KR20040039552A - Attacker traceback and isolation system and method in security network - Google Patents

Abstract

PURPOSE: A system and method for tracking an attacker back and intercepting an attack in a security network is provided to trace the location of an attacker back in case that the attacker accesses a specific host via many hosts for the purpose of the stealing or change of important data. CONSTITUTION: A system and method for tracking an attacker back and intercepting an attack in a security network is comprised of a session logging part(240), a security management system(220), and a traffic interruption part(230). The session logging part(240) is installed and executed at each host(210-213). The security management system(220) executes an attacker tracking function at each domain. The traffic interruption part(230), having an interface for an external system, intercepts an attacker's traffic through the interface.

Description

Attacker traceback and isolation system and method in security network

The present invention relates to network security, and more particularly, an attacker backtracking and attack blocking system in a security network for backtracking the actual location of an attacker necessary for active and effective response to connection-based cyber attacks on a network; It is about a method.

In general, when an attacker connects to a specific host, the host is not connected directly from the logged-in host to the target host, but through multiple hosts in between. These hosts exist globally across domains. 1 illustrates a security mechanism applied in a conventional network security technique. The conventional network security system includes an intrusion detection system 111 and a firewall system 110 for blocking intrusion traffic detected at an entrance of a corresponding domain to detect an intrusion into a corresponding domain (local network). In the past, the security manager manually integrated for the integration with the two systems, but the response is late, the security management system 112 is currently placed. If an attack is made through the Internet (120), it is detected by the intrusion detection system and notified to the security management system of the corresponding domain (121). The security management system changes the configuration of the firewall system (122), thereby blocking the attack traffic (123).

In this case, the information about the traffic to be blocked is based on the address of the previous host that connected to the host of the domain, and if the attacker passes through multiple hosts, the traffic from the intermediate transit host is not blocked. Done. Therefore, if an attacker re-attempts a different transit host, this is allowed. In other words, the current network security technology targets only one's own domain. An intrusion detection system for detecting an intrusion in one's own domain and a firewall system for blocking attack traffic are installed at the entrance of one's domain. The focus is on how to detect attacks well and block attack traffic. In this case, however, the information possessed by the attacker is not the host information of the attacker logged in, but the information of the host through the middle. Based on this information, even if the attacker blocks traffic, the attacker can freely access the network. have. As a result, the second and third attacks using other transit hosts are allowed, and there is a problem in that no action can be taken against these attacks in the attacked domain.

The present invention has been proposed to solve the conventional problems as described above, and the technical problem to be achieved by the present invention is to establish a connection to a particular host via a number of hosts for the purpose of cutting, changing, etc. important data on the network To provide an attacker backtracking system and method in a security network that traces back the actual attacker's location in case of intrusion.

Another technical problem to be achieved by the present invention is to set up a connection to a specific host through various hosts for the purpose of cutting or changing important data on the network, and invading the attacker's network by trace back the actual attacker's location. It is to provide a system and method for backtracking and blocking attackers in a secure network that can block the connection at the entry point.

1 illustrates a security mechanism applied in a conventional network security technique.

2 illustrates an embodiment of an attacker traceback and attack blocking system in a security network according to the present invention.

FIG. 3 shows each function block and its operation for communicating with the security management system, leaving log data for tracking information for each connection in the host.

In order to achieve the above technical problem, the attacker traceback system in the security network according to the present invention is installed in the host in a network including at least one local network including a host for transmitting and receiving packet data, A session logging unit having information on a connection path between hosts for transmitting and receiving; And a security management system that requests the connection path information from a host of each local network and tracks an attacker's location by using the response to perform tracking of the attack.

The information on the connection path between hosts in the session logging unit includes log data by generating trace information about a connection that is accessed from another host to another host using packet information transmitted and received and user session change information in the host. It is preferable to. The session logging unit may retrieve tracking information for a specific connection from the log data and session change information of the user, and search for user account change information.

In order to achieve the above technical problem, an attacker traceback method in a security network according to the present invention includes a network including at least one local network including a host for transmitting and receiving packet data and a security management system in charge of security management. Generating information regarding connection paths between hosts for transmitting and receiving packet data at the host; and requesting connection path information generated by the security management system to a host of each local network in order to track an attack And using the response to track the attacker's location.

The step of generating connection path information between the hosts may include generating trace information on a connection that is accessed from the host to another host using packet information transmitted and received and user session change information in the host, and leaving it as log data; And retrieving tracking information for a specific connection from the log data and session change information of the user, and retrieving user account change information.

In order to achieve the above another technical problem, an attacker traceback and blocking system in a security network according to the present invention is installed in the host in a network including at least one local network having a host for transmitting and receiving packet data, A session logging unit having information on a connection path between hosts for transmitting and receiving packet data; A security management system that requests the connection path information from a host of each local network and tracks an attacker's location using the response to perform a trace of the attack; And a traffic blocking unit for blocking the specific connection traffic by receiving a blocking request for the specific connection traffic from the security management system.

The session logging unit comprises a packet data collection unit for collecting information about the transmitted and received packets; A session information collecting unit collecting user session change information from a process running on the host; A user connection tracking information generation unit configured to leave log data by generating tracking information about a connection which is connected to the other host from the host by combining the data collected by the packet data collecting unit and the session information collecting unit with each other; A user session change information generation unit for generating session change information of a user and leaving log data; A tracking target connection retrieving unit for retrieving the tracking information for a specific connection from the log data generated by the user connection tracking information generation unit and the user session change information generation unit and returning the result; And a user account change information search unit for searching for and returning user account change information. The traffic blocking unit is preferably an edge router of the public network blocking at the point of entry into the public network.

In order to achieve the above technical problem, an attacker traceback and blocking method in a security network according to the present invention includes at least one local network including a host for transmitting and receiving packet data and a security management system in charge of security management. Generating information on a connection path between hosts for transmitting / receiving packet data in a network; Requesting the connection path information from a host of each local network by the security management system to track the attack, and using the response to track the attacker's location; And blocking the specific connection traffic by receiving a block request for the specific connection traffic from the security management system.

The generating of the connection path information may include combining log data transmitted and received and session change information to generate tracking information on a connection that is accessed from the corresponding host to another host and leaving log data; Generating session change information of the user and leaving log data; Retrieving tracking information for a specific connection from log data of the user connection tracking information and user session change information; And retrieving user account change information.

A computer readable recording medium having recorded thereon a program for executing the invention described above is provided.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention. First, the security structure and the overall procedure of the present invention will be outlined and described in more detail.

The security structure of the present invention can be divided into three parts for the actual implementation. First, an interface to an external system and a session log program installed and executed on each host to leave information on connection on each host. In order to trace the attack, the security management system requests tracing information from each transit host and performs continuous tracing based on the response. Third, it accepts the blocking request for specific connection traffic from the security system. It consists of routers of a network that can do it.

The overall procedure is as follows. In the first step of collecting information, each host collects information related to the user's connection from packets sent and received from the network card, and simultaneously collects information about changes in user sessions from processes running on that host. It generates the tracking information about user connection from and stores the data. In this state, an attack that invades a specific host through multiple hosts is made, and when the attack is detected in the domain (local network) where the attacking host exists, the back trace is performed by notifying the security management system existing in the domain. .

The security management system makes a trace request to the previous host based on information such as the address of the two hosts, the connection port number of the connection, the connection user ID, and the connection time. Based on the information, the requested host also transmits the information about the previous host and the connection to the security management system. By repeating this task, the attacker traces back to the real host.

When the tracking is completed, the security management system makes a request for blocking the traffic of the attack to the edge router of the public network where the domain (local network) to which the attacker's login host belongs is connected, and the router blocks the traffic by blocking the traffic. This completes the tracking and blocking of access to the network.

Meanwhile, an attacker backtracking and attack blocking system and its operation in a security network for backtracking the attacker's position and blocking the attacker's attack according to the present invention will be described in detail with reference to the accompanying drawings.

2 illustrates an embodiment of an attacker traceback and attack blocking system in a security network according to the present invention. The attacker traceback and attack blocking system in the security network is a session logging unit 240 installed and executed in the host 210, 211, 212, 213, security management system 220 to perform the attacker tracking function in each domain And a traffic blocker 230 having an interface to an external system and blocking the attacker's traffic at the point of entry into the network through the interface.

The traffic blocking unit 230 receives the blocking request for the specific connection traffic from the security management system 220 to block the specific connection traffic, and when the actual implementation, it is preferable to perform the function in the edge router of the public network. This is also the case in the present embodiment. (Hereinafter, reference numeral 230 of the traffic blocking unit and the edge router of the public network will be denoted the same.)

The session logging unit 240 has information on a connection path between hosts for transmitting and receiving packet data, and may be implemented in software as a session logging program. The session logging program is preloaded and executed in each host, collects and processes data necessary to configure tracing information on an attacker's connection, leaves log information, and receives and responds to requests from the security management system 220. It has an interface to an external system. When the attacker intrudes into the target host 213 via the multiple hosts 211 and 212 from the host 210 where the user logs in, he detects it and attacks the security management system 220 in the corresponding domain. Information about the connection such as the address, port number, connection user ID, and connection time of the host 212 and 213 configuring the connection is also notified.

When the security management system 220 makes a request for tracking information 291 of the connection to the previous host 212 based on the corresponding information, the host 212 based on the log information left by its session logging program. The information on the previous host 211 and the connection between the previous host and itself is made to the security management system 220. (291)

By performing this procedure for each previous host 211, 210, the attacker actually tracks the host 210 logged in. At this stage, the encryption method for the data exchanged with the mutual authentication procedure can be applied for security between the host and the security management system requesting the host. If the attacker's host is tracked, the attacker's domain is blocked from the network connection by requesting the edge router 230 of the public network to which the attacker's domain is connected to the public network to block the attacker's traffic.

FIG. 3 shows each function block and its operation for communicating with the security management system, leaving log data for tracking information for each connection in the host. The packet data collection unit 320 collects information on packets transmitted and received through the network card 310. The session information collecting unit 321 collects user session change information from a process running on the host.

The user connection tracking information generating unit 330 combines the raw data collected by the packet data collecting unit 320 and the session information collecting unit 321 with each other and traces all connections that are connected to the other host from the corresponding host. Generates information and leaves log data. The user session change information generation unit 331 generates the session change information of the user and leaves log data.

The tracking target connection searcher 340 retrieves tracking information about a specific connection from the log data generated by the user connection tracking information generator 330 and the user session change information generator 331 and returns the result. The user account change information search unit 341 searches for and returns the user account change information.

In addition, the external interface unit 350 provides a communication function with the security management system. The communication security unit 392 performs an encryption function for security during communication.

In addition, the integrity verification unit 390 periodically and repeatedly checks whether each module executed in the host has not been violated. The generation information management unit 391 manages the log data generated continuously.

Meanwhile, the above-described functional blocks can be programmed as functional modules when implemented in software.

As described above, in one embodiment of the attacker traceback and attack blocking system and method in the security network according to the present invention, the attacker traceback and attack blocking functions have been described, but the attacker traceback system is one of the present inventions; The method comprises only the attacker traceback part of the attacker traceback and attack blocking system except for the attack blocking. Therefore, the description of the attacker traceback is included in the above description will not be described separately.

As described above, the present invention can also be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

According to the present invention described above, the present invention has the following effects. First, even if an attacker intrudes through a host through a host connection setting, the attacker's actual location can be determined. Second, by tracking the actual location and blocking the connection at the point of entry to the attacker's network, it is possible to cope with subsequent attacks by the same attacker. Third, by identifying the attacker's location, it is possible to respond to the attacker on a global level, thereby rapidly improving the ability to cope with cyber attacks.

Claims (11)

A network comprising at least one local network having a host for transmitting and receiving packet data, the network comprising: A session logging unit installed in the host and having information on a connection path between hosts for transmitting and receiving packet data; And In order to track the attack, the attacker station in the security network comprising a security management system for requesting the connection path information from the host of each local network, and using the response to track the location of the attacker Tracking system. The method of claim 1, wherein the information about a connection path between hosts of the session logging unit is Attacker trace back in the security network, which includes log data by generating trace information about the connection from the host to the other host by using the transmitted / received packet information and the user session change information in the host. system. The method of claim 2, wherein the session logging unit And retrieving tracking information for a specific connection from the log data and session change information of the user, and retrieving user account change information. A network comprising at least one local network having a host for transmitting and receiving packet data, the network comprising: A session logging unit installed in the host and having information on a connection path between hosts for transmitting and receiving packet data; A security management system that requests the connection path information from a host of each local network and tracks an attacker's location using the response to perform a trace of the attack; And And a traffic blocker for blocking a specific connection traffic by receiving a block request for a specific connection traffic from the security management system. The method of claim 4, wherein the session logging unit A packet data collecting unit collecting information on the transmitted and received packets; A session information collecting unit collecting user session change information from a process running on the host; A user connection tracking information generation unit configured to leave log data by generating tracking information about a connection which is connected to the other host from the host by combining the data collected by the packet data collecting unit and the session information collecting unit with each other; A user session change information generation unit for generating session change information of a user and leaving log data; A tracking target connection retrieving unit for retrieving the tracking information for a specific connection from the log data generated by the user connection tracking information generation unit and the user session change information generation unit and returning the result; And An attacker traceback system in a secure network, comprising: a user account change information search unit for searching for and returning user account change information. The method of claim 4 or 5, wherein the traffic blocking unit Attacker backtracking and blocking system in a security network, characterized in that the edge router of the public network to block at the point of entry into the public network. In the network comprising at least one local network having a host for transmitting and receiving packet data and a security management system in charge of security management, Generating information regarding a connection path between hosts for transmitting and receiving packet data in the host; and In order to track the attack, the security management system comprises the step of requesting the connection path information generated in the host of each local network, and using the response to track the attacker's location security Attacker traceback method in network. The method of claim 7, wherein the generating of connection path information between the hosts comprises: Generating trace information on a connection to be accessed from the host to another host using packet information transmitted and received and user session change information in the host, and leaving it as log data; And And retrieving tracking information for a specific connection from the log data and session change information of the user, and retrieving user account change information. In the network comprising at least one local network having a host for transmitting and receiving packet data and a security management system in charge of security management, Generating information on a connection path between hosts for transmitting and receiving packet data; Requesting the connection path information from a host of each local network by the security management system to track the attack, and using the response to track the attacker's location; And And blocking the specific connection traffic by accepting a block request for the specific connection traffic from the security management system. The method of claim 9, wherein the generating of the connection path information comprises: Combining the transmitted and received packet data and the session change information with each other to generate tracking information on a connection that is connected to the other host from the host and leaving log data; Generating session change information of the user and leaving log data; Retrieving tracking information for a specific connection from log data of the user connection tracking information and user session change information; And A method for tracking and blocking attackers in a secure network, comprising retrieving user account change information. A computer-readable recording medium having recorded thereon a program for executing the invention according to any one of claims 7 to 10.