KR20000065547A - Intelligent Intrusion Detection System based on distributed intrusion detecting agents - Google Patents

Abstract

PURPOSE: An intrusion detection system is provided to collect dynamically intrusion information from distributed intrusion detection agents, train the distributed intrusion detection agents, and send trained detection codes to detectors to enhance an intrusion detection efficiency. CONSTITUTION: An intrusion detection system comprises a plurality of detectors, a detector coordinator, a scenario generator, and a detector training engine. The detectors receive a kernel audit data according to detection codes, and analyzes a degree of suspicion. The detector receives the degree of the suspicion, determines if an intrusion occurs at a current computer node, and performs an automatic proper measure. The scenario generator generates virtually an operation sequence of a non-normal state and a normal state. The detector training engine trains the detectors via the scenario, and distributes detection codes.

Description

Intelligent Intrusion Detection System based on distributed intrusion detecting agents

The present invention relates to an intrusion detection system, and more particularly, based on a distributed intrusion detection agent that dynamically collects intrusion information from a distributed detection agent to learn a detection agent and deliver the learned detector code to the detectors. An intelligent intrusion detection system (hereinafter referred to as DABIDS).

As computer and network technologies evolved, interconnections between computers increased, which made computer security a critical issue. When the IP protocol was experimentally applied to ARPANET in 1981, only 210 hosts were connected to ARPANET, but today more than 7 million computer systems worldwide are interconnected using the same IP protocol. Computers are becoming a target for hackers.

In order to cope with these threats, research on intrusion detection system, an advanced form of auditing technology that analyzes and detects illegal intrusions on documents or systems requiring information protection and prevents problems in advance, is actively conducted. It is becoming.

Intrusion detection systems detect intrusions and take appropriate action to protect computers from illegal intrusions. In general, the safety and ease of use of systems are in opposition to each other, and designing a secure system is very expensive, so it is almost impossible to design an ideal system that is safe against any attack. In such a system, all files can be encrypted and stored as a countermeasure against illegal behavior, but this causes new problems such as encryption algorithm selection, key management problem, and system administrator role adjustment.

For this reason, there is a need for an intrusion detection system that performs intrusion detection on an insecure computer system. The intrusion detection system records each event generated by a user for an audit trail and, when necessary, who, You should be able to track what you have done. In general, all activities in the system should be closely investigated and analyzed in order to prevent illegal intrusions or to detect the occurrence of intrusions and minimize losses. However, since log data generated in the system is generated at several megabytes per hour in UNIX, manual collection and analysis of data is impossible, and an automated tracking method is essential. Intrusion detection systems, an advanced form of automated audit tracking, also need to reduce the amount of audit data by minimizing the amount of overhead associated with storing and analyzing data.

Recently, various techniques and models have been developed to meet the needs of intrusion detection services. However, due to the complexity of the computer network, the primitive vulnerability of the target system, the lack of understanding of information protection, and the development of new illegal intrusion techniques, The model is also incomplete.

Accordingly, an object of the present invention is to solve such a problem, and based on the distributed detection agent, the intrusion information of the hacker is dynamically collected from each of the distributed detection agents to learn the intrusion pattern through the detection agents. In order to improve the intrusion detection rate of all distributed agents by distributing learned detector codes.

1 shows a structure of an intrusion detection system based on a distributed intrusion detection agent according to the present invention,

Figure 2 shows the detector internal structure according to the present invention,

3 shows the detector coordinator internal structure according to the present invention,

4 shows an internal structure of a scenario generator according to the present invention;

5 shows a detector learner according to the invention,

6 illustrates a detector code comprised of an analysis tree in accordance with a preferred embodiment of the present invention,

7 shows that the present invention is applied to one node.

According to the present invention for achieving the above object, a plurality of detectors to obtain the kernel audit data provided by the system to determine the degree of doubt through it; A detector coordinator that receives a degree of suspicion of intrusion transmitted from each of the detectors, determines whether the current computer node is invasive, and automatically performs an intrusion response action to notify an intrusion warning or take an appropriate action against the intrusion; A scenario generator that collects steady state and abnormal state intrusion information and virtually generates a sequence of steady state operations and abnormal state operations; An intelligent intrusion detection system based on a distributed intrusion detection agent including a detector learner that learns a detector through a scenario generated from the scenario generator and distributes the learned detector code is disclosed.

Preferably, the detector coordinator transfers the learning scenario generated by the scenario generator to the detector learner, receives the learned detector code transmitted from the detector learner, delivers the learned detector code to the plurality of detectors, and Manage multiple detectors.

Hereinafter, the objects, features, and advantages of the present invention described above will be described in more detail with reference to the preferred embodiments of the present invention shown in the accompanying drawings.

An intelligent intrusion detection system (DABIDS) based on the distributed intrusion detection agent according to the present invention will be described with reference to FIG. 1.

DABIDS dynamically collects the hacker's intrusion information from each of the distributed detection agents and learns the intrusion pattern through the agents, and distributes the learned detector code to detect the intrusion through the detector that is most suitable for the intrusion that occurred when the intrusion occurred. To respond.

Looking at each component constituting the DABIDS, first, the detector of the DABIDS is configured as shown in Figure 2 to obtain the kernel audit data provided by the system according to the detector code by the IDS engine to determine the degree of doubt Forward to the detector coordinator.

At this time, the system state information extractor provides transparency between the detector and the intrusion detection system, and the detector requests for the average CPU usage time, the average number of login attempts of a user, the IP address, and the interval between access to a specific port. It extracts system current status information from kernel audit data.

The detector code is executed by the IDS engine, and when the detector code is changed, the detector requests different state information of the system through the system state information extractor, thereby detecting the intrusion from a different angle. Therefore, the detector code is an important factor in determining the detector's intrusion detection performance.

Meanwhile, the detector suspicion reporter collects suspicions according to the detector's intrusion decision resulting from the execution of the detector code by the IDS engine, and delivers the detector to the detector coordinator. do. At this time, the suspicious detector reporter is not determined to be an intrusion as a result of a series of commands performed on the intrusion detection target system, but if the system is abnormal, it manages the series of commands to be used as a scenario for further agent learning and scenario generator. to the scenario generator.

The detector suspicious reporter defines the intrusion scenario when the number of true in the detector code is within a certain range for the total condition present in the conditional statement. If the range is lowered, the detector frequently delivers the performance to the scenario generator. The overall communication overhead increases, while increasing the range raises the problem that the intrusion scenario becomes the same as the known intrusion.

Meanwhile, when defining an intrusion scenario, the detector suspicious reporter considers the ratio of the number of conditions true for the total conditional statements constituting the detector code as the probability of intrusion, and delivers the result to the scenario generator through the detector coordinator. In other words, if there are 10 total conditional statements in the detector code configured in the detector, and the number of conditions is true, the probability of intrusion is 80%, and the process of becoming 8 is a new intrusion scenario. Later, the detector learner trains the detection agent through a scenario with an 80% probability of intrusion.

The detector coordinator receives the degree of suspicion of intrusion from each of the detectors as shown in FIG. 3 to determine whether the current computer node is invasive, to inform the security administrator of the intrusion warning, or to take an appropriate action against the intrusion. Respond automatically. On the other hand, the detector coordinator transfers the learning scenario generated by the scenario generator according to behavior knowledge by the detector coordinator engine to the detector learner through the high-level communication unit, and from the detector learner. It receives the learned detector code, passes it to the detector through the lower level communication unit, and manages the detectors.

On the other hand, the scenario has a probability value indicating the probability that the scenario is an intrusion, for example, "If the access is to a reserved port, and the access interval is 1 second, the probability of intrusion is 90%", the scenario for normal system operation If it lowers the probability of intrusion.

Therefore, in the proposed DABIDS, the detection agents report the degree of suspicion about the situation of the current system to the detector coordinator. If the detection agent is above a certain threshold (the number satisfied among the total conditional statements), the detection agent reports the intrusion. If it is in the middle, it is assumed to be in a semi-doubt state, and audit data is generated to generate a scenario. In general, an intrusion into a computer system means that the computer system is somewhat out of normal operation. Since a high level intrusion is less deviated, the scenario for the quasi-doubt state described above is trained to detect a detection agent. It can be more resistant to intrusion.

As such, the scenario generator of each node collects through the suspect audit data collector which gave intrusion information (audit data) of normal state and abnormal state according to the knowledge of behavior by the scenario generator engine as shown in FIG. 4. Anomaly behavior sequence is generated virtually and communicated to the detector learner through the scenario transmitter.

Next, the detector learner of the DABIDS according to the present invention will be described with reference to FIG.

First, the learning scenario database is a module that stores and manages intrusion information of normal state and abnormal state occurring in each node. For example, if accessing a reserved port and access interval is 1 second, the probability of intrusion is 90%. Scenario is received from the scenario generator and stored.

On the other hand, the operator set is called a function set in genetic programming, it means operators (eg, arithmetic, condition, logical operator) performed by the detection agent, and "IF", " IP-NEQ "belongs to this.

A set of primitives is called a terminal set in genetic programming and means constants obtained by the detector from kernel audit data through the system state information extractor. In FIG. 6, "IP-DEST," MY -IP "and" RAISE "belong to this," IP-DEST "is a primitive requesting the destination address of the packet entered into the current system," MY-IP "is a primitive requesting the IP address of the current system itself, "RAISE" is a primitive to inform the suspicion of intrusion, therefore, the analysis tree illustrated in Fig. 6 compares the IP address of all packets input to the system with the IP address of the system and notifies the suspicion if it does not match.

Operator sets and primitive sets corresponding to detectors applied to the system according to the present invention are as follows.

● I / O related detector

Operator set: IF, I / O-Interval-EQ, User-Permit

Primitive set: I / O-Interval, Constant, User, RAISE

● NFS related detector

Operator set: IF, IsREAD, IsWRITE, User-Permit

Primitive set: ThisOperation, User, RAISE

● Detector related to TCP / IP

Operator set: IF, IP-NEQ

Primitive set: IP-DEST, MY-IP, RAISE

● Detector associated with the file

Operation set: IF, IsFileDuplicate, IsFileMove, IsFileRemove, IsFileCreate,

Primitive set: owner, object, source, permit, RAISE

On the other hand, the parse tree generator combines all the elements of the operator and primitive sets in the same way that a solution program is created by combining a function set and a terminal set in gene programming. As shown in FIG. 6, a coupling relationship of a tree structure is formed.

The gene pool stores analysis trees for all cases that may be included in the problem area generated by the analysis tree generator.

The training engine provides detection agents with steady-state and abnormal state intrusion information stored in the training scenario database, and each agent is placed in every analysis tree (i.e. detection code) for a particular detection area stored in the gene pool. By performing the scenario provided accordingly, a detection agent having the most suitable detection code is obtained.

The accuracy for finding the best detection code is calculated according to Equation 1,

However, the accuracy is set to 100 when the intrusion probability and the suspected output probability are the same.

The meaning is the difference between the intrusion probability of the scenario and the probability of outputting the suspicion as a result of executing a scenario having a certain intrusion probability by a detection agent having several analysis trees.

For example, if the detector agent runs the scenario "Connected to a reserved port and access interval is 1 second" with a 90% probability of intrusion based on multiple analysis trees, the suspicious output is 100% and 50%. , 90%, the accuracy is 10, 25, and 100, respectively, and the detector is trained by passing the analysis tree with high accuracy as the analysis tree or detector code that is most suitable for the scenario.

Looking at the operation between the major components of the intelligent intrusion detection system (DABIDS) based on the distributed intrusion detection agent according to the present invention.

First, each detector detects intrusion information of normal and abnormal states generated by each node (which means the same as a system and a computer) by a scenario generator, and delivers it to the detector learner shown in FIG. After storing in the database and generating the analysis tree as shown in Figure 6 from the operator set and primitive set included in the problem area by the genetic programming technique, the agent checks the accuracy after performing the operation using the generated analysis tree The same process is performed for several generations by applying genetic operations (crossover, mutation) to find the most suitable analysis tree, and the detector code containing the analysis tree code obtained at each node is transmitted to the nodes to update the detector and the entire intrusion detection. Improve system performance.

On the other hand, as shown in Figure 7, each node has a number of trained detectors, as shown in Figure 7 I / O detector from the audit data (audit data) input from the system kernel through the system state information extractor It checks the status related to I / O of the server, the NFS detector checks for requests and actions on NFS, and the TCP detector checks to connect to the system through the TCP protocol. This allows the detector coordinator to determine whether the current system is invasive and notify the system administrator.

As described above, according to the present invention, a detector code learned by dynamically collecting intrusion information of a hacker from each of the distributed detection agents based on the distributed detection agent and learning the intrusion pattern through the detection agents. As a result, the intrusion detection rate of all distributed agents is improved.

In addition, in the conventional agent-based intrusion detection system, the agent learning is performed in a human-induced feedback method, so that the problem of learning for a long time can be overcome, and the problem of creating a scenario currently works abnormally on each node. By creating a scenario based on the pattern information and passing it to the detection agent learner, the agent can be trained to reduce the effort for developing an artificial scenario.

Claims (2)

In a distributed system where multiple systems are networked, A plurality of detectors that obtain kernel audit data provided by the system and determine the degree of suspicion through the system; A detector coordinator that receives the degree of suspicion of intrusion from each of the detectors to determine whether the system is invasive, to notify the intrusion warning or to automatically perform an intrusion response action to take an appropriate action against the intrusion; A scenario generator that collects steady state and abnormal state intrusion information and virtually generates a sequence of steady state operations and abnormal state operations; Intelligent intrusion detection system based on a distributed intrusion detection agent comprising a detector learner for learning the detector through the scenarios generated from the scenario generator to distribute the learned detector code. The method of claim 1, wherein the detector coordinator, Delivering the learning scenario generated by the scenario generator to the detector learner, receiving the learned detector code delivered from the detector learner, passing it to the plurality of detectors, and managing the plurality of detectors. Intelligent intrusion detection system based on distributed intrusion detection agent.