KR20000010253A - Trespass detection system and module of trespass detection system using arbitrator agent - Google Patents

Abstract

PURPOSE: An intrusion detection system and module of an intrusion detection system using arbitrator agent is provided to prevent general paralysis of system according to destruction of a detection module. CONSTITUTION: The system comprises an agent discriminates whether a system is trespassed by test a packet ascended from a lower network layer using a detection module, and a learning module making the agent learn refer to an intrusion pattern. The learning module uses all records for the agents is operated as next learning's input. The lower network layer controls an application program be capable of receiving a packet from a real data link layer. A network primitive abstraction processes a user menace message transferred from the agents.

Description

Intrusion Detection System using Coordinator Agent and Intrusion Detection Module of Intrusion Detection System

The present invention relates to an intrusion detection system of a network, and more particularly, a user threat behavior message transmitted from monitoring processes learned by unit intrusion behavior on an intrusion detection system based on a detection module and an independent agent-based intrusion detection system. It is about the coordinator agent in charge of processing.

As the Internet expands, the possibility of network intrusion continues to increase, and accordingly, interest in research and development in the field of intrusion detection has continuously increased. Intrusion detection system requires well-processed security-related audit record data. Detailed technology includes security-related audit record data collection technology, data storage technology for later audit, and security-related audit record data analysis and interpretation technology. Currently, research is underway in the direction of user interface providing technology. Currently, various countries such as the United States and the United Kingdom have been conducting research from various angles to develop an intrusion detection system that can prepare for various intrusion attacks. From 1983 to the present, the research is ongoing.

Intrusions into the network fall into two broad categories: misuse intrusion and abnormal intrusion. Misuse Intrusion is an intrusion that uses known weaknesses or bugs in system or application software. For example, a bug in send mail or fingerd on the Internet. Anomaly intrusion is an intrusion determined by observation of differences from normal system usage patterns. An intrusion can be established by establishing a profile of the system to be monitored and finding important differences therefrom. Is detected. Misuse intrusions follow well-known patterns, so they can be detected by pattern matching with audit trail information, but abnormal intrusions are difficult to detect. In this case, since there is no fixed pattern to be compared and analyzed, the introduction of the fuzzy theory approach is necessary. Therefore, for the most ideal intrusion detection, the system has a human-like pattern matching capability due to the tight program, and the system with potential for intrusion should always be thoroughly monitored. And if you classify it as an intrusion for normal user behavior, you should also have the ability to ignore it, based on your experience with your system for a long time, as determined by your security staff. It depends on the heuristic side.

Anomalous behavior detection is based on the assumption that misuse or intrusion types deviate from the unusual behavioral types that deviate from the use of normal systems. It is the attacker who breaks legitimate user revisions, because the attacker behaves differently than normal users. So if the intrusion detection system can estimate normal behavior during a user session, it can determine that the user did not perform normal behavior and an attack was detected. Intrusion detection systems can configure this type as a learning record principle, and report abnormal behavior to human or another intrusion detection system for further analysis. Such an abnormal behavior detection system has a characteristic of screening through the summary of regional information, the development of regional information from experience summary, and the establishment of the threshold of abnormal behavior experience. Anomalous behavior detection uses a exponential method that weights disparate data parts and empirical data rather than current data to fuse and explore data, and establish a tolerance for detecting anomalous behavior in the network for types. It proceeds in natural and smooth removal of new data in harmony with the system, but abnormal behavior detection is difficult because the normal behavior can change over time. Furthermore, steady state can be established with different time zones.

In this intrusion detection system, there have been studies focused on behavior classification and data reduction. Behavioral discrimination is a matter of deciding whether or not it is an intrusion or not intrusion for a given set of behaviors, and data reduction reduces the amount of data that can be analyzed for massive amounts of data that can be analyzed up to several megabytes. Say that. In general, the artificial intelligence techniques used to solve these problems use rules-based systems and neural networks or statistical classification systems. The limitations of this approach are that they require a large amount of initial learning and a lot of effort to maintain the system over the life of the system.

Expert systems require expert intervention with a high level of expertise in the field for early rule-based development. This is a very time consuming task. In addition, the more important disadvantage of the expert system approach is that no expert is aware of all the vulnerabilities in the system, and no more can be discovered about the vulnerabilities that arise from the interaction between the weaknesses of many existing systems. If a significant change in the system's profile occurs, then rule-based systems must be redesigned for new intrusion potential. This is a very error prone task, and new rules can deviate from countermeasures against existing system vulnerabilities. More practically, these problems make it difficult for the system operator to operate and maintain current rules, resulting in operations that depend on historical information from the intrusion detection system.

An example of a rule-based intrusion detection system is the IDES system. The system has a rules database that contains knowledge of the target system's vulnerabilities, security policies, and past intrusions. If an intrusion occurs from the state of the current system, the detection system will classify whether or not the current system has been invaded by the rules for intrusion. However, the IDES system has an important characteristic that it remembers the past intrusions compared to the conventional statistical rule-based approach. This is a very important feature in improving the performance of intrusion detection systems because most new intrusion forms are only a partial variation of the existing ones. A new solution proposed by Handy and Luger is to classify the current state of a network system using a classifier system. It derives matrices about network packet information and infers how to classify the network from them. However, this approach has two major limitations. When many computers, such as ATM or FDDI backbones, are connected to a high speed network, performance is noticeable and the information used to determine the state of the network is limited to the header data of the packet. Since the characteristics of the behavior cannot be processed from the information extracted from the header, the header information alone is insufficient to extract useful information necessary for classification. An example of this is that if an intrusion is made through a legitimate mail port, the system by this approach will not be able to identify the intrusion.

The approach proposed by Kephart proposed a detection and removal system for computer viruses similar to the human immune system. However, this approach only focuses on viruses on PC computers, and there is a limit to that there is no mention of abnormal behavior on the system or how to determine if the system is under attack. Kephart's approach, however, addresses some important issues. First, it is about the problem of recognition of intrusion which judges that the action by the user can be an intrusion, learning about intrusion similar to IDES system, and how to deal with intrusion when it is detected.

The approach based on the pattern matching technique proposed by Kumar and Spaffod is focused on the problem of improving the flexibility required by the system, but has the disadvantage of not having the ability to learn. They showed how to classify intrusions based on what appears on the system. Each pattern here encodes dependencies between system states. This approach also has the disadvantage that it depends on powerful methods of detecting intrusions or pre-made patterns. In other words, if the pattern itself is incomplete, there is a huge loophole in the defense of the system. And if there is a change in security policy or system operation, patterns should be recreated.

The intrusion detection system built as one such big module has some problems. The most prominent problem is the system load, which is given to the system equipped with the intrusion detection module. Is analyzed by intrusion detection modules on other systems. In order to analyze audit data, the system kernel must generate audit information for every action on the system, which is enormous and requires huge amounts of system disk space or CPU processing time for this task. . Once the audit data is created, the intrusion detection system reads it and translates it to analyze its association with other system information.

As mentioned above, most of the proposed intrusion detection systems are a single integrated system, which is placed on the operating system of the target system such as the kernel to monitor all processing requests coming into the kernel. However, these system models have many problems such as the load problem on the whole system, the stability problem due to the destruction of the detection module, and the performance guarantee of the system expansion.

SUMMARY OF THE INVENTION The present invention has been made to solve such a problem. The object of the present invention is to divide a target system locally or functionally, and then to perform a plurality of light processes to monitor system resources divided into independent operations. In case of an intrusion into the entire system, it is detected through cooperation between these processes, such as load problems on the existing system, paralysis of the entire function due to the destruction of the detection module, and guarantee of scalability of the detection system according to the expansion of the system. To provide a detection module and coordinator agent for an intrusion detection system.

1 is a block diagram schematically illustrating an intrusion detection system using an independent agent,

FIG. 2 is a block diagram schematically illustrating an independent agent in an intrusion detection system using the independent agent.

3 is a block diagram schematically illustrating the overall structure of an intrusion detection system using a coordinator agent according to an embodiment of the present invention;

4 is a block diagram schematically illustrating an intrusion detection module of an intrusion detection system according to an embodiment of the present invention;

5 is a block diagram schematically showing a detailed configuration of an intrusion detection module of an intrusion detection system according to an embodiment of the present invention;

6 is a flowchart illustrating an intrusion detection method in an intrusion detection module of an intrusion detection system according to an embodiment of the present invention.

In order to achieve the above object, the present invention, the network intrusion detection system agent for inspecting packets coming from the lower network layer with a detection module to determine whether the system intrusion;

A learning module that trains the agent on intrusion patterns and uses all records during the agent's operation as inputs for the next learning;

A lower network layer, which is an interface that allows an application program to receive a packet of an actual data link layer;

In the intrusion detection system using an independent agent consisting of a network initial abstraction is a level that receives the actual network packet from the interface of the lower network layer to change the structure of the packet so that the agent can handle the packet,

And a coordinator agent in charge of processing a user threat message transmitted from agents learned for each unit action.

In addition, the present invention includes an intrusion determination module for determining an intrusion by checking a source address, a protocol port and a symbol, and an intrusion related database after a traffic analysis;

An intrusion-related database module that collects various intrusion patterns;

The intrusion detection module of the intrusion detection system may be formed as a standardized rule loading module that mounts new intrusion patterns in the intrusion related database module.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 1 is a block diagram schematically illustrating an intrusion detection system using an autonomous agent, including a learning module 100, an agent 200, and a lower network layer; DLP1) 300 and Network Primitive Abstraction 400.

The learning module 100 is a module for learning an agent. The agents that have been learned once may operate independently of the learning module, and all records while the agents are operating are used as inputs for the next learning.

The agent 200 determines whether an invasion of the system by inspecting the packet coming from the lower network layer 300 with the detection module in the independent agent-based intrusion detection system, each agent 200 is input to the module in charge of its own If the message is considered to be an intrusion, the intrusion estimate is increased, and when the intrusion estimate reaches a certain threshold, it is regarded as a sure intrusion. As shown in FIG. Placed in the agent by an evaluator 220, the interpreter 220 obtains audit information from the System Abstraction Layer (SAL) 230 and is considered an intrusion if it is considered an intrusion. And increase the intrusion estimate of 240, and the system estimation layer 230 calculates statistics on the audit information and sends the information to the agent. Balls, and a decryption audit information, and the basic element (average CPU usage rate, average number of log-ins) for all systems, as well as to extract a required region continuously provided.

The lower network layer 300 is a Sun DLP1 interface that allows an application to receive a packet of an actual data link layer.

The network initial abstraction 400 is a level that receives the actual network packet from the DLP1 interface, which is the lower network layer 300, and changes the structure of the packet so that the agent 200 can handle the packet.

In such an independent agent-based intrusion detection system, each module process has a form of an agent 200 that is trained to observe behavior patterns of system resources and to notify them of abnormal behavior. For agent learning, genetic algorithms are used to train suspicious patterns of suspicious behavior and then to be placed on each monitored resource. That is, the agent 200 must learn about the intrusion profile in order to monitor the audit information. Genetic Programming (GP) (Koza 1992) introduced in this need allows agent programs to continue to evolve with new and unknown types of intrusion and then be used in real environments. The final result of Genetic Programming is a set of programs, which are loaded into a real system and run continuously. Genetic programming has access to audit data files and is coded in a simple language with the ability to manipulate audit data. In a stand-alone solution, this genetic programming is interpreted by an interpreter 220 which provides it with audit information.

Behavior by system users consists of a series of access and service requests to system resources, so that each user's behavior is monitored on target system resources. Agents 200 that operate independently of each other, when a suspicious activity occurs during monitoring, notify the surrounding agents 200 (Broadcasting), and continuously monitors the behavior of a suspicious specific user. If the behavior exceeds the threshold of certain levels allowed by the system as a whole, it will be considered abnormal and will respond and report. The detection mechanism for this intrusion minimizes the possibility of false-positive errors among the errors that may occur on the detection system, and optimizes and configures each agent 200 for monitoring of the corresponding resource. As a result, it is possible to ultimately improve the performance of the intrusion detection system.

In the present invention, in order to more stably provide a message loss and message processing in the message processing that is the base information of the intrusion detection on the independent agent-based intrusion detection system, transmitted from the monitoring processes learned for each intrusion behavior By adding coordinator agent that can be in charge of handling user threat behavior message, it is not only stabilized message processing problem but also cooperative work between agents 200 of intrusion detection system using independent agent. The intrusion determination function and the management function of the agent 200 that have been performed are also performed to improve the flexibility and expandability of the system.

That is, as shown in Figure 3, the coordinator agent 500 that can make overall adjustment of the intrusion determination and detection module and the system through the interpreter through the audit data and the agent of the two stages based on the independent agent 200 under the The coordinator agent 500 constructs abnormal usage and misuse patterns of internal users using genetic programming into a knowledge database, and includes a black board between the coordinator agent 500 and the independent agent 200. By constructing a black board system, in practice, various agents on the system cooperate to monitor intrusions and build a real-time intrusion detection system by speeding up response to new types of intrusions. That is, the coordinator agent 500 is connected one-to-many with independent agents 200 performing individual tasks to support stable message processing, intrusion detection and reporting, and maintenance of the entire system structure composed of these independent agents 200. And operation.

This coordinator agent 500 is handed over and complements many roles that had to be performed by each independent agent 200 on an independent agent based intrusion detection system. Therefore, there are some important differences in the nature and role between the independent agent 200 in the intrusion detection system according to the present invention and the agent in the FGA. That is, the independent agent 200 in the intrusion detection system using the coordinator agent 500 of the present inventor has a processing load for messages returned from surrounding agents for a number of users who have performed threat actions such as agents in the FGA. It is not necessary. In addition, since the centralized agent manager 510 manages the message information to be transmitted, the central agent agent 510 does not require a separate storage and processing module for this information on the independent agent 200. As a result, independent agents 200 in the intrusion detection system according to the present invention are present in a much lighter form than agents in the FGA, and the role of the user is a threat behavior of individual system resources that can be judged by learning. It is only necessary to find and convey the facts to the central coordinator agent 500. This not only provides the physical or logical scalability of the independent agent 200 based intrusion detection system, but also enhances the advantages of the FGA model over existing centralized intrusion detection systems such as system flexibility, as well as intrusion detection. The message processor 520 in the central coordinator agent 500 exists stably to provide the message processing that is the basis of the present invention. From the standpoint of the coordinator agent 500, the coordinator agent 500 processes the message from the independent agent 200, prepares user-specific behavioral data, and intrusion determination based on the same, to support the system's own intrusion determination algorithm. In addition, the management function of the independent agents 200 is performed to maintain and operate the entire intrusion detection system together with the reporting function. As such, the coordinator agent 500 interacts with the independent agents 200 and detects and reports on intrusions, and manages the independent agents 200, based on a knowledge base having an existing centralized system structure. It has the superior function of an intrusion detection system and there are similar aspects of its structure.

In addition, the present invention in order to determine whether any pattern is an intrusion through the source address, protocol port and signature, and traffic analysis in the intrusion detection system, as shown in Figures 4 and 5 The intrusion determination module 610 determines a source address, a protocol port and a symbol, and an intrusion related database after traffic analysis to determine whether an intrusion is detected, and an intrusion related database module 620 which collects various intrusion patterns. In addition, it provides an intrusion detection module consisting of a standardized rule loading module 630 for mounting new intrusion patterns in the intrusion-related database module.

To determine whether to intrude on any user behavior, the intrusion determination module 610 searches 612 the source address through any authorized pattern analysis 611, and analyzes the protocol port and symbol 613. And a traffic analysis 614. The intrusion scenario pattern is searched in the source address-related database 621, the protocol port and symbol-related database 622, and the traffic-related database 623 of the intrusion-related database module 620 according to each analyzed element. The intrusion scenario pattern is compared with the analyzed input pattern (615) to determine whether the intrusion. In addition, when a predetermined pattern for mounting new intrusion patterns into the intrusion related database module 620 is input, the standardized rule loading module 630 analyzes (631) a source pattern and searches for a source address (632). After analyzing the protocol port and symbol (633), analyzing the traffic (634), each element analyzed is the source address-related database 621 of the intrusion-related database module 620 and the protocol port and symbol-related database ( 622, the traffic related database 623, to form a database for new intrusion patterns.

At this time, the field configuration of each database of the intrusion-related database module 620 is as follows.

The field configuration of the source address related database 621 is composed of a rule name, a source address, a source port, a destination address, a destination port, and an action for determining whether or not to be allowed, as shown in Table 1. .

Field name Field Field Description Rule Name String 10 The name of the rule Source Address String 15 Source address Source Port Integer 2 Origin protocol Dest. Address String 15 Destination address Dest. Port Integer 2 Destination port number Action String One D (disallowed) or P (allowed)

The field configuration of the protocol port and symbol related database 622 is composed of a rule name, a command, and an argument as shown in Table 2.

Field Field type Field Description Rule Name String 10 The name of the rule Command String 10 Command used Argument # 1 String 10 Factor 1 Argument # 2 String 10 Factor 2

In addition, the field configuration of the traffic-related database 623 is composed of the rule name, command, and argument as shown in Table 3.

Field Field type Field Description Rule Name String 10 The name of the rule Command String 10 Command used Argument # 1 String 10 Factor 1 Argument # 2 String 10 Factor 2

A method of determining an actual intrusion in the intrusion detection module formed as described above will be described below with reference to FIG. 6.

The intrusion determination module 610 analyzes whether a source address and a source port exist through an arbitrary pattern analysis in order to determine whether an intrusion is performed for any user action (S1), and the source address and the source port exist. Search for a source address (S2), and then search for an intrusion scenario pattern in the source address-related database 621 composed of the fields as shown in Table 1 of the intrusion-related database module 620. If it is D (disallowed), it is determined as an intrusion (S3). If the source address and source port do not exist (S1), it is analyzed whether a protocol port such as ftp or telnet exists through random pattern analysis (S4). If a protocol port or the like exists, the protocol port or the like is searched (S5), and then a protocol intrusion scenario pattern is searched in the protocol related database 622 having fields as shown in Table 2 of the intrusion related database module 620. If it is determined to be an intrusion (S6), and if a protocol port or the like does not exist (S4), there will be an e-mail and a finger related to traffic (S7). In other words, after the traffic is searched (S8), an intrusion scenario pattern is searched in the traffic related database 623 having fields as shown in Table 3 of the intrusion related database module 620, and a match is determined as an intrusion ( S9).

As described above, in the present invention, the coordinator agent locally or functionally partitions a target system in an intrusion detection system using an independent agent, and then causes several processes in light form to monitor system resources divided into independent operations. In case of intrusion into the entire system, it is detected through cooperation between these processes, which can prevent problems such as load problems on the existing system, paralysis of the entire function due to the destruction of the detection module, and guarantee scalability of the detection system as the system expands. In order to solve the problem, the intrusion detection module may database intrusion patterns and actively detect intrusion by comparing the intrusion scenario with the database when an arbitrary pattern is input. In addition, when configuring the intrusion detection system using the inventor coordinator agent, the load of the monitoring process (agent) can be reduced, the type of intrusion behavior and the weakness of the system can be detected, and the stability of the overall intrusion detection system is ensured. do.

Claims (6)

An agent that determines whether the system is invaded by inspecting a packet coming from a lower network layer in the network intrusion detection system with a detection module; A learning module that trains the agent on intrusion patterns and uses all records during the agent's operation as inputs for the next learning; A lower network layer, which is an interface that allows an application program to receive a packet of an actual data link layer; In the intrusion detection system using an independent agent consisting of a network initial abstraction is a level that receives the actual network packet from the interface of the lower network layer to change the structure of the packet so that the agent can handle the packet, Intrusion detection system using the coordinator agent further comprises a coordinator agent in charge of the processing of the user threat message transmitted from the agents learned for each unit action. The agent of claim 1, further comprising a coordinator agent capable of overall control of the intrusion determination and detection module and the system through an interpreter through audit data, and a two-level agent based on an independent agent under the coordinator agent. An intrusion detection system using a coordinator agent, comprising an internal user's abnormal usage and misuse pattern using genetic programming as a knowledge database, and configuring a blackboard system between the coordinator agent and an independent agent. The method according to claim 1 or 2, wherein the coordinator agent supports the system's own intrusion determination algorithm, the message processing from the independent agent, the creation of user-specific behavioral data and intrusion determination based on it, and reporting on it. Intrusion detection system using the coordinator agent, characterized in that to perform the management function of the independent agent for the maintenance and operation of the entire intrusion detection system. An intrusion determination module that checks an arbitrary pattern for a source address, a protocol port and a symbol, and an intrusion related database after traffic analysis to determine whether it is an intrusion; An intrusion-related database module that collects various intrusion patterns; Intrusion detection module of the intrusion detection system, characterized in that consisting of a regular rule-mounting module for mounting new intrusion patterns in the intrusion-related database module. 5. The system of claim 4, wherein the intrusion-related database module comprises: a source address-related database storing intrusion patterns for the source address; A protocol port and symbol related database storing intrusion patterns for protocol port and symbol; Intrusion detection module of an intrusion detection system, characterized in that the traffic related database is stored in the intrusion patterns stored. 5. The method of claim 3 or 4, further comprising: analyzing whether a source address and a source port exist through any pattern analysis applied; In the above step, if the source address and the source port exist, the source address is searched, and then the intrusion scenario pattern is searched in the database related to the source address to determine whether the invasion occurs. Analyzing whether a protocol port or the like exists; If a protocol port or the like exists in the above step, search for a protocol port or the like, and then search for an intrusion scenario pattern in a protocol-related database to determine whether an invasion exists. Intrusion detection module of the intrusion detection system, characterized in that detecting the intrusion by any user in the step of determining the intrusion by searching the intrusion scenario pattern.