection System (FDS) as part of a study of insider behavior detection technology to prevent recurrence of hacking crimes involving subcontractors.

The above-mentioned research can extend the scope of surveillance to programmers who have the right to modify / delete software, not the general public, to insiders who have been excluded from the security surveillance in the meantime.

Insiders of the enterprise have the risk that they can change important logic at any time because they can access the system easily due to the nature of their work and can make a random change (or restoration after a momentary change). Because of this, hacking crimes by insiders are difficult to find evidence without professional knowledge.

Meanwhile, various security tools for examining source code have been commercialized. Accordingly, companies are introducing a variety of security tools to inspect secure coding, software complexity, memory leaks, coverage / acceptance factors, and so on.

However, since these security tools aim at managing the quality and security of the source code itself, it is difficult to perform the original information security functions against hacking crimes that insiders can attempt.

1 is a view showing an example of a violation method of a hacking accident caused by an insider. The table shown in FIG. 1 shows a case where a logical hole (exception) is generated by adding a single line of conditional expression (1) that seems to have no security problem. If a particular condition condition occurs intermittently (1%), it is not easy to see if there is a logical problem in the process, even if the security officer is constantly monitoring it. Eventually, logical illegal infringement can occur when certain conditions occur intermittently (1%) for normal operation (99%).

In this way, it is not easy to prevent and monitor hacking crimes by insiders in the past. In addition, in order to prevent hacking crimes by insiders, institutional / personal measures such as setting stronger access rights, strengthening supervision / procedures, and expanding management personnel are necessary but can not be a fundamental solution. This is because the institutional / human approach can cause loopholes in unexpected situations (eg, emergency maintenance requests, system checks, etc.).

Accordingly, there is a need in the past to provide a technology capable of not only technically preventing a hacking crime by an insider but also monitoring an illegal attempt to bypass important processes or arbitrarily change an algorithm.

The object of the present invention is to provide a method and apparatus for analyzing the effect of software changes, analyzing the effect of software change as a part of static monitoring for monitoring source code, The present invention also provides an apparatus and method for monitoring illegal activities using an influence evaluation of a source code that can detect illegal activities of an insider having authority to change (modify, create, delete, etc.)

Another object of the present invention is to detect and prevent an arbitrary change of an algorithm and a process detour through static monitoring and dynamic monitoring of illegal actions by an insider.

Another object of the present invention is to prevent illegal actions on source code involving an insider through a relatively simple analysis such as line comparison of source code and input factor verification.

 Another object of the present invention is to quickly detect a bypass of important processes or arbitrary modifications of core algorithms among all the processes constituting business logic.

Another object of the present invention is to minimize the performance degradation since it is possible to set not only the comparison and analysis of the files related to the interest process, but some of the areas, but also the monitoring range.

An illegal behavior monitoring apparatus using source code change impact evaluation according to an aspect of the present invention includes a monitoring area information generating unit for generating surveillance area information indicating a region of interest related to a source to be monitored in a process; And a monitoring unit monitoring the source code or the process using the monitoring area information, wherein the monitoring unit generates an observation source code through an annotation process using the monitoring area information, And a process monitoring unit for analyzing the accumulated process variation data in accordance with the insertion of the process variation data, wherein the process monitoring unit derives a process variation model by performing pattern analysis using the process variation data accumulated in the log as the system is operated A process variation pattern model unit; A process variation anomaly monitoring unit for detecting process anomaly using the process variation model; And a process variation visualization unit for displaying the process variation image as visual information on the process variation using the process variation model.

Wherein the monitoring unit extracts a change through comparison of versions of the source code by using the monitoring area information when the source code is changed, calculates a possibility of danger due to the change of the source code, And a source code monitoring unit.

delete

The surveillance area information generation unit may include a surveillance area information extraction unit for scanning the process area to extract surveillance area information; And a monitoring area information management unit for storing and managing the monitoring area information in an organized form according to a predetermined data structure.

Wherein the source code monitoring unit comprises: a source code change detection unit detecting a change of the source code; A source code change extracting unit for comparing the corresponding source file including the changed source code by version using the monitoring area information to extract a change of the source code; And a risk awareness and influence analysis unit for analyzing the risk potential and the process detour possibility according to the source code change through the modification of the extracted source code.

Wherein the process monitoring unit includes: an annotation processing unit for collectively inserting a security annotation into the original source code identified through the surveillance region information and automatically converting the security annotation into a monitoring source code; And an annotation management unit for storing and managing the positions (line numbers) of all the annotation codes inserted in the monitoring source code.

delete

The process is characterized by a process of interest determined according to importance.

The process is characterized by being categorized into an algorithm implementation area and a process call area.

The algorithm implementation area is an area of an original source written in a compilation language.

The process calling area is an area of an original source written in an interpreter language.

The monitoring area information includes a process name, a source name, a monitored object, and an area of interest (line number) included in the original source.

The monitoring target is divided into an algorithm operation monitoring area and a process bypass monitoring area.

The source code change section is characterized in that a code line corresponding to the code modification section, the code generation section, the source code change section including the code deletion section, and the source code change contents are extracted.

The risk awareness and impact analysis unit is characterized by checking the possibility of danger due to the source code change according to the comparison result of the region information between the source of the previous version and the source of the changed version.

The risk awareness and influence analyzing unit is characterized by interlocking with an external work instruction system to judge whether or not the operation of the code by the insider is permitted.

The risk awareness and impact analysis unit may calculate the SW change influence degree according to a predefined risk level if the change area identified as a result of the comparison corresponds to the process bypass monitoring area.

Wherein the change area is an area appearing by inserting a bypass code into the previous version source or inserting a new call statement into the previous version source.

The annotation processing unit sets a tracking range of the monitoring process using a forward / backward variable.

And the annotation management unit detects the annotation change attempt.

The process variation abnormality monitoring unit detects a process variation abnormality using a subgraph monitoring technique of a bayesian algorithm and a control flow graph.

In addition, the illegal action monitoring method using the source code change impact evaluation according to an embodiment of the present invention includes generating surveillance region information indicating a region of interest related to each source in the process; And monitoring the source code or the process using the monitoring area information, wherein the process monitoring step performs a pattern analysis using the process variation data accumulated in the log as the system is operated, ; Detecting a process anomaly using the process variation model; And displaying the process variation information as visual information on the process variation using the process variation model.

The monitoring of the source code may include a step of monitoring the source code when the source code is changed using the monitoring area information and comparing the version of the corresponding source file including the changed source code, ; And monitoring and monitoring the possibility of risk and the circumvention possibility of the process due to the change of the source code.

Wherein the process monitoring step includes: collectively inserting a security annotation into the original source code identified through the monitoring area information and automatically converting the security annotation into a monitoring source code; And storing and managing the position (line number) of all the annotation codes inserted in the monitoring source code.

delete

The present invention can extend the scope of surveillance to the area that was excluded from the security surveillance by the technique of detecting illegal activity for the insider having the authority to change (modify, create, delete, etc.)

In addition, the present invention can easily detect and prevent algorithm arbitrary change and process detour through static monitoring and dynamic monitoring of illegal actions by an insider.

In addition, since the present invention can provide a line-by-line access control method instead of the access control method according to the source file through the analysis of the SW change influence, it is possible to provide a low-quality source file in which various functions or functions are implemented in one file It is possible to simply monitor illegal activities by the insider.

In addition, since the present invention stores and manages the positions of all annotation codes through the annotation management unit, a security element for preventing illegal actions by the insider can be satisfied. That is, since the insider stores and manages the location of all annotation codes, the annotation code can not be arbitrarily deleted or annotated. The insider can not know what role the annotation code plays, what part of the source code the monitoring code monitors, or what annotation code is inserted when compiling.

In addition, the present invention can prevent illegal actions on source code involving an insider through a comparatively simple analysis such as line comparison of source code and input factor confirmation.

 In addition, the present invention can quickly detect an attempt to bypass a critical process or arbitrary modification of a core algorithm among all the processes constituting the business logic. In particular, the present invention encompasses both static and dynamic surveillance and can therefore be rigidly monitored.

In addition, the present invention minimizes performance degradation since it can perform comparison and analysis not only for some areas related to a process of interest, but also for some areas, as well as setting a monitoring scope.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a view showing an example of a violation method of a hacking accident by an insider,
2 is a diagram illustrating a process operation procedure within a program,
3 shows a process operation procedure when a code is changed by an insider,
4 is a block diagram of an illegal behavior monitoring apparatus using source code change impact evaluation according to an embodiment of the present invention.
FIG. 5 is a detailed configuration diagram of the illegal behavior monitoring apparatus of FIG. 4,
Figure 6 is an illustration showing process variation,
7 is a diagram of a process configuration for generating surveillance zone information,
8 is a diagram showing a detailed configuration of the monitoring area information generating unit 110,
9 is a diagram showing a detailed configuration of the source code monitoring unit 110,
FIGS. 10A and 10B are diagrams showing version-by-version comparisons of source codes by the source code change extracting unit;
11 is a view for explaining the danger perception by the risk perception and influence analyzing unit,
12A and 12B are diagrams for explaining the influence analysis by the risk awareness and influence analysis unit,
13 is a diagram showing intermittent process bypassing,
14 is a diagram showing a detailed configuration of the process variation tracking unit 140,
Figure 15 shows the insertion of an annotation into an original source,
16A to 16E are diagrams for explaining setting of a tracking area of the monitoring process,
17 is a diagram showing a process configuration and a probability model derivation process by the process variation pattern modeling unit,
18A and 18B are views showing an example of a process anomaly detection technique,
19 is an exemplary view showing a process variation visualization.

For a better understanding of the present invention, a preferred embodiment of the present invention will be described with reference to the accompanying drawings. The embodiments of the present invention may be modified into various forms, and the scope of the present invention should not be construed as being limited to the embodiments described in detail below. The present embodiments are provided to enable those skilled in the art to more fully understand the present invention. Therefore, the shapes and the like of the elements in the drawings can be exaggeratedly expressed to emphasize a clearer description. It should be noted that in the drawings, the same members are denoted by the same reference numerals. Detailed descriptions of well-known functions and constructions which may be unnecessarily obscured by the gist of the present invention are omitted.

Prior to the description of the present invention, the following terms are defined.

An "insider" is a programmer who has the authority to change (ie modify, create, delete, etc.) the source code of a file system. It is a programmer who manages the internal workforce and contract / .

A process is a unit of event elements that constitute business logic. For example, a process in a bidding system can be composed of bidding start / end, tactics, wicking, calculation of a prize, selection of a winning bidder have.

A 'method' is a set of functions or functions that make up a process.

'Illegality' refers to the result of an illegal attempt or action by an insider to circumvent or arbitrarily manipulate a critical process or arbitrarily alter the algorithm.

FIG. 2 illustrates a process operation procedure in a program, and FIG. 3 illustrates a process operation procedure when a code is changed by an insider.

It is an object of the present invention to prevent an insider from arbitrarily manipulating an important process operating in a program. For example, if 'process 3' (2) in FIG. 2 is the most important process in the program, it should be possible to confirm whether or not the process has been normally performed. However, if the insider changes the code to call "process 3" (3) instead of "process 3" (2) as shown in FIG. 3, the insider's illegal actions for changing the calling code of the process are authenticated Even if mathematical / statistical techniques are applied, it is difficult to detect easily. Eventually, the program can be easily disabled by illegal actions by insiders.

Illegal acts by insiders are difficult to detect because of the following reasons.

First, it is difficult for the program supervisor (that is, the person in charge) to check the details of frequent maintenance work performed by the insider, and it is not easy to determine whether the program is normal or abnormal even if the change history of the source code is checked.

Moreover, logical manipulation or bypass attempts on the source code are not detected by commercial security tools.

In addition, there is little evidence that the JSP (Java Server Pages) file, which is one of the interpreter languages, is judged to be an abnormal symptom because there is no process such as compile or restart when the insider changes the file. In particular, in FIG. 3, when the insider tries to illegitimate the important process 'Process 3' (2) [Compiled language Java], select 'Process 3' (2) We prefer to change the JSP file, which is code that calls 'process 3' (2).

In the old phase of code, it is difficult to analyze because it is operated and maintained for a long time, and a tightly coupled phenomenon occurs in which various functions are implemented in one file. For example, many systems often contain more than 2 to 4,000 files in one system.

FIG. 4 is a configuration diagram of an illegal behavior monitoring apparatus using source code change impact evaluation according to an embodiment of the present invention, and FIG. 5 is a detailed configuration diagram of the illegal behavior monitoring apparatus of FIG.

The illegal behavior monitoring apparatus (hereinafter referred to as "illegal behavior monitoring apparatus") 100 using the source code change impact evaluation according to the embodiment of the present invention is an illegal behavior monitoring apparatus You can monitor your actions. In addition, monitoring illegal activities in this manner may also have the effect of preventing illegal acts by insiders in advance. In this case, the monitoring range may be whether or not the source code and the important process are normally performed. The target source code may be a compile language such as JAVA, C #, C ++, or an interpretive language such as JSP, PYTHON, Lt; / RTI >

The illegal behavior monitoring apparatus 100 performs 'SW change impact analysis' as a static monitoring for analyzing the influence of software change and monitors the source code, and as part of dynamic monitoring for monitoring the business logic and monitoring the process Perform 'business logic tracking'.

First, 'SW change impact analysis' shows a technique for evaluating how an insider changes the source code before it is reflected in the operating system (20), thereby affecting the entire service. In other words, 'SW change impact analysis' corresponds to the static monitoring method. When the source code is changed by the insider, the change area is extracted by comparing with the source code of the previous version. To be evaluated.

Next, the 'business logic tracking' corresponds to the dynamic monitoring method and monitors the transition (see FIG. 6) of the process state (ie, start → process → end) to find an outlier. Fig. 6 is an exemplary view showing a process variation.

Hereinafter, the components of the illegal behavior monitoring apparatus 100 shown in FIGS. 4 and 5 will be described in detail. In describing the components of the illegal behavior monitoring apparatus 100, additional drawings related to the respective components will be described to facilitate understanding of the explanation.

The illegal behavior monitoring apparatus 100 may include a monitoring area information generating unit 110, a source code monitoring unit 120, and a process monitoring unit 130.

First, the surveillance region information generation unit 110 generates (hereinafter referred to as "surveillance region information") indicating 'a region of interest related to a surveillance target for each source in a critical process (or a process of interest to be observed) do. Here, the surveillance area information is information necessary for proceeding with 'SW change impact analysis' or 'business logic tracking', and should be generated before proceeding with 'SW change impact analysis' or 'business logic tracking'.

Hereinafter, the configuration of a process for generating surveillance region information will be described with reference to FIG. 7 is a diagram of a process configuration for generating surveillance zone information.

The process is structured so as to be able to extract an implementation area (code line) by classifying it as a 'logic (algorithm) implementation area' and a 'process calling area'. The reason for configuring the process as described above is that it is important to grasp in advance which source file the important process is in and which area it is implemented in order to evaluate whether the important process is bypassed / manipulated.

The most important process in the corresponding program of FIG. 7 is 'Process 3'. The original source 'A.Java' is composed of a compilation language (Java), and a logic (algorithm) implementation area 151 exists. The original sources 'B.jsp' and 'C.jsp' are composed of the interpreter language (jsp), and the process call areas 152 and 153 exist.

Hereinafter, the detailed configuration of the monitoring area information generating unit 110 will be described with reference to FIG. 8 is a diagram showing the detailed configuration of the surveillance zone information generation unit 110. As shown in FIG.

The monitoring area information generating unit 110 may include a monitoring area information extracting unit 111 and a monitoring area information managing unit 112.

The monitoring area information extracting unit 111 extracts information constituting the monitoring area information 160 by scanning a logic (algorithm) implementation area and a process calling area with respect to an important process. That is, the surveillance region information extraction unit 111 extracts the process name 161, the source name 162, the monitored object 163, the area of interest (line number) 164, and the like from the original source A, B, And extracts corresponding information. The information extracted by the surveillance region information extracting unit 111 is information that is not organized according to a predetermined data structure. In addition, the surveillance region information extracting unit 111 can scan the entire source code file to distinguish important processes.

The surveillance area information management unit 112 stores and manages the information extracted from the surveillance area information extracting unit 111 as the surveillance area information 160 in a form of a predetermined data structure.

The surveillance region information 160 may be information for specifying the surveillance regions 160a, 160b, and 160c that are likely to cause illegal actions by the insiders in the original sources A, B, That is, the process names 161, the source name 162, and the ROI 164 of the monitoring area information 160 are specified as the monitoring areas 160a, 160b, and 160c. The type of the illegal action that can be caused by the insider can be specified as the monitored object 163 of the surveillance area information 160. [ That is, the monitoring object 163 is divided into an 'algorithm operation monitoring area' and a 'process bypass monitoring area'.

Whether a process uses either a compiled language or an interpreter language through the source name 162 is distinguished, and through these language types it can be distinguished whether it belongs to a logic implementation area or a process calling area. Thus, the source name 162 is relevant for specifying the type of the monitored object 163.

Next, the source code monitoring unit 120 can perform static monitoring through 'SW change impact analysis' using the monitoring area information generated by the monitoring area information generating unit 110. That is, when the source code is changed, the source code monitoring unit 120 extracts the change by comparing the version of the source code with the use of the monitoring area information, and estimates the risk potential and the process detour possibility according to the source code change .

Hereinafter, the detailed configuration of the source code monitoring unit 120 will be described with reference to FIG. 9 is a diagram showing a detailed configuration of the source code monitoring unit 110. As shown in FIG.

The source code monitoring unit 120 may include a source code change detection unit 121, a source code change source extraction unit 122, a code modification influence analysis unit 123, and a risk protection unit 124 .

The source code change detection unit 121 detects a change in the source code using a log of the operating system 20. [ For example, if the insider changes the source code from "Revision 541" (previous version source) to "Revision 542" (change version source), the source code change detection unit 121 detects the source You can detect changes to the code.

The source code change detection unit 121 inquires of the surveillance region information management unit 112 whether the source file including the changed source code is included in the surveillance region information list. At this time, the surveillance area information management unit 112 checks whether the corresponding source file exists on the surveillance area information list. Here, the surveillance zone information management unit 112 can check whether the corresponding source file exists on the surveillance zone information list by using the source name of the corresponding source file.

When it is determined that the corresponding source file exists on the surveillance region information list, the source code change detection unit 121 extracts the source code change (that is, the changed portion) of the corresponding source file . Here, the source code change of the corresponding source file includes the source code change contents and the area (code line).

Hereinafter, the version-by-version comparison of the source code by the source code change extractor 122 will be described with reference to FIGS. 10A and 10B. FIGS. 10A and 10B are diagrams showing version-by-version comparisons of source codes by the source code change extracting unit. FIG.

The source code change extracting unit 122 can extract the source code change by comparing the corresponding source files by version as shown in FIGS. 10A and 10B. That is, the source code change extracting unit 122 can output information about the difference between the previous version source (Revision 541) and the change version source (Revision 542) by using the file comparison utility "Diff".

10A and 10B, the source code change extracting unit 122 extracts the source code changes between the previous version source (Revision 541) and the change version source (Revision 542), and the code modification units 171a and 171b The code lines CL1 to CL9 corresponding to the source code change contents as well as the source code change contents such as the code generation parts 172a and 172b and the code deletion parts 173a and 173b can be extracted.

The risk awareness and impact analysis unit 123 performs 'risk perception' by giving an alarm that it is necessary to check the possibility of danger due to the change of the source code through the comparison of the first area information, When the change area overlaps with the process bypass monitoring area, an 'impact analysis' is performed to calculate an influence of the SW change according to the possibility of process bypass and to provide an alarm.

Hereinafter, the risk perception and influence analysis by the risk perception and influence analysis unit 123 will be described with reference to FIGS. 11, 12A, and 12B. FIG. 11 is a view for explaining the risk perception by the risk perception and influence analysis unit, and FIGS. 12A and 12B are diagrams for explaining the influence analysis by the perception perception and the perception unit.

Specifically, the risk awareness and influence analyzing unit 123 analyzes the change area of the source code change extracted by the source code change extracting unit 122 and the change area of the source code change extracted by the monitoring area information managing unit 112 And compares the monitoring areas (that is, the algorithm operation monitoring area and the process bypass monitoring area) with each other to perform a risk recognition.

Referring to FIG. 11, in the previous version source (Revision 541) 181, the algorithm operation monitoring area 181a is an area corresponding to the line numbers 1-121. The change areas 182a and 182b changed by the insider in the change version source (Revision 542) 182 are areas corresponding to the line numbers 60 to 78 and the line numbers 978 to 981, respectively. The danger recognition and influence analysis unit 123 compares the area information between the previous version source Revision 541 181 and the revision version source Revision 542 182 so that the alarm unit 30 An alarm indicating that the code operation confirmation is necessary is transmitted to the person in charge. In this case, the risk recognition and influence analyzing unit 123 can determine whether the code manipulation by the insider is an allowed action when interfacing with an external work instruction system (not shown). In addition, when it is determined that the operation of the code by the insider is not allowed, the risk recognition and influence analyzing unit 123 can transmit an alarm to the responsible person through the alarm unit 30 that the code operation confirmation is necessary.

On the other hand, the risk awareness and influence analysis unit 123 compares the area information between the previous version source (Revision 541) and the revision version source (Revision 542) to check the changed area, If overlapped, an additional impact analysis is performed. That is, when the possibility of circumventing the process is confirmed, the risk awareness and influence analyzing unit 123 calculates the SW change influence degree (upper / middle / lower) according to the predefined risk level, You can tell.

Referring to FIGS. 12A and 12B, the process bypassing monitoring area 185a of the original source, that is, the previous version source (Revision 541) 185 is an area corresponding to the line numbers 419 to 423. Here, the insider may insert a detachable code 186a into the previous version source (Revision 541) 185 or insert a new call statement 187a into the previous version source (Revision 541) In other words, the change version source (Revision 542) 186, 187 includes a 'bypass code insert version' 186, a previous version source (Revision 541) 185 in which a detachable code 186a is inserted in a previous version source (Revision 541) Quot; insert call insert version " 187 in which a new call insert 187a is inserted into the insert call insertion block 185, as shown in FIG.

In the case of the bypass code insert version 186, the risk awareness and influence analysis unit 123 checks whether the bypass enable code 186a is inserted before the 'Process_3 ()' and analyzes the influence of the SW change on the bypass enable code 186a . Here, detour code 186a may be code such as if / else, for, while, switch / case, and MACRO (# ifndef / endif).

In addition, in the case of the call statement insertion version 187, the risk awareness and influence analysis unit 123 analyzes the influence on the 'Process_3 ()' executed immediately after the corresponding method. For example, if the input parameter 'param2' 188a, which is passed in the 'Process_3' call in FIG. 12b, equals 'param2' 189 in the input argument of 'Process_new' Depending on the execution result, the execution result of 'Process_3' may be affected. That is, the input parameter 'param2' (188b), which is transmitted when calling 'Process_3' in the change version source (Revision 542), influences the input argument redefined according to the execution result of 'Process_new', that is, 'param2 → param2' Receive.

As described above, since the static monitoring according to the 'SW change impact analysis' is not the access control for each source file but the access control for each line, a low-quality source file in which various functions or functions are implemented in one file It is possible to simply monitor the illegal actions by the insider.

In addition, there is also a method of converting both the executable file and the source code into a hash value and monitoring it to prevent the operation of the algorithm. However, this method is undesirable in the case of a system that is frequently maintained and requires additional management such as hash code history management / change control.

Next, the process monitoring unit 130 can perform dynamic monitoring through 'business logic tracking' using the monitoring area information generated by the monitoring area information generating unit 110.

Dynamic monitoring through business logic tracking is process monitoring using annotation or macro techniques. Dynamic monitoring through business logic tracking is used for dynamic process monitoring because it aims at process flow and transition tracking in real time. 'Annotation' means any technical, descriptive reference, annotation or marking inserted or added to a program or document. Here, 'annotation' refers to a security code technique that is automatically inserted at the position of a code line for process monitoring. It is a security code technique using a user definition annotation technique (JVM, C ++, C # , macro) can be used.

Static monitoring through SW change impact analysis can detect illegal actions by insiders only by analyzing the modified source code, while dynamic monitoring through business logic tracking allows the variation of a specific process And statistically track and visualize in real time to detect tampering by insiders.

13 is a diagram showing an intermittent process bypass.

If 'Process 3' 191 is an important process in the program, the insider can cause the process bypassing by changing the code to call 'Process 3' 192 instead of 'Process 3' 191 .

The process monitoring unit 130 can perform real-time tracking and visualization of a certain process variation in a probability / statistical manner while actually operating the system through business logic tracking. Accordingly, the process monitoring unit 130 can track and visualize intermittent process detour as shown in FIG. 13 in real time.

The process monitoring unit 130 may include a process variation tracking unit 140 and a process variation analysis unit 150. The process variation monitoring unit 140 includes an annotation processing unit 141 and an annotation management unit 142. The process variation analysis unit 150 includes a process variation monitoring unit 151, a process variation pattern modeling unit 153, And a variation visualization unit 152.

Hereinafter, the detailed configuration and tracking range setting function of the process variation tracking unit 140 will be described with reference to FIGS. 14, 15, and 16A to 16E. FIG. 14 is a diagram showing a detailed configuration of the process variation tracking unit 140, FIG. 15 is a diagram showing insertion of an annotation into an original source, and FIGS. 16A to 16E are diagrams Fig.

As described above, the process variation tracking unit 140 may include an annotation processing unit 141 and an annotation management unit 142.

14, the annotation processing unit 141 is an annotation processing unit for automatically converting the original source code 141a to the monitoring source code 141c using the monitoring area information managed by the monitoring area information management unit 112 And performs processing 141b. Here, the annotation processing is performed by inserting the security annotation (that is, the monitoring or security marking necessary for the process tracking) into the original source code 141a at the position of the code line for monitoring the process, .

The monitoring source code 141c can be used as a code for operating the system (service). Therefore, at the time of system operation, the log of the process variation, the date, the time and the number of times can be recorded without fail. Therefore, the log can be used as an element for tracking outliers through real-time analysis. That is, the process variation analyzer 150 can perform real-time anomaly detection using the log.

In addition, the annotation processing unit 141 can insert annotations 201 and 202 into the original source code as shown in FIG. 15 to generate the source code for monitoring, and set the tracking range of the monitoring process as shown in FIGS. 16A to 16E.

In FIG. 15, the inserted annotations 201 and 202 are visually recognizable when an insider is performing maintenance. That is, since the inserted annotations 201 and 202 are written in a simple representation (i.e., @ core code, @ bypass monitoring), the insider can not know what function is performed internally or which part is monitored. Since the inserted annotations 201 and 202 give an alarm to the person in charge at the time of deletion, it is impossible to delete them. As a result, the inserted annotations 201 and 202 can securely provide security.

In particular, the annotation processing unit 141 sets the tracking range of the monitoring process using a forward / backward variable (i.e., an F / B variable). 16A shows a case in which the tracking range of the monitoring process is variously set on the basis of the process 'Process 3' which is a process of interest from the process 1 'to the process 8'. That is, the annotation processing unit 141 can set a tracking range for the variation of the monitoring process to the forward (forward) / backward (backward) process or the entire business logic on the basis of the interested process.

The tracking range of the monitoring process is determined using the F / B variable as shown in [Table 1]. That is, the F / B variable is a variable that determines the progress stage of the process before and after the monitoring process. Therefore, the scope of tracing of the surveillance process is determined as the progress stage of the preceding / following process based on the interested process.

F / B variable Tracking scope of monitoring process F = 0 / B = 0 Track only interested processes F = n / B = 0 Track to the nth previous process F = 0 / B = m Track to the mth backward process F = n / B = m nth forward, mth backward process tracking

Hereinafter, examples shown in Figs. 16A to 16E will be described with reference to Table 1 above.

In FIG. 16A, the tracking range TA of the monitoring process is divided into four areas such as a first tracking range TA1, a second tracking range TA2, a third tracking range TA3, and a fourth tracking range TA4 You can set it to trace range. Here, the interested process is 'process 3'.

As shown in FIG. 16B, the first tracking range TA1 shows a case in which only the interested process 'process 3' is set as a tracking range. At this time, the F / B variable is F = 0 / B = 0. That is, only the process 3 is included in the first tracking range TA1.

In addition, the second tracking range TA2 indicates a case where the tracking range from the process 'process 3' to the 'first process' is set as the tracking range as shown in FIG. 16C. At this time, the F / B variable is F = 1 / B = 0. That is, in the second tracking range TA2, 'Process 7' and 'Process 8' corresponding to the first process before the process 3 are included.

In addition, the third tracking range TA3 shows a case where the tracking range from the process 'process 3' to the 'first back process' is set as the tracking range as shown in FIG. 16D. At this time, the F / B variable is F = 0 / B = 1. That is, in the third tracking range TA3, 'Process 2' and 'Process 4' corresponding to the first and second processes are included based on Process 3 '.

In addition, the fourth tracking range TA4 shows a case where the tracking range is from the first process to the first process and back to the first process based on the process 'Process 3' as shown in FIG. 16E. At this time, the F / B variable is F = 1 / B = 1. That is, in the fourth tracking range TA4, 'Process 7' and 'Process 8' corresponding to the first preceding process are included on the basis of 'Process 3', and 'Process 2' and ' Process 4 'is included.

On the other hand, the annotation managing unit 142 stores and manages the positions (i.e., line numbers) of all the annotation codes inserted in the monitoring source code. Since the annotation managing unit 142 stores and manages the positions of all the annotation codes, the security element for preventing illegal actions by insiders can be satisfied. That is, the annotation managing unit 142 protects all the annotation codes inserted in the monitoring source code by preventing the insider malicious access to all the annotation codes inserted in the monitoring source code. That is, the annotation managing unit 142 may notify the source code change detecting unit 121 of an attempt by the insider to change the source code (for example, annotation deletion or correction).

Specifically, the insider can not arbitrarily delete or annotate the annotation code because the positions of all the annotation codes are stored and managed. The insider can not know what role the annotation code plays, what part of the source code the monitoring code monitors, or what annotation code is inserted when compiling. However, the insider can view the annotation code inserted in the monitoring source code.

Hereinafter, process anomaly detection by the process variation analyzer 150 will be described with reference to Figs. 17, 18A, 18B and 19. FIG. 17 is a diagram illustrating a process configuration and a probability model derivation process by the process variation pattern modeling unit. FIGS. 18A and 18B are exemplary views showing a process anomaly detection technique, and FIG. 19 is an example of process variation visualization.

The process variation analyzer 150 can detect a process anomaly in real time by deriving a process configuration and a probability model (i.e., a process variation model) using the log.

The process variation analyzing unit 150 may include a process variation abnormality monitoring unit 151, a process variation pattern model unit 152, and a process variation visualization unit 153.

The process variation abnormality monitoring unit 151 detects a process abnormality in real time in cooperation with the process variation pattern model unit 152 and the process variation visualization unit 153 and visually displays the process abnormality detection result to the person in charge have.

Specifically, the process variation pattern modeling unit 152 performs pattern analysis using the process variation history data accumulated in the log as the system is operated. Here, the log is output every time the system is executed. That is, since the target for monitoring, that is, the annotation necessary for the process tracking, is embedded in the original source, the log can be recorded without missing any process variation, date, time,

When the process variation model is derived by the process variation pattern modeling unit 153, the process variation abnormality monitoring unit 151 generates a process variation model based on a Bayesian algorithm (see FIG. 18A) and a control flow graph 18b) can be used to detect and track process outliers in real time. The process variation abnormality monitoring unit 151 notifies the person in charge through the alarm unit 30 when it detects an abnormality in the process.

The process variation visualization unit 153 can display (i.e., visualize) the process variation model, the process variation, the cycle, the frequency, and the like as visual information that can confirm the process variation model (see FIG. 19). The process variation visualization unit 153 can provide visual information about the process variation model to the person in charge.

Meanwhile, the illegal behavior monitoring apparatus 100 performs a SW change influence analysis, which is a static monitoring method, in cooperation with a file system 10 and an operating system 20, Perform tracking. In addition, the illegal behavior monitoring apparatus 100 notifies the surveillance person through the alarm unit 30 of the possibility of a problem through static or dynamic monitoring.

In other words, the illegal behavior monitoring apparatus 100 evaluates whether a process bypassing and logic illegal change is detected when a source code change by an insider is detected by using "SW change impact analysis" and "BizSys logic tracking". If there is a problem as a result of the evaluation, the illegal behavior monitoring apparatus 100 generates an alarm so that the monitoring person can recognize the alarm.

Meanwhile, the illegal activity monitoring method of the present invention can be used for standardizing the log or log grammar necessary for security monitoring. In particular, the illegal behavior monitoring method of the present invention can be used for software coverage inspection when the object of interest is extended to all methods / processes. Here, the coverage test is one of techniques for checking software quality, and refers to a test for detecting a code error or an unused dead code (a function that is never called).

It will be apparent to those skilled in the art that various modifications and variations may be made in the present invention. Accordingly, it is to be understood that the present invention is not limited to the above-described embodiments. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims. It is also to be understood that the invention includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention as defined by the appended claims.

10: File system 20: Operating system
30: alarm part 100: illegal behavior monitoring device
110: Surveillance zone information generation unit 111: Surveillance zone information extraction unit
112: Surveillance zone information management unit 120: Source code monitoring unit
121: source code change detection unit 122: source code change minute extraction unit
123: Risk perception and influence analysis unit 130: Process monitoring unit
140: Process variation tracking unit 141: Annotation processing unit
142: annotation management unit 150: process variation analysis unit
151: process variation abnormality monitoring unit 152: process variation pattern model unit
153: process variation visualization unit

Claims (25)

A monitoring area information generating unit for generating surveillance area information indicating a region of interest related to each source of monitoring in the process; And
And a monitoring unit monitoring the source code or the process using the monitoring area information,
Wherein,
And a process monitoring unit for generating surveillance source code through annotation processing using the surveillance region information and analyzing accumulated process variation data according to insertion of the annotation,
The process monitoring unit,
A process variation pattern model unit for deriving a process variation model by performing pattern analysis using process variation data accumulated in the log as the system is operated;
A process variation anomaly monitoring unit for detecting process anomaly using the process variation model; And
A process variation visualization unit for displaying the process variation information as visual information on a process variation using the process variation model;
And a source code change impact assessment comprising:
The method according to claim 1,
Wherein the monitoring unit extracts a change through comparison of versions of the source code by using the monitoring area information when the source code is changed, calculates a possibility of danger due to the change of the source code, A source code monitoring unit for detecting the source code;
And a source code change impact assessment comprising:
delete The method according to claim 1,
Wherein the surveillance zone information generation unit comprises:
A monitoring area information extracting unit for scanning the process area and extracting surveillance area information; And
A surveillance zone information management unit for storing and managing the surveillance zone information in an organized form according to a predetermined data structure;
And a source code change impact assessment comprising:
3. The method of claim 2,
The source code monitoring unit,
A source code change detection unit detecting a change of the source code;
A source code change extracting unit for comparing the corresponding source file including the changed source code by version using the monitoring area information to extract a change of the source code; And
A risk awareness and influence analysis unit for analyzing the risk potential and the process detour possibility according to the source code change through the modification of the extracted source code;
And a source code change impact assessment comprising:
The method according to claim 1,
The process monitoring unit,
An annotation processing unit for collectively inserting the security annotation into the original source code identified through the surveillance region information and automatically converting the security annotation into the monitoring source code; And
An annotation management unit for storing and managing the positions (line numbers) of all the annotation codes inserted in the monitoring source code;
And a source code change impact assessment comprising:
delete The method according to claim 1,
Characterized in that the process is a process of interest determined according to the importance.
The method according to claim 1,
Wherein the process is classified into an algorithm implementation area and a process call area.
10. The method of claim 9,
Wherein the algorithm implementation area is an area of an original source written in a compilation language.
10. The method of claim 9,
Wherein the process calling area is an area of an original source written in an interpreter language.
The method according to claim 1,
Wherein the monitoring area information includes source code change impact evaluation including a process name, a source name, a monitoring target, and a region of interest (line number) included in the original source.
13. The method of claim 12,
Wherein the monitoring object is divided into an algorithm operation monitoring area and a process bypass monitoring area.
6. The method of claim 5,
Wherein the source code change includes a code modification section, a code generation section, a source code change content including a code deletion section, and a code line corresponding to the source code change content, Illegal behavior monitoring device.
6. The method of claim 5,
The risk perception /
And checking the possibility of the danger due to the source code change according to a result of comparing the region information between the source of the previous version and the source of the change version.
16. The method of claim 15,
The risk perception /
And the intervention is interlocked with an external work instruction system to judge whether the operation of the code by the insider is an allowed action.
16. The method of claim 15,
The risk perception /
And when the change area identified as a result of the comparison corresponds to the process bypass monitoring area, the SW change influence degree is calculated according to a predefined risk level.
18. The method of claim 17,
Wherein the change area is an area appearing by inserting a bypass code into the previous version source or inserting a new call statement into the previous version source.
The method according to claim 6,
Wherein the annotation processing unit sets the trace range of the monitoring process by using a forward / backward variable.
The method according to claim 6,
Wherein the annotation management unit detects the attempt to change the annotation.
The method according to claim 1,
Wherein the process variation abnormality monitoring unit detects a process variation abnormality by using a subgraph monitoring technique of a bayesian algorithm and a control flow graph. Illegal behavior monitoring device.
Generating surveillance region information indicating a region of interest associated with each source of surveillance in the process; And
And monitoring the source code or the process using the monitoring area information,
Wherein the process monitoring step comprises:
Performing pattern analysis using process variation data accumulated in the log as the system is operated to derive a process variation model;
Detecting a process anomaly using the process variation model; And
Displaying visual information on the process variation using the process variation model;
A method for monitoring illegal activities using source code change impact assessment.
23. The method of claim 22,
The source code monitoring step includes:
Extracting a change through comparison of versions of a corresponding source file including the changed source code using the monitoring area information when the source code is changed; And
Estimating the possibility of risk and the possibility of circumventing the process due to the change of the source code and monitoring it;
A method for monitoring illegal activities using source code change impact assessment.
23. The method of claim 22,
Wherein the process monitoring step comprises:
Automatically inserting the security annotation into the original source code identified through the monitoring area information and automatically converting the security annotation into the monitoring source code; And
Storing and managing the position (line number) of all the annotation codes inserted in the monitoring source code;
A method for monitoring illegal activities using source code change impact assessment.
delete

Images