KR102458075B1 - Malware response method to ensure high availability of cyber physical system - Google Patents

Abstract

The present invention relates to a malicious code response method for ensuring high availability of a cyber-physical system, and more particularly, to an attack tree that can be caused by the identified malicious code after identifying an expected malicious code from a network message of the cyber-physical system High availability of a cyber-physical system that can quickly respond to zero-day attacks and minimize damage by creating a firewall configuration file based on the model and transmitting it to devices corresponding to the network section where malicious code can be propagated It relates to a method of countermeasures against malicious code for guarantee.

Description

Malware response method to ensure high availability of cyber physical system

The present invention relates to a malicious code response method for ensuring high availability of a cyber-physical system, and more particularly, to an attack tree that can be caused by the identified malicious code after identifying an expected malicious code from a network message of the cyber-physical system High availability of a cyber-physical system that can quickly respond to zero-day attacks and minimize damage by creating a firewall configuration file based on the model and transmitting it to devices corresponding to the network section where malicious code can be propagated It relates to a method of countermeasures against malicious code for guarantee.

Malicious code is a set of malicious or exploitable software, and is a generic term for all software that is potentially dangerous to users and computers, such as viruses, worms, spyware, and malicious adware. Currently, more than 200,000 new variants of malicious code are newly discovered every day around the world, and the amount of malicious code is increasing every year.

On the other hand, cyber-physical system is a complex system that connects the real physical world system with information and communication devices through sensors and actuators. Although it was separated from the external network because of its configuration, a detour attack caused by malicious code revealed limitations in dealing with a simple air gap policy. And for maintenance, it became necessary to connect to an external network.

The security of these cyber-physical systems consists of a blacklist-based security technology that registers a list of malicious codes that cause infringing behavior and blocks them through monitoring, and a whitelist-based security technology that registers normal network packets and then transmits only the registered network packets. is being applied

However, since the currently applied security technology operates based on the communication protocol to detect and block various malicious behaviors on the Internet, the cyber physical system built with an independent platform and control technology has the There is a problem that the information protection mechanism cannot be applied as it is.

For example, the Internet is only a system for information delivery, and it is possible to respond through immediate blocking to prevent information leakage when a malicious behavior occurs. Therefore, if it is blocked, the availability of system operation is reduced.

Also, in general, attackers who perform malicious actions using malicious codes mainly perform cyber attacks using mutant malicious codes that are modified from existing malicious codes. This is because it is relatively easy and the development cost is low.

In addition, there is a problem in that it is difficult to deal with an attack using such a malicious code because, when a security vulnerability is discovered, a zero-day attack is performed by exploiting the vulnerability before the existence of the problem itself is announced.

Accordingly, since the security technology based on blacklist and whitelist lacks responsiveness to unregistered malicious codes, in order to effectively respond to intrusions caused by various malicious codes, malicious codes are identified and identified malicious codes are identified. Appropriate countermeasures are required for infringing behavior that the code may cause.

Therefore, there is a need for a method that can maximize the availability of system operation by identifying malicious behaviors that cause usability problems in the cyber-physical system and responding to possible infringements through this.

The present invention has been devised to solve the above problems, and an object of the present invention is to identify malicious code included in a network message collected from a cyber-physical system, and to block and respond to intrusive actions against the identified malicious code. It is to provide a malicious code countermeasure method to ensure high availability of a cyber physical system that can maximize the availability of system operation by minimizing damage to the cyber physical system.

In order to achieve the above object, the present invention performs static and dynamic analysis on previously collected malicious code to construct a clustering model that groups specific patterns of malicious code and an attack tree model for malicious code-induced intrusion behavior. ; identifying a malicious code by inputting network messages of the cyber-physical system collected in real time into the clustering model; extracting an attack tree model corresponding to the identified malicious code; extracting a malicious code response section to prevent the identified malicious code infringing actions from being performed and propagated; and generating a firewall setting file based on the extracted attack tree model and transmitting it to devices corresponding to the malicious code response section. is to provide

In a preferred embodiment, the network messages may be collected in a mirroring manner.

In a preferred embodiment, the extracting of the malicious code correspondence section comprises: extracting nodes to which a network message having a malicious code identified in the network graph of the cyber-physical system can be reached; and constructing a network graph composed of the extracted nodes as a minimum spanning tree, and selecting step-by-step nodes of the minimum spanning tree as a malicious code-corresponding section.

In a preferred embodiment, the malicious code response section has a step-by-step correspondence section that is a set of nodes stepping away from the node of the source address step by step, and includes a step-by-step corresponding section included within a certain distance from the node of the source address. The malicious code response section is selected.

In addition, the present invention further provides a computer program stored in a recording medium for a method for countering malicious codes for ensuring high availability of the cyber-physical system using a computer.

The present invention has the following excellent effects.

According to the malicious code countermeasure method for ensuring high availability of the cyber physical system of the present invention, malicious code in network messages is detected through the malicious behavior clustering model and attack tree model generated by performing static and dynamic analysis of the collected malicious code. After identifying and extracting infringing behaviors that may occur from the identified malicious code, the firewall configuration file for the infringing behaviors is created and transmitted to the devices included in the network section that requires response, thereby minimizing damage and providing a system with high availability. It has the advantage of being able to operate

In addition, according to the malicious code countermeasure method for ensuring high availability of the cyber-physical system of the present invention, unlike the blacklist and whitelist-based security technologies, unregistered malicious code has a similar characteristic pattern through the malicious behavior clustering model. It has the advantage of being able to effectively respond to zero-day attacks by identifying malicious code and creating and providing a firewall configuration file for the identified malicious code infringing actions.

1 is a flowchart of a malicious code countermeasure method according to an embodiment of the present invention;
2 is a flowchart of a clustering model and an attack tree model generation process according to an embodiment of the present invention;
3 is a flowchart of a malicious code response section extraction process according to an embodiment of the present invention;
4 is a diagram showing a network graph of a cyber-physical system according to an embodiment of the present invention;
5 is a network graph in which nodes reachable by a network message having an identified malicious code are extracted according to an embodiment of the present invention;
6 is a diagram showing a minimum spanning tree and a step-by-step malicious code correspondence section according to an embodiment of the present invention.

As for the terms used in the present invention, general terms that are currently widely used as possible have been selected, but in certain cases, there are also terms arbitrarily selected by the applicant. So the meaning must be understood.

Hereinafter, the technical configuration of the present invention will be described in detail with reference to preferred embodiments shown in the accompanying drawings.

However, the present invention is not limited to the embodiments described herein and may be embodied in other forms. Like reference numerals refer to like elements throughout.

1 is a flowchart of a malicious code countermeasure method according to an embodiment of the present invention, FIG. 2 is a flowchart of a clustering model and an attack tree model generation process according to an embodiment of the present invention, and FIG. It is a flowchart of the extraction process of the malicious code response section.

1 to 3 , the malicious code response method according to an embodiment of the present invention identifies malicious code in a network message of a cyber-physical system and creates a firewall setting file based on the identified malicious code intrusion behavior. The present invention relates to a method for performing security of the cyber-physical system by transmitting to devices included in a network section in which a response is to be performed.

In addition, the malicious code countermeasure method according to an embodiment of the present invention is performed by a computer, and the computer stores a computer program that functions the computer to perform the malware countermeasure method.

In addition, the computer refers to a computing device in a broad sense including a smart device such as a smart phone or a tablet PC as well as a general personal computer.

In addition, the computer program may be provided by being stored in a separate recording medium, and the recording medium may be specially designed and configured for the present invention or may be known and available to a person skilled in the field of computer software. .

For example, the recording medium includes a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as a CD and DVD, a magneto-optical recording medium capable of both magnetic and optical recording, ROM, RAM, and flash memory. and the like, alone or in combination, may be a hardware device specially configured to store and execute program instructions.

In addition, the computer program may be a computer program composed of program instructions, a local data file, a local data structure, etc. alone or in combination, and may be executed by a computer using an interpreter as well as machine code such as generated by a compiler. It may be a computer program written in a high-level language code that can be

Also, according to the present invention, a server for storing the computer program and receiving a network message from the cyber-physical system to perform the malicious code countermeasure method may be separately provided.

Hereinafter, the malicious code countermeasure method of the present invention will be described in detail.

The malicious code response method according to an embodiment of the present invention includes the steps of constructing a malicious behavior clustering model and an attack tree model (S1000), identifying the malicious code (S2000), and extracting the attack tree model of the identified malicious code. Step S3000, extracting the malicious code response section (S4000), and transmitting the firewall setting file to the malicious code response section (S5000) are included.

First, in the malicious code response method according to an embodiment of the present invention, a clustering model and an attack tree model are constructed (S1000).

In detail, the clustering model and the attack tree model are formed based on the analyzed characteristic patterns and infringing behaviors after performing static and dynamic analysis of previously collected malicious codes (S1100) (S1200).

In addition, the malicious code may be collected through mirroring in the cyber-physical system.

The static analysis is a method of performing analysis without separately executing malicious code, and analyzes specific patterns such as size, content, delivery address, time, and time interval of a network message in which malicious code is generated.

In addition, the static analysis may be performed using ssdepp, which identifies similarity by hashing binaries in block units, PeID, which identifies whether or not packing is applied to malicious code, and a commercial analysis tool.

In the dynamic analysis, the malicious code is directly executed in an emulator or virtual machine environment for the infringement actions that appear after executing the analysis.

In addition, the static analysis may be performed using a process explorer, a system explorer, a process monitor, and a commercial analysis tool.

The malicious behavior clustering model is a model in which specific patterns of malicious codes collected through the static analysis are clustered in a preset manner and grouped. The clustering model may be performed by various known algorithms, preferably K- means algorithm can be used.

In addition, a process for generating a clustering model may be performed after performing a pre-processing process for extracting a feature vector for dozens of specific patterns through the static analysis.

The attack tree model is a model in which intrusion actions that can be performed to apply a malicious action are structured in a tree format, and is generated using the intrusion actions of malicious codes collected through the dynamic analysis.

Next, a malicious code is identified by receiving network messages from the cyber-physical system and inputting them into the clustering model (S2000).

In addition, in order to identify the malicious code by inputting the network message into the clustering model, static analysis is performed according to the type of data used to generate the clustering, and a process of extracting a specific pattern or a feature vector from a specific pattern is performed. can be

In addition, whether or not the network message is malicious code can be determined through the clustering model, and even new or modified malicious code not used to generate the clustering model can be identified as malicious code having a similar characteristic pattern. can

Next, an attack tree model corresponding to the identified malicious code is extracted (S3000).

Here, the attack tree model is an attack tree model corresponding to the identified malicious code among the attack tree models generated for each malicious code.

Next, a malicious code response section is extracted to prevent the identified malicious code infringement actions from being performed and propagated (S4000).

4 is a diagram showing a network graph of a cyber-physical system according to an embodiment of the present invention. 6 is a diagram showing a minimum spanning tree and a step-by-step malicious code correspondence section according to an embodiment of the present invention.

4 to 6 , the malicious code response section is extracted based on the sending address and the receiving address of the network message having the identified malicious code, and the following process is performed.

First, nodes to which a network message having an identified malicious code can be reached are extracted from the network graph of the cyber-physical system generated in advance ( S4100 ).

The network graph expresses the components of the cyber-physical system as nodes, and visualizes the relationship between the components through a connection line. It is possible to extract the reachable nodes (e) by the preset communication method and destination setting.

In addition, the components of the cyber-physical system include devices such as a sensor, an operating system, a control system, and a network device.

Next, the network graph composed of the extracted nodes (e) is configured as a minimum spanning tree, and a section corresponding to the step sequence malicious code is selected (S4200).

The minimum spanning tree is an algorithm that can construct a tree using a given network graph at a minimum cost. Through this, unnecessary connection lines connected between each node can be removed, and a section corresponding to the malicious code of each node can be selected.

In detail, the malicious code correspondence section has a step-by-step correspondence section (level1, level2, ...) that is a set of nodes that step away from the node (a) of the source address through the minimum spanning tree, A step-by-step corresponding section (level1, level2, ...) included within a predetermined distance from the node (a) of the source address may be selected as the malicious code response section.

In addition, the step of the corresponding section may be variously set by the user according to the environment and security level of the cyber-physical system.

Next, the firewall setting file is transmitted to the devices corresponding to the malicious code response section.

Here, the firewall setting file may be automatically created based on the extracted attack tree model, or may be a firewall setting file created in advance for each attack tree model.

In addition, when a firewall setting file is previously created for each attack tree model, a firewall setting file corresponding to the extracted attack tree model may be selected and transmitted to devices corresponding to the malicious code response section.

Therefore, the malicious code response method of the present invention extracts a malicious code response section that can be affected by malicious code, creates and transmits a firewall setting file so that devices included in the section can respond to malicious code, and transmits the malicious code. In addition to minimizing the damage caused by the code, it is possible to operate the cyber-physical system with high availability.

In addition, the malicious code countermeasure method of the present invention identifies malicious code having a similar characteristic pattern through a clustering model even when unknown new or variant malicious code is included in the network message, and sets up a firewall for the identified malicious code intrusion actions By creating and providing a file, it has the advantage of being able to effectively respond to a zero-day attack.

As described above, the present invention has been illustrated and described with reference to preferred embodiments, but it is not limited to the above-described embodiments, and those of ordinary skill in the art to which the present invention pertains within the scope not departing from the spirit of the present invention Various changes and modifications will be possible.

delete

Claims (5)

constructing a clustering model in which specific patterns of malicious code are grouped by performing static and dynamic analysis on previously collected malicious code and an attack tree model of malicious code-induced intrusion;
identifying malicious codes by inputting network messages of the cyber-physical system collected in real time into the clustering model;
extracting an attack tree model corresponding to the identified malicious code;
extracting a malicious code response section to prevent the identified malicious code infringing actions from being performed and propagated; and
Including; generating a firewall setting file based on the extracted attack tree model and transmitting it to devices corresponding to the malicious code response section;
Extracting the malicious code response section:
extracting nodes to which a network message having an identified malicious code is reachable from the network graph of the cyber-physical system; and
A malicious code for ensuring high availability of a cyber-physical system, comprising: constructing a network graph composed of extracted nodes into a minimum spanning tree and selecting step-by-step nodes of the minimum spanning tree as a malicious code response section; How to respond. The method of claim 1,
The malicious code countermeasure method for guaranteeing high availability of a cyber-physical system, characterized in that the network messages are collected in a mirroring method.
3. The method of claim 2,
The malicious code response section has a step-by-step correspondence section that is a set of nodes stepping away from the node of the source address as the starting point, and the step-by-step corresponding section included within a certain distance from the node of the source address is selected as the malicious code response section A malicious code response method for ensuring high availability of a cyber-physical system, characterized in that A computer program stored in a recording medium to execute the malicious code countermeasure method for guaranteeing high availability of the cyber-physical system according to any one of claims 1 to 3 using a computer.





delete

Images