KR102126626B1 - Separating network system with honeypot - Google Patents

Abstract

The present invention relates to a network separation system to which the honeypot is applied, and photographing means; Image separation means; First conversion means; Review means; Second conversion means; Detection means; Control means; Third conversion means; And monitoring means; In addition, it is possible to stably protect the system even if malicious components are included in the components used to build the video security system, as well as the system administrator's perception of the network infringement method that is rapidly advancing technology and actively It is characterized by collecting infringement method data so that a countermeasure can be quickly established.

Description

Network separation system with honeypot{SEPARATING NETWORK SYSTEM WITH HONEYPOT}

The present invention relates to a network separation system to which a honeypot is applied, and more specifically, it is possible to stably protect a system even if malicious components or the like are included in a component used to construct a video security system, and rapidly advance technology. It is related to the network separation system to which the honeypot is applied, which enables the system manager's perception of the network infringement method and actively collects the network infringement method to quickly establish a countermeasure.

In recent years, rapidly increasing public sector terrorism, kidnapping, fire prevention of major facilities, and children's safety accidents have emerged as social problems, and as a result, installation of real-time video security systems based on surveillance cameras has rapidly increased. Doing.

However, although the need for external sharing and use of public purposes has emerged for the shooting data of video security systems operated by public institutions and public corporations, it is difficult to secure the stability of the system against external threats such as hacking, which is shared externally. Avoiding things.

Honeypot is widely used as a method of responding to the threat of external infringement. Honeypot refers to a system that is intentionally installed to detect abnormal access through external networks, that is, intrusion such as hacking, and attracts detection, tracking, and collection of information by inducing spam, computer viruses, and cracker servers that have entered the system. It can be used a lot to prevent cyber terrorism.

Meanwhile, as components required for building a video security system, for example, a network camera (IP camera) and a network video recorder (Network Video Recorder, NVR), have been developed in the form of network products, malicious software (Malicious Software, Malware), etc. are built into the components in advance. There are threats of security breaches caused by components used to build a video security system, such as hacking possible.

In particular, the issue of security breaches of network cameras disclosed in the public and private internet networks has been issued through media several times.In April 2016, a distributed bot of a distributed denial of service (DDoS) attack could be created. Malicious code was found in Chinese network cameras sold at Amazon, and in November 2016, a large-scale DDoS attack occurred to US DNS companies using botnets included in Chinese network video security products.

As a result, the US Congress passed the National Defense Authorization Act (NDAA) to prohibit the use of Chinese-made network video security products in major facilities.

However, a number of Chinese network video security products have already been supplied to and installed and operated in network video security systems operated by domestic public institutions and public enterprises.

Therefore, it is possible to protect the system even if malicious components are included in the components used to build the system as well as infringement (hacking) through the external network by physically separating the video security system from the network and rapidly advancing technology. In order to recognize the system administrator's network infringement method and establish a quick countermeasure, there is a growing need to collect active network infringement method data.

Republic of Korea Patent Registration No. 10-0926456

Accordingly, an object of the present invention is to solve such a conventional problem and to provide a network separation system with a honeypot capable of stably protecting a system even if malicious components or the like are included in a component used to construct a video security system. have.

In addition, it is to provide a network separation system to which a honeypot is applied, which enables the system manager to recognize the network infringement method, which is rapidly advancing technology, and actively collect data on the network infringement method to quickly establish a countermeasure.

The above object is, according to the present invention, a honeypot is applied to the network separation system, the imaging means; Image separating means for separating image data from the photographing data photographed by the photographing means; First conversion means for receiving the image data from the image separation means and converting it into first unidirectional data that is unilaterally transmitted toward one direction; Review means for receiving the photographing data from the photographing means or the image separating means, and examining whether control data included in the photographing data is normal or abnormal; As a result of the review of the review means, second conversion means for receiving normal control data and converting it into second unidirectional data transmitted unilaterally; Detection means for receiving abnormal control data as a result of the review of the review means, and detecting cracker data included in the abnormal control data; Control means for receiving the first one-way data and the second one-way data from the first conversion means and the second conversion means; Third conversion means for receiving the abnormal control data from the detection means and converting it into third unidirectional data unilaterally transmitted toward one direction; And receiving and storing the cracker data and the third unidirectional data, and transmitting the third unidirectional data to the cracker server when the cracker data includes cracker server information, among the photographing means and the control means. Monitoring means for monitoring the system operated by either or both; It is achieved by a network separation system to which the honeypot containing is applied.

Here, it is preferable that the information of the cracker server is address information of the cracker server or address information of data stored in the cracker server.

Here, it is preferable that the review means judges the control data as abnormal when the protocols of the control data are different from each other by comparing with a predetermined protocol.

Here, as a result of the review of the control data through the review means, any one or two of whether or not the cracker data is detected through the detection means is inserted into a caption containing any one or two of text, images, and delivered to the control means A caption inserting means; It is preferable to further include.

According to the present invention, there is provided a network separation system to which honeypots can be stably protected even if malicious components or the like are included in components used to construct a video security system.

In addition, it is possible to quickly establish a countermeasure by collecting system administrator's perception and network infringement method data on the network infringement method that is rapidly advancing technology.

1 is a configuration diagram briefly showing the configuration of a honeypot-applied network separation system according to a first embodiment of the present invention,
Figure 2 is a schematic diagram showing the configuration of a honeycomb network separation system is applied according to a second embodiment of the present invention,
3 is a flowchart illustrating a sequence of separating and using image data according to the operation of the network separation system to which the honeypot is applied according to the first embodiment of the present invention,
4 is a flow chart illustrating a procedure for reviewing and processing the presence or absence of malicious software in a recording means used to construct a network separation system to which a honeypot is applied according to the first embodiment of the present invention.

Hereinafter, a network separation system to which the honeypot according to the present invention is applied will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram briefly showing a configuration of a network separation system to which a honeypot is applied according to a first embodiment of the present invention.

Referring to FIG. 1, the network separation system to which the honeypot is applied according to the first embodiment of the present invention is largely a photographing means 10, an image separating means 20, a first converting means 30, a review means 40, It comprises a second conversion means 50, the control means 60, the detection means 70, the third conversion means 80 and the monitoring means 90.

The photographing means 10 is an essential component for building an image security system, and a camera installed in a place for surveillance or security, for example, a plurality of network cameras may be used, and the photographing means 10 may be used. Through this, the shooting data is generated. The photographing data generated by the photographing means 10 includes data of a photographed image, that is, image data and control data.

The image separating means 20 is a component that separates image data from the photographing data generated by the photographing means 10, and a so-called parsing engine may be used.

The first conversion means 30 is a component that receives image data from the image separation means 20 and converts it into one-way (Simplex) data, ie, first one-way data that is unilaterally transmitted toward one direction.

In the present invention, in addition to the first conversion means 30, the data is converted into data transmitted only in one direction, that is, unidirectional data through the second and second conversion means 50 and 80 described below. The unidirectional data is divided into a transmission method and a reception side in a communication method such as TV broadcasting or radio broadcasting in which the data flow direction is only one side, and TV in the home of the receiving side through image data transmitted from the broadcasting station as the transmitting side. Although viewing is possible, it is not possible to transmit the corresponding image data from the receiving party to the broadcasting station, or to access the broadcasting station through the corresponding image data.

In other words, the receiving side of the unidirectional data transmits the unidirectional data to the transmitting side or through this, access to the transmitting side is fundamentally blocked, and the first unidirectional data converted by the first converting means 30 is received. Transmission of the first one-way data from the control means 70 (receiving side) to the first conversion means 30 (transmission side) or access to the first conversion means 30 (transmission side) through the first one-way data is blocked. .

The review means 40 is a component that receives the photographing data from the photographing means 10 or the image separation means 20, and examines whether the control data included in the photographing data is normal or abnormal. Here, in the drawing, the review means 40 is configured to be arranged in the next step of the image separation means 20, but the review means 40 is arranged between the imaging means 10 and the image separation means 20 to capture data. After reviewing whether the included control data is normal or abnormal, the image separation means 20 may be configured to separate the image data.

As a result of the review by the review means 40, the second conversion means 50 is a component that receives normal control data and converts it into second unidirectional data that is unilaterally transmitted toward one direction. Like the first unidirectional data converted by ), access to the transmitting side through the second unidirectional data from the receiving side of the second unidirectional data, that is, the control means 60, is basically blocked.

The control means 60 is a component that receives the first unidirectional data and the second unidirectional data from the first converting means 30 and the second converting means 50, respectively, and the photographing means 10 or a honeypot according to the present invention The entire network separation system 100 to which this is applied can be controlled. The control means 60 may be configured to store an image photographed through the photographing means 10, and for this purpose, a network video recorder (NVR) or the like may be used as the control means 60.

The detection means 70 is an element that receives abnormal control data as a result of the review by the review means 40 and detects cracker data included in the abnormal control data.

The third conversion means 80 is a component that receives abnormal control data from the detection means 70 and converts it into third unidirectional data that is unilaterally transmitted toward one direction, and the aforementioned first and second unidirectional data. Similarly, access from the receiving side of the third unidirectional data, that is, the monitoring means 90 below, to the transmitting side through the third unidirectional data becomes impossible.

The monitoring means 90 is a component that receives and stores cracker data and third unidirectional data, and transmits the third unidirectional data to the cracker server when the cracker data includes information of the cracker server 200. In addition, the monitoring means 90 monitors the system operated by any one or two of the imaging means 10 and the control means 60, that is, the network separation system 100 to which the honeypot according to the present invention is applied.

Here, the information of the cracker server 200 may include address information of the cracker server 200, for example, an IP address, a domain name, and a uniform resource locator (URL). In addition, address information of data stored in the cracker server 200, for example, a data location address (Uniform Resource Locator), may be used.

2 is a configuration diagram briefly showing a configuration of a network separation system to which a honeypot is applied according to a second embodiment of the present invention.

The network separation system 100 to which the honeypot is applied according to the second embodiment of the present invention is configured almost the same as the network separation system to which the honeypot is applied according to the first embodiment described above, but the subtitle insertion means for inserting the subtitles It is distinguished from each other in that 95 is further included.

The subtitle insertion means 95 is a review result of the control data through the review means 40, that is, whether the control data included in the shooting data is normal or abnormal, or whether cracker data is detected through the detection means 70, and In addition, it is a component that generates and transmits subtitles to the control means 60 so as to visually display various information necessary for an administrator or a user managing the network separation system 100 to which the honeypot is applied.

In this case, the subtitles may be one or two of text, text, and/or images composed of letters or numbers.

Hereinafter, a network separation system to which the honeypot is applied according to the first embodiment of the present invention will be described in detail. At this time, in the case of the network separation system to which the honeypot according to the second embodiment of the present invention is applied, the configuration of the first embodiment is almost the same, so a detailed description of the second embodiment is omitted.

3 is a flowchart illustrating a sequence of separating and using image data according to an operation of a network separation system to which a honeypot is applied according to a first embodiment of the present invention.

First, the photographing means 10 is operated, that is, photographing data is generated by the photographing means 10 (S10 ). The operation of the photographing means 10 may be performed according to a command set by the photographing means 10 itself, and data transmitted to control the operation of the photographing means 10 from the control means 60, for example, photographing Data (control of control means) for controlling operations such as lifting or panning of means 10, pan, tilt, zoom, start or finish of shooting, and on/off of power, etc. Data).

The generated shooting data is transmitted to the image separation means (S20), and the image separation means 20 separates the image data from the received shooting data (S30).

Then, the separated image data is transferred to the first conversion means 30 (S40) and converted to the first unidirectional data transmitted unilaterally (S50). A variety of known methods can be used to convert the video data to the first one-way data through the first conversion means 30. After simply decoding the video data in real time, converting it into an AVI file or an MP4 file, etc. This can be converted into first unidirectional data. In addition, to improve security, it is first decoded and converted into low data, and then the converted raw data is encoded into serial data or parallel data, and then decoded secondly to decode the image data. It can also be converted into one-way data.

The converted first unidirectional data is transmitted to the control means 60 (S60). The display device is separately connected to the control means 60 together with the second unidirectional data described below, for example, delivered to a monitor for display. Or, it can be configured to store a separate image storage device.

4 is a flow chart illustrating a procedure for reviewing and processing the presence or absence of malicious software in a recording means used to construct a network separation system to which a honeypot is applied according to the first embodiment of the present invention.

First, the first step (S100) in which the photographing data is generated by the photographing means 10 is the same as the step of S10 in the description of FIG. 3 described above, and the generated photographing data is transmitted to the review means 40 (S110). . At this time, in FIG. 4, the photographing data delivered to the review means 40 is shown to be transmitted from the photographing means 10, but the photographing data separated from the image separating means 20 rather than the photographing means 10 is transmitted. It may be.

Next, the review means 40 examines whether the control data included in the photographing data is normal or abnormal (S120). If, among the components used when constructing the honeypot applied network separation system 100 according to the present invention, malicious software (Malware) is included in the photographing means 10, that is, the cracker is sold with the malicious software hidden. When the camera 10 (the photographing means) is used to construct the system 100, it is difficult to discriminate and use virtually any malicious software. In particular, it is more difficult when a large amount of the camera 10 is used. Therefore, when the system 100 is built by purchasing the imaging means 10 in which malicious software is hidden, the cracker data is activated from the imaging means 10 at a certain point in time and is included in the shooting data, in particular, the control system 100 Will be affected.

Accordingly, in the present invention, whether or not malicious software is included in the photographing means 10 among the constructed systems 100 by examining whether the control data included in the photographing data is normal or abnormal through the review means 40. It is possible to know and can reliably protect the system.

At this time, the review of whether the control data is normal or abnormal is determined by comparing the protocol of the control data with the protocol set in the review means 40. That is, if the protocols match each other, it is determined to be normal, and if they are different, it is determined to be abnormal.

If it is determined that the control data is different from a predetermined protocol, such as a content that is not instructed by the system administrator or a separate content in addition to the instruction, the control data may be determined as abnormal control data. In particular, if the control data includes important protocols such as addition, deletion, and change of shooting data, not the direction of the system administrator, it is possible to be almost sure of the existence of malicious software.

As a result of comparing the protocol through the review means 40, if the control data is normal, the normal control data is transmitted to the second conversion means 50 (S122), and this is the second unidirectional data transmitted unilaterally in one direction. It is converted (S124) and transmitted (S126) to the control means 60, and the control means 60 can be transmitted to a separate display device together with the first unidirectional data described above for display or stored in a separate image storage device. have.

Then, if the control data is abnormal, that is, if it is determined that the malicious software is included in the photographing means 10, the abnormal control data is transmitted to the detection means 70 (S130) to detect cracker data (S140).

Cracker data can be detected through a variety of known techniques. The cracker data referred to in the present invention may be extracted data obtained by directly extracting specific data, for example, information about malicious software, from abnormal control data or log data generated by logging abnormal control data.

Then, the third conversion means 80 receives the abnormal control data directly from the review means 40, or receives the abnormal control data from which the cracker data is detected by the detection means 70 (S150), and receives the abnormal control data in one direction. It is converted to the third unidirectional data transmitted toward (S160) and transmitted to the monitoring means (90) (S170).

The monitoring means 90 may perform analysis on the transferred cracker data to determine what purpose the control data has and how it will affect the system 100, but in most cases, what is the cracker data It is difficult to find out if the content is included.

Therefore, the monitoring means 90 determines whether the cracker data has information of the cracker server 200 such as the IP address, domain, URL, etc. of the cracker server (S180), and if so, uses the cracker server 200 to the cracker server 200. The third unidirectional data is transmitted (S190) to wait for a cracker reaction.

At this time, the monitoring means 90 monitors the cracker server 200 by allowing the cracker server 200 to record the information of the cracker server 200 in a blacklist when information of the cracker server 200 exists in the cracker data. good.

Subsequently, the monitoring means 90 includes a separate control data for controlling the photographing means 10 from the cracker server 200 or the cracker server 200 connected to the cracker server 200 receiving the third unidirectional data. After being delivered, it is possible to quickly establish a countermeasure against crackers by monitoring how the imaging means 10 operates and what happens to the system 100 according to the operation of the imaging means 10.

In particular, in the present invention, the third unidirectional data is configured to be transmitted to the cracker server 200 through the monitoring means 90 rather than the imaging means 10. That is, it is determined that the third unidirectional data has been transmitted from the photographing means 10 by the malicious software that the cracker that received and confirmed the third unidirectional data has hidden in the photographing means 10.

Accordingly, in order to check the IP address of the photographing means 10 in the cracker server 200, a system command, for example, ifconfig, inconfig, ipconfig, netstat, etc., may be performed, but in reality, the photographing means 10 Not to check the IP address of the monitoring means (90).

That is, the cracker determines that the monitoring means 90 is the photographing means 10, and even though separate data is transmitted from the cracker to the system 100, it passes through the monitoring means 90 serving as a honeypot in the present invention. It makes it easy for administrators to collect data on network infringement.

As described above, the network separation system 100 to which the honeypot is applied according to the present invention is capable of stably protecting a system even if malicious components and the like are included in a component used to construct a video security system, and is rapidly advancing technology. It is a useful invention that can quickly establish a countermeasure by collecting the system administrator's perception and network infringement method data on the network infringement method.

The scope of the present invention is not limited to the above-described embodiments, but can be implemented in various forms of embodiments within the scope of the appended claims. Any person having ordinary skill in the art to which the present invention pertains without departing from the gist of the present invention as claimed in the claims shall be deemed to be within the scope of the claims of the present invention to a wide range that can be modified.

10: photographing means 20: image separation means
30: first conversion means 40: review means
50: second conversion means 60: control means
70: detection means 80: third conversion means
90: monitoring means 95: subtitle insertion means
100: Honeypot applied network separation system 200: Cracker server

Claims (4)

In the honeypot applied network separation system,
Photographing means;
Image separating means for separating image data from the photographing data photographed by the photographing means;
First conversion means for receiving the image data from the image separation means and converting it into first unidirectional data that is unilaterally transmitted toward one direction;
Review means for receiving the photographing data from the photographing means or the image separating means, and examining whether control data included in the photographing data is normal or abnormal;
As a result of the review of the review means, second conversion means for receiving normal control data and converting it into second unidirectional data transmitted unilaterally;
Detection means for receiving abnormal control data as a result of the review of the review means, and detecting cracker data included in the abnormal control data;
Control means for receiving the first one-way data and the second one-way data from the first conversion means and the second conversion means;
Third conversion means for receiving the abnormal control data from the detection means and converting it into third unidirectional data unilaterally transmitted toward one direction; And
The cracker data and the third unidirectional data are received and stored, and when the cracker data includes cracker server information, the third unidirectional data is transmitted to the cracker server, and the photographing means or the control means Monitoring means for monitoring the system operated by one or two;
Network separation system to which the honeypot is applied. According to claim 1,
The information of the cracker server,
A network separation system to which a honeypot is applied, characterized in that the address information of the cracker server or the address information of data stored in the cracker server. The method according to claim 1 or 2,
The review means,
A network separation system to which a honeypot is applied, characterized in that the control data is determined to be abnormal when the protocols of the control data are different from each other by comparing with a predetermined protocol. According to claim 3,
As a result of the review of the control data through the review means, a subtitle that inserts any one or two of whether or not the cracker data is detected through the detection means as subtitles containing any one or two of text or images and delivers them to the control means Insertion means;
Network separation system to which the honeypot is applied, characterized in that it further comprises.

Images