KR20040080534A - Apparatus and method for simulating information warfare using client-server model - Google Patents

Abstract

PURPOSE: A device and a method for an information warfare simulation using a client-server model are provided to effectively test various attack/defense technologies used for the information warfare. CONSTITUTION: A simulation server(105) forms a network based on a database and simulates an attack/defense scenario of the information warfare by a command of a user. A simulation studio(101) provides the command and the data of the user to the simulation server, and provides a simulation result received from the simulation server to the user. The simulation server includes the database(106) storing the data used for the information warfare simulation, a DML generator(107) generating a DML file by receiving the network configuration information and the scenario information from the database, and using an initial DML file(109), a simulation engine(111) executing the simulation by reading the initial/final DML file(110), and an information warfare daemon(108) transmitting a result file(112) received from the simulation engine to the simulation studio or receiving the data and the command from the simulation studio.

Description

Apparatus and method for simulating information warfare using client-server model}

The present invention relates to a simulation apparatus capable of effectively experimenting with various attack and defense techniques used in information warfare, and more particularly to an information warfare simulation apparatus and method composed of a client-server model.

With the development of communication through computer systems and networks, the spread of hacking code using e-mail attachments, attacks using vulnerabilities in computer systems, and denial of service attacks that lead to resource depletion; Cyber attacks through the hacking of personal information or computer systems such as DDoS) are gradually increasing.

In order to protect the system from cyber attacks, various attack techniques and defense techniques have been studied and appropriate countermeasures have been published. However, at present, countermeasures are generally established only after the attack and its damages have been confirmed. Once countermeasures are known, the frequency of attacks using the same attack technique is known to be low.

Moreover, no specific cases or characteristics of all-out information warfare attacks have been officially reported, and although not all-out, rogue-level information wars or highly probable attacks Because it is difficult to obtain data even on the Internet, it is difficult to study the characteristics of the network or system, the characteristics of the attacks used in information warfare, the ripple effect, and the degree of damage when an attack through the Internet is applied.

Simulation-based research techniques are widely applied in that users can freely create near-real virtual situations and examine the behavior of attacks. Simulation techniques that can implement the actual situation as it is and study various problems or solutions based on it can be used in various engineering fields other than the computer field because they can be implemented even in extremely difficult situations. From this point of view, the simulation technique is very useful for conducting research on information warfare.

The Internet, which is the battlefield of information warfare, is rapidly changing in size and speed, and cyber attack technology is also changing so that it is difficult to realize the real situation virtually. Is difficult to establish an experimental environment.

In order to successfully build a simulation environment, it is important to adopt appropriate simulation techniques and models. In this respect, information warn simulation must satisfy the following conditions.

First, the internet and internet protocol should be able to be expressed as a network corresponding to the battlefield of modern information warfare. Unlike the existing simulation in a network consisting of small nodes or a network for evaluating performance of a specific protocol, the internet consisting of more than 100,000 nodes should be represented as a simulation and the simulation can be performed.

Second, the foundation for evaluating the impact of various attacks and for simulating various attack techniques and defense techniques should be established. We need a simulation base that can represent a variety of attacks and defenses rather than a simulation base that can only represent attacks or defenses based on a specific model.

Third, it should be possible to build a simulation foundation in a distributed computer environment rather than in a single computer environment. It is necessary to be able to perform simulation for various models for a long time in order to effectively research information warfare.

Various simulation frameworks can be considered as the basis of information warfare simulation. In particular, a network simulator (NS), which provides discrete event simulation and enables simulation of various protocols such as TCP, routing, multicast, etc., running on wired and wireless networks, is a network simulation. Most widely used in the field. However, the network simulator NS has many problems in simulating a large network in terms of the use of a central processing unit (CPU) or memory. Georgia Tech has developed a Parallel Distributed NS (PDNS) to address this, but it is still being studied at the laboratory level and is insufficient to represent large networks and simulate information warfare.

Meanwhile, GloMoSim was developed to solve the scalability problem of the network simulator (NS), and GloMoSim provides a scalable simulation base for a wireless or wired network. GloMoSim also enables parallel simulation to improve performance, and has a simulation process of the discrete event-based simulation framework. However, even though GloMoSIm is likely to evolve, it currently supports only wireless protocols, making it a lab-level simulation framework like PDNS. Therefore, it is expected to be difficult to use for information warfare simulation based on large networks like the Internet.

In addition, dummynet, NistNet Utah Network Testbed, and Netwo are building or verifying various network simulations or emulation bases such as emulator, Ohio Network Emultor, Opnet, and Shunra Cloud, but there are no simulators for information warfare.

An object of the present invention is to provide an information warping simulation apparatus and method comprising a client providing an interface to a user and a server configured to configure a network based on the user's input and execute various simulations to output a result.

The information warfare simulation apparatus using the client-server model of the present invention for achieving the above object comprises a simulation server for constructing a network based on a database according to a user's command, and simulates attack and defense scenarios of information warfare, And a simulation studio providing commands and data to the simulation server and providing the user with simulation results transmitted from the simulation server.

The simulation server includes a database storing data used for the information warfare simulation, a DML generator for receiving network configuration information and scenario information from the database, and generating a DML file using an initial DML file, and generating from the DML generator. A simulation engine that reads the generated DML file and the final DML file and executes the simulation, and an information transfer daemon that receives the result file from the simulation engine and sends it to the simulation studio or receives data and command information from the simulation studio. It features.

The simulation studio provides a user interface module that provides the user with an interface for network monitoring, host configuration, security configuration, and scenario editing, and receives the user command through the user interface module, and manages a database of the simulation server. And a daemon connector for transmitting the user command and data transmitted from the management module to the simulation server and receiving information stored in a database and the simulation result from the simulation server.

In order to achieve the above object, the information warfare simulation method using the client-server model of the present invention generates a network to be used for information warfare and stores it in a database. After constructing, storing in database, creating actors scenario by combining actors necessary for creating scenarios, storing in database, and importing network and scenario stored in the database to generate DML file using initial DML file. The method may include performing an information warfare simulation using the generated DML file, and outputting the simulation result as a file.

1 is a block diagram of an information warfare simulation apparatus utilizing a client-server model according to the present invention.

2 is a flowchart illustrating a method of simulation of information warfare using a client-server model according to the present invention.

<Description of the code | symbol about the principal part of drawing>

101: simulation studio 102: user interface module

103: Management Module 104: Daemon Connector

105: simulation server 106: database

107: DML Generator 108: Information War Daemon

109: Initial DML File 110: Final DML File

111: Simulation Engine 112: Result File

The present invention enables to specifically simulate the effect on the system or network when cyber attacks in information warfare. Specific objects and ranges of the present invention are as follows.

A) Development of information warfare modeling method

There is a need for an improved modeling method that can reflect the association and flow of attack techniques used in information warfare simulation.

B) Actor development

In order to simulate the attack behaviors used in each attack scenario, a software (S / W) module is required that can take the same behavior as the actual attack behavior.

C) Development of DML (Domain Modeling Language) generator

The simulation engine uses DML as input. Therefore, a module is needed to convert various simulation data stored in DBMS, not DML, into DML.

D) simulation studio development;

Simulation Studio requires the following features:

Scenario creation: the ability to configure and run attack scenarios for simulation

Simulation environment setup: Ability to set the state of virtual networks and hosts used in simulations

-Simulation execution and process display: Ability to run a simulation based on the created scenario and the set simulation environment, and visually express the process

-Replay: Replay the simulation repeatedly so that the attack scenario can be thoroughly analyzed and the countermeasure against real attacks can be prepared.

E) development of simulation engines;

You need a core module of the simulator that reads the DML files output from the DML generator and actually performs various information warping simulations and outputs the results.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an information warfare simulation apparatus utilizing a client-server model according to the present invention, and is configured based on a client and a server for future scalability such as distributed simulation.

The client, simulation studio 101, provides a simulator user interface that simulates attack and defense scenarios of information warfare. The simulation studio 101 includes a user interface module 102 that provides various interfaces to a user, and a management module 103 that receives input from the user and transmits the input to the simulation server 105 and controls various functions of the simulation server 105. And a daemon connector 104 for communication with the simulation server 105. The user interface module 102 includes a network viewer (Visual Network Viewer), a host configurator, a security configurator, a scenario editor, and the like. The management module 103 includes a database manager ( DB Manager), Scenario Manager, and Network Manager.

The simulation server 105 inputs network configuration information and scenario information from the database 106 and database 106, which store various types of data used in the information warfare simulation, for example, attack scenarios and defense scenarios, actors, and network configuration information. And a DML generator 107 that generates a DML file using the initial DML file 109, a simulation engine 111 that reads the final DML file 110 generated from the DML generator 107, and executes a simulation, and a simulation engine Receives the result file 112 from 111 and sends it to the simulation studio 101 or receives data and command information from the simulation studio 101 and stores it in the database 106 or sends it to the DML generator. It is composed.

The sub-system of the simulation apparatus according to the present invention will now be described in more detail.

Simulation engine (111)

The simulator main function is the engine that drives the simulation and runs on the discrete event-based simulation framework. Parses the input DML file 110 and calls the Java functions specified in the DML. As the called Java functions execute, the information warping simulation proceeds. All events and their actions generated during the simulation process are made by events or processes. However, information generated or referenced by actors that are executed by one of the application-specific simulation processes, such as which actors were executed, which actors generated what information, etc. Global variables are defined for sharing.

Simulation Studio (101)

Runs on Microsoft Windows and provides a user interface. It has a daemon connector 104 for establishing a communication channel with the information warping daemon 108 of the simulation server 105 and a TCP / IP socket, and sends all commands to the simulation server 105 or simulates it. The server 105 receives the contents sent.

The functions of the simulation studio 101 include database management, network view, property setting of network elements, scenario generation (copy of scenarios, search of scenarios, search of properties of actors constituting a scenario, Generation, execution of information warfare simulation, etc.) and all user interfaces are implemented. The functions of the simulation studio 105 are classified into five categories as shown in Table 1 below.

division Detail function Edit scenario Create new scenario Read scenarios (fix existing scenarios) Edit Scenario (Add / Modify / Delete Actors) Save scenario Scenario Management Scenario Management (Add / Modify / Delete Scenarios) Network management Network Management (Add / Modify / Delete Network) Database administration Full database management (manage database as SQL query) Run simulation DML generation Run simulation Simulation run result

The user interface module 102, which consists of a network viewer, a host configurator, a security configurator, a scenario editor, and the like, provides various interfaces to a user and edits a scenario. The management module 103, which is composed of a database manager, a scenario manager, a network manager, and the like, receives a user input and transmits the input to the simulation server 105, and controls various functions of the simulation server 105. That is, the database manager manages the database, the network manager manages the network, and the scenario manager manages the scenario.

Actor

Actors are the Java classes that play the most important role in information warfare simulation. All nodes used in the scenario are implemented as actors, generated in the form of Java libraries, and sent to the simulation engine 111. There are two types of actors, the types of nodes in the scenario. Relational computational actors are used to control the flow of the simulation with the relationships between the actors, and attacking actors are used to represent the unit attacks required for information warfare.

The structure of an actor is a Java class with three methods: <actor-name> is a way of initializing the conditions necessary to run an actor and initializing the actor itself. An action is a code of the action the actor represents. In the present invention, the behavior of the actual actor is simplified, but in an attempt to show a substantial part of the actual program.

Next, we describe the postconditions that must be satisfied after the actor is executed. Post-conditions include effects on the simulation after the actor runs. However, the output of the actor as it runs is recorded in the action.

public class NetworkScan Extends Actor {

public <Actor name> NetworkScan (<Arg>)

public boolean action () {

precondition ();

<actor-specific behavior description>

// initialize for execution, // execute, // save processing result

postcondition ();

private booleanprecondition ()

}

Anything that actors output is output through the standard output. Since the standard output device is a socket made by the information warfare daemon 108, all outputs are input to the information warfare daemon 108. The information warfare daemon 108 reads the inputs, i.e., the outputs of the actors, processes them appropriately and stores them in the result file 112 or outputs them to a socket connected to the simulation studio 101.

Database 106

All data necessary for the simulation is recorded and managed in the database 106. The database 106 defines tables such as category, actor, scenario, result, network, host, service, firewall, vulner, network, os-list, service-list, and the like.

DML Generator (107)

Since the simulation engine 111 takes a DML file as an input, a DML file should be created. The DML file 110 is generated using various data stored in the database 106.

DML is a language for network modeling. In the present invention, a basic DML schema is provided, and a user should describe a DML applicable to a domain desired by the user according to the DML schema provided by the present invention.

DML includes network-related properties such as hosts, routers, links, interfaces, and packet queues, and properties related to protocols and applications such as protocols, protocol messages, and timers.

Information Warfare Daemon (108)

The information warfare daemon 108 in charge of communication with the simulation studio 101 uses a TCP / IP socket as a communication protocol. The information exhibition daemon 108 receives a command requested by the simulation studio 101, and transfers the simulation result executed by the server 105 to the daemon connector 104 of the simulation studio 101. Examples of commands required by the simulation studio 101 include commands for searching various databases stored in the simulation server 105, commands for executing simulation (generation of DML, execution of simulation, etc.). In addition, the information warfare daemon 108 stores various types of information output by the actors in the process of executing the simulation, or transfers some information to the simulation studio 101.

Then, the process of the information warfare simulation in the information warfare simulation device configured as described above will be described with reference to FIG.

1. Create a network

The user creates a network to be used for information transfer through the simulation studio 101 (step 10). A user creates and specifies a network using the network viewer and host configurator of the simulation studio 101. The network generated at this time is sent to the simulation server 105 and is defined as DML and stored in the database 106.

2. Network Configuration

The user configures the target network via the simulation studio 101 (step 20). The database 106 of the simulation server 105 stores components necessary for network configuration (router, rule set of firewall, bandwidth of a network link, operating system of hosts, host performance and daemon in service, etc.). The user can configure the target network by importing and specifying components stored in the network database 106. The configured network is stored in the network database 106 of the simulation server 105.

3. Create Scenario

The user creates an information warfare scenario using the scenario editor 102 of the simulation studio 101 (step 30). At this time, consider the characteristics of network, router, host, etc. to be composed. Scenarios or components thereof that have already been created are stored in the scenario database 106 of the simulation server 105, where unit attacks or defenses are defined as one actor and stored in the actor database 106. Thus, the user can create one new scenario by combining the stored actors.

4. Generate DML

The network and scenarios stored in the database 106 are imported to generate a DML file (step 50). The DML generator 107 inserts a network and a scenario into the initial DML file 109 to generate a DML file. The actors that actually perform the unit attack used in the information warfare scenario are obtained from the actor database 106. If you need to change the actor library, create a new one to use in the simulation framework (step 40).

5. Information Warfare Simulation

The simulation engine 111 performs the information war simulation using the final DML file 110 output from the DML generator 107 (step 60). The simulation is performed by specifying the created network, attributes of the network, scenarios, and the like, which modify the specified network DML by searching the database 106 for values described in the network's attributes and scenarios.

6. Output result file

The simulation result value output from the simulation engine 111, that is, the result file 112 is sent to the simulation studio 101, the user can confirm this through the user interface module 102 (step 70). All results generated during the simulation run are stored in the file 112. Therefore, the result file 112 is sent to the simulation studio 101 so that the user can check. In addition, after the simulation is finished, it can be used to play back the simulation.

The work request from step 10 to step 50 is made in the simulation studio 101, and the simulation execution and various database related processes are made in the simulation server 105.

As described above, the information warfare simulation apparatus of the present invention comprises a client that provides an interface to a user, and a server that configures a network based on user input and executes various simulations to output a result. The simulation server configures the network based on the database stored according to the user's command, and simulates the attack and defense scenarios of information warfare. The simulation studio, the client, provides the user's command and data to the simulation server and simulates the simulation results from the simulation server. To the user. The present invention is to improve the modeling method for information warfare simulation to achieve the construction of information warfare research and secure data through the implementation of the simulator, and to configure and simulate a variety of network environments and scenarios in a short time, the information actually expected Make sure you are effectively prepared for the whole situation.

Claims (9)

A simulation server that constructs a network based on a database according to a user's command and simulates information and attack scenarios, And a simulation studio for providing the user's command and data to the simulation server and providing the user with simulation results transmitted from the simulation server. The method of claim 1, wherein the simulation server comprises: a database storing data used for the information warfare simulation; A DML generator for receiving network configuration information and scenario information from the database and generating a DML file using an initial DML file; A simulation engine that executes a simulation by reading the DML file and the final DML file generated from the DML generator; An information warfare simulation apparatus utilizing a client-server model, comprising: an information warfare daemon receiving a result file from the simulation engine and sending the result file to the simulation studio or receiving data and command information from the simulation studio. 3. The information warfare simulation apparatus using the client-server model according to claim 2, wherein the database stores attack scenarios, defense scenarios, actors, and network configuration information. The apparatus of claim 1, wherein the simulation studio comprises: a user interface module for providing the user with an interface for network monitoring, host configuration, security configuration, and scenario editing; A management module which receives the user command through the user interface module and manages a database of the simulation server; Information using the client-server model, characterized in that it comprises a daemon connector for transmitting the user command and data transmitted from the management module to the simulation server and receives the information stored in the database and the simulation results from the simulation server. Pre simulation device. 5. The information warfare simulation apparatus using a client-server model according to claim 4, wherein the daemon connector forms a communication channel with a TCP / IP socket. a) creating a network to be used for information warfare simulation and storing it in a database; b) configuring the network using the components necessary for network construction and storing it in a database; c) creating an information warfare scenario by combining actors necessary for creating a scenario, and storing it in a database; d) importing networks and scenarios stored in the database to generate a DML file using the initial DML file, e) performing information warfare simulation using the generated DML file; and f) outputting the simulation results to a file. 7. The method of claim 6, wherein the generated network is defined in DML and stored in a database. 7. The information transfer simulation using a client-server model according to claim 6, wherein the component is a router, a rule set of a firewall, a bandwidth of a network link, an operating system of hosts, a performance of a host, and a daemon being serviced. Way. 7. The method of claim 6, further comprising generating a new actor library when the actor library needs to be changed in step c).