KR20040035305A - A Method for Reverse-Chasing the Active Network Attacker and Reporting the Result therefrom using movable Sensor - Google Patents

Abstract

PURPOSE: A method for re-tracking an active network trespasser by a mobile sensor and notifying the result is provided to re-track an attacker, who trespasses on a specific node through several nodes of an active network, through linkage with a transit node and transmit the result to a victim node. CONSTITUTION: If an external trespasser(14) connects to a server B(23) of a domain B(20) through several paths and attacks a server C(33) of a domain C(30), the server C(33) of the domain C(30) informs a sensor management server C(32) of the domain C(30) that the server C(33) receives attack from the server B(23) of the domain B(20)(S201). A mobile sensor, which resides in the sensor management server C(32), moves to a sensor management server B(22) of the domain B(20)(S202). The mobile sensor moves between the sensor management server B(22) and the server B(23), acquires information of a transit node and session logging information, and transmits information of the transit node and session logging information to the sensor management server B(22)(S203,S204). The sensor management server B(22) generates a new mobile sensor, and transmits the generated new mobile sensor to the sensor management server C(32) of the domain C(30) for notifying the re-tracking result including basic information of the mobile sensor, information of the transit node, information of an attacker node and session information between a real attacker node and the server B(23)(S205). The mobile sensor moves to a sensor management server A(12) of a domain A(10) to which the trespasser(14) belongs(S206).

Description

{A Method for Reverse-Chasing the Active Network Attacker and Reporting the Result therefrom using movable Sensor}

The present invention relates to an active networking technology, and more particularly, by using a mobile sensor running on an active node of an active network, an attacker who invades a specific node via various nodes of the active network through association with a waypoint node. The present invention relates to a method of backtracking an intruder packet using a mobile sensor that traces back a result and delivers the result to a victim node and a method of notifying the result.

Generally. Currently widely used sensor is a kind of program that operates in one application layer, and the conventional sensor technology is limited to simply collecting information. As such, there is a practical limit to actively securing, monitoring, and managing a network through a conventional passive sensor that simply collects data and delivers it. Therefore, the active security and monitoring of the network using sensors requires a new concept of sensors that reside in the active nodes on the network, which are programmable, have enhanced functions for network management, and operate in the kernel of the operating system as well as the application layer. It became.

With the recent spread of the Internet, anyone can simply connect to the network to send and receive a lot of information. However, many side effects such as attacking and paralyzing after invading a system or a network, such as hacking, have also appeared, and the methods thereof have also been diversified. As described above, in order to proactively and proactively deal with external intruders, it is necessary to trace back the attacker's information in order to proactively and proactively deal with external intruders. New countermeasures such as informing victims have been urgently needed.

In general, in the case of the traceback to the network intruder, when the sensor management server detecting the intruder tries to trace back, the active packet is transmitted to the node where the connection session with the victim node is established. The transmitted active packet determines whether this node is a real attacker or a waypoint of attack. If this node is used as a waypoint, the active packet refers to the connection session information of the waypoint node and moves to the node that connected to the waypoint node. The node identified as the new attacker performs the same operation as the waypoint node, and when it is revealed that it is an actual attacker, it responds by isolating the corresponding IP and sends the information about the actual attacker to the management server of the victim domain. At this time, information on the waypoint node should be delivered together, and three methods can be applied. One is to include information about waypoints in the sensor during backtracking. This has the disadvantage that the size of the sensor cannot be fixed because the number of waypoint nodes cannot be predicted. The other is that the management server of the waypoint node manages the information on the waypoint node without sending the information about the waypoint node to the victim node. When information about waypoint nodes is needed, the victim node must request information from the waypoint node separately. The last method is to manage the waypoint node information by the management node of the waypoint node until the traceback is completed, and then add it to the sensor when the sensor that informs that the traceback sent from the management server of the final attacker's domain is completed. have. This method does not track the progress of the traceback until the victim node receives the traceback completion sensor.

The victim's management server on the network wants to respond to the black list using the information on the waypoint node, and at the same time, to quickly grasp the progress of the backtracking. However, since the conventional sensor has a simple function and operates at one application layer, the conventional sensor cannot actively use the resources of the system in a complex distributed network system environment. It was virtually impossible to cope actively.

The present invention has been proposed to solve the above-mentioned problem, and detects a new attacker address in the waypoint node, while a mobile sensor existing on the active node in the active network moves to a new attacker node and simultaneously provides information on the waypoint node and the waypoint node. Its purpose is to provide an intruder traceback and result notification method using a sensor that notifies the victim node of session information between the client and victim nodes.

1 is a diagram illustrating an embodiment of an intruder's movement path in an active network to which the present invention is applied.

2 is a diagram illustrating a process of tracking back and informing an intruder using a movement sensor according to the present invention.

Explanation of symbols on the main parts of the drawings

10: domain A 11: active node A

12: sensor management server A 13: server A

14: Intruder (Attacker or Hacker) 20: Domain B

21: active node B 22: sensor management server B

23: server B 30: domain C

31: active node C 32: sensor management server C

33: server C 41 ~ 43: active node

100: Internet 1,2: intruder movement path

The present invention for achieving the above object, the active network intruder using the mobile sensor in the active network configured to include a plurality of active nodes and the sensor management server for managing the mobile sensor, each of which is run and resides therein, and 1. A method of notifying a result, the method comprising: a first step of detecting, by a mobile sensor running in an active node, an attack of an intruder entering through an active network, and reporting it to a sensor management server of a domain to which a victim node belongs; The mobile sensor moves to a sensor management server of a domain via the intruder and obtains information of a node used as a waypoint and session information connected to the waypoint node; A third step of analyzing the obtained information to regard a node having a session with the waypoint node as an intruder node and to notify the sensor management server of the victim node of the intruder traceback result information for the waypoint node; The mobile sensor moves to a sensor management server of a domain to which the intruder node belongs, checks session information connected to the intruder node, and finally determines the node as an actual intruder when there is no more session information; And a fifth step of notifying the sensor management server of the victim node of the intruder traceback result information for the last intruder node.

The present invention provides a method for tracking back network intruders using sensors and reporting the results. In particular, when tracing an intruder (attacker) who invades a specific node after disguising its location through multiple nodes using TCP-based remote access service, it traces in connection with the waypoint node and traces the result. Provides a way to efficiently deliver. In order to trace back an attacker through multiple nodes, the information provided by each node through the intruder is used to determine which node the attacker is connected to. Information about nodes traversed by the intruder is forwarded to the server managing the compromised node. To this end, in the present invention, a mobile sensor having a mobility of a mobile code, operating in the kernel of an operating system, using resources of a system constituting a network, and directly connecting to a part of the operating system and changing contents as needed. It uses active security technology. The mobile sensor that moves along the intruder's path forwards the information obtained from the waypoint node to the server in the victim's domain that first attempted backtracking and uses this information to move to the next node. Therefore, the present invention proposes a mechanism for transmitting the intruder's information found at the waypoint node to the server managing the domain to which the victim node belongs using active network technology.

Accordingly, in the present invention, the mobile sensor for backtracking moves to the management server of the waypoint domain to obtain information on the node used as waypoint and session information connected to the waypoint node. The mobile sensor for backtracking analyzes the acquired information and considers the node that has established a session with the waypoint node as a real attacker, and the basic information of the backtracking sensor, waypoint node information, intruder node information, session information between two nodes, etc. A mobile sensor for reporting the traceback result is included and transmitted to the management server of the victim node, and the user moves to the sensor management server of the domain to which the intruder belongs. By repeating this, if there is no more session information, the node is determined to be the actual final attacker. At this time, the mobile sensor for reporting the traceback performance result sent to the sensor management server of the victim domain indicates that the sensor is a mobile sensor that reports the last result of the traceback so that the sensor management server of the victim domain finishes the backtracking. .

The above objects, features, and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in detail the present invention.

1 illustrates an embodiment of an intruder's movement path in an active network to which the present invention is applied. FIG. 1 shows an attacker (attacker) attacking a victim domain after disguising himself by accessing a specific server in another domain. The figure shown. The active network illustrated in FIG. 1 may be, for example, a large-scale network such as an ISP network, or may be an active network existing in the form of an IP network or an overlay. As shown in FIG. 1, each server 13, 23, 33 in each domain 10, 20, 30 is responsible for overall management in that domain, and each active node 11, 21, 31 in the domain. Denotes the redistribution point or endpoint of data transmission as the connection point on the active network. The active nodes 11, 21 and 31 contain management information of the active network and are programmed to have a function for recognizing, processing or transmitting data to another node. Furthermore, each active node may be connected to an active node of another network (which may be another active network or a general IP network) to transmit data or directly connected to a host. The execution node may be, for example, a router or the like.

A mobile sensor resides on the active node. Substantially, the mobile sensor includes active network management information and receives the policy from the sensor management servers 12, 22, and 32 in each of the domains, and takes charge of the active network management. The sensor management servers 12, 22, and 32 construct and manage information on mobile sensors residing in each domain in a database and are in charge of communication with the mobile sensors. The mobile sensor according to the present invention is a sensor of a new concept that resides on an active network, is programmable, and has advanced functions with respect to network management and security. 1, it is assumed that a log agent exists in a host in each domain 10, 20, 30 to record access session information.

In the structure of an active network according to an embodiment of the present invention shown in FIG. 1, an intruder (Hacker) 14 or an attacker connects to the server A 13 of the domain A 10 and disguises itself, and then, The victim node C 30 is shown to be attacked via the active nodes 41, 42 and 43 through the nodes of the other domain B 20. Here, the sensor management servers 12, 22, 32 and the active nodes 11, 21, 31 in each domain are configured to be mobile sensors. It is assumed that a log agent exists in each host in each domain to record connection session information. As such, in an active network, the intruder 14 invades by connecting to the server A 13 of the domain A 10 and then attacks a specific node via various nodes on the network, thereby causing the victim node to be hacked or paralyzed. It will cause the same side effects. In Fig. 1, server C 33 of domain C 30 becomes its victim node. Reference numerals 1 and 2, which are not shown, indicate the route order of the attacker 14.

Figure 2 shows the process of backtracking and informing the intruder using the movement sensor according to the present invention. Here, the same reference numerals are given to the same apparatus as compared with FIG. Referring to FIG. 2, as shown in FIG. 1, an intruder 14 masquerades as server B 23 via a node in domain B 20 and attacks server C 33 in domain C 30. In this case, the process of backtracking the intruder 14 and reporting the result will be described. First, an unsuspecting external intruder 14 connects to server B 23 of domain B 20 via various paths, and then disguises itself as server B 23 to server of domain C 30. When attacking the C (33), the server C (33) of the domain C (30) sensor management server of its own domain C (30) that the attack from the server B (23) of the domain B (20) Informed by C 32 (S201). Subsequently, the mobile sensor residing in the sensor management server C 32 moves to the sensor management server B 22 of the domain B 20 to trace back the server that has been attacked (S202). The mobile sensor reciprocates between the sensor management server B 22 and the server B 23 to obtain information on the node used as a waypoint and session logging information connected to the waypoint node, and to obtain the sensor logging server B. (22) (S203, S204). In this case, the sensor management server B 22 analyzes the acquired information of the mobile sensor to determine whether the server B 23 is an intruder or merely a stopover node, and the server B 23 is an intruder 14. Since it is a waypoint node, the node that has established a session with the waypoint node (here, the active node 11 of the domain A 10) is a real attacker and the server B 23 determines that it is only a waypoint node. Subsequently, the sensor management server 22 includes the basic information of the mobile sensor for the backtracking, the information of the waypoint node, the information of the attacker node, the session information between the actual attacker node and the server B 23, and the like. A new mobile sensor for notifying the tracking performance is generated and transmitted to the sensor management server C 32 of the victim domain C 30 (S205). At the same time, the mobile sensor for backtracking moves to the sensor management server A 12 of the domain A 10 to which the intruder (attacker) belongs (S206). By repeating the above steps, if there is no more session information connected to the node of the domain A 10, the node is finally determined as an actual attacker. Subsequently, the sensor management server A 12 generates a new mobile sensor for reporting the performance of the traceback and informs the sensor management server C 32 of the victim domain C 30 through this. In this case, the new mobile sensor is marked to indicate that the sensor reports the last result of the traceback. As a result, the backtracking to the attacker 14 is finished and the notification is finished as a result. Although three domains 10, 20, and 30 are disclosed in the drawings, the present invention is not limited thereto.

As described above, the mobile sensor for backtracking according to the present invention obtains the address of the sensor management server of the corresponding domain from the active node of the transit point domain and moves to the sensor management server from the log agent of the host designated as an attacker. Obtain session access information to determine the actual attacker's location. The mobile sensor for backtracking moves through the waypoint domain to the actual attacker domain, and at the same time, a new mobile sensor for reporting backtracking results conveying waypoint information moves to the sensor management server in the victim domain. If a real attacker is found, the mobile sensor for traceback is destroyed, and a new mobile sensor for reporting the last traceback result is moved to the victim domain. The sensor management server receiving the mobile sensor for reporting the traceback result can manage the blacklist or block the attacker's packet according to the degree of the attack.

In the detailed description and drawings of the present invention, a method of backtracking and reporting a result of a mobile sensor is disclosed, and the present invention is limited to one embodiment of an active network. May be applied. In addition, the network of the above structure is merely a preferable example for explaining the present invention and does not limit the scope of the present invention. Such network structure, apparatus, and implementation method may be variously changed, replaced, or modified using the concept of the present invention. Accordingly, the scope of the present invention should be determined by the appended claims rather than by the foregoing description.

According to the present invention, when attempting to trace back from the sensor management server of the attacked domain, not only the progress of the traceback can be grasped, but also appropriate response to the loss or error of the sensor that may occur during the traceback is performed. Can be. In addition, since the mobile sensor for backtracking does not include connection session information between the attacker and the waypoint node, the size of the sensor can be fixed and the fast backtracking can be performed.

Claims (5)

In the active network intrusion tracer using the mobile sensor in the active network including a plurality of active nodes each running and running the mobile sensor and the sensor management server for managing the mobile sensor, and the result notification method, A first step of detecting, by the mobile sensor running on the active node, an attack of an intruder entering through the active network, and reporting it to the sensor management server of the domain to which the victim node belongs; The mobile sensor moves to a sensor management server of a domain via the intruder and obtains information of a node used as a waypoint and session information connected to the waypoint node; A third step of analyzing the obtained information to regard a node having a session with the waypoint node as an intruder node and to notify the sensor management server of the victim node of the intruder traceback result information for the waypoint node; The mobile sensor moves to a sensor management server of a domain to which the intruder node belongs, checks session information connected to the intruder node, and finally determines the node as an actual intruder when there is no more session information; And Informing the sensor management server of the victim node of the intruder traceback result information for the last intruder node; Active network intruder traceback using the mobile sensor and the result notification method comprising a. The method of claim 1, wherein the second step, The mobile sensor traces back the active network intruder using the mobile sensor and reports the result, wherein the mobile sensor moves to the sensor management server of each corresponding domain in the reverse order of the nodes passed by the intruder. The method of claim 1, wherein the backtracking result information of the third step is And information about the mobile sensor, waypoint node information, intruder node information, and session information between the intruder node and the waypoint node. The method of claim 1, wherein the third step, And generating, by the sensor management server of the domain to which the waypoint node belongs, a new mobile sensor for notifying the intruder backtracking result of the waypoint node by using the generated mobile sensor. Active network intruder backtracking and result notification method using a mobile sensor, characterized in that notified to the sensor management server. The method of claim 1, wherein the fifth step is And generating, by the sensor management server of the domain to which the intruder node belongs, a new mobile sensor for notifying the final traceback result. The sensor management server of the victim node receives the traceback result using the generated mobile sensor. Active network intruder traceback using the mobile sensor and the result notification method characterized in that the notification.