KR20000058818A - Emergency alarm system of internet server - Google Patents

Abstract

PURPOSE: An emergency alarming system of an internet server is provided for stably managing an internet server as the use of the internet is rapidly increased. CONSTITUTION: A server operation member is registered(S1). The server operation member is connected with a web site, and an environment protection information of a corresponding server is inputted, and an emergency state is reported(S2). A program capable of reporting an information of a corresponding server to a checking server is installed in the server, and a related data of a corresponding server is received by the checking server(S3). The traffic amount of a processor is checked(S41). The space of a disc is checked(S42). It is checked as to whether a photo scan is performed(S43). It is checked as to whether a RootKit is installed(S45). An environment information transferred from a registered corresponding server is received and is changed to an analyzable data(S5).

Description

EMERGENCY ALARM SYSTEM OF INTERNET SERVER}

The present invention relates to an emergency alert system of the Internet server, and in particular, while monitoring the Internet server through an external monitoring server, to immediately notify a number of administrators in the event of an error to provide an uninterrupted service, the detailed The present invention relates to an emergency alert system of an internet server capable of providing system operation information.

Due to the rapid spread of the Internet, e-mails, file transfers, newsgroups, websites, etc. have been widely used, and as the number of networks connected to the Internet and the number of Internet users increase rapidly, the number of websites also increases rapidly. have.

Such a web server can be interrupted at any time according to the load of the system regardless of the stability of the hardware due to its characteristics, and therefore can be notified to the administrator due to the technical limitation of a single computer operating alone in case of sudden downtime. There is no need for a large number of specialists to manage specific web servers.

However, in general, server administrators check the server abnormally periodically in order to check whether the server is up and running, so it is very expensive and expensive to monitor a particular server 24 hours a day. It is practically impossible to properly check the ever-changing traffic and the load of the central processing unit (CPU).

In addition, advanced managers who have the ability to accurately grasp the status of the server and cope with problems before they occur are less than 10% of the server administrators. If the server goes down in an unknowing situation, the company loses its credibility, and the web service company has to compensate for the damages to its customers.

On the other hand, the technology for monitoring the operation status of the server existed in the past, but most of these conventional monitoring techniques are limited to the instantaneous measurement function, it is possible to monitor the current status of the instant, but it is possible to monitor the operation status of the server It is difficult to keep track of each time zone, and there is a problem that the abnormality of the server is impossible unless the real-time check is performed continuously.

In general, the security system of the server focuses on defending against external attacks by the security system installed on the server, but cannot detect the initial movement (for example, port scan) to hack a specific server. Due to the inability to implement quick security measures, the consequences are increased.

In addition, due to the above problems, it is impossible to accurately grasp the server operation statistics such as excessive traffic, processor load, and disk usage during a certain time zone which shows continuous server operation state that changes every hour. Abrupt suspension of processor load, and destruction of server data caused by the absence of disk spare, were followed.

Therefore, in order to solve the conventional problems as described above, by using a specific monitoring server to monitor a plurality of the corresponding server while creating server operating statistics, the server administrator in the form of a log file that can be analyzed It provides information to the server to determine whether the server is running or not through the external monitoring server. Detailed information on server operation (processor, memory, hard disk usage, user access time, duration, work, FTP, Telnet, Sendmail usage statistics, the number of Httpd daemons at specific times, the number of CGI daemons at specific times, repeated external ping attact attempts, zombie daemons, external user port scan attempts, specific port access attempts, RootKit Checking whether or not to install from time to time will automatically notify the server administrator every certain time.

In addition, if there is a problem such as a sudden server stoppage or an external attack attempt, the server operator can be notified so that appropriate measures can be taken promptly, and the timing of server hardware upgrade and unnecessary waste of server resources. The purpose of this is to notify the server administrator so that the system can be prevented, so that the system risk time can be determined in advance, so that the system can be promptly repaired and prepared.

1 is a conceptual diagram schematically showing the procedure of the emergency alert system of the Internet server as an embodiment of the present invention.

Figure 2 is a block diagram of the procedure for the configuration of the emergency alarm system of the Internet server as an embodiment of the present invention.

Figure 3 is a graph statistical data showing an example of the operation report of the monitoring server as an embodiment of the present invention

4 to 7 are block diagrams showing the configuration of an emergency alert system of an Internet server according to another embodiment of the present invention.

8 is a conceptual diagram schematically showing a procedure of an emergency alert system showing another embodiment of the present invention.

9 to 10 are process block diagrams showing the configuration of an emergency alert system as another embodiment of the present invention.

Emergency alarm system of the present invention Internet server for achieving the above object is possible by the following program.

In other words, while monitoring a large number of relevant servers using a specific external monitoring server on the Internet, it prepares server operation statistics that combine reports of specific time periods and provides them to the server administrator in the form of log files that can be analyzed. This is enabled by a program that notifies a large number of server administrators when usage is at risk or when hacking is detected by outsiders and when server services are suspended.

Hereinafter, a step-by-step description of the method of the emergency alarm system of the present invention Internet server.

First of all, (S1).

(S2). The server operator member accesses the website operated by the present invention, enters the environmental protection of his / her own server, and registers a method of receiving notification when an abnormality occurs;

(S3). Installing and operating a development program for reporting the information of the corresponding server to the monitoring server on its own server, and receiving the related data of the corresponding server by the monitoring server,

(S) When there is data reception.

(S4) .The daemon installed on the server collects information on the server.

(S41) .Processor amount check.

(S42) .Check the amount of disk.

(S43). Whether to scan the port.

(S44). Check whether zombie daemon occurs.

(S45) .Check if RootKit is installed.

(S5) Receiving the environmental information transmitted from the registered server, and converts it into data that can be analyzed, and informs the server administrator if it is good.

(P) If there is no more than 1 revolution (minute) report from the server

(P1) The monitoring server checks the server in reverse.

(P2) If the server does not have any abnormality, the daemon goes back to collecting the information of the server (S4),

(P3) The server down.

(P41) Overload.

(P42) Not enough remaining.

(P43) There may be a scan

(P44) Zombie daemon

(P45) It is divided into the step (P5) of issuing an emergency alert to the contacts of a plurality of registered server administrators when determining that the RootKit installation is abnormal.

Referring to the operation of the emergency alarm system of the present invention configured as described above in more detail as follows.

First, recruit the server operator members (S1),

The server operator member accesses the website operated by the present invention, enters the environmental protection of his / her own server, and registers a method of receiving a notification when an abnormality occurs (S2).

Install and run the development program for reporting the information of the server to the monitoring server on its own server, the monitoring server receives the server-related data (S3),

If there is data reception (S), the daemon installed in the server goes to step (S4) of collecting information on the server.

At this time, when there is no data reception of the corresponding server (P), the monitoring server checks the corresponding server (P1), and when an issue such as server down occurs, an emergency alert is issued to the administrator of the corresponding server (P5).

In case of receiving the above data (S),

(S41) Processor, memory check.

(S42) .Hard disk usage, access time by user, duration, work contents. Check FTP (File Transfer Protocol), Telnet, Sendmail accounting.

(S43) .Check whether an external user attempts to scan a port, whether or not a specific port is connected, and whether or not a repeated external ping attact is attempted.

(S44). Check the occurrence of zombie daemon, the number of Httpd daemon at a certain time, and the number of CGI daemon at a certain time.

(S45) .It checks data such as whether or not RootKit is installed.

The monitoring server receiving the environmental information transmitted from the corresponding server analyzes and writes the report of the client into a log file capable of sequential analysis, and informs the administrator of the corresponding server of the comprehensive report (S5).

However, when the data reception of the corresponding server is not more than one cycle (minutes) (P), the monitoring server checks the server in reverse (P1), and performs an abnormal alarm command (P5) to the server. If there is a problem with the server (P2),

Overload (P41) occurs in the processor usage check (S41),

Insufficient remaining amount (P42) in the disk usage check (S42),

Attempt to scan port scan (S43), Scan attempt (P43),

Zombie daemon occurs (P44) in the check whether or not the zombie daemon occurs (S44),

In the case of RootKit installation check (S45) is classified as RootKit installation (P45), when such an abnormality occurs, the following emergency alert is issued to the contacts of a plurality of registered server administrators (P5).

① An alarm is issued when the hard disk usage exceeds the specified limit.

② An alarm is issued when the processor usage exceeds the specified limit.

③ An alarm is issued when the memory usage exceeds the specified limit.

(4) Attempt port scan, Ping attact, RootKit installation or unauthorized port connection alert will be issued.

Therefore, the server administrator who is alerted can immediately be notified when the server is stopped or attempted to scan ports for the purpose of server hacking, and users who have long-term access to the system for a separate purpose. Since this is possible, stable management of the server will be possible.

In addition, by analyzing the load level of the system, it is possible to predict when to upgrade the system in advance, and when the disk usage reaches a critical level, it can be notified to prevent data loss due to lack of space.

You can take countermeasures by identifying the scripts that are putting a heavy load on the system, and by detecting and removing zombie daemons remaining in the memory, you can prevent wasting server resources.

On the other hand, Figure 4 to Figure 7 shows another embodiment of the present invention, as shown in Figure 4 using a particular monitoring server to report the operating status from a plurality of servers, the server administrator to write the operating statistics of the server It is possible to operate the monitoring server provided by

As shown in Figure 5, when the server shows the hard disk, memory, processor usage out of the registered value is another embodiment showing an emergency alert system of the Internet server to notify the administrator of the server.

In addition, FIG. 6 is an emergency alert system that notifies the server administrator when a specific server detects a possibility (port scan attempt) by an outsider.

In FIG. 7, when the monitoring server is stopped, the monitoring server checks the corresponding server to determine whether the corresponding server is down and notifies the corresponding server administrator.

9 is another embodiment of the present invention, recruits the corresponding server operator members (S1 '), inputs the relevant server related information (S2'), and the monitoring server checks the corresponding server (P1 '), and When the server is down (P3 '), the server abnormality alarm is issued to the multiple administrators of the server (P5'), and the monitoring server periodically checks whether the server is down without receiving relevant data from the server. To form a server emergency alert system that notifies the server administrator,

FIG. 10 recruits domain administrator members (D1), inputs the relevant domain related information (D2), and the monitoring server periodically checks the corresponding domain (D3) without receiving the relevant data of the corresponding domain, and then downloads the corresponding domain. If D4) is found, an emergency alarm system is issued to issue (D5) an abnormality alarm of the domain to a plurality of managers of the domain.

[Glossary]

* server;

A computer or computer program that serves web servers, Web pages (HTML pages or files), and so on.

Every web server computer, etc. has a single IP address (or domain name). For example, if an Internet user enters http://kmh.yeungnam-c.ac.kr/index.html as the URL in his web browser, the browser will have a domain name of kmh.yeungnam-c.ac.kr. Send a web page (index.html) request to the server. Upon receiving the request, the server finds the page and sends it to the requesting browser.

Any computer can be a web server by installing a web server program and connecting to the Internet.

The most used web server programs are as follows.

ㆍ UNIX environment: Apache, CERN, NCSA

ㆍ Windows NT: IIS (Internet Information Server), Apache NT

Windows 98: WebSite. OmniHTTPd

* FTP

FTP (File Transfer Protocol) is an upper layer protocol of TCP / IP. FTP realizes reliable file transfer between computers.

FTP is also an application protocol of TCP / IP on the Internet, such as HTTP (Hypertext Transfer Protocol) for transferring web pages and related files that can be displayed on the screen, and Simple Mail Transfer Protocol (SMTP) for sending e-mail.

FTP is commonly used to transfer files associated with web pages from the author's computer to the server for everyone to see on the Internet.

It is also commonly used to download programs or files from other servers to your computer.

ㆍ Telnet's biggest advantage and disadvantage was that all the work of Telnet was done through the terminal of the remote branch.

In other words, all data is centrally managed in the host system. However, as the distributed server system and the client server system become popular, the limit of distributed data management has been reached.

Especially for data exchange between networks in a wide area network such as the Internet, a protocol for only file transfer using TCP sessions is needed for stable transmission of data.

That is FTP.

FTP also provides a command set like Telent. Unlike Telnet's full support for UNIX's text-based command mode, it provides a minimal set of commands for file transfers.

ㆍ FTP needs to designate FTP server directory and FTP client directory, so it can be divided into two commands: R (Remote) command and client command.

The FTP service also provides flexibility in the transmission method, which uses ASCII mode for text only transmission and binary mode for other large files. If I know the connection ID and password of the remote FTP server I want to connect to, I can connect with that ID. If I am not a registered user on the public FTP server, I connect anonymously.

* Telnet

Telnet (remote computer access) refers to a service where a user in a specific area connects a computer located elsewhere online. Once connected to the remote system, the user can use the connected remote computer as if it were a hardware-connected terminal.

In the TCP / TP protocol scheme, this feature is called "TELNET". Internet users can use TELNET to access BBS, various book databases and information systems from various universities, text-only databases, data files and many other online services. You can be provided.

ㆍ General users of the Internet can access many systems that cover these various services without having their own accounts.

The reason why this application service is so effective is that it can be easily connected to a remote system regardless of distance. Internet users can access any system on the earth easily and at a moderate speed, just as if they were accessing a system in the next building.

Normally, in order to telnet to a remote host, you must have an account on the host. However, hosts that provide some public services (such as providing a white page directory) do not have to have personal accounts.

* Ping attack

Ping is a command to know whether a system that communicates over the Internet is currently running and a round trip time to communicate to a desired system.

=> Finger

Packet Internet Groper, a program used to check reachability to a destination by sending an ICMP change request and waiting for a response.

The term is used at the same time as in "Ping HostX to make sure HostX is working properly".

Ping attack is a type of attack that is attempted to interrupt the function of a server by making a large number of requests using the net function of the ping.

Httpd daemon

On the web, each server has an HTTPD that waits for incoming requests. A daemon is a program, which, as interpreted in Webster's dictionary, means "guardian spirit or soul." The daemon waits for incoming requests and forwards them for proper processing.

CGI daemon

CGI is an abbreviation of Common Gateway Interface, but it processes various information in HTML in web browser, but it can't handle all the information by its function alone. CGI serves as a connection between external programs and web server (HTTP Server) to supplement this. The protocol for doing this is CGI.

Or, it can be said to include external programs that perform CGI in a broad sense.

For example, if you want to create a guestbook on the homepage that can receive comments from visitors, you can't solve it with HTML that is implemented on the web. Therefore, since an external program is required, the protocol for exchanging between the external program and the web at this time is called CGI, and the program used at that time is called a gateway program, which is often called a CGI program (or script). This CGI program is usually implemented using C / C ++, PERL or UNIX Shell, cl / Tk, etc.

A CGI program must exist on the server and be ready to run whenever the user requests it to run at any time. Again ignorant, there should always be a process called the web server daemon.

The requester, ie, the client, enters data into an input form using a web browser or otherwise prepares data to be sent to the server. The web browser receives the data and sends the data via TCP / IP to the connected web server.

The web server daemon receives this data as a CGI environment variable (QUERY_STRING) or standard input and passes it to the CGI program.

ㆍ Here CGI program works. The program connects to an ASCII, binary file or database on the server, performs input or output, and receives the returned result.

The CGI program processes this result, formats it to the appropriate Multipurpose Internet Mail Extension (MIME) Type, and passes it back to the daemon.

The daemon passes the formatted results back to the Web browser, or client, using TCP / IP. The web browser displays the data from the CGI program to the browser according to the MIME Type.

Guest books, bulletin boards, counters, etc. that we commonly talk about are programs that follow 100% of the CGI flow. What is called a "guestbook source" or "bulletin source" can be implemented in various programming languages for the web server environment.

Zombie Daemon

The process that the web server initiates to perform a certain task persists, even though its role is terminated, to occupy the system's processor and memory, reducing the overall performance of the system.

Port scan

To access a particular server, you need to search the port that the server is currently serving.

A user who always uses the server will continue to use the open port, but a user who is not associated with the server (such as a hacker) will be able to attack the vulnerability of the open port after searching the port that the server is serving.

* Rootkit

Once a hacker has gained root privileges on a particular server, he or she installs a special program on that server in case he or she comes back in, or monitors the real administrator's behavior and keeps receiving specific information.

* Server

The server refers to a computer that receives surveillance service by registering information to use this service.

Monitoring server

It is a server that collects and processes information periodically to monitor a number of relevant servers and issues an alert to the registrant when an abnormality is found.

* traffic

The amount of data transfer between the network that occurs through the file transfer and the connection between the server and client.

Log file

The Web / File / Mail server or the like records the movement of the user using the server in text form according to a preset condition.

Depending on the settings, various information such as connection time, connection movement, and connection address are recorded in this file and used for future server status analysis.

As described above, the present invention implements various analysis and emergency alarm systems that cannot be performed by the server itself moving individually, and writes server operation statistics while monitoring a plurality of servers using a specific monitoring server. It provides this information to the server administrator in the form of log file that can be analyzed. Detailed information on server operation (processor, memory, hard disk usage, user-specific) is determined through external monitoring server to determine whether the server is running. Connection time, duration, work history, File Transfer Protocol (FTP), Telnet, Sendmail usage statistics, number of Httpd daemon at a certain time, number of CGI daemons at a certain time, repeated external ping attact attempts, zombie daemon occurrence Check whether the external user attempts to scan the port, whether or not a specific port is attempted, or whether RootKit is installed Because it automatically notifies the server administrator at regular intervals,

In case of a problem such as sudden server interruption or an external attack attempt, the server operator is notified so that appropriate actions can be taken promptly, and the timing of server hardware upgrade and unnecessary waste of server resources are prevented. It notifies the server administrator so that it can do so, and provides the service that can determine the system risk time in advance, and also has the effect of quick recovery and countermeasures of the system.

Claims (7)

By using a specific external monitoring server to monitor a large number of relevant servers, create server operation statistics that combine reports from specific time periods and provide them to the server administrator in the form of log files that can be analyzed. An emergency alert system for an Internet server, wherein an administrator is notified when a possibility is detected by an outsider or when the service of the server is stopped. In description of Claim 1. Emergency alarm system of the Internet server, characterized by receiving the operating status from a plurality of servers using a specific monitoring server, and writes the operating statistics of the server to the server administrator. In description of Claim 1. An emergency alert system of an Internet server, which notifies the administrator of the server when the server shows hard disk, memory, and processor usage that are out of registered values. In description of Claim 1. An emergency alert system for an Internet server, which notifies the server administrator when a possibility of a port scan attempt is detected by an outsider. In description of Claim 1. Emergency monitoring system of the Internet server, characterized in that when the monitoring server is stopped, the monitoring server checks the server to determine whether the server is down and notifies the server administrator. In the description of claim 1, The emergency alert system of the Internet server, characterized in that by periodically checking the server to determine whether or not down and notify the server administrator. In the description of claim 1, An emergency alarm system of an Internet domain, characterized by periodically checking the domain to determine whether it is down, and notifying the domain administrator.