KR101951730B1 - Total security system in advanced persistent threat - Google Patents

Abstract

The present invention provides a security system capable of controlling harmful sites, blocking malicious software, enhancing security for administrator mode access, and strengthening control over non-network use.
To this end, a security system according to an embodiment of the present invention includes a server, a user terminal, and a security device that performs security between the server and the user terminal, wherein the server collects blocking log information of the security device An IP collecting unit for collecting Internet users' Internet Protocol (IP) and extracting and extracting actual user IP from the converted IP through a network address translator (NAT); A first judging unit for judging whether the number of times exceeds a first threshold value which is a predetermined threshold value and for extracting a corresponding log and a corresponding IP (monitoring IP) A monitoring unit for detecting whether or not the monitoring IP communicates with the monitoring IP; and a malicious software (MalWare And a second judging unit for judging whether the malicious software is the primary malicious software after comparing the hash value of the malicious software with the reference hash value, A malicious software monitoring server for comparing the malicious software in the blocking log with the previously stored malicious software database when it is determined that the malicious software is not the primary malicious software through the third determination unit and the second determination unit, A third determination unit, and a mirroring database unit for storing related IP information to which malicious software derived from the malicious software monitoring server is applied, and a file and URL downloaded by the user terminal as mirroring data.
Through this, it is possible to construct a more systematic security system by detecting IP by user with NAT IP and router IP which is not utilized in existing security equipment.

Description

{TOTAL SECURITY SYSTEM IN ADVANCED PERSISTENT THREAT}

The present invention relates to a security system, and more particularly, to a security system capable of controlling a harmful site, blocking malicious software, enhancing security for administrator mode access, and strengthening control over non-network use.

Nowadays IT devices including PCs are increasing in security holes due to various equipment and applications, and it is very difficult to detect correct attacks due to various types of attacks.

Generally, in order to treat a new or variant virus, the user finds an abnormal symptom on his computer and then finds the program causing the problem and reports the virus to the vaccine company. The malicious code is diagnosed and blocked and the malicious program is blocked from being transferred to another computer user's computer system.

Many of the computer viruses that have been found are mostly reported after someone has been infected with the virus first. However, recently known computer viruses and hacking programs use a high level of concealment techniques, so it is often difficult for computer users to find malicious code, and even if they are infected by computer viruses on their computers.

As a result, not only are vaccine vendors reporting virus infections late, vaccine production is delayed, causing damage from viruses, and the damage spread to other computers. On the other hand, in order to overcome this, vaccine vendors are suggesting ways to secure new and modified viruses early without resorting to user reporting. For example, if a function of the process is similar to a characteristic of a computer virus, the program is collected as a sample. The vaccine vendor analyzes the collected samples and distributes the updates by creating antivirus if it is determined to be malicious code.

As a conventional technique for detecting a malicious process by inspecting a program (or a process) to be executed as described above, Korean Patent Laid-Open Publication No. 2009-0080220 (published on July 24, 2009) have.

This prior art relates to a harmful process detection / blocking method for blocking malicious processes by finding out malicious processes that are problematic or blocking them from being executed by converting the types of execution processes into databases.

However, there is a limitation in that the above-mentioned conventional technique checks an already executed program. In other words, monitoring new inflow executable programs means that malicious code has already been installed and running. Therefore, it does not know the moment when malicious code is installed and installed, so it can not secure all installation information (creation of new file, change of existing file, etc.) of malicious code. As a result, the real-time monitoring technology of the execution program of the vaccine company has a disadvantage of analyzing only the execution program itself and collecting only related files during execution.

In addition, the real-time monitoring technology of the execution program of the conventional vaccine company can not cope with the malicious code analysis because the vaccine can be dealt with only after the vaccine is produced and distributed even if the sample is collected and the malicious code is analyzed.

Meanwhile, in order to overcome the problem of the above-mentioned real-time monitoring program execution technology, when a specific event occurring in the system kernel, for example, writing of a specific file, execution of a specific program, Techniques for inspection are presented.

The present invention relates to a system and method for detecting a hidden process using system event information in Korean Patent Application Publication No. 2007-0121195 (published on Dec. 27, 2007), which is an example of such a technology. A process of extracting a process list using event information and comparing the process list with a process list provided to a user in an application layer, detects a hidden process existing in the system in real time by detecting and removing a process provided only in the kernel layer as a hidden process .

However, the conventional art has a problem that the load on the system may be increased because the kernel layer that generates the system event checks the process.

In addition, although the above-described prior art has a difference in inspecting an execution program at an application level and inspecting a system event at a kernel level, it relies only on the information of the computer terminal itself in order to find a new or variant malicious code, , DDoS dedicated equipment, security control system, etc., it is possible to delay the response because it can not use the detection information.

Accordingly, there is an urgent need to develop a technique that can effectively solve and solve the problems of the conventional techniques.

The present invention provides a security system capable of controlling harmful sites, blocking malicious software, enhancing security for administrator mode access, and strengthening control over non-network use.

The problems to be solved by the present invention are not limited to the above-mentioned problems. Other technical subjects not mentioned may be clearly understood by those skilled in the art from the following description.

A security system according to an embodiment of the present invention includes a server, a user terminal, and a security device that performs security between the server and the user terminal, wherein the server collects blocking log information of the security device An IP collecting unit for collecting Internet protocols of the system user and extracting and collecting actual user IPs from IPs converted through a network address translator (NAT) A first judging unit for judging whether the number of occurrences per IP exceeds a first threshold value which is a predetermined threshold value and for extracting a corresponding log and a corresponding IP (surveillance IP), a case where the first judging unit exceeds the first threshold value A monitoring unit configured to detect whether the user terminal communicates with the monitoring IP when it is determined that the user terminal is in communication with the monitoring IP; A second judging unit for comparing the hash value of malicious software (MalWare) of the blocking log with the reference hash value and judging whether or not the malicious software is the primary malicious software; when judging the primary malicious software through the second judging unit Malicious software of the blocking log in the case where it is determined that the malicious software is not the primary malicious software through the second determination unit, based on the file and the URL downloaded by the user terminal; Related IP information to which malicious software derived from the malicious software monitoring server compares with the stored malicious software database, the third determination unit, and the malicious software monitoring server, and a file and a URL downloaded by the user terminal are stored as mirroring data And a mirroring database unit The.

The server may further include a fourth determination unit for determining whether to block access by detecting access to the administrator mode and the fourth determination unit may determine that access to the administrator mode is permitted based on the mirroring data, If it is determined that the input of the password is not within the time limit, the controller transmits a manager response request signal to the user terminal. If the response signal is received, (A mismatch threshold value or less) through the monitor whether the monitoring IP communicates with the user terminal through the monitoring unit (exceeding the mismatch threshold value) by determining whether the mismatch threshold exceeds the mismatch threshold again .

The server may further include a spoofing attack detecting unit for decreasing the first threshold value for a predetermined time to detect a spoofing attack of the blocking log information.

The server may further include a white list module for determining and storing a white list composed of low-risk information on the basis of the mirroring data, and a white list module for detecting and storing at least one of pharming, phishing, malicious code, And a network monitoring unit including an IP SCAN module, a Port SCAN module, a whitelist session detection module, and an internal network connection detection module.

The network monitoring unit may transmit information for determining whether the software is malicious if the number of occurrences of the monitoring target exceeds a second threshold value, which is a predetermined threshold value, to the second determination unit.

The server further includes a statistical analysis unit, wherein the statistical analysis unit compares the daily network statistics of the out-of-white list session and the daily average statistical data of each user terminal with a predetermined reference range, And transmits the download information to the second determination unit after acquiring software download information for a predetermined period.

According to the embodiment of the present invention, it is possible to construct a more systematic security system by detecting IPs for each user with the NAT IP and the router IP not utilized in the existing security equipment.

In addition, it is possible to achieve an active coping effect on a pattern of accessing a real important server by distinguishing between an administrator and a general user.

Also, it has an effect of quickly detecting an attack pattern of the same type by hashing the identified actual attack pattern.

In addition, the hash value of the detected attack pattern can be shared with other sites, thereby enabling more accurate security detection.

1 is a schematic diagram showing the structure and problems of a conventional security system.
2 is a block diagram illustrating the configuration of a security system according to an embodiment of the present invention.
3 is a block diagram illustrating a server configuration of a security system according to an embodiment of the present invention.
4 is a block diagram illustrating a configuration of a network monitoring unit of a security system according to an embodiment of the present invention.
5 is a flowchart illustrating a MalWare determination process of the security system according to the embodiment of the present invention.
6 is a flowchart illustrating a security process according to an administrator mode approach of a security system according to an embodiment of the present invention.
7 is a flowchart illustrating an internal network monitoring process of a security system according to an embodiment of the present invention.
8 is a flowchart illustrating a security process using statistical information of a security system according to an embodiment of the present invention.

Other advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims.

Unless defined otherwise, all terms (including technical or scientific terms) used herein have the same meaning as commonly accepted by the generic art in the prior art to which this invention belongs. Terms defined by generic dictionaries may be interpreted to have the same meaning as in the related art and / or in the text of this application, and may be conceptualized or overly formalized, even if not expressly defined herein I will not.

The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, various uses of " comprises " and / or the verb do not exclude the presence or addition of one or more other elements, acts, and / or elements other than the mentioned elements, operations, and / or elements. A general description of known configurations may be omitted so as not to obscure the gist of the present invention. In the drawings of the present invention, the same reference numerals are used as many as possible for the same or corresponding configurations.

Hereinafter, a security system according to an embodiment of the present invention will be described in detail with reference to the drawings.

First, the advantages of the security system according to the embodiment of the present invention will be described below with reference to FIG. 1 in order to compare with the prior art.

1 is a schematic diagram showing the structure and problems of a conventional security system.

In the conventional security system, as shown in FIG. 1, a system in which a server is managed is connected to the Internet through a router for the first time. Conventional security systems include a server zone firewall, a web firewall, an internal firewall, and the like as security devices. Recently, there have been developed methods for disabling such security devices, and development of a solution thereof has been required.

As shown in FIG. 1, the protection of IPs converted through NAT (IP address translator, private IP address to public IP address) among security events is not effectively performed . In other words, it is a main problem that the internal user can not be traced to the NAT IP transmitted from the security device.

In addition, there is a problem that when an event of accessing from the firewall to the important server of the manager PC occurs, monitoring of the important server connection status of the abnormal manager PC can not be performed.

In order to solve these problems effectively, a security system according to an embodiment of the present invention is proposed.

The configuration of a security system according to an embodiment of the present invention will be described in detail below with reference to Figs. 2 to 4. Fig. FIG. 2 is a block diagram illustrating the configuration of a security system according to an embodiment of the present invention. FIG. 3 is a block diagram illustrating a server configuration of a security system according to an embodiment of the present invention. FIG. 5 is a block diagram illustrating a network monitoring unit configuration of a security system according to an example.

As shown in FIG. 2, the security system according to the embodiment of the present invention may include a security device 10, a server 100, and a user terminal 200. The security device 10 can generally be a security device that is currently in use. That is, when a connection to a specific system is performed from the outside via the Internet, a security device that performs blocking when it is determined that an abnormal event occurs or a program that needs to be blocked is applied.

In addition, the server 100 processes various access information received from the guarantee device 10, transmits the access information to the user terminal 200, receives information from the user terminal 200, and sends the information to the outside via the Internet again . The detailed operation process of the server 100 for performing an effective security operation will be described in detail below.

Also, the user terminal 200 may include a PC or other communication terminal as a terminal used by a user connected to the server 100 and accessing the Internet. As shown in FIG. 2, one or more user terminals 200 may be provided.

Next, the detailed configuration of the server 100 of the security system according to the embodiment of the present invention will be described with reference to FIG. 3 to FIG. The server 100 includes a log collecting unit 101, an IP collecting unit 102, a first determining unit 103, a monitoring unit 104, a second determining unit 105, a third determining unit 106, The monitoring server 107, the mirroring DB unit 108, the fourth determination unit 109, the camouflage attack detection unit 110, the whitelist module 111, the network monitoring unit 112, and the statistical analysis unit 113 .

The log collecting unit 101 collects the blocking log information of the security device 10.

In addition, the IP collector 102 collects the Internet protocol (IP) of the system user and extracts and collects the actual user IP from the converted IP through the network address translator (NAT). That is, it extracts and collects the actual user IP of the converted IP through the NAT as well as the user IP which can grasp the surface.

The first judging unit 103 judges whether the number of occurrences of the blocking log information collected by the log collecting unit 10 for each IP of the IP collecting unit 102 exceeds a first threshold value which is a predetermined threshold value . Finally, the log and the corresponding IP (monitoring IP) are extracted. That is, the first determination unit 103 can determine the first threshold value by statistically grasping the state where the blocking log information occurs frequently in the system, occurs at a time, or periodically occurs, and determines the first threshold value as a reference The monitoring log information is filtered to extract the monitoring IP and the corresponding log to be monitored.

The monitoring unit 104 also detects whether the user terminal 200 communicates with the monitoring IP when the first determination unit 103 determines that the first determination unit 103 exceeds the first threshold value. That is, it detects whether a direct connection between the supervisory IP to be monitored and the user terminal 200 is established.

If it is determined that the monitoring IP communicates with the user terminal 200 through the monitoring unit 104, the second determination unit 105 may determine a hash value of the malicious software MalWare corresponding to the blocking log After comparing with the reference hash value, it is judged whether or not the primary MalWare exists. That is, when a connection is established between the monitoring IP to be monitored and the user terminal 200, the second determination unit 105 determines whether or not the MalWare corresponding to the blocking log between the two is primarily a real MalWare do. If the hash value is the same as the standard hash value, it would be a real MalWare, otherwise it could be MalWare or a separate MalWare that is not identified as a hash value.

If it is determined through the second determination unit 105 that the primary malware is detected, the third determination unit 106 determines whether the malware (malware) is finally detected based on the file downloaded by the user terminal 200 and the URL (Uniform Resource Locator) . That is, unlike the second determination unit 105, which is a process of determining through a simple process of determining only a hash value, the user terminal 200 directly analyzes the file and URL information directly downloaded to determine whether the file is a final MalWare .

If it is determined that the malwares are not the primary MalWare through the second determination unit 105, the MalWare monitoring server 107 (malicious software monitoring server 107) further compares the MalWare of the blocking log with the previously stored MalWare database to determine whether MalWare . That is, a separate MalWare database is provided to further determine whether MalWare has been added.

The security system according to the embodiment of the present invention can effectively perform MalWare detection that is systematic and hardly misses through the first determination unit 103 to the MalWare monitoring server 107 described above.

The mirroring DB unit (mirroring database unit) 108 mirrors the associated IP information to which the MalWare applied through the third determination unit 106 and the MalWare monitoring server 107 is applied and the file and URL downloaded by the user terminal 200 And stores it as data. In other words, the IP information and the download file related to MalWare are converted into a database so that they can be used as inquiry data when the same event or similar event occurs in the future. Through the DB configuration, the security system according to the present invention can perform a faster MalWare determination process and effectively cope with the changed external intrusion.

In the foregoing, the MalWare judgment process (function 1) based on the blocking log serving as a basis of the present security system has been described. Hereinafter, a case of accessing the system from the outside by the administrator mode will be described.

The fourth determination unit 109 of the server 100 of the security system according to the embodiment of the present invention determines whether access to the administrator mode is detected using the mirroring data stored in the mirroring DB unit 108. [ That is, the fourth determination unit 109 detects access to the administrator mode and determines whether to block access to the system.

If the access is detected, the fourth determination unit 109 determines whether access is made within the work allowable time. That is, the fourth determination unit 109 determines whether the access procedure is a normal access or an abnormal access based on whether the access procedure exceeds the allowable time.

If the allowance time is exceeded, the fourth determination unit 109 transmits an administrator response request signal to the user terminal 200, and if the response signal corresponding to the request signal is received from the user terminal 200, . That is, when a signal indicating that a manager connection is correct is received from the user terminal 200, a process of requesting a password input is performed.

Accordingly, if the input password does not match, the fourth determination unit 109 further determines whether the mismatch threshold value, which is the number of mismatches or the mismatch time, is exceeded.

That is, when it is judged that it is within the allowable working time again (in the case of the disagreement threshold value or less), it is judged that the connection is normal. If the mismatch threshold value is exceeded, the process returns to the process of detecting whether the monitoring IP communicates with the user terminal 200 through the monitoring unit 104. That is, in the latter case, when it is determined that the manager access is not valid, the detection process is performed through the monitoring unit 104 described above while providing a notification to the user terminal 200,

MalWare will be judged.

In the above, the security process of accessing the present system from the outside, which is the second function of the present security system, in the administrator mode is described, and the internal network monitoring process, which is the third function of the present system, is described below.

The server 100 of the security system according to the embodiment of the present invention includes a spoof attack detection unit 110. The spoof attack detection unit 110 detects a spoof attack of blocking log information by setting a first threshold value Decrease over time. That is, among the various events occurring in the network, a process corresponding to the camouflage (temporary operation or irregularization or slowing of connection) may occur. To cope with this, the camouflage attack detection unit 110 of the present system detects the first The process of temporarily lowering the threshold value is performed.

The whitelist module 111 then determines and stores a whitelist consisting of low-risk information based on the mirroring data. That is, information with high stability is selected based on the mirroring data and stored separately.

In addition, the network monitoring unit 112 monitors at least one of a pharming, a phishing, a malicious code and an information leak in a network of the user terminal.

4, the network monitoring unit 112 includes an IP SCAN module 112-1, a port SCAN module 112-2, a whitelist session detection module 112-3, an internal network connection detection Module 112-4. The IP SCAN module 112-1 monitors the IP of the internal network, the Port SCAN module 112-2 senses the port, the non-whitelist session detection module 112-3 monitors sessions outside the whitelist , The internal network connection detection module 112-4 detects whether or not the internal network is connected.

The network monitoring unit 112 transmits to the second determining unit 105 information for determining whether the software is malicious if the number of times of occurrence of the monitoring target exceeds a second threshold value, which is a predetermined threshold value. That is, the network monitoring unit 112 transmits the related information to the hash value comparing step which is the MalWare determining process of the second determining unit 105 when the number of events to be monitored in the internal network exceeds the second threshold value .

In addition, the server 100 includes a statistical analysis unit 113, and the statistical analysis unit 113 calculates the daily statistical data of the out-of-white list sessions and the daily statistical average data of the user terminals.

The statistical analysis unit 113 compares the calculated statistics and data with a predetermined reference range, and if the calculated statistical and data exceeds the reference range, the statistical analysis unit 113 acquires the software download information for a predetermined period and transmits the download information to the second determination unit 105 do. Here, the predetermined reference range may be an error rate of each statistic and data. When the error rate is exceeded, the download details for the period of about 7 days are searched and downloaded on the basis of the error rate occurrence date, 105). The 7-day period is an example, and may be changed depending on the type of information and the characteristics of the system.

Next, the MalWare determination process of the security system according to the embodiment of the present invention will be described in detail with reference to FIG. The process shown in FIG. 5 is for the first function of the security system according to the embodiment of the present invention. 5 is a flowchart illustrating a MalWare determination process of the security system according to the embodiment of the present invention.

As shown in FIG. 5, the security system according to the embodiment of the present invention first collects a blocking log (S10), and collects actual user IPs changed through IP collection and NAT (S11). Then, it compares the number of intercepted logs with the first threshold value. Specifically, it determines whether the number of intercepted logs exceeds the first threshold value (S12). If the number of blocking logs is equal to or less than the first threshold value, the blocking log collecting process is performed (return to S10). If the blocking log number exceeds the first threshold value, the user terminal 200 and the monitoring IP communicate (S13). When the user terminal 200 and the monitoring IP communicate with each other, it is determined whether or not the blocking log MalWare hash value is identical to the reference hash value (S14). If the two values are the same, it is finally determined whether the file and the URL downloaded through the monitoring IP correspond to MalWare (S15). If the two values are different from each other, MalWare and DB (MalWare database) are checked again. Finally, after making the above two decisions, each information (download file and URL information) is stored in the mirroring database (mirroring database) as mirroring data (S17).

Next, a security process according to an administrator mode approach of a security system according to an embodiment of the present invention will be described with reference to FIG. The security process shown in FIG. 6 is for a second function of the security system according to an embodiment of the present invention. 6 is a flowchart illustrating a security process according to an administrator mode approach of a security system according to an embodiment of the present invention.

As shown in FIG. 6, a security system according to an embodiment of the present invention detects the occurrence of an administrator mode access event to perform a security process according to an administrator mode access (S20). If it is detected, it is determined whether the approach process exceeds the preset or pre-stored work permissible time (S21).

If the access procedure is equal to or less than the work permissible time, it is judged as a normal access (S22) and the process is terminated.

If it is determined that the access process exceeds the work allowable time, an administrator response request signal is transmitted to the user terminal 200 (S23). That is, when the access procedure exceeds the operation allowable time, the server 100 determines that there is an inappropriate administrator mode access, and the server 100 transmits an administrator response request signal .

When the server 100 receives the response signal from the user terminal 200, the server 100 requests the password input again (S24). When the password input through the user terminal 200 is input to the password input requested by the server 100, the input password is compared with the reference password to determine whether the input password is inconsistent (S25). If the two passwords match, it is determined that the access is normal (S22) and the process ends.

If the two passwords do not coincide with each other, it is determined as an abnormal access in advance and the password input is requested again, and it is judged whether or not the number of inconsistencies exceeds the inconsistency threshold value of the password input time at which the inconsistency occurs (S26).

If the mismatch threshold value is not exceeded, it is determined as a normal access (S22) and the process ends.

If the mismatch threshold value is exceeded, the process proceeds to step S13 where it is determined whether the monitoring IP and the user terminal 200 communicate with each other.

Next, an internal network monitoring process of the security system according to the embodiment of the present invention will be described with reference to FIGS. 7 to 8. FIG. The internal network monitoring process corresponds to a third function of the security system according to the embodiment of the present invention. FIG. 7 is a flowchart illustrating an internal network monitoring process of a security system according to an embodiment of the present invention, and FIG. 8 is a flowchart illustrating a security process using statistical information of a security system according to an embodiment of the present invention.

As shown in FIG. 7, one of the internal network monitoring processes of the security system according to the embodiment of the present invention is a process of monitoring an internal network. That is, the internal network is monitored first (S30). The internal network monitoring monitors a monitoring target consisting of at least one of pharming, phishing, malicious code, and information leakage in the network of the user terminal 200. In step S31, it is determined whether the number of events to be monitored exceeds the preset second threshold value through the monitoring. That is, it is a process of judging whether or not the corresponding software associated with the monitored object is malicious.

If the number of occurrences of the monitoring object does not exceed the second threshold value, the process returns to step S30 to monitor the internal network again. If the number of occurrences exceeds the second threshold value, the process proceeds to step S14 of FIG. And performs the process of comparing the blocking log MalWare hash value.

In addition, FIG. 8 shows a process of monitoring the internal network by collecting the daily statistical data on the internal network and the daily statistical average data of each user terminal according to the embodiment of the present invention.

First, the daily network statistic A is collected (S40), the daily statistical average data B for each user terminal is collected (S41), and statistical values considering both the statistical data A and the average data B are calculated And then determines whether it exceeds a predetermined reference range (S42). If the statistical value does not exceed the predetermined reference range and the statistical information is again collected, the process returns to step S40. If the statistical value exceeds the predetermined reference range, the process proceeds to step S14 in FIG. 5 and the MalWare hash value A comparison process is performed. Here, if the predetermined reference range is exceeded, the predetermined reference range may be the error rate through the statistical comparison. If there is a predetermined reference range, the downloaded contents are searched for about 7 days on the basis of the event occurrence date before moving to step S14, The flow advances to step S14.

Also, the daily network statistics are daily net statistics other than the whitelist, which may include protocol statistics, port statistics, 80,443 statistics, and country statistics.

In addition, if the file is not found, the site-specific process for malware funnel navigation is executed.

It is to be understood that the above-described embodiments are provided to facilitate understanding of the present invention, and do not limit the scope of the present invention, and it is to be understood that various modifications may be made within the scope of the present invention. Therefore, the technical protection scope of the present invention should be determined by the technical idea of the claims, and the technical protection scope of the present invention is not limited to the literary description of the claims, The invention of a category.

10: security device 100: server
101: log collecting unit 102: IP collecting unit
103: First judging unit 104:
105: second judgment unit 106: third judgment unit
107: MalWare monitoring server 108: Mirroring DB unit
109: fourth judging unit 110: camouflage attack detecting unit
111: White list module 112: Network monitoring section
112-1: IP SCAN module 112-2: Port SCAN module
112-3: Out-of-whitelist session detection module
112-4: Internal network connection detection module
113: Statistical Analysis Department

Claims (6)

A security system comprising a server, a user terminal, and a security device for performing security between the server and the user terminal,
The server comprises:
A log collector for collecting blocking log information of the security device,
An IP collector for collecting Internet protocol (IP) of the system user and extracting and collecting an actual user IP from IP converted through a network address translator (NAT)
A first judging unit for judging whether the number of occurrences of the blocking log information for each IP in the IP collecting unit exceeds a first threshold value which is a predetermined threshold value and for extracting a log and a corresponding IP (monitoring IP)
A monitoring unit for detecting whether the user terminal communicates with the monitoring IP when it is determined that the first determining unit exceeds the first threshold,
A second judging unit for comparing the hash value of malicious software (MalWare) of the blocking log with the reference hash value when the monitoring IP communicates with the user terminal through the monitoring unit, ,
A third determination unit for determining whether the malicious software is the last malicious software based on the file and the URL downloaded by the user terminal when the malicious software is determined as the primary malicious software through the second determination unit;
A malicious software monitoring server for comparing the malicious software of the blocking log with a previously stored malicious software database when it is determined that the malicious software is not the primary malicious software through the second determination unit,
And a mirroring database unit for storing, as the mirroring data, the related IP information to which the malicious software derived from the third determining unit and the malicious software monitoring server are applied, and the file and URL downloaded by the user terminal,
The server may further include a fourth determination unit for determining whether to block access by detecting access to the administrator mode,
Wherein the fourth determination unit determines whether access to the administrator mode is performed based on the mirroring data and whether the access is made within the operation allowable time, transmits an administrator response request signal to the user terminal when the permission time is exceeded, If the response signal corresponding to the signal is received, it is determined whether or not the password input is coincident. Then, when a signal indicating that the administrator connection is correct is received from the user terminal 200, the process of requesting the password input is performed. (Not equal to or less than a mismatch threshold value) through the mismatch threshold value exceeding the mismatch threshold value or the mismatch threshold, or whether the monitoring IP communicates with the user terminal through the monitoring unit ≪ / RTI >
delete The method according to claim 1,
The server comprises:
Further comprising: a spoof attack detecting unit for decreasing the first threshold value for a predetermined time to detect a spoofing attack of the blocking log information. The method according to claim 1,
The server comprises:
A white list module for determining and storing a white list composed of low-risk information based on the mirroring data;
A network monitoring unit consisting of an IP SCAN module, a Port SCAN module, a whitelist session detection module, and an internal network connection detection module is provided to monitor a monitoring target in at least one of pharming, phishing, malicious code and information leakage in the network of the user terminal The security system comprising: 5. The method of claim 4,
Wherein the network monitoring unit transmits information for determining whether the software is malicious if the number of times of occurrence of the monitoring target exceeds a second threshold value that is a predetermined threshold value to the second determination unit. 5. The method of claim 4,
The server further includes a statistical analysis unit,
Wherein the statistical analysis unit compares the daily network statistics of the out-of-white-list session and the daily statistical average data of each user terminal with a predetermined reference range to acquire software download information for a predetermined period of time when exceeding the reference range, And transmits the download information to the second determination unit.

Images