KR20030050307A - The mechanism of security policy stores and detection alert generation in Ladon-SGS - Google Patents

Abstract

PURPOSE: A Ladon-SGS(Security Gateway System), its security policy setting method and a harmful traffic detection alarm generating method are provided to control an illegal intrusion or a harmful traffic by analyzing a large scale network traffic and packet information. CONSTITUTION: A communication processor(21) sets connection with a security policy server and a Ladon-SGS and transfers and receives information according to security policy. A system controller(22) performs operations related to initialization of the Ladon-SGS and controls an overall system. A security policy processor(23) converts the security policy transferred from a security policy server into a form applicable to the Ladon-SGS. An intrusion detection analyzer(24) analyzes an intrusion as occurred through a network and transfers an analysis result to an intrusion detection alarm processor. An intrusion detection alarm processor(25) analyzes an intrusion alarm importance according to a pre-set security policy on the basis of information related to the intrusion type analyzed by the intrusion detection analyzer(24), compares the importance with a reference value, and determines whether to cope with it by a system or transfer it to the security policy server. A security policy storing unit(26) stores the security policy which has been converted by the security policy processor(23), the intrusion detection and corresponding results of the detected intrusion. A firewall processor(27) cuts off an illegal intrusion defined by a firewall policy and a harmful traffic.

Description

Radon-Security Gateway system and its security policy setting method and method for generating harmful traffic detection alarm {The mechanism of security policy stores and detection alert generation in Ladon-SGS}

The present invention relates to a security gateway system for detecting intrusion of illegal information system through a network in real time. Specifically, the present invention analyzes large network traffic and packet information such as a wide area network to detect illegal intrusion and abnormal network Radon-SGS (Radon-SGS) to manage network traffic according to network management policy and security policy such as controlling harmful traffic leading to the situation and to detect and respond to policy-based intrusion in real time against illegal intrusion and harmful traffic; Security Gateway System) It is about security policy setting method and harmful traffic detection alarm generation method in system.

The security gateway system was developed for the purpose of preventing the intrusion or destruction of the information in advance by blocking illegal intrusion through the network to the system where the information is stored. Intrusion into the system is increasingly advanced, diversified, advanced, and globalized as the technology is developed. Therefore, a stronger security gateway system is required to cope with the intrusion.

Conventional technologies related to security gateway systems generally use many intrusion detection systems. This intrusion detection system controls illegal intrusion or harmful traffic in a small network area or the same network and operates only as a single intrusion detection system. Therefore, the intrusion detection system has no information exchange with other intrusion detection systems. Not only does it fail to perform a function, but it also has a problem that it cannot respond quickly to distributed denial of service attacks by analyzing traffic on a small network.

In addition, it does not work with other intrusion detection systems independently and cannot actively respond to new attack patterns or attacks from other networks, and can not maintain normal traffic flow by increasing the amount of network traffic by sending frequent alarms every time. Have

The present invention is to solve the above-mentioned problems, the purpose is to respond to various attack patterns such as illegal intrusion or distributed denial of service attacks in a large network in real time to enable the system to operate safely and continuously To provide a Ladon-SGS system.

Another object of the present invention is to provide a security policy setting method and harmful traffic detection alarm generation method that can maintain a normal network flow by controlling the alarm transmission according to the intrusion alarm.

This purpose is to monitor the contents of the traffic passing through the network and to remove harmful or intrusion detection traffic defined by the security manager, so that the normal traffic flows smoothly. It can be achieved by applying to SGS system.

Ladon-SGS system according to the present invention is a security system having a plurality of Ladon-SGS system in the management network of one security policy server to cope with harmful traffic infiltrating through the network, the security policy server and Ladon- Communication processing means for establishing an interconnection with an SGS system to transmit and receive information according to a security policy; System management means for performing tasks related to the initialization of the Ladon-SGS system and controlling the entire system; Security policy processing means for converting the security policy transmitted from the security policy server to be applicable in the Ladon-SGS system; Intrusion detection analysis means for analyzing the type of intrusion when an external intrusion occurs through the network and transferring the analyzed result to the intrusion detection alarm processing means; Based on the information related to the intrusion type analyzed by the intrusion detection analysis means, the analysis of the intrusion alert importance (S) defined according to the preset security policy, and comparing the importance (S) with the reference value in the system or security Intrusion detection alert processing means for determining whether to transmit to a policy server; Security policy storage means for storing the security policy converted by the security policy processing means, the intrusion detection and the corresponding results of the detected intrusion; And intrusion blocking processing means for performing a function of blocking a traffic determined to be illegal intrusion or harmful traffic defined by a blocking policy.

The security policy setting method in Ladon-SGS of the present invention is a method for setting a security policy by communication between a security policy server and a plurality of Ladon-SGS systems, and initializes the Ladon-SGS system and establishes a connection with the security policy server. Receiving an identifier by transmitting the Ladon-SGS system configuration information to the security policy server in a completed state; Storing an identifier assigned by the security policy server and notifying the security policy server that it is ready to receive a security policy; Receiving a security policy transmitted from the security policy server and storing the security policy in a storage means; And analyzing whether the received security policy is a detection policy or a blocking policy, and notifying the intrusion detection analysis means of the update of the security policy in the case of the detection policy, and updating the security policy to the intrusion blocking processing means in the case of the blocking policy. And notifying the security policy server of the completion of storing the security policy after notification. When a new intrusion or harmful traffic is detected from any one of the Ladon-SGS systems, the security policy server detects the completion of the security policy storage. Information on intrusion or harmful traffic is transmitted, and the security policy server analyzes the alarm and transmits the new security policy according to the alarm to all Ladon-SGS systems in the management network.

Alarm generation method in Ladon-SGS of the present invention is a method for generating an alarm for intrusion of harmful traffic in a security system that includes a plurality of Ladon-SGS system in the management network of one security policy server to counter the intrusion The method of claim 1, further comprising: analyzing harmful traffic types in the system when harmful traffic is detected in any one of the Ladon-SGS systems; Transmitting an information including the response to the analyzed harmful traffic and the result of the response to the intrusion prevention processing means and simultaneously generating an alarm message; And comparing the intrusion alert importance S for the harmful traffic with a set value and processing the system itself when the intrusion alert importance S is less than a reference data transmission amount, and on the contrary, the intrusion alert importance S is the reference data. If it is larger than the transmission amount by performing a routine, including the steps related to the intrusion type and response to the security policy server, by analyzing the pattern for illegal intrusion in the security policy server and establish a new security policy Characterized in that the transmission to the Ladon-SGS system.

According to the above-described configuration and method, the present invention generally provides a new security policy to Ladon-SGS system by comprehensively analyzing alarms and information transmitted from Ladon-SGS, which is a plurality of security gateway systems located at various locations in the security policy server. By delivering, you can respond to new attacks in real time.

It also prevents DDOS (Distributed Denial Of Service) originating from various attackers so that normal service of web server or other servers is possible.

Furthermore, the network traffic flow can be properly adjusted by analyzing the network, system state and the effects of the intrusion, and controlling the amount of alarms transmitted by the intrusion detection alarm processing means.

1 is a schematic configuration diagram of a policy-based security management system for explaining the connection between the Ladon-SGS and the security policy server to which the present invention is applied;

2 is a block diagram of Ladon-SGS according to the present invention;

3 is a flowchart illustrating a method for receiving, converting, and storing a security policy performed by a security policy processing unit of Ladon-SGS according to the present invention;

4 is a flowchart illustrating a method for responding to a detected intrusion performed by an intrusion detection alarm processing unit of Ladon-SGS, generating an alarm, and determining whether to transmit an alarm according to the present invention;

5 is a flowchart illustrating a method for determining an alarm transmission in an intrusion detection alarm processing unit of Ladon-SGS according to the present invention;

* Description of the symbols for the main parts of the drawings *

10; Security Policy Server 20; Ladon-SGS System

21; communication processing unit 22; system control unit

23; security policy processing unit 24; intrusion detection analysis unit

25; intrusion detection alarm processing unit 26; security policy storage unit

27; intrusion blocking processing unit

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. 1 is a connection diagram showing the connection between the security policy server and the Ladon-SGS system.

In the figure, reference numeral 10 denotes a security policy server, and reference numerals 20, 30 and 40 denote a plurality of Ladon-SGS systems existing in the management network of the security policy server 10. Referring to the drawings, the present invention illustrates a security system in which one security policy server 10 and three Ladon-SGS systems 20, 30, and 40 dispersed in various places form a wide area network. .

The security policy server 10 according to the present invention manages a plurality of Ladon-SGS systems 20, 30, 40, and the packet information input and output from the Ladon-SGS system 20, 30, 40 At the same time, a new security policy is defined by comprehensively analyzing the harmful traffic detected here, and by transmitting the defined security policy to each Ladon-SGS system 20, 30, 40, Block traffic

Referring to the drawings, for example, the type of attack, the first attacker 51 of the first network, the second attacker 52, 53 of the second network, the third attacker 54 of the third network Is assumed to be a form of illegal invasion of the attacker 55 of the fourth network, the third attacker 54 is an attacker who is attacked by the second attacker 53 of the second network and simultaneously enters the fourth network. Distributed service attacks, such as the attacker role to attack the attacked person 55 can be.

As such, when the attacker 55 in the fourth network is attacked by the attackers, the second Ladon-SGS system 30 detects an attack of the attacker 53 of the second network, and the third Ladon-SGS system 40 ) Detects an attack of the attacker 54 existing in the third network and transmits an alert message to the security policy server 10 while responding according to the defined security policy.

As described above, the security policy server 10 analyzes packet information inputted and outputted from each Ladon SGS system 20, 30, 40 or the first, second, third, and fourth networks existing in its own management network. Detecting illegal intrusions and delivering defined security policies to each system, it is possible to respond to new attack patterns in real time.

Figure 2 is a block diagram showing the internal system configuration of Ladon-SGS according to the present invention. Since each Ladon-SGS system has the same structure, the embodiment of FIG. 2 avoids duplicated codes and displays the codes in association with the code 20 of the first Ladon-SGS system.

Ladon-SGS system 20 according to the present invention comprises a communication processor 21 for transmitting and receiving information according to the security policy by establishing a connection between the security policy server and the Ladon-SGS system; A system controller 22 performing tasks related to initialization of the Ladon-SGS system and controlling the entire system; A security policy processing unit 23 for converting the security policy transmitted from the security policy server 10 to be applied by the Ladon -SGS system; An intrusion detection analyzer 24 analyzing the type of intrusion when an external intrusion occurs through a network and transferring the analyzed result to an intrusion detection alarm processing means; Based on the information related to the intrusion type analyzed by the intrusion detection analysis unit 24, the intrusion alarm importance level (S) defined according to the preset security policy is analyzed, and the importance (S) is compared with the reference value to respond in the system. Intrusion detection alert processing unit 25 to determine whether or not to transmit to the security policy server; A security policy storage unit 26 for storing the security policy converted by the security policy processing unit 23, intrusion detection, and corresponding results of the detected intrusion; And an intrusion blocking processing unit 27 that performs a function of blocking traffic determined to be illegal intrusion and harmful traffic defined by a blocking policy.

According to this configuration, a single security policy server 10 manages a plurality of Ladon-SGS systems 20, 30, 40, and harmful traffic from any one of the Ladon-SGS systems can be detected. In this case, the information is transmitted to the security policy server 10, and the security policy server 10 comprehensively analyzes harmful traffic to establish a new security policy. The security policy is transmitted to all Ladon-SGS systems included in the management network. By transmitting, it is possible to cope with a new attack pattern.

The present invention configured as described above will be described with reference to FIGS. 3 to 5. FIG. 3 is a flowchart illustrating a method for processing a security policy between the security policy server 10 and the Ladon-SGS system 20 in the above system.

Referring to FIG. 3, when the Ladon-SGS system 20 starts and performs a system initialization operation such as storing configuration information of the Ladon-SGS system 20 (S61), the system control unit 22 The communication processing unit 21 is controlled to establish a connection with the security policy server 10. (S62)

When the connection setting between the security policy server 10 and the Ladon-SGS system 20 is completed, the Ladon-SGS system 20 transmits its configuration information to the security policy server 10 (S63), and the security policy server. In step 10, the authentication procedure is performed on the information transmitted from the Ladon-SGS system 20, and when authentication is performed, a unique identifier (ID) is transmitted to the Ladon-SGS system 20, and the Ladon-SGS system In 20, the identifier (ID) transmitted from the security policy server 10 is stored in the security policy storage unit 26. (S64-S65)

As such, when the identifier ID is given from the security policy server 10 in the Ladon-SGS system 20, the system control unit 22 of the Ladon-SGS system 20 receives the security policy by the security policy processing unit 23. In order to be notified and to be notified that the reception preparation is completed by the security policy processing unit 23, the system controller 22 controls the communication processing unit 21 to wait for receiving the security policy to the security policy server 10. Sends request information about status and security policy. (S66-S67)

Thereafter, the system controller 22 confirms the connection setting between the security policy server 10 and the Ladon-SGS system 20 in order to receive the security policy to be transmitted from the security policy server 10 (S68). When the connection is completed, the security policy server 10 receives the security policy transmitted, and under the control of the system control unit 22, the security policy processing unit 27 converts the received security policy to be applied to the system, the conversion The stored security policy is stored in the security policy storage unit 26. (S69-S70)

When the security policy transmitted from the security policy server 10 is stored in the security policy storage unit 26 as described above, the security policy processing unit 27 determines whether the security policy is a detection policy or a blocking policy (S71). If the security policy is a harmful traffic detection policy, the security policy update is notified to the intrusion detection analysis unit 24, and in the case of the harmful traffic blocking policy, the security policy update is notified to the intrusion blocking processing unit 27 and then each system is updated. Under the control of the control unit 22, the security policy server 10 stores the security policy and simultaneously notifies that the operation for intrusion detection is started. (S72-S74)

Then, the process returns to step 68 to wait for an instruction on the new security policy, and when the new security policy is transmitted from the security policy server 10, the security policy is processed in the same manner as described above.

On the other hand, if the connection between the security policy server 10 and the Ladon-SGS system 20 has not been established in step 68, it is confirmed whether or not to cancel the normal connection state (S74) and ends in the case of normal disconnection. In case of abnormal disconnection, the process returns to step 68 to retry connection establishment with the security policy server 10 (S75).

4 is a flowchart illustrating a method of managing network traffic and responding to an intrusion in accordance with a network management policy and a security policy of the present invention.

Referring to the drawings, the present invention receives the information on the security policy from the security policy server 10 as described above, and stores in the system, the result according to the intrusion detection analysis unit 24, intrusion detection alarm processing unit 25 And intrusion detection operation is started in the state transmitted to the security policy server 10 (S81).

In this situation, when illegal intrusion occurs from outside, the intrusion detection analysis unit 24 analyzes harmful traffic, and transmits the analyzed information to the intrusion detection alarm processing unit 25, and the alarm processing unit 25 receives the received information. Information including the response to the harmful traffic and the result of the response is transmitted to the intrusion prevention processing unit 27, and an alarm message is generated (S82-S83).

When the illegal intrusion is detected as in step 83, the intrusion detection alarm processing unit 27 determines whether to send an alarm message to the security policy server 10 according to the intrusion type and the corresponding result (S84).

If, as a result of analyzing the intrusion type, harmful traffic that does not need to be transmitted are stored in the security policy storage unit 26 and a countermeasure against illegal intrusion, and on the contrary, an alarm message is transmitted to the security policy server 10. In this case, by sending infor- mation related to intrusion type and response, it is possible to analyze the pattern of the same illegal invasion and to establish a new security policy. (S85-S86)

When the intrusion detection alarm processing unit 25 transmits an alarm message for illegal intrusion to the security policy server 10, when the amount of the alarm transmission is large, the intrusion alarm may increase the network traffic and worsen the network flow. Therefore, in order to solve this problem, the intrusion detection alarm processing unit 25 determines whether to transmit an alarm according to the importance of the intrusion alarm.

5 is a flowchart illustrating a detailed determination method of whether to send an alarm message for illegal intrusion to a security policy server.

Referring to the drawings, in the present invention, when an intrusion into the system occurs, the intrusion detection alarm processing unit 27 processes the intrusion alarm importance level S by a set function, and the intrusion alarm importance level S is an attack type value. (C) Calculate by analyzing the factors of the attack strength or fatality (L), the state of the victim system (SC) and the current network traffic (NC) (S91-S94).

Intrusion alert importance (S) according to the present invention defines a function such as S = (C + L)-(SC + NC), and analyzes each factor according to the function, and compares the calculated value with a reference value It is determined whether or not to send an alarm message to the security policy server 10. (S95) In other words, if the intrusion alarm importance (S) is greater than the alarm transmission reference value (data transmission amount) as in step 96, intrusion alarm security policy When the server transmits the data to the server 10 and the importance S is smaller than the reference value, the server 10 stores the data in the security policy storage unit 26 to prevent the network traffic caused by the intrusion alarm from increasing. (S97-S98)

As described above, the present invention can control harmful traffic leading to illegal intrusion or abnormal situation of the network by analyzing large network traffic and packet information such as a wide area network, and a detection policy and a network management and security policy. By establishing a blocking policy, you can protect your system from harmful traffic.

In addition, through the alarms delivered from multiple Ladon-SGS systems, the security policy server comprehensively analyzes the traffic patterns and allows the new security policy to be applied to the Ladon-SGS system to quickly and proactively respond to new malicious traffic attacks. Can be.

Moreover, by preventing distributed denial of service attacks from multiple attackers, web servers or other servers not only maintain normal service, but also calculate the importance of intrusion alarm when harmful traffic is detected. By solving the problem, it is possible to maintain the normal network flow by preventing the impediment of traffic flow caused by sending an alarm every time.

Claims (6)

In the security system having a plurality of Ladon-SGS system in the management network of one security policy server to cope with harmful traffic invading through the network, Communication processing means for establishing an interconnection between the security policy server and the Ladon-SGS system to transmit and receive information according to a security policy; System control means for performing tasks related to the initialization of the Ladon-SGS system and controlling the entire system; Security policy processing means for converting the security policy transmitted from the security policy server to be applicable in the Ladon-SGS system; Intrusion detection analysis means for analyzing the type of intrusion when an external intrusion occurs through the network and transferring the analyzed result to the intrusion detection alarm processing means; Based on the information related to the intrusion type analyzed by the intrusion detection analysis means, analyzes the intrusion alert importance (S) defined according to the preset security policy, and compares the importance (S) with the data transmission reference value to respond in the system. Or intrusion detection alert processing means for determining whether to transmit to the security policy server; Security policy storage means for storing the security policy converted by the security policy processing means, the intrusion detection and the corresponding results of the detected intrusion; And Radon-secure gateway system comprising a; intrusion blocking processing means for performing the function of blocking the traffic determined to be illegal intrusion, harmful traffic defined by the blocking policy. The radon-security gateway system according to claim 1, wherein the intrusion alarm importance level (S) in the intrusion detection alarm processing means has a function as follows. S = (C + L)-(SC + NC) Where C is the type of attack, L is the criticality of the attack, SC is the victim system's state, and NC is the current network traffic. In the method of setting the security policy by communication between the security policy server and a plurality of Ladon-SGS system, Initializing a Ladon-SGS system and receiving an identifier by transmitting the Ladon-SGS system configuration information to the security policy server in a state where connection establishment with the security policy server is completed; Storing an identifier assigned by the security policy server and notifying the security policy server that it is ready to receive a security policy; Receiving a security policy transmitted from the security policy server and storing the security policy in a storage means; And Analyzing whether the received security policy is a detection policy or a blocking policy, and notifying the intrusion detection analysis means of the update of the security policy in the case of the detection policy, and notifying the intrusion blocking processing means of the update of the security policy in the case of the blocking policy. And then notifying the security policy storage completion to the security policy server. When new harmful traffic is detected from one of the Ladon-SGS systems, the security policy server analyzes the information about the harmful traffic and transmits the new security policy to all Ladon-SGS systems belonging to the management network. Security policy setting method in the radon-security gateway system, characterized in that. In the method for generating an alarm for the intrusion of harmful traffic in a security system that includes a plurality of Ladon -SGS system in the management network of one security policy server to counter the intrusion, Analyzing the type of harmful traffic in the system when harmful traffic is detected in any one of the plurality of Ladon-SGS systems; Transmitting an information including the response to the analyzed harmful traffic and the result of the response to the intrusion prevention processing means and simultaneously generating an intrusion detection alarm message; And Determining whether to store the response method and the result of the response in the system according to the intrusion alarm importance level (S) for the harmful traffic or transmit the details related to the intrusion to the security policy server; and by performing a routine. And analyzing the pattern of illegal intrusion in the security policy server, establishing a new security policy, and transmitting it to all Ladon-SGS systems in the management network. According to claim 4, In the step of transmitting an intrusion detection alert message for the harmful traffic, Intrusion alert importance (S) is defined in the defined function through factors of attack type value (C), attack fatality (L), victim system status (SC) and current network traffic amount (NC) for the harmful traffic. Calculating by; Storing the intrusion detection alert in a database and processing the system itself when the intrusion alert importance level S is smaller than a set reference data transmission amount; And And transmitting information related to the intrusion type and the response to the security policy server when the intrusion alert importance level (S) is greater than the reference data transmission amount. The method according to any one of claims 4 to 5, The intrusion alarm importance level (S) has a function as follows alarm generation method in a radon-security gateway system. S = (C + L)-(SC + NC) Where C is the type of attack, L is the criticality of the attack, SC is the victim system's state, and NC is the current network traffic.