KR20040021926A - A Method for Handling Intrusion Packet of Active Network using Sensor - Google Patents

Abstract

PURPOSE: A method for confronting a packet intruding into an active network by using a sensor is provided to protect the network stably by making the sensor inform a sensor management server of a probability of an intrusion packet, making the sensor management server order a confrontation method to the sensor after confirming the intrusion, and making the sensor actively confront the intrusion. CONSTITUTION: Each sensor operated on an execution node detects the intrusion of the intrusion packet by checking the packet entered through the active network. If the sensor detects the intrusion, the information related to a pattern of the intrusion packet is reported to the sensor management server(S303). The sensor management server confirms the intrusion by comparing the pattern information of the intrusion packet with the stored pattern information(S304). If the intrusion is confirmed, the sensor management server transfers a confrontation instruction and method for the intrusion packet to the sensor(S305). The sensor performs the confrontation for the intrusion packet by using the confrontation method according to the confrontation instruction(S306).

Description

A method for handling intrusion packet of active network using sensor

The present invention relates to network security, and more particularly, to monitor intrusion packets through the active network using a sensor resident on the sensor engine of an execution node in an active network, and to check whether an intrusion packet is found. The present invention relates to a method for responding to an active network intrusion packet using a sensor that responds to the intrusion packet.

In general, a sensor generally refers to a device that directly detects data near or near a target to be measured and delivers necessary information as a signal. It can also be measured by the human senses, and it can be attached to a lot of dangerous work machines, especially in industrial robots. Such sensors generally detect, detect, determine, or measure various types of physical quantities such as temperature, pressure, and humidity, which are similar to the role of collecting information such as human eyes, nose, ears, and tongue. The detected information is transferred to the information processing unit corresponding to the human brain, where the judgment is made there. The output signal of the sensor is used a lot of electrical signals, because it is easy to amplify, store and remote control, and easy to handle when input to the computer corresponding to the brain.

However, such a conventional sensor is a kind of program operating in one application layer, and the sensor technology is limited to simply collecting information. As such, there has been practical limitations in actively securing, monitoring, and managing a network through a conventional passive sensor that simply collects data and delivers it. Therefore, for the active security of the network using the sensor, it exists in the execution node with the sensor engine on the network, and it is a new concept that is programmable, has improved functions in network management, and operates in the kernel of the operating system as well as the application layer. The need for sensors has emerged.

Recently, with the development of information and communication technology, the Internet can be used easily, and anyone can simply connect to the network to send and receive a lot of information. However, by leaking and exploiting other people's information, the number of damages to other users increases, and many side effects such as hacking of the system or the network, such as hacking, also appear, and the methods thereof are also diversified. Therefore, new countermeasures are urgently needed to proactively and actively cope with external intruders from security policies that have been urgently needed to protect their own networks.

In the case of conventional network security, a firewall, an intrusion detection system (IDS), or a virtual private network (VPN) is introduced to provide a predetermined schedule for traffic entering the network in which it is installed. It was a way to protect your network by setting rules to see if you were an illegal intruder (Attacker or Hacker) and blocking the traffic if you were an illegal intruder. However, this method is very local and passive, and this method has a limitation in preventing a large-scale distributed denial of service attack by multiple intruders in a distributed environment. In order to solve such a problem, an integrated security system for providing better security by interworking a conventional individual security system is emerging, but there are also many problems in interworking heterogeneous security systems.

On the other hand, a system for monitoring network-based intelligent using a sensor is published in the Republic of Korea Patent Application No. 2000-27086. The system includes a sensor unit including a plurality of sensors, a plurality of web cameras for transmitting an image to a local CPU, a local control logic connected to the local CPU, a server connected to the local CPU and a network, a display device connected to the server, and control logic. And an input device, and provide an intelligent monitoring system that can monitor an abnormal condition of a building based on a network and automatically perform a corresponding action when an abnormal condition occurs. However, the sensor in the system merely has a function of transmitting data to be monitored to the local CPU and can only operate on an application program.

In addition, as a prior patent on a method of improving the security of the network, Korean Patent Application No. 1999-004918 discloses a method for identifying a mobile agent in which another mobile agent exists in the same place. The method combines the genetic information in the mobile agent to move the mobile agent to a remote server in a distributed computer environment, and has the ancestral gene information and the self-genetic information in its agent when meeting the new agent. By comparing genetic information with each other, different mobile agents are identified. In particular, by combining genetic information in a mobile agent, each mobile agent provides a method of identifying its ancestors, children, grandchildren, siblings, etc. and thereby identifying other mobile agents. However, the method only provides a method for identifying a mobile agent on the network, and does not provide a method for analyzing an intruder in the network and providing a proactive and active response method for the intruder.

As such, the conventional sensor has a simple function and operates at one application layer, and thus cannot actively use resources of the system in a complex distributed network system environment, thereby monitoring and invading intrusion through the network as described above. It was virtually impossible to cope actively with discovery.

In order to solve the above problem, the present invention is directed to a sensor management server when a sensor existing on a sensor engine on an execution node having a packet pattern recognition function generates a possibility of an intrusion packet. After confirming the intrusion, the appropriate response method is instructed by the sensor, and the sensor actively responds to the intrusion according to the instruction to provide a network intrusion packet response method using a sensor that can stably protect the network. have.

1 is a block diagram showing an embodiment of an active network configuration to which the present invention is applied.

2 is a structural diagram showing an embodiment of an execution node according to the present invention.

3 is a flowchart illustrating a method for responding to an active network intrusion packet according to the present invention.

Explanation of symbols on the main parts of the drawings

10: active network 110: sensor management server

111: sensor management database 112: sensor communication interface

113: Intrusion Pattern Database 120: Sensor

130: sensor engine 140: running node

150: intrusion packet

In order to achieve the above object, the present invention provides a method for responding to an active network intrusion packet using a sensor in an active network including a plurality of execution nodes each having a sensor engine in which a sensor resides and a sensor management server managing the sensor. To

A first step of each sensor running in the plurality of execution nodes checking packets coming through the active network to detect intrusion of intrusion packets; A second step of reporting, by the sensor, the intrusion of the intrusion packet, the pattern related information of the intrusion packet to the sensor management server; A third step of the sensor management server comparing the pattern related information of the intrusion packet received from the sensor with the intrusion pattern related information previously stored in the sensor to determine whether the intrusion has occurred; A fourth step of transmitting, by the sensor management server, a response to the intrusion packet to the corresponding sensor and a corresponding method according to the detection result of the third step; And a fifth step of performing corresponding to the intrusion packet by using the corresponding method according to the corresponding instruction transmitted from the sensor management server.

Here, the first step, the sensor detects the intrusion packet by checking the pattern or operation of the incoming packet. In addition, the sensor management server includes an intrusion pattern database unit, and collects and stores pattern related information in advance for each intrusion packet entering through the active network. The execution node provides an environment in which the sensor can execute, and the sensor resides on the sensor engine of the active network execution node and operates in the kernel of the operating system with mobility of mobile code. On the other hand, the active network intrusion packet response method, if it is determined that the intrusion is not determined as the third step includes the step of checking the next incoming packet.

According to the present invention, when a sensor monitors an intrusion packet showing an abnormal symptom among packets coming in through an active network from the outside and reports the possibility of intrusion of the intrusion packet, the sensor management server reports an intrusion to the sensor management server. After checking whether the packet is invaded, and instructs the sensor to respond to an appropriate response method, the sensor receives this and provides a method for actively and actively responding to the intrusion packet. To this end, the present invention includes a mechanism for recognizing the flow of packets coming through the network and confirming the intrusion pattern through the pattern of the packet, and a mechanism for determining whether or not the real intrusion through the intrusion packet having a strange pattern.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in detail the present invention.

1 is an active network configuration diagram showing an embodiment of an active network configuration to which the present invention is applied. The active network illustrated in FIG. 1 may be, for example, a large-scale network such as an ISP network, or may be an active network existing in the form of an IP network or an overlay. Referring to FIG. 1, the sensor management server 110 is responsible for overall management of the active network 10, and each execution node 140 represents a redistribution point or endpoint of data transmission as a connection point on the active network 10. . The execution node 140 includes management information of the active network 10 and is programmed to have a function for recognizing, processing, or transmitting data to another node. Furthermore, although not shown in the drawing, each execution node 140 may be connected to an execution node of another network (which may be another active network or a general IP network) to transmit data or directly to a host. The execution node 140 may be, for example, a router.

Each execution node 140 includes a sensor engine 130. The sensor 120 resides on each sensor engine 130 and is executed. Substantially, the sensor 120 includes active network management information and receives a policy from the sensor management server 110 to manage the active network. The execution node 140 on which the sensor 130 is mounted includes an execution environment that provides all the environments required for the sensor 130 to be executed, a sensor engine 130 on which the sensor 120 can be mounted, and an application thereof. It consists of API (Application Program Interface) that provides programs and interfaces. This will be described in detail below. The execution node 140 basically includes a packet determination function in detail, and may further include other functions. In addition, the execution node 140 also serves to assist the functions required for the sensor 120 to respond to the intrusion packet 150. Further, the sensor 120 analyzes the flow pattern of incoming packets through the function of each execution node 140 and transmits the analyzed result to the sensor management server 110 and from the sensor management server 110. Receive a corresponding instruction to perform a response to the intrusion packet 150. In addition, the sensor 120 according to the present invention is a sensor of a new concept that exists on the network, which is programmable and has improved functions with respect to network management and security. In particular, the sensor 120 operates in the kernel of an operating system having mobility of mobile code, can use resources of a system constituting a network, and has a function of directly changing a content as necessary by directly connecting to a part of the operating system.

As shown in FIG. 1, the sensor management server 110 includes a sensor management database 111, a sensor communication interface 112, and an intrusion pattern database 113. The sensor management server 110 and each sensor 120 constitute a network. The sensor management database 111 constructs and manages information on all sensors 120 currently resident in the domain as a database. The sensor management server 110 performs authentication and update of the sensor 120 by using the sensor information of the sensor management database 111 and informs the sensor 120 of the policy of the sensor management server 110. Forward and authenticate the policy. The sensor communication interface 112 is a sensor currently present on the sensor engine 130 of the execution node 140 that provides all the environments in which the sensor management server 110 and the sensor 120 can be mounted. It is in charge of communication with them. The intrusion pattern database unit 113 constructs and stores all information related to the intrusion pattern in a database. That is, the sensor management server 110 stores in the intrusion pattern database 113 information on packets or traffic having strange behavior or patterns coming into the active network from the external domain as well as its own domain. In this case, the sensor management server 110 preferably stores and manages all intrusion pattern information in the intrusion pattern database unit 113 regardless of whether an intrusion packet is detected by the sensor 120 and continuously maintains a new intrusion pattern. Collect and store it in the intrusion pattern database 113 to upgrade automatically. The sensor management server 110 compares the intrusion packet pattern with the intrusion pattern previously stored in the intrusion pattern database unit 113 when a new intrusion packet is found by continuously monitoring the network. will be.

The sensor 120 resides on the sensor engine 130 of the execution node 140 and is executed by receiving a policy from the sensor management server 110 through communication with the sensor communication interface 112. At the same time, the sensor 120 monitors the intrusion packet 150 invading through the network 10 to perform overall monitoring of the network 10. At this time, the sensor 120 checks the packet coming through the active network 10 one by one to check whether there is a strange behavior or pattern to determine whether the intrusion packet 150 is invaded. If any sensor 120 detects a strange behavior or pattern from a packet coming through the network, it reports the sensor management server 110 through communication with the sensor communication interface 112. For example, you may want to check the behavior of a packet or pattern of packets, such as concentrating or skewing specific traffic, headless and aggressive traffic, or sending a lot of traffic at once. When detected, the sensor 120 reports this to the sensor management server 110. After receiving the report, the sensor management server 110 matches the intrusion pattern stored in the intrusion pattern database unit 113 and checks whether it is a real intrusion. If the intrusion is correct, the sensor management server 110 transmits the corresponding response to the intrusion and the corresponding scheme to the corresponding sensor 120, and the corresponding sensor 120 responds to the received response according to the corresponding instruction. In response to the intrusion packet 150 is performed. As described above, in the present invention, the sensor 120 of each execution node 140 actively monitors the intrusion packet 150 through the network and actively responds according to the corresponding instruction of the sensor management server 110. The network can be protected from external intrusions.

2 is a structural diagram showing an embodiment of an execution node according to the present invention, and shows an embodiment of an internal structure diagram of an execution node on which a sensor is executed. As shown in FIG. 2, the execution node 140 includes an application program 210, an API 220, a sensor engine 130, and an execution environment 250, and the sensor engine 130 includes the above-described sensor ( 120 is mounted and executed. In this case, it is the execution environment 250 that provides all the environment that the sensor 120 can execute, and the sensor engine 130 is required to perform information collection on the intruder in charge of the sensor 120. The packet pattern determination unit 230 and the functional unit 240 to be added later. The sensor 120 resides on the sensor engine 130 and is connected to various application programs 210 through the API 220.

3 is a flowchart illustrating a method of responding to an intrusion packet in a network according to the present invention, and is a flowchart illustrating a process in which a sensor responds when an intrusion occurs. Each sensor 120 residing on the sensor engine 130 of the execution node 140 monitors the pattern of all packets present on the active network and, in particular, checks packets coming into the active network (S301). At this time, the inspection of the packet is to check whether there is a strange behavior or a strange pattern by checking the flow or pattern of the packet, and preferably, each sensor 120 checks every incoming packet one by one. Subsequently, it is checked whether a strange behavior or a strange pattern is found from the incoming packet (S302). That is, in step S302, the sensor 120 of the execution node 140 checks whether an intrusion packet has invaded through the network. As a result of the checking in step S302, if no abnormal behavior or pattern is found from the incoming packet, the flow advances to step S301 to check the next incoming packet. However, if a strange behavior or pattern is found from the incoming packet as a result of checking in step S302, the sensor 120 detects this and detects the pattern information of the intrusion packet through the sensor communication interface 112. Report to the sensor management server 110 (S303).

Subsequently, the sensor management server 110 checks whether the intrusion pattern related information stored in the intrusion pattern database 113 owned by the sensor management server 110 and the intrusion pattern related information transmitted from the sensor 120 is a real intrusion or not. (S304). Subsequently, if the result of the check in step S304 is not an intrusion, the sensor 120 that reported the intrusion is notified of the fact and proceeds to step S301, and the corresponding sensor 120 receives the next incoming packet. Will be checked. However, if the intrusion is confirmed as a result of the step (S304), the sensor management server 110 transmits the corresponding instruction to the corresponding sensor 120 that reported the intrusion and the corresponding method (S305). The sensor 120 performs a corresponding function with respect to the intrusion packet 150 in the corresponding manner according to the received corresponding instruction (S306).

As described above, according to the present invention, information about an incoming packet is efficiently stored in advance, and immediately after an intrusion is found, only the information about the intruder is extracted from the stored information, and the intruder belongs to the intruder through the back trace using a sensor. Active blocking directly in the active network. The sensor is an application with mobility and self-programmability. In this regard, active means active response to network intrusion in terms of security, and in terms of service execution, it easily detects and responds to new attacks using network technology and dynamically performs them.

Therefore, the present invention monitors an intrusion through an active network using a new concept of a sensor operating in the kernel of an operating system having mobility of a mobile code, and detects an intrusion through a communication with a sensor management server if an intrusion is detected and a corresponding method. The present invention proposes a method for actively determining and directly responding through the corresponding sensor.

The above description and contents of the drawings are related to one embodiment of the present invention and are not intended to limit the present invention. In particular, the structure of the network, the structure of the execution node, and the function of the sensor to facilitate the description of the present invention will be substituted, changed, or modified within the scope without departing from the spirit of the present invention. Accordingly, the scope of the invention should be determined by the appended claims rather than by the description and drawings.

According to the present invention as described above has the following effects.

First, it is possible to respond promptly and actively by selecting appropriate and effective response method according to intrusion method using sensor.

Second, it is easy and efficient to update new packet intrusion method and intrusion response method by collecting packet information using sensor.

Third, active and proactive responses to active network intrusion can be applied through communication between sensors and communication between sensors and sensor management servers.

Fourth, by using the sensor networking structure of the present invention, it is possible to effectively respond to cyber attacks from domestic and foreign hackers at specific companies, government departments or national levels to ensure a safe and reliable Internet environment, and also through the sensor itself It is easy to update the intrusion pattern and response method, so it is easy to manage.

Claims (6)

In the active network intrusion packet coping method using a sensor in an active network comprising a plurality of execution nodes each having a sensor engine running and resident sensor and a sensor management server for managing the sensor, A first step of each sensor running in the plurality of execution nodes checking packets coming through the active network to detect intrusion of intrusion packets; A second step of reporting, by the sensor, the intrusion of the intrusion packet, the pattern related information of the intrusion packet to the sensor management server; A third step of the sensor management server comparing the pattern related information of the intrusion packet received from the sensor with the intrusion pattern related information previously stored in the sensor to determine whether the intrusion has occurred; A fourth step of transmitting, by the sensor management server, a response to the intrusion packet to the corresponding sensor and a corresponding method according to the detection result of the third step; And A fifth step of the corresponding sensor performing a response to the intrusion packet by using the corresponding method according to a corresponding instruction transmitted from the sensor management server; Network intrusion packet response method using a sensor comprising a. The method of claim 1, wherein the first step, And a sensor detecting the intrusion packet by confirming a pattern or an operation of the incoming packet. The method of claim 1, wherein the sensor management server, A network intrusion packet response method using a sensor comprising an intrusion pattern database unit for collecting and storing pattern-related information for each intrusion packet entering the network in advance. The method of claim 1, wherein the execution node, Network intrusion packet response method using the sensor, characterized in that to provide a general environment that the sensor can run. The method of claim 1, wherein the sensor, A method for responding to a network intrusion packet using a sensor, which is located on a sensor engine of the active network execution node and operates in a kernel of an operating system having mobility of mobile code. The method of claim 1, And if it is determined that the third step is not an intrusion, the sensor checks a next incoming packet.