KR19990027327A - Real-time analyzer and analysis method of audit data - Google Patents

Abstract

The present invention is a real-time analysis method and analyzer of the audit data to support the real-time analysis function of the audit system that performs the audit tracking and analysis function of the audit data generated in the computer network to solve the problem of information security vulnerability of the system in the computer network In order to perform a real-time analysis function, we develop a real-time analysis technique of the audit data using the active rules of the active database system, and the audit system minimizes the damage to the system from intrusions occurring in the system, In order to detect, the real-time analysis and audit concept is provided by applying the ECA rule, which is an active rule describing the activeness of the active database, to the audit data analysis by switching from the batch process of the audit data to the real-time analysis function. It can be used in all environments that require high performance.In systems where authentication and security are implemented, effective real-time analysis can be used to further strengthen system management. It can also be used in an EDI environment, an electronic document exchange system.

Description

Real-time analyzer and analysis method of audit data

The present invention relates to a real-time analysis method and analyzer for audit data to support the real-time analysis function of the audit system that performs the audit tracking and analysis function of the audit data generated in the computer network.

Recently, with the rapid development of information industry and communication technology, the use of computer system on the Internet is increasing rapidly.

Based on ARPANET, the exchange network of the US Department of Defense, which is the origin of the Internet, the Internet has been used mainly for the exchange of research data in schools and research institutes.In the 1990s, the Internet has been actively commercialized. Up to users are using the Internet.

However, due to the bugs and vulnerabilities of Transmission Control Protocol / Internet Protocol (hereinafter referred to as TCP / IP), a standard protocol constituting the Internet, and bugs in the operating system, Computer systems have encountered a variety of information security issues.

For example, server systems operated and managed in public institutions, research laboratories, schools, businesses, and private networks are threatened with external intrusions, threatening the system's resources and important data, and sometimes even fatally.

There are many techniques for the way an intruder uses to log in to the system illegally.

These methods mainly deal with bugs in the daemon process provided by the server system operating in the client / server structure, architecture and operational bugs that can occur in the computer network, and bugs in the operating system itself. The intrusion form used is mentioned.

Specific types of intrusions using bugs include IP spoofing, Domain Name Server (DNS) cheating, Network File System (NFS), and Network Information Service. Service (hereinafter referred to as NIS) bugs, packet sniffing, network scanning, sendmail, trojan horse, computer viruses, back doors, There are various types of methods, including setuid bit programs, denial of service, buffer overflows, and intrusions using Web server bugs.

These methods are well known forms of intrusion and can be exploited by unknown bugs.

In order to secure systems and resources from intrusions violating known integrity, availability, confidentiality, and the like, efforts to solve the problem by using methods such as data transmission, reception, encryption, and firewall are currently in many fields. Is going on.

However, the above methods have their own disadvantages. Using data encryption techniques can cause communication overhead problems, and authentication and firewall systems also have disadvantages in that they cannot efficiently control users after authentication.

In general, an audit system such as an independent intrusion detection system and an audit tracking system detects an abnormal behavior by detecting a deviation behavior using log information generated by a user.

At this time, there was a problem of late detection of the current system intrusion by using batch processing and periodic log analysis which lack the concept of real-time analysis in the analysis function of log information.

In order to solve the above problems, the present invention, in order to support the real-time analysis (real_time analysis) function to the audit system that performs the audit trail and analysis of the audit data (audit data) generated in the computer network, active database (active database) By developing a real-time analysis method of audit data using the active rules of the system, it detects the intrusion from the system intrusion as soon as possible and reports it to the system administrator, thereby reducing the damage of the system and detecting the intrusion in progress. There is a purpose.

1 is a block diagram of an audit system for supporting a real-time analysis function according to the present invention,

2 is a block diagram of a real-time audit analyzer of the audit data using the active rule of the active database to which the present invention is applied,

3 is a flowchart of a real-time audit analysis process of audit data using an active rule according to the present invention.

Explanation of symbols for main parts of the drawings

100: Audit System 101: Case Classifier

102: Activity Database 104: Anomaly Detector

105: Audit Recorder 106: Rule Generator

107: Profile Generator 108: Alarm

109: Profile Database 110: Rules Database

111: normal database 112: abnormal database

113: Audit Provider 200: External Computer Network

210: Real Time Audit Analyzer 211: Event Classifier

212: active database system 212a: database

212b: Active Rule 213: Profile Information

214: Anomaly Pattern Rule Information

In order to achieve the above object, the present invention provides an event classifier daemon process for generating audit data using log information generated from a computer network, an anomaly detector performing an analysis function of the generated audit data, and an inactive audit of the analyzed audit data. An audit recorder that records data in the database, a profile generator that describes the user's normal patterns using past audit data, a rule generator that updates the analysis rules of the audit data, and an audit on service request from the auditor An audit provider interface for providing a service, and an alarm to alert the system administrator by informing an alarm when an abnormal event occurs, characterized in that the alarm.

The amount of incident data related to audits in the system is enormous and manual collection and analysis of data are not possible.

Therefore, the concept of auditing with automated analysis of audit data is one of the essential concepts in the system.

The audit concept is a technology that detects an event that violates a given security policy through an audit analysis after storing and managing an event generated by a user.

As such, an audit system having an audit and analysis function of a user's use of the system can be utilized in all systems operated and managed on the Internet, and can solve the information security vulnerability problem of the system.

Auditing requires the ability to record each event generated by the user and track when, who and what is done when needed.

In addition, in order to prevent illegal intrusions or minimize system losses due to intrusions, intrusions should be detected as soon as possible through careful investigation and analysis of all activities occurring in the system.

The audit system should provide real-time analysis of audit data that occurs over time in order to minimize the loss of the system.

Therefore, in the present invention, in order to implement the above requirements, the concept of real-time analysis of audit data was developed using active rules of an active database system.

An active database is a system that combines a database with a rule system similar to that used by an expert system to give an active database.

Rules in an active database are described using a rule language that defines ECA rules, using rules consisting of events, conditions, and actions, commonly abbreviated as ECAs.

An event is the cause of triggering a rule. In general, an event is specified for database operations on relations or attributes, and the main database operations that can specify an event include inserts, deletes, and modifications.

The condition is the part that decides whether or not to execute the executed rule when the event occurs.

Predicates can be defined using one of query languages or predlicates.

If the predicate is a query, the condition is satisfied if the value returned by the query is not null.

On the other hand, for predicate descriptions such as large and small, the condition is satisfied if the value returned by the predicate is true.

An action consists of a set of database operations and a set of user procedures that are executed if the condition evaluation of the triggered rule is true.

Wherein a set of operations is ordered and constituted by arbitrary operations that specify any search and modification to any data.

The specification of the action part of the rule can take various forms depending on the characteristics of the system, but it can be summarized in the following three types.

The first is represented by a single statement, the second is an arbitrary database operation, and the third is an application program call.

Rules defined for real-time analysis of user activities in the computer network audit system have an ECA structure of events, conditions, and actions. Events are used to monitor general user activities, and conditions are used to check the type and status of audit data. In this regard, measures are defined to perform the functions of monitoring and analyzing the activities of illegal users.

Rules that can be defined in the audit system include: monitoring login sessions, monitoring specific network services, monitoring users logging in from non-system time zones, monitoring specific commands executed, and leaking excess data from the session. For example, you can define rules such as monitoring excessive login failures.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is an audit system configuration diagram for supporting a real-time analysis function according to the present invention, an event classifier 101 for generating audit data among log information generated in the system, and an activity database for storing audit data generated in the event classifier (102), anomaly detector 104, which is an action part that detects an event defined in an active rule and executes when a condition is satisfied, a profile database 109 with system usage pattern information of a user, system intrusion information, system security policy, Rules database 110 with information on management matters, alerter 108 to notify of illegal system usage on the system in the event of an abnormal condition of audit data, normal according to all audit analysis results generated by users recorded in the activity database Auditor that performs the function of writing to the 111 and the abnormal database 112 105, an audit provider 113 that provides an update service function by using audit data recorded when an audit service is requested from an auditor and a system administrator, and periodically updates the profile database using audit data of a normal database. The profile generator 107 performs a function, and the rule generator 106 performs a function of periodically updating the rule database 110 by using audit data of the abnormal database 112.

The event classifier 101 generates audit data consisting of information on a connection, information on a command to be executed, time information, and information on the use of system resources among log information generated in the system and records the information in an activity database.

The types of audit data generated are classified into audit data for system access and audit data for command execution.

Audit data generated by the event classifier 101 is recorded in the activity database 102, triggering the events defined in the active rules.

The abnormality detector 104 is a user procedure that is an action part that is executed when an event defined in an active rule is detected and a condition is satisfied.

The anomaly detector 104 uses the profile database 109 which contains the system usage pattern information of the user, and the activity database using the rule database 110 which has information about past system intrusion information, system security policy and management matters. Perform an analysis of the audit data recorded in (102).

The alarm 108 alerts the system administrator when an abnormal condition of the audit data is generated by the abnormal detector 104 to inform that an illegal system usage is occurring on the current system.

The audit recorder 105 records all audits generated by the user recorded in the activity database 102 in the normal 111 and the abnormal database 112 according to the analysis result when the user logs out of the system. Perform the function.

The audit provider 113 uses the audit data recorded in the activity database 102, the normal database 111, and the abnormal database 112 when requesting an audit service from an auditor and a system administrator, to provide information about a user who is currently active. And a search service function for providing normal and abnormal audit information that has occurred in the past, and an update service function for updating a profile and rule database.

The profile generator 107 periodically updates the profile database 109 by using the audit data of the normal database 111 to describe a pattern of audit data recently generated by the user.

The rule generator 106 periodically updates the rule database 110 using audit data of the abnormal database 112.

2 is a block diagram of a real-time audit analyzer of the audit data using the active rules of the active database to which the present invention is applied, the computer network 200 to request a connection to the server, the event classifier 211 to generate the audit data for audit analysis , An active database system 212 that executes the operation performed by the event classifier and stores it in the database 212a, a profile information providing unit 213 providing information to the active database system, and abnormal pattern rule information to the active database system. It consists of a real-time audit analyzer 210 including an abnormal pattern rule information providing unit 214 to provide.

The service user of FIG. 2 requests access to a server from an external computer network 200 in order to use a function provided by a specific system.

The real time audit analyzer 210 performs a real time analysis function of the user log information, and the event classifier 211 generates audit data necessary for the audit analysis using the user log information and performs database operations (Insert, Delete) on the database 212a. , Update).

Active database system 212 identifies insert, delete, and update operations performed by event classifier 211 and triggers ECA active rules 212b for audit data analysis stored and managed in database 212a.

An event is defined by the event classifier 211 and performed on the database 212a, and the condition has a function of checking a pattern of audit data.

If the result of the condition check is not null or true, the analysis of the audit data defined in the Action is performed.

3 is a flow chart of a real-time audit analysis process of the audit data using the active rule according to the present invention, when a legal user and an illegal user determine whether there is a service request in the system to use system resources (S1). Obtain log information from the system (S2).

At this time, the event classifier generates and records the audit data in the database (S3), and after the Insert, Delete, Update events occur in the active data system (S4), the service type of the audit data, the user Time and error state is checked (S5).

After checking the service type, user time, and error state of the audit data, it is determined whether the condition of the active rule of the access information is true or false (S6). If true, information is read from the profile and rule database (S7). If false, the activity profile and rule information is read (S8) to perform audit data analysis (S9).

If there is no abnormality by determining an abnormal state of the analysis result (S10), information is read from the profile and rule database, and when an abnormal state is found as a result of analysis of the audit data, an alarm is notified to the system administrator (S11).

As described above, the present invention can exert an excellent effect in all environments that require real-time analysis and auditing concepts. Furthermore, in a system where authentication and security are implemented, system management is further enhanced by using effective real-time analysis results. You can.

In order to prevent illegal intrusion into the computer network, the firewall system currently being researched for the security of the computer network is located between the computer network and the internal computer network and protects the internal computer network by using a user access control method provided by a proxy server. As a system operated for the purpose of, the analysis method of the real-time audit data presented in the present invention can be used.

In addition, there is an effect that can be used in the EDI environment, which is an electronic document exchange system that delivers transaction information by a standardized format between companies.

Claims (5)

In the real-time analysis structure of audit data using active rules, An event classifier daemon processor for generating audit data by using log information generated from a computer network; An abnormality detector for analyzing the generated audit data; An audit recorder for recording inactive audit data among the analyzed audit data in a database; A profile generator for describing a normal pattern of a user by using audit data generated in the past; A rule generator for updating an analysis rule of the audit data; An audit provider interface for providing an audit service when requesting a service from an auditor; Internal structure of the audit system consisting of a real-time analyzer of audit data, including an alarm to alert the system administrator by informing an alarm when an abnormal event occurs. The method of claim 1, wherein the real-time analyzer of the audit data using the active rule of the active database An event classifier for generating audit data for audit analysis; An active database system that executes operations performed by the event classifier and stores them in a database; A profile information provider for providing information to the active database system; An internal structure of an audit system consisting of a real-time analyzer of audit data, characterized by an abnormal rule information section which provides abnormal pattern rule information to an active database system. 3. The event classifier of claim 2, wherein the event classifier Real-time analyzer of audit data, characterized in that to generate the audit data for audit analysis by using the user log information and to perform database operations on the database. The system of claim 2, wherein the active database system is A real-time analyzer of audit data characterized by generating ECA active rules for identifying insert, delete and update operations performed by the event classifier and for analyzing and storing audit data stored in a database. Event classifier daemon process that generates audit data by using log information generated from computer network, abnormal detector that analyzes generated audit data, audit recorder that records inactive audit data among analyzed audit data in database, past Profile generator that describes user's normal pattern by using audit data that occurred in the system, rule generator to update the analysis rule of audit data, audit provider interface that provides audit service when requesting service from auditor, alarm in case of abnormal event In the audit analysis processing method consisting of an alarm to alert the system administrator by informing the intrusion, A first step of judging whether a legitimate user and an illegal user have a service request in the system to use system resources; Acquiring log information from the system when there is a service request after the determination; The event classifier generates and records audit data in a database, and generates an insert, delete, and update event in an active data system, and then checks the service type, user time, and error state of the audit data; A fourth step of judging true false of a condition of an active rule of access information after checking the state of the audit data and reading information from the profile and rule database if it is true; A fifth step of reading the activity profile and the rule information and performing the analysis of the audit data when the condition of the active rule is false after the determination; A sixth step of determining an abnormal state of the analysis result and reading information from the profile and rule database if there is no abnormality; And a seventh step of alerting the system administrator of an intrusion when an abnormal condition is found as a result of the analysis of the audit data.