KR102199177B1 - Security information and event management system and method for detecting hacking by scenario based correlation analysis - Google Patents

Abstract

The present invention relates to a hacking detection technology, and more specifically, hacking detection security information that increases the accuracy of hacking detection through scenario-based correlation analysis of logs generated in the overall path of hacking procedures including not only network and security equipment but also web log analysis. It relates to an event management system and method.

Description

Hacking detection security information event operation system and method through scenario-based correlation analysis {SECURITY INFORMATION AND EVENT MANAGEMENT SYSTEM AND METHOD FOR DETECTING HACKING BY SCENARIO BASED CORRELATION ANALYSIS}

The present invention relates to a hacking detection technology, and more specifically, hacking detection security information that increases the accuracy of hacking detection through scenario-based correlation analysis of logs generated in the overall path of hacking procedures including not only network and security equipment but also web log analysis. It relates to an event management system and method.

Recently, attacks using the vulnerability of the server are proceeding as a zero-day attack, and the attack is a method that can quickly and easily penetrate the server through the vulnerability of the web application.

SIEM “Security Information & Event Management” is an early warning monitoring system capable of responding to advanced threats by providing a correlation analysis function that can report only core logs, not simple log collection and analysis.

However, it is very difficult to find anomalous symptoms in a situation where thousands to hundreds of millions of logs are generated per day, and there is a limit to the detection of attack behavior through the web through correlation analysis focusing on network and security device log collection.

As a result of investigating the infection path of the advanced ransomware attack combined with the recent cryptocurrency-related service and APT attack aimed at monetary gains, the percentage of incoming via the Internet was the highest with 66%, followed by email 25% and P2P 9%. . In addition, the Internet is being used as a major transit point for APT attacks.

Web attack security, which accounts for 80% of hacking accidents, is important, but there is no SIEM solution that responds to hacking by analyzing web logs.

As a prior art document for the present invention, there is Patent Registration No. 10-1417671 (2014.07.02).

The present invention collects network security equipment, system logs, and web logs that make up the entire IT infrastructure, and analyzes the logs generated in the overall path of the hacking procedure from various viewpoints through an intelligent continuous attack. It provides a hacking detection security information event operation system and method that more accurately finds abnormal symptoms such as (APT: Advanced Persistent Threat) and Ransomware attacks.

According to an aspect of the present invention, a hacking detection security information event operation system is provided.

A hacking detection security information event operating system according to an embodiment of the present invention includes a log setting unit configured to collect logs from at least one of a web server and a web server operating system, and the logs collected according to the settings. A log aggregating unit that generates log information for each server, a model selection unit that continuously updates modeling information for the normal pattern of each server by developing a scenario linked with the log information, and a scenario correlation for the log information based on the scenario It may include a log analysis unit that performs analysis.

According to an embodiment, the log setting unit collects a log including data transmitted to the post-body and response-body, and the program operation location, program execution information, program execution target type and program execution subject, full program path and program You can set to collect a log including one or more of the information.

According to an embodiment, in the case of a system-level application abnormal symptom detection scenario, the model selection unit is a task of avoiding log generation by modifying a profile after login, and a task of repeatedly performing the root password of the mysql server by searching bash_history after logging in. , Transferring the mysql dump file to the outside after logging in, saving redis data as a dump file and transferring it to the outside, and changing the host file simultaneously or at different times on multiple servers. have.

According to an embodiment, in the case of a ransomware detection scenario, the model selection unit may detect a situation in which an actual user's file is altered by analyzing a combination of a management log and a security log, occurrence, and pattern.

According to another aspect of the present invention, a method of operating a hacking detection security information event is provided.

A method of operating a hacking detection security information event according to an embodiment of the present invention includes performing a setting for collecting a log, generating log information including the log collected according to the setting, and receiving the log information. Transmitting to a cloud server, developing a scenario linked with the log information, continuously updating modeling information on a normal pattern of logs for each server, and performing a scenario correlation analysis on the log information based on the scenario It may include.

According to an embodiment, the step of performing the setting for collecting the log in the hacking detection security information event operation unit collects the log including data transmitted to the post-body and response-body, and the program operation location and program execution information , A program execution target type and program execution subject, a full program path, and a setting to collect a log including at least one of program information may be performed.

According to an embodiment, in the case of a management log, a step of monitoring a system and a network log in terms of management, and in the case of a security log, the step of managing and monitoring by classifying an attack type may be further included.

According to an embodiment, when an attack is detected, the step of generating detection information including a source IP address corresponding to the log information may be further included.

According to an embodiment of the present invention, an AI-based big data analysis platform can filter out actual hacking based on the information automatically analyzed and respond with conclusive evidence confirmed through in-depth analysis by experts such as responders and analysts. You can focus your time on detailed analysis of more important events. In addition, a broader analysis can be performed based on threat detection scenarios including various logs such as network traffic and system information.

According to an embodiment of the present invention, the paradigm of financial security is changing as the new financial and IT convergence markets such as fintech and big data increase. Payment finance is focused on user convenience such as relaxation of domestic security regulations and expansion of simple payments. As the environment changes, the importance of the Fraud Detection System (FDS) is increasing as an alternative to reinforcing user security. In order to increase the weakened security level due to simple payment, comprehensive analysis is performed in the back-end block. Can be detected.

1 is a view for explaining a hacking detection security information event operating system according to an embodiment of the present invention.
2 and 3 are diagrams for explaining a hacking detection security information event operation unit of a hacking detection security information event operating system according to an embodiment of the present invention.
4 to 7 are diagrams for explaining a method of operating a hacking detection security information event for real-time web hacking detection according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art can easily implement the present invention. However, the present invention may be implemented in various forms and is not limited to the embodiments described herein. In addition, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless specifically stated to the contrary.

1 is a diagram illustrating a hacking detection security information event operating system according to an embodiment of the present invention.

Referring to FIG. 1, a hacking detection security information event operation system according to a first embodiment of the present invention includes a web server 100, a cloud server 200, and a hacking detection security information event operation unit 300.

The web server 100 performs log settings for generating logs collected by at least one of the web server and the operating system of the web server, and generates and collects logs according to the log settings to generate log information.

The web server 100 transmits the generated log information to the cloud server 200.

The hacking detection security information event operation unit 300 receives web hacking detection information from the cloud server 200 or obtains the information by automatically obtaining the corresponding information, and provides the source IP address of the log included in the web hacking detection information. Add it to the block list. Through the hacking detection security information event operation unit 300, the web server 100 or the web server operating system blocks access from each source IP address included in the block list.

2 and 3 are diagrams illustrating a hacking detection security information event operation unit of a hacking detection security information event operating system according to an embodiment of the present invention.

Referring to FIG. 2, a hacking detection security information event operation unit 300 according to an embodiment of the present invention has an architecture for processing big data and applying machine learning technology on a cloud.

The hacking detection security information event operation unit 300 automatically blocks attack type analysis information and verifying the final result through continuous learning of machine learning.

The hacking detection security information event operation unit 300 transmits all log streams registered on the agent upload server to Kafka, a distributed streaming platform for big data processing.

The hacking detection security information event operation unit 300 serves as a backbone for transferring to a speed layer for asynchronous real-time analysis and a batch layer for batch analysis.

The hacking detection security information event operation unit 300 has a verified scale-out structure according to an increase in the amount of data in the transmitted log stream, and may support load balancing and automatic scale functions.

The hacking detection security information event operation unit 300 delivers the learned model information generated in the batch layer to another layer in real time, and serves model information updated in real time in the speed layer.

The hacking detection security information event operation unit 300 supports integrity and defect tolerance functions while delivering to the layer, develops a technology for utilizing and optimizing verified open sources, and continuously processing machine learning data based on this.

When an attack is detected, the hacking detection security information event operation unit 300 generates detection information including a source IP address of log information to be analyzed.

Referring to FIG. 3, the hacking detection security information event operation unit 300 includes a log setting unit 320, a log collection unit 340, a model selection unit 360, and a log analysis unit 380.

The hacking detection security information event operation unit 300 may perform the operation of the log setting unit 320, the log collection unit 340, the model selection unit 360, and the log analysis unit 380 on an operating system.

The log setting unit 320 performs setting for log generation. For example, in general Windows or Linux, sensitive data set in advance is leaked according to security principles such as a password of a server through program execution, memory hacking through injection into a specific executable program, and phishing through host file modification. It is not set up to record a log of malicious actions, such as a reverse connection connection, which allows hackers to access the inside of the server through a pharming attack or remote access to the outside. In the case of Windows, the log setting unit 320 performs log setting to enable object access tracking audit and process tracking audit in the advanced security audit policy. The log setting unit 320 performs log setting to collect data transmitted through all HTTP/HTTPS protocols including data transmitted to the post-body and response-body as a log. Here, methods of the HTTP/HTTPS protocol used by the web server 100 include a verb-type method such as GET, PUT, or POST, and a noun-type method such as HEAD or OPTIONS. For example, GET is a method to load a single resource, and POST is a method that means that data must enter the server (such as creating or modifying a resource or creating a temporary document that needs to be returned). The log setting unit 320 sets the post-body and response-body contents to be logged in order to increase the ability to detect web hacking attacks.

The log collection unit 340 generates log information by collecting logs generated according to log settings. The log collection unit 340 transmits log information to the log analysis unit 380.

According to the protocol setting of the log setting unit 320, the log collection unit 340 supports general plaintext analysis in case of HTTP(80), and in case of HTTPS(443), the ciphertext is used using the certificate and private key of the web server. You can save the log by converting it to plain text.

The model selection unit 360 creates a detection rule scenario by interlocking with web logs (OWASP) and system level application (MySQL, Redis, Postfix, Bind, HAProxy, OpenVPN, Linux command) logs.

The model selection unit 360 develops a scenario generation and management system, but manages possible threat actions based on the threat subject, method, and means from the perspective of 5W1H (who, when, where, what, how, and why) and security Scenarios are defined through log combinations.

The model selection unit 360 may implement a defined scenario with basic information such as a scenario name, classification, and risk level, and provide a detection setting screen reflecting a condition to provide a scenario management service.

The model selection unit 360 develops scenarios linked with various applications and continuously updates modeling information on normal patterns of logs for each server to perform automated abnormality detection.

For example, the model selection unit 360 is a task of avoiding log generation by modifying a profile after logging in as a system-level application abnormal symptom detection scenario, and repetitively executing the root password of the mysql server by searching bash_history after logging in. , You can select the operation of transferring the mysql dump file to the outside after logging in, the operation of saving redis data as a dump file and transferring it to the outside, and the operation of changing the host file simultaneously or at a time difference on multiple servers. have.

The model selection unit 360, for example, manages a situation in which a real user's file is tampered with a ransomware detection scenario (extension conversion, ransom note generation, C&C server connection, etc.). Analysis can be set up for detection.

The log analysis unit 380 performs a scenario correlation analysis by dividing a massive log collected on the cloud into a management log and a security log to develop a scenario-based correlation analysis hacking detection system.

The log analysis unit 380 analyzes the log according to the detection rule (scenario) generated in conjunction with the web log (OWASP) and system level application (MySQL, Redis, Postfix, Bind, HAProxy, OpenVPN, Linux command) logs. .

The log analysis unit 380 may improve the accuracy of detection of abnormal symptoms of ransomware and database access through system level application logging support.

The log analysis unit 380 applies machine learning hacking detection logic through web log analysis, and features necessary for machine learning to learn through POST-BODY logging of all web servers such as Apache, Tomcat, IIS, WebLogic, and WebToB. Is extracted, and an abnormal symptom can be determined through this.

4 to 7 are diagrams for explaining a method of operating a hacking detection security information event for real-time web hacking detection according to an embodiment of the present invention.

Referring to FIG. 4, in step S410, the hacking detection security information event operation unit 300 performs log setting and collects logs. The hacking detection security information event operation unit 300 collects a log including data transmitted to the post-body and response-body, and the program operation location, program execution information, program execution target type and program execution subject, the entire program path, and Logs including one or more of program information can be collected.

In step S420, the hacking detection security information event operation unit 300 transmits log information to the cloud server 200.

In step S430, the hacking detection security information event operation unit 300 monitors the system and network logs in the case of a management log in terms of management.

Referring to FIG. 5, the hacking detection security information event operation unit 300 may monitor through a management log UI.

In step S440, the hacking detection security information event operation unit 300 classifies, manages, and monitors an attack type in the case of a security log.

6, the hacking detection security information event operation unit 300 is a Cookie, Status, Server, Request, Referer, User-Agent, Connection, Host, Accept-Encoding, Method generated in the web server through the security log UI screen. , x-forwarded-for, Remote-addr, Uri, Cache-Control, Content-Length, Request-date, Content-Type log and HTTP protocol request method of web traffic GET, POST, HEAD, OPTIONS, PUT, DELETE, TRACE logs can be managed and monitored.

In step S450, the hacking detection security information event operation unit 300 develops a scenario linked with log information, and continuously updates modeling information on a normal pattern of logs for each server.

In step S460, the hacking detection security information event operation unit 300 performs a scenario correlation analysis on log information based on the scenario.

In step S470, when an attack is detected, the hacking detection security information event operation unit 300 generates detection information including a source IP address corresponding to the log information.

Referring to FIG. 7, the hacking detection security information event operation unit 300 may generate detection information using machine learning.

The hacking detection security information event operation unit 300 derives meaningful features through acquisition and analysis of RFI/LFI attack type learning data, and performs effective and commonly applied data preprocessing.

The hacking detection security information event operation unit 300 supervises learning RFI/LFI attack patterns using Apache Spark machine learning tools, cross-validation of the trained models, and various algorithms to increase accuracy and Parameter tuning, API is applied using the finally created model.

The hacking detection security information event operation unit 300 can verify and improve the accuracy by reading and learning web logs and attack detection logs collected from the existing cloud SaaS service from the ELK stack using the Apache Spark Stream tool. have.

In step S480, the hacking detection security information event operation unit 300 blocks access from the source IP address of the detection information. For example, the web server 100 may add the source IP address of the detection information to the block list and block access corresponding to each source IP address included in the block list.

The above-described embodiments of the present invention may be implemented through various means. Further, embodiments of the present invention may be implemented by hardware, firmware, software, or a combination thereof.

In the case of implementation by hardware, the method according to embodiments of the present invention includes one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), It can be implemented by field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, and the like.

In the case of implementation by firmware or software, the method according to the embodiments of the present invention may be implemented in the form of a module, procedure, or function that performs the functions or operations described above. A computer program in which software codes and the like are recorded may be stored in a computer-readable recording medium or a memory unit and driven by a processor. The memory unit may be located inside or outside the processor, and may exchange data with the processor through various known means.

In addition, combinations of each block of the block diagram attached to the present invention and each step of the flowchart may be performed by computer program instructions. Since these computer program instructions can be mounted on the encoding processor of a general-purpose computer, special purpose computer or other programmable data processing equipment, the instructions executed by the encoding processor of the computer or other programmable data processing equipment are each block of the block diagram or Each step of the flow chart will create a means to perform the functions described. These computer program instructions can also be stored in computer-usable or computer-readable memory that can be directed to a computer or other programmable data processing equipment to implement a function in a particular way, so that the computer-usable or computer-readable memory It is also possible to produce an article of manufacture in which the instructions stored in the block diagram contain instruction means for performing the functions described in each block or flow chart. Computer program instructions can also be mounted on a computer or other programmable data processing equipment, so that a series of operating steps are performed on a computer or other programmable data processing equipment to create a computer-executable process to create a computer or other programmable data processing equipment. It is also possible for the instructions to perform the processing equipment to provide steps for performing the functions described in each block of the block diagram and each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code containing one or more executable instructions for executing a specified logical function. It should also be noted that in some alternative embodiments, functions mentioned in blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially simultaneously, or the blocks or steps may sometimes be performed in the reverse order depending on the corresponding function.

As such, those skilled in the art to which the present invention pertains will be able to understand that the present invention can be implemented in other specific forms without changing the technical spirit or essential features. Therefore, the embodiments described above are illustrative in all respects and should be understood as non-limiting. The scope of the present invention is indicated by the claims to be described later rather than the detailed description, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present invention. .

Claims (8)

In the hacking detection security information event operating system,
A log setting unit configured to perform a setting for collecting logs in at least one of a web server and a web server operating system;
A log collection unit generating log information including the logs collected according to the setting; And
A model selection unit for continuously updating modeling information on a normal pattern of logs for each server by developing a scenario linked with the log information; And
Including a log analysis unit for performing a scenario correlation analysis on the log information based on the scenario,
The model selection unit
In the case of a system-level application anomaly detection scenario, the task of avoiding log creation by modifying the profile after login, repetitively executing the root password of the mysql server by searching bash_history after logging in, and sending the mysql dump file to the outside after logging in Select a scenario that includes a task of performing a task, saving redis data as a dump file and transferring it to the outside, and changing a host file at the same time or with a time difference on multiple servers,
In the case of a ransomware detection scenario, the situation in which the actual user's file is altered is detected by analyzing the combination of management log and security log, occurrence, and pattern,
The log analysis unit
Scenario-based correlation analysis To develop a hacking detection system, a scenario correlation analysis is performed by dividing the vast log collected in the cloud into a management log and a security log,
Analyzes logs by detection scenarios created in conjunction with web logs and system level application logs,
A hacking detection security information event operation system that extracts features required for machine learning to learn through postbody logging of a web server.
The method of claim 1,
The log setting unit,
Collects logs including data transmitted to post-body and response-body, and logs that include at least one of program operation location, program execution information, program execution target type and program execution subject, full program path, and program information. Hacking detection security information event operating system that performs settings to collect.
delete delete In a hacking detection security information event operation method for real-time web hacking detection in a hacking detection security information event operating system,
Performing settings for collecting logs;
Generating log information including the log collected according to the setting;
Transmitting the log information to a cloud server;
Developing a scenario linked with the log information and continuously updating modeling information on a normal pattern of logs for each server; And
Including the step of performing a scenario correlation analysis on the log information based on the scenario,
Developing a scenario linked with the log information and continuously updating the modeling information on the normal pattern of logs for each server
In the case of a system-level application anomaly detection scenario, the task of avoiding log creation by modifying the profile after logging in, repetitively executing the root password of the mysql server by searching bash_history after logging in, and sending the mysql dump file to the outside after logging in Select a scenario that includes a task of performing a task, saving redis data as a dump file and transferring it to the outside, and changing a host file at the same time or with a time difference on multiple servers,
In the case of a ransomware detection scenario, the situation in which the actual user's file is altered is detected by analyzing the combination of management log and security log, occurrence, and pattern,
Performing a scenario correlation analysis for the log information based on the scenario
Scenario-based correlation analysis To develop a hacking detection system, a scenario correlation analysis is performed by dividing the vast log collected in the cloud into a management log and a security log,
Analyzes logs by detection scenarios created in conjunction with web logs and system level application logs,
A hacking detection security information event operation method that extracts features necessary for machine learning to learn through postbody logging of a web server.
The method of claim 5,
The step of performing the setting for collecting logs in the hacking detection security information event operation unit includes collecting logs including data transmitted to the post-body and response-body, and the program operation location, program execution information, and program execution target type. And a hacking detection security information event operating method configured to collect a log including one or more of a program execution subject, a full program path, and program information.
delete delete

Images