KR102210051B1 - Separating network system with honeypot - Google Patents

Abstract

The present invention relates to a network separation system to which a honeypot is applied, comprising: a control means; Photographing means; First review means; First conversion means; First detection means; Second conversion means; And monitoring means; Including, it is possible to reliably protect the system even if the components used to build the video security system contain malicious software, etc., and it is possible to safely utilize the video data of the video security system established in public institutions or public enterprises. In addition, it is possible to increase the utilization of the video security system and increase the efficiency of integrated control of the video security system in the vicinity, as well as to check and respond to the infringement in real time when an infringement activity on the video security system occurs, so that new cyber attack information can be collected. It is characterized in that it is possible to improve the security of the system by providing feedback.

Description

Network separation system with honeypot applied {SEPARATING NETWORK SYSTEM WITH HONEYPOT}

The present invention relates to a network separation system to which a honeypot is applied, and more particularly, even if malicious software is included in components used for building a video security system, the system can be reliably protected, and is built in public institutions or public enterprises. It is possible to safely utilize the video data of the video security system to increase the utilization of public services, improve the efficiency of integrated control of the video security system in the surrounding area, and check the fact of infringement in real time when an infringement on the video security system occurs. It relates to a network separation system to which a honeypot is applied, which can cope with it, so that it is possible to collect new cyber attack information and to improve the security of the system by feeding it back.

In recent years, emergencies such as terrorism in the public sector, kidnapping, and arson against major facilities and safety accidents of children are emerging as social issues, and accordingly, the installation of real-time video security systems based on surveillance cameras has rapidly increased. Are doing.

However, as components necessary to build a video security system, such as network cameras and network video recorders (NVRs), have been developed into network products, malicious software (malware), etc. The threat of security breaches caused by components used to build a video security system is increasing, such as hacking is possible through this.

In particular, the issue of security infringement on network cameras disclosed on public and private internet networks has been an issue several times through the mass media.In April 2016, a bot that can create a distributed denial of service (DDoS) attack Malware was discovered in Chinese network cameras sold on Amazon, and in November 2016, a large-scale DDoS attack occurred on US DNS companies using a botnet included in a Chinese network video security product.

Accordingly, the US Congress passed the National Defense Authorization Act (NDAA), banning the use of Chinese-made network video security items at major facilities.

Meanwhile, a number of Chinese-made network video security products have already been supplied, installed, and operated in network video security systems operated by domestic public institutions and public enterprises.

In addition, there is a need for external sharing and public use of photographed data for video security systems operated by public institutions and public enterprises, but it is difficult to secure the stability of the system against external intrusion threats such as hacking, so it is shared externally. I'm avoiding it.

Therefore, even if the components used to build the video security system contain malicious software, the system is physically separated from the network to protect the system from intrusion (hacking) through external networks, and the technology is rapidly advancing. There is a need to collect data on aggressive network infringement methods for system administrators' awareness of infringement methods and to establish rapid countermeasures.

Korean Patent Registration No. 10-0926456

Accordingly, an object of the present invention is to solve such a conventional problem, and to provide a network separation system to which a honeypot is applied that can reliably protect the system even if the components used for the video security system construction include malicious software, etc. have.

In addition, it provides a network separation system with honeypots that can safely utilize the image data of the video security system established in public institutions or public enterprises, thereby enhancing the utilization of public services and increasing the efficiency of integrated control of the video security system in the surrounding area. Is in.

In addition, since it is possible to check and respond to the infringement of the video security system in real time, it is possible to collect new cyber attack information, and a network separation system with a honeypot that can improve the security of the system through feedback. In the offering.

The object is, according to the invention, the control means; Photographing means operating under the control of the control means; First review means for receiving first control data for controlling the photographing means from the control means and for reviewing whether the first control data is normal or abnormal; A first conversion means for receiving, as a result of the review by the first review means, the first normal control data, converting it into first one-way data transmitted unilaterally in one direction, and transmitting it to the photographing means; First detection means for receiving abnormal first control data as a result of the review by the first review means, and detecting first cracker data included in the abnormal first control data; Second conversion means for receiving the abnormal first control data from the first detection means and converting it into second one-way data that is unilaterally transmitted in one direction; And a monitoring means for receiving and storing the first cracker data and the second one-way data, and transmitting the second one-way data to the cracker server when the first cracker data includes information on the cracker server. A honeypot comprising a is achieved by a network separation system applied.

Here, image separating means for separating the image data from the photographed data photographed by the photographing means; A third converting means for receiving the image data from the image separating means, converting it into third one-way data transmitted in one direction, and transmitting it to the control means; Second review means for receiving the photographing data from the photographing means or the image separating means, and examining whether the second control data included in the photographing data is normal or abnormal; A fourth conversion means for receiving, as a result of the review by the second review means, the normal second control data, converting it into fourth one-way data that is unilaterally transmitted in one direction, and transmitting it to the control means; Second detection means for receiving abnormal second control data as a result of the review by the second review means, and detecting second cracker data included in the abnormal second control data; And a fifth conversion means for receiving the abnormal second control data from the second detection means and converting it into fifth one-way data that is unilaterally transmitted in one direction. In addition, the monitoring means receives and stores the second cracker data and the fifth one-way data, and when the second cracker data includes information of the cracker server, the fifth It is desirable to transmit one-way data.

Here, it is preferable that the information of the cracker server is address information of the cracker server or data stored in the cracker server.

Here, the monitoring means is connected to the second conversion means to receive and store the first cracker data and the second one-way data, and when the first cracker data includes information on the cracker server, the cracker A first monitoring unit for transmitting the second unidirectional data to a server; And connected to the fifth conversion means to receive and store the second cracker data and the fifth unidirectional data, and when the second cracker data includes information of the cracker server, the fifth unidirectional data is transferred to the cracker server. A second monitoring unit for transmitting data; It is preferable to include.

Here, the first review means determines the first control data to be abnormal when the protocol of the first control data is different from a preset protocol, and the second review means comprises: When the protocol is different from the preset protocol, it is preferable to determine the second control data as abnormal.

According to the present invention, the system can be stably protected even if malicious software or the like is included in the components used to build the video security system.

In addition, it is possible to safely utilize the image data of the video security system established in public institutions or public corporations, thereby increasing the utilization of public services and increasing the efficiency of integrated control of the video security system in nearby areas.

In addition, since it is possible to check and cope with the fact of infringement in real time when an infringement activity on the video security system occurs, it is possible to collect new cyber attack information and improve the security of the system by providing feedback.

1 is a schematic diagram showing the configuration of a network separation system to which a honeypot is applied according to a first embodiment of the present invention;
2 is a schematic diagram showing the configuration of a network separation system to which a honeypot is applied according to a second embodiment of the present invention;
3 is a schematic diagram showing a configuration of a network separation system to which a honeypot is applied according to a third embodiment of the present invention;
4 is a flow chart showing a state in which the network separation system to which the honeypot is applied according to the first embodiment of the present invention is operated to determine whether malicious software or the like is included in components used for system construction,
5 is a flow chart showing a state in which a network separation system to which a honeypot is applied according to the second and third embodiments of the present invention is operated to determine whether malicious software or the like is included in a component used for system construction and respond to it.

Hereinafter, a network separation system to which a honeypot according to the present invention is applied will be described in detail with reference to the accompanying drawings.

Here, Honeypot refers to a system intentionally installed to detect abnormal access through an external network, that is, infringement such as hacking, and detects and tracks by attracting spam, computer viruses, and cracker servers that invade the system. It is widely used to prevent cyber terrorism because it can collect information.

The present invention applies the concept of a honeypot to a physical network separation system so that the system can be stably protected even if a component used for building a video security system includes malware (malware).

1 is a schematic diagram showing the configuration of a network separation system to which a honeypot is applied according to a first embodiment of the present invention.

First, referring to FIG. 1, the network separation system 10 to which the honeypot according to the first embodiment of the present invention is applied is largely a control means 100, a photographing means 200, a first review means 110, and a first conversion. It comprises a means 120, a first detection means 130, a second conversion means 140, and a monitoring means 300.

The control means 100 is the operation of the photographing means 200, for example, elevating, pan, tilt, zoom, etc., power on/off, and start or completion of photographing. As a component that controls the like, control data, that is, first control data, is transmitted to the photographing means 200 for this purpose. In this specification, it has been described that the control means 100 controls the photographing means 200, but may be configured to control the entire network separation system 10 to which the honeypot according to the present invention is applied. In addition, the control means 100 is preferably capable of storing an image photographed through the photographing means 200, and for this purpose, a network video recorder (NVR) or the like can be used as the control means 100.

The photographing means 200 is a component such as a camera installed in a place for monitoring or security by operating under the control of the control means 100, and one or a plurality of network cameras can be used. Such photographing means 200 The video recorded with) becomes the recording data.

The first review means 110 is a component that receives first control data for controlling the photographing means 200 from the control means 100 and examines whether the first control data is normal or abnormal.

The first conversion means 120 is one-way (Simplex) data, that is, first one-way data, which receives the first control data of a normal person as a result of the review by the first review means 110 and is transmitted unilaterally toward one direction. It is a component that is converted to and transmitted to the photographing means 200. As a method of converting the normal first control data into first unidirectional data, various known methods, such as using an encoder, can be used.

The first detection means 130 is a component that receives abnormal first control data as a result of the review by the first review means 110 and detects first cracker data included in the abnormal first control data.

The second conversion means 140 is a component that receives abnormal first control data from the first detection means 130 and converts it into second one-way data that is unilaterally transmitted in one direction. Like the first one-way data converted through the first conversion means 120, the abnormal first control data converted into the second one-way data cannot be accessed through the second one-way data.

The monitoring means 300 receives and stores the first cracker data and the second one-way data, and when the first cracker data includes the information of the cracker server 20, the second one-way data is transmitted to the corresponding cracker server 20. It is a component that transmits.

Here, the information of the cracker server 20 may correspond to address information of the cracker server 20, for example, an IP address, a domain name, a URL (Uniform Resource Locator), and the like, In addition, address information of data stored in the cracker server 20, for example, a data location address (Uniform Resource Locator), etc. may be used.

2 is a schematic diagram showing the configuration of a network separation system to which a honeypot is applied according to a second embodiment of the present invention.

As shown in Fig. 2, the second embodiment of the present invention is similar to the first embodiment described above, but in the case of the first embodiment, the control means 100 among the components used when constructing the network separation system 10 to which the honeypot is applied. In the second embodiment, there is a difference in reviewing and processing whether malware is included in the photographing means 200 in addition to the control means 100 in the second embodiment.

Accordingly, the network separation system 10 to which the honeypot according to the second embodiment of the present invention is applied, in addition to the components used in the first embodiment, includes an image separation means 210, a third conversion means 220, and a second review means. (230), a fourth conversion means 240, a second detection means 250 and a fifth conversion means 260 is configured to further include.

First, the image separating means 210 is a component for separating the image data from the photographed data captured by the photographing means 200, and a so-called parsing engine may be used.

The third conversion means 220 is a component that receives image data from the image separation means 210, converts it into third unidirectional data transmitted in one direction, and transmits it to the control means 100. Accordingly, access from the control means 100, which is the receiving side of the third unidirectional data, to the third conversion means 220, which is the transmitting side through the third unidirectional data, is blocked.

The second review means 230 is a component that receives photographing data from the photographing means 200 or the image separating means 210 and examines whether the second control data included in the photographing data is normal or abnormal. Here, in the illustrated drawing, the second review means 230 is arranged and configured after the image separation means 210, but the second review means 230 is disposed between the photographing means 200 and the image separation means 210 Thus, after first examining whether the second control data included in the photographing data is normal or abnormal, the image separating means 210 may be configured to separate the image data.

The fourth conversion means 240 receives the second control data, which is a normal person, as a result of the review by the second review means 230, converts it into fourth one-way data transmitted unilaterally in one direction, and transmits it to the control means 100. It is a component, and access from the control means 100, which is the receiving side, to the fourth conversion means 240 through this fourth one-way data becomes impossible.

The second detection means 250 is a component that receives abnormal second control data as a result of the review by the second review means 230 and detects second cracker data included in the abnormal second control data. The second detection means 250 may extract the second cracker data through the same method as the first detection means 130 detects the first cracker data, or may extract the second cracker data by another method. have. In the case of the first detection means 130, similar to the extraction of data related to the malware included in the control means 100, the second detection means 250 collects data related to the malware included in the photographing means 200. It will be extracted.

The fifth conversion means 260 is a component that receives abnormal second control data from the second detection means 250 and converts it into fifth one-way data that is unilaterally transmitted in one direction.

In addition, the monitoring means 300 for receiving and storing the first cracker data and the second one-way data in the first embodiment receives and stores the second cracker data and the fifth one-way data in the second embodiment.

When the second one-way data is transmitted and the first cracker data includes information of the cracker server 20 such as IP address, domain, URL, etc., the monitoring means 300 transmits the second one-way data to the corresponding cracker server 20. ).

In addition, when the fifth unidirectional data is transmitted to the monitoring means 300 and the information of the cracker server 20 is included in the second cracker data, the fifth unidirectional data is transmitted to the corresponding cracker server 20.

That is, if the information of the cracker server 20 exists in the first cracker data and the information of the cracker server 20 does not exist in the second cracker data, only the second one-way data is transmitted to the corresponding cracker server 20, If the information of the cracker server 20 exists only in the second cracker data, only the fifth one-way data is transmitted to the cracker server 20.

At this time, if information of the cracker server 20 is included in both the first cracker data and the second cracker data, the second one-way data and the fifth one-way data are transmitted to the corresponding cracker server 20, but different IP addresses Is configured to send to.

3 is a schematic diagram showing the configuration of a network separation system to which a honeypot is applied according to a third embodiment of the present invention.

The network separation system 10 to which the honeypot is applied according to the third embodiment of the present invention is almost the same as the second embodiment described above, but is distinguished from each other in that the monitoring means 300 is physically divided and configured.

That is, in the case of the third embodiment, the monitoring means 300 is divided into two, and the first monitoring unit 310 and the second monitoring unit 320 are configured, and the first monitoring unit 310 is provided with the same configuration as in the first embodiment. The first cracker data and the second unidirectional data are transmitted and stored, and the second cracker data and the fifth unidirectional data are transmitted and stored in the second monitoring unit 320.

In this case, if malware is included in the control means 100 and the information of the cracker server 20 is included in the first cracker data, the first monitoring unit 310 sends the second one-way data to the corresponding cracker server 20. Will be transmitted.

In addition, when malware is included in the photographing means 200 and information of a cracker server 20 different from the first cracker data is included in the second cracker data, the second monitoring unit 320 20), the fifth one-way data is transmitted.

If malware is included in both the control means 100 and the photographing means 200, and the first cracker data and the second cracker data contain information of different cracker servers 20, the first and second The monitoring unit 320 separately transmits the second one-way data and the fifth one-way data to the corresponding cracker server 20, respectively.

On the other hand, when malware is included in both the control means 100 and the photographing means 200, and the same cracker includes such malware, in other words, the second one-way data is transmitted to the first monitoring unit 310, 2 When the fifth one-way data is transmitted to the monitoring unit 320 and the information of the same cracker server 20 is included in both the first cracker data and the second cracker data, the second one-way data is sent to the corresponding cracker server 20. And the fifth one-way data is transmitted. The first monitoring unit 310 for transmitting the second one-way data and the second monitoring unit 320 for transmitting the fifth one-way data are physically divided and have different IP addresses. It is transmitted to the cracker server 20.

Hereinafter, a state in which the network separation system to which the honeypot is applied according to the present invention is used will be described.

4 is a flow chart showing a state in which the network separation system to which the honeypot is applied according to the first embodiment of the present invention is operated to determine whether malicious software or the like is included in components used for system construction and to respond.

First, data for controlling the photographing means 200, that is, first control data, is generated from the control means 100 and transmitted to the photographing means 200.

In the present invention, the first control data is not directly transferred to the photographing means 200, but is first transferred to the first review means 110 (S100), so that the first control data transferred from the control means 100 is normally controlled. It goes through a process of reviewing whether data or abnormal control data (S110), that is, whether malware is included in the control means 100 used to construct the network separation system 10 to which the honeypot according to the present invention is applied. do.

At this time, whether the first control data is normal or abnormal is determined by comparing a protocol of the first control data with a protocol preset in the first review unit 110. In other words, if the protocols match each other, it is judged as normal, and if they are different, it is judged as abnormal.

This is a protocol preset by performing an operation such as including malware in the control means 100, and including content not instructed by the system administrator or additional content in addition to the instructed by the malware in the first control data. If it is determined that it is different from the first control data, the corresponding first control data can be determined as abnormal control data. In particular, if the first control data contains important protocols such as addition, deletion, or change of photographing data, not the system administrator's instruction, the presence of malware can be assured.

In this way, the first control data transmitted from the control means 100 passes through the first review means 110 before being transferred to the photographing means 200, so that malware is included in the control means 100, and the malware is Even if the applied network separation system 10 is operated as soon as it is constructed or is operated after a certain period of time, it is always possible to check whether the first control data is normal or abnormal. That is, the first review means 110 serves to check the presence of malware that may have been stored in the storage means in advance by the cracker.

If the first control data reviewed through the first review means 110 is normal (S120), that is, if it is determined that the control means 100 does not contain malware, it is transmitted to the first conversion means 120 (S122) Then, the normal first control data is converted into first one-way data (S124) and transmitted to the photographing means 200 (S126), and the photographing means 200 is driven according to the contents of the first one-way data.

One-way data refers to data in which the flow direction of data proceeds in only one direction, and a communication method such as TV broadcast or radio broadcast, for example, the relationship between a microphone and a speaker, is divided into a transmitting side and a receiving side. In other words, in such a situation, the broadcasting station unilaterally transmits the image data, and at home, the TV is viewed through the image data unilaterally transmitted from the broadcasting station. That is, the broadcasting station unilaterally transmits data to the home, and the home can only watch TV with the data received from the broadcasting station, but cannot transmit it to return to the broadcasting station.

That is, in the present invention, by converting the normal first control data into first one-way data and transferring it to the photographing means 200, the photographing means 200, which is the receiving side of the first one-way data, operates according to the first one-way data. , Access to the control means 100, which is the transmitting side through the first one-way data, is essentially blocked.

Next, when the first control data is determined to be abnormal as a result of the review through the first review means 110 (S120), that is, when the control means 100 contains malware or the malware operates, the protocol of the first control data If it is determined that it is different from the preset protocol, the abnormal first control data is transmitted to the first detection means 130 (S130).

The first detection means 130 detects the first cracker data from the abnormal first control data (S140), and a method of detecting the first cracker data may use various known techniques. Here, the first cracker data may be log data generated by logging abnormal first control data, or may be extracted data obtained by directly extracting information on malware included in the control means 100.

Then, the second conversion means 140 receives the abnormal first control data from the first detection means 130 (S150), converts it into second one-way data that is unilaterally transmitted in one direction (S160), and the monitoring means It is transmitted to (300) (S170). As such abnormal first control data is converted into second one-way data, it becomes impossible to access the transmitting side through the second one-way data.

In the monitoring means 300, the first cracker data detected through the first detection means 130 and the second one-way data converted by the second conversion means 140 are transferred (S170) and stored. The monitoring means 300 may analyze the transmitted first cracker data to determine what purpose and how the malware included in the control means 100 by the cracker will operate, but in most cases, malware It is difficult to determine the contents of malware except for the presence of

Accordingly, in the present invention, it is determined whether information of the cracker server 20, for example, the IP address, domain, URL, etc. of the cracker server 20 exists in the first cracker data (S180), and if the cracker server 20 If information exists, the second one-way data is transmitted to the cracker server 20 through this (S190).

In this way, when the information of the cracker server 20 is known, the information of the cracker server 20 is recorded in a blacklist in the monitoring means 300 so that the corresponding cracker server 20 can be monitored.

In addition, by transmitting the second one-way data to the cracker server 20, it is possible to block the cracker from accessing the monitoring means 300, which is the transmitting side, through the second one-way data.

On the other hand, even if the cracker server 20 that has received the second one-way data performs a system command for checking the IP address of the control means 100 containing malware such as ifconfig, inconfig, ipconfig, netstat, etc., the control means 100 The IP address of the monitoring means 300 is checked, not the IP address of ).

That is, the cracker may think that the attempted system intrusion was successful without being aware of the fact that it is being detected and monitored, but the system administrator recognizes the presence of malware included in the control means 100 and is preparing for external intrusion. Therefore, it can be used in a variety of ways, such as detecting and tracking cracker information, collecting information such as cracker attack timing and pattern, and improving the security of the system.

5 is a flow chart showing a state in which a network separation system to which a honeypot is applied according to the second and third embodiments of the present invention is operated to determine whether malicious software or the like is included in a component used for system construction and respond to it.

First, the photographing means 200 operates to generate photographing data (S200). The operation of the photographing means 200 may be based on the first control data of the control means 100, in particular, the contents of the first one-way data converted from normal first control data. That is, the second and third embodiments of the present invention can be viewed as being connected and operated in the above-described first embodiment, and the step of generating photographing data in FIG. 5 (S200) includes the first unidirectional data in FIG. It may be a step performed after the step (S126) transmitted to the photographing means 200.

Next, in FIG. 5, the photographing data generated by the photographing means 200 is shown to be transmitted (S210, S260) to the image separating means 210 and the second review means 230, respectively, and the second review means 230 The photographing data transmitted to) may be transmitted from the image separating means 210.

The image separating means 210 separates the image data from the transmitted photographing data (S220), and the separated image data is transmitted to the third conversion means 220 (S230) and is transmitted unilaterally toward one direction. It is converted into one-way data (S240).

Here, the third conversion means 220 may use the same data conversion method as the first and second conversion means 140. In addition, the image data is decoded in real time and converted into an AVI file or an MP4 file, or security To increase the performance, convert it into unidirectional data, for example, serial data or parallel data, and then convert it into unidirectional data converted into image data by second decoding after converting it into low data. It may be configured to do.

In addition, the third one-way data is transmitted to the control means 100 (S250). Likewise, a video playback device separately connected to the control means 100 together with the fourth one-way data transmitted to the control means 100, for example, a monitor It may be transmitted to and displayed, or a separate image storage device may be provided for storage.

Meanwhile, when the photographing data is transmitted to the second review means 230 (S260), the second review means 230 reviews whether the second control data included in the photographing data is normal or abnormal (S270). Similar to the first review means 110 for comparing the protocol of the first control data, the second review means 230 compares whether the protocol of the second control data is the same as or different from a preset protocol to control the second control data. It determines whether the data is normal or abnormal. In this way, since the second control data undergoes a review step through the second review unit 230, it is possible to check the presence of malware that the cracker may have previously stored in the component, that is, the photographing unit 200.

If the second control data is normal (S280), that is, if it is determined that the photographing means 200 does not contain malware, the normal second control data is transferred to the fourth conversion means 240 (S282), and this is It is converted into data (S284) and transmitted to the control means 100 (S286), and transmitted to the display device together with the above-described third unidirectional data to display the third unidirectional data.

And, if the second control data is abnormal (S280), that is, if it is determined that malware is included in the photographing means 200, the abnormal second control data is transmitted to the second detection means 250 (S290), and the second cracker is Data is detected (S300).

Next, the fifth conversion means 260, which has received the abnormal second control data from the second detection means 250 (S310), converts it into fifth one-way data (S320), and the monitoring means 300 has a second The cracker data and the fifth one-way data are transmitted (S330).

The monitoring means 300 checks whether information of the cracker server 20 such as an IP address, domain, URL, etc. of the cracker server 20 exists in the second cracker data (S340), and if present, the cracker server 20 ), the fifth one-way data is transmitted (S350), and even if the cracker server 20 performs a system command for checking the IP address of the photographing means 200, the monitoring means (not the IP address of the photographing means 200) ( 300)'s IP address can be verified to hide the fact that crackers are being detected and tracked.

If both the second one-way data and the fifth one-way data are transmitted to the monitoring means 300, and the information of the cracker server 20 is included in both the first cracker data and the second cracker data, different IP addresses The second unidirectional data and the fifth unidirectional data are transmitted.

Therefore, even if the cracker server 20 performs a system command for checking the IP addresses of the control means 100 and the photographing means 200, different IP addresses are checked, and this is the control means 100 and the photographing means, respectively. It is recognized as the IP address of (200).

Meanwhile, in the network separation system 10 to which the honeypot according to the present invention is applied, the review result of the first control data through the first review means 110 or the review result of the second control data through the second review means 230 is abnormal. Or, whether it is normal, whether the first cracker data or the second cracker data is detected, whether the information of the cracker server 20 is present, etc. are inserted as subtitles such as text or images, and the system administrator uses a video playback device, for example. For example, it can be configured to include a separate caption insertion means (not shown) that is displayed through a monitor so that the system administrator can easily recognize it.

The scope of the present invention is not limited to the above-described embodiments, but may be implemented in various forms within the scope of the appended claims. Without departing from the gist of the present invention claimed in the claims, any person of ordinary skill in the art to which the present invention belongs is considered to be within the scope of the description of the claims of the present invention to various ranges that can be modified.

10: network separation system with honeypot applied 20, 20a, 20b: cracker server
100: control means 110: first review means
120: first conversion means 130: first detection means
140: second conversion means 200: photographing means
210: image separation means 220: third conversion means:
230: second review means 240: fourth conversion means
250: second detection means 260: fifth conversion means
300: monitoring means 310: first monitoring unit
320: second monitoring unit

Claims (5)

In the network separation system to which a honeypot is applied, which includes a control means and a photographing means operating under the control of the control means, and detects whether malicious software is included in one or two or more of the control means and the photographing means. In,
A first review of receiving first control data for controlling the photographing means from the control means, reviewing whether the first control data is normal or abnormal, and determining whether malicious software is included in the control means Way;
A first conversion means for receiving, as a result of the review by the first review means, the first normal control data, converting it into first one-way data transmitted unilaterally in one direction, and transmitting it to the photographing means;
First detection means for receiving abnormal first control data as a result of the review by the first review means, and detecting first cracker data included in the abnormal first control data;
Second conversion means for receiving the abnormal first control data from the first detection means and converting it into second one-way data that is unilaterally transmitted in one direction; And
The first cracker data and the second one-way data are received and stored, and when information of a cracker server is included in the first cracker data, the second one-way data is transmitted to the cracker server, and the second one-way data Monitoring means for monitoring the access of the cracker server that has received the transmission;
A network separation system to which a honeypot is applied, including. The method of claim 1,
Image separating means for separating image data from the photographing data photographed by the photographing means;
A third converting means for receiving the image data from the image separating means, converting it into third one-way data transmitted in one direction, and transmitting it to the control means;
Second review means for receiving the photographing data from the photographing means or the image separating means, and examining whether the second control data included in the photographing data is normal or abnormal;
A fourth conversion means for receiving, as a result of the review by the second review means, the normal second control data, converting it into fourth one-way data that is unilaterally transmitted in one direction, and transmitting it to the control means;
Second detection means for receiving abnormal second control data as a result of the review by the second review means, and detecting second cracker data included in the abnormal second control data; And
A fifth conversion means for receiving the abnormal second control data from the second detection means and converting it into fifth one-way data that is unilaterally transmitted in one direction; Including more,
The monitoring means,
Receiving and storing the second cracker data and the fifth unidirectional data, and transmitting the fifth unidirectional data to the cracker server when the second cracker data includes information on the cracker server Network separation system. The method of claim 2,
The information of the cracker server,
The network separation system to which the honeypot is applied, characterized in that it is address information of the cracker server or data stored in the cracker server. The method of claim 3,
The monitoring means,
The second one-way data is connected to the second conversion means to receive and store the first cracker data and the second one-way data, and the second one-way data to the cracker server when the first cracker data includes information on the cracker server. A first monitoring unit for transmitting a signal; And
The fifth one-way data is connected to the fifth conversion means to receive and store the second cracker data and the fifth one-way data, and the fifth one-way data to the cracker server when the second cracker data includes information on the cracker server. A second monitoring unit that transmits;
A honeypot-applied network separation system comprising a. The method according to any one of claims 2 to 4,
The first review means,
If the protocol of the first control data is different from a preset protocol, the first control data is determined as abnormal,
The second review means,
The network separation system to which the honeypot is applied, characterized in that when the protocol of the second control data is different from a preset protocol, the second control data is determined to be abnormal.

Images