KR20040087206A - Device for detecting and preventing system hacking - Google Patents

Abstract

PURPOSE: A system hacking detection and prevention system is provided to detect a hacker's invasion via a real time monitoring, and to prevent data from being leaked by automatically blocking a hacking activity. CONSTITUTION: The system comprises a router(2), a fire wall(3), a DMZ(De-Militarized Zone, 6), plural sensors(41, 42, 43) and plural manager modules(51-54). The router(2) and the fire wall(3) connects to the internet, and the DMZ(6) connects to the fire wall(3). The sensor modules(41, 42, 43), connecting to the fire wall(3), detect a hacking activity by applying a petrinet algorithm to task content, block the hacking activity, enable a manager to refer to system security related data, and perform a user approval request. The manager modules(51-54), connecting to the router(2), the fire wall(3) and the sensors(41, 42, 43), request the sensors(41, 42, 43) to perform a user approval, receive the data from the sensors(41, 42, 43), and monitor the received data.

Description

Device for detecting and preventing system hacking

The present invention relates to the field of computer security, and more specifically, to detect hacker intrusion through real-time monitoring, and automatically block when there is a hacker's intrusion, and prevent information leakage. And it relates to a system intrusion detection and prevention device, which can lead to the security of the DMZ (DeMilitarized Zone) that is exposed to hacking by preventing.

In recent years, computer-related crimes have surged. The Internet is rapidly spreading, and anyone can easily connect to any host connected to the Internet, cracking and using denial-of-service attacks using intrusion methods easily available on the Internet. Service, DoS) can make services impossible. According to statistics, more than one accident occurs every second, the size is enormous.

As a result, the demand for security in the computing industry is more urgent than ever.

The purpose of the present invention is to solve such technical problem, and can detect hackers' intrusion through real-time monitoring and automatically prevent the leakage of information by blocking the hacker's intrusion. It is to provide a system intrusion detection and prevention device that can lead to the security of the DMZ exposed to hacking by preventing it.

1 is a block diagram of a system intrusion detection and prevention apparatus according to an embodiment of the present invention.

2 is an operation flowchart of a system intrusion detection and prevention apparatus according to an embodiment of the present invention.

3 is a flowchart illustrating operations of a sensor module and a manager module when detecting a system intrusion of the system intrusion detection and prevention device according to an embodiment of the present invention.

4 is a flowchart illustrating operations of a sensor module and a manager module when collecting and inquiring system information of a system intrusion detection and prevention device according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

1: internet 2: router

3: firewall 41, 42, 43: sensor module

51, 52, 53, 54: manager module 6: DMZ

As a means for achieving the above object, the configuration of the present invention includes a router and a firewall connected to the Internet, a DMZ connected to the firewall, and a content of a user connected to the firewall and accessing the system. It detects hacking in real time by using Petrinet algorithm and automatically blocks the intrusion when an intrusion occurs, thereby preventing the leakage of information and querying the security related information of the system. In this case, the sensor is authenticated and the sensor module transmits data when there is a request for data transmission from the manager module. It is connected to the router, the firewall, and the sensor module. After requesting and authenticating from the sensor module, Comprises a plurality of manager modules for monitoring the received data by receiving a data transmission is coming.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings in order to describe in detail enough to enable those skilled in the art to easily carry out the present invention. . Other objects, features, and operational advantages, including the object, operation, and effect of the present invention will become more apparent from the description of the preferred embodiment.

For reference, the embodiments disclosed herein are only presented by selecting the most preferred embodiment in order to help those skilled in the art from the various possible examples, the technical spirit of the present invention is not necessarily limited or limited only by this embodiment Rather, various changes, additions, and changes are possible within the scope without departing from the spirit of the present invention, as well as other equivalent embodiments.

The configuration of the system intrusion detection and prevention apparatus according to an embodiment of the present invention, as shown in FIG. 1, is connected to the router 2 connected to the Internet 1 and to the router 2 described above. Firewall (3), the DMZ (6) connected to the firewall (3), the user's work connected to the firewall (3) and access the system in real time using a Petrinet algorithm It can prevent the leakage of information by checking the hacking status and automatically block the intrusion in case of intrusion, and can check the security related information of the system. When there is a data transmission request, a plurality of sensor modules (41, 42, 43) for transmitting data and the sensor module (41, 42, 43) are connected to the sensor module after connecting to the sensor module. It includes a plurality of manager modules (51, 52, 53, 54) for monitoring the received data by receiving the data transmitted from the sensor module after the use authentication request from the sensor module and the use authentication is made.

Operation flow of the system intrusion detection and prevention apparatus according to an embodiment of the present invention, as shown in Figure 2, the step of starting the operation (S1), the step of waiting for the connection (S2), use authentication Step (S3), applying a detection module (S4), determining whether there is an intrusion (S5), storing an intrusion-detected content when there is an intrusion (S6), and And determining whether to terminate the operation (S7), and terminating the operation (S8).

The operation flow of the sensor module during the intrusion detection of the system intrusion detection and prevention apparatus according to an embodiment of the present invention, as shown in Figure 3, starting the communication (S9) and the step of waiting for connection ( S10), when there is a request for use authentication from the manager module (S11), authenticating whether there is a request for data transmission from the manager module (S12), and when there is a request for data transmission from the manager module. And transmitting the data (S13), determining whether to end the operation (S14), and terminating the operation (S15).

The operation flow of the manager module at the time of intrusion detection of the system intrusion detection and prevention apparatus according to an embodiment of the present invention, as shown in Figure 3, starting the management (S16) and connecting to the sensor module Step (S17), and requesting the use authentication request to the sensor module (S18), and receiving the data transmitted from the sensor module after the use authentication from the sensor module (S19) and the received data Monitoring step (S20), if there is an intrusion (S21, S22) to display on the screen with a warning sound, the step of determining whether to terminate the operation (S23), and the step of ending the operation ( S24) is made.

The operation flow of the sensor module at the time of collecting and inquiring system information of the system intrusion detection and prevention apparatus according to an embodiment of the present invention, as shown in FIG. Step (S32), a step of performing authentication when there is a request for use authentication from the manager module (S33), a step of waiting for a request for data (S34), and data when there is a request for data from the manager module. It includes reading (S35), transmitting the requested data to the manager module (S36), determining whether to terminate the operation (S37), and terminating the operation (S38).

The operation flow of the manager module when collecting and inquiring system information of the system intrusion detection and prevention apparatus according to an embodiment of the present invention is as shown in FIG. Accessing (S40), requesting authentication for the sensor module (S41), requesting data when the authentication is made from the sensor module (S42), and receiving data transmitted from the sensor module And a step S43 of checking the received data, a step S45 of determining whether to end the operation, and a step S46 of terminating the operation.

The operation of the system intrusion detection and prevention apparatus according to an embodiment of the present invention by the above configuration is as follows.

System intrusion detection and prevention apparatus according to an embodiment of the present invention is composed of a server sensor module for the main function of intrusion detection and prevention, and a client manager module for receiving information from the sensor to monitor various information. .

The sensor module is designed to not interfere with the unique task of the system. The sensor module determines whether the user's work has been hacked in real time using the Petrinet algorithm to determine whether an intrusion processor is detected. It performs automatic intrusion detection and prevention by automatically blocking, logging intrusion detection information to the manager and sending it to the module, and sending system configuration information and real-time network traffic to the manager module.

The manager module operates on a computer used by a security administrator or a system administrator, sets information on a sensor module, receives and monitors detection information of a sensor module, generates an alarm sound when an intrusion is detected, and configures system information. And inquires real-time network traffic and inquires trace information about an IP logged into the sensor module. That is, in addition to the main functions of intrusion detection and prevention, it is possible to inquire information related to server, various LOG inquiry, and real-time traffic inquiry about network port.

In addition, the manager module may monitor one or more servers, and in some cases, may be monitored in a WAN environment.

When the operation is started (S1), the sensor module 41, 42, 43 waits for connection (S2), authenticates the use (S3), and applies the detection module (S4) to determine whether there is an intrusion. (S5).

The detection process by the detection module is audited by Audit Daemon, a resident processor created by the Basic Security Module (BSM) provided in the Solaris environment of Sun Microsystems. Once generated, the data needed for detection is extracted by reading the audit log, and the extracted data is converted into a format to be applied to the detection module and then detected.

The detection module is implemented based on a Petri Net algorithm, and mainly detects the following intrusion patterns.

1. admintool error

Link any file to /tmp/.group.lock and run the / user / bin / admintool program to create a random file with the user group ID.

2. kcms_calibrate error

Link random files to /tmp/Kp_kcms_sys.sem, then run the / usr / openwin / bin / kcms_calibrate program and run a program that interferes with it to create a competitive state and generate random files owned by root.

3. automountd error

Create a program that makes AUTOFS_MOUNT and execute it to cause an error. This changes the permissions of any file on the specified host.

4. nispopulate errors

/ usr / lib / nis / nispopulate Use temporary files created during program execution. Run the nispopulate program to create a file owned by root by linking the generated temporary file to another file.

5.eject, fdformat, ffbconfig, passwd, ping, rlogin

Invoke overflow by executing arbitrary code after the command line parameter.

6. Misuse of functions

Deplete system resources and paralyze the system. Belongs to a service disruption attack.

The above-mentioned Petrinet is well known as a mathematical useful tool for modeling and analyzing discrete development systems, which can be applied to a variety of graphical and graphical systems that can express and analyze the flow activity in a single picture form.

As a graphical tool, PetriNet uses visual-communication, block diagrams, and net operations similar to flowcharts, and as a mathematical tool, PetriNet can use state equations, algebraic equations, or other mathematical models.

The Petrinet is used in various fields such as performance analysis of information processing systems having parallel, asynchronous, distributed, parallel, or stochastic properties, design verification of communication protocols, and FMS.

The characteristics of the Petrinet can be divided into the behavioral and structural properties. The behavioral property of the Petrinet is to study the marking of the Petrinet. Several studies have been conducted on reachability, boundedness, and liveness. In addition, the structural properties of the above-mentioned Petri net only consider the structure of the Petri net regardless of marking. The study on the structural properties of Petrinet has been studied in the concept of invariant, structural boundedness, and conservation. In particular, the analysis of the place and the side variables give a lot of useful information about the structure of the Petrinet.

When it is determined that the intrusion is detected by the detection module implemented on the basis of the Petrinet algorithm, the sensor modules 41, 42, and 43 store the detected intrusion content in the internal memory (S6). It is determined whether to end (S7), and the operation ends (S8).

On the other hand, upon intrusion detection, the sensor modules 41, 42, 43 communicate with the manager modules 51, 52, 53, 54. When communication is started (S9), while waiting for connection (S10), the manager module If there is a request for use authentication from (51, 52, 53, 54), use authentication is performed (S11).

Next, the sensor modules 41, 42, and 43 determine whether there is a data transmission request from the manager modules 51, 52, 53, and 54 (S12), and the data from the manager modules 51, 52, 53, and 54. If there is a transfer request, after transmitting the data (S13), it is determined whether to end the operation (S14), and the operation is terminated (S15).

On the other hand, during intrusion detection, the manager modules 51, 52, 53, and 54 are connected to the sensor modules 41, 42, and 43 in the process of starting management (S16), and the sensor modules 41, 42, 43) request for authentication (S18).

After use authentication is made from the sensor modules 41, 42, 43, the manager module 51, 52, 53, 54 is the data transmitted from the sensor module 41, 42, 43 After receiving (S19), after monitoring the received data (S20), and if there is an intrusion on the screen with a warning sound (S21, S22), and determines whether to terminate the operation (S23), The operation ends (S24).

On the other hand, when the system information inquiry, the sensor module (41, 42, 43), when collecting information is started (S31), while waiting for connection (S32), the user authentication request from the manager module (51, 52, 53, 54) If there is a use authentication (S33).

Next, the sensor module (41, 42, 43) is waiting for the data request (S34), when there is a data request from the manager module (51, 52, 53, 54) to read the data (S35), After the requested data is transmitted to the manager modules 51, 52, 53, and 54 (S36), it is determined whether to end the operation (S37), and the operation ends (S38).

On the other hand, when the system information inquiry, the manager module 51, 52, 53, 54 is connected to the sensor module (41, 42, 43) (S40), when the information query is started (S39), the sensor module 41 , 42, 43) requests the use authentication (S41).

When use authentication is made from the sensor modules 41, 42, and 43, the manager modules 51, 52, 53, and 54 request data from the sensor modules 41, 42, and 43 (S42). After receiving the data transmitted from the sensor modules 41, 42, and 43 (S43), and after inquiring the received data (S44), it is determined whether to end the operation (S45), and the operation is terminated. (S46).

As described in the above embodiments, the present invention can detect intrusion of hackers through real-time monitoring and automatically block when there is an intrusion of hackers, thereby preventing information leakage, and hacking by intrusion and prevention by system unit. Even the security of the DMZ that is exposed to can be derived.

Claims (6)

Routers and firewalls connected to the Internet, DMZ connected to the above firewall, It is connected to the above firewall and detects hacking in real time using the Petrinet algorithm to detect the work of the user who accesses the system and prevents the leakage of information by automatically blocking the intrusion when an intrusion occurs. A plurality of sensor modules which can inquire related information and authenticate the user when there is a request for authentication from the manager module, and transmit the data when there is a request for data transmission from the manager module; It is connected to the router, firewall, and sensor module. After connecting to the sensor module, it requests the authentication of the sensor module and receives the data transmitted from the sensor module after the authentication of the sensor module. System intrusion detection and prevention device comprising a plurality of manager modules for monitoring the. According to claim 1, wherein the detection process, if the audit record is generated by the resident processor Daemon (Audit Daemon), by reading the audit log (audit log) to extract the data required for detection, such extraction System intrusion detection and prevention device characterized in that the detection after changing the format (format) to be applied to the detection module. The method of claim 1, wherein the sensor module waits for connection when communication is started, authenticates use when there is a use authentication request from the manager module, and determines whether there is a data transmission request from the manager module. System intrusion detection and prevention device, characterized in that for transmitting data when there is a data transmission request. The method of claim 1, wherein the manager module, when management is started, connects to the sensor module to request a use authentication, and receives data transmitted from the sensor module after use authentication is made from the sensor module. System intrusion detection and prevention device, characterized in that for monitoring the received data and, if there is an intrusion to display on the screen with a beep. The method of claim 1, wherein the sensor module, when the collection of information starts, authenticates use when there is a request for use authentication from the manager module while waiting for access, and when there is a request for data from the manager module while waiting for a request for data. System intrusion detection and prevention device, characterized in that for transmitting the requested data to the manager module by reading the data. The method of claim 1, wherein the manager module is connected to the sensor module when the information inquiry is started, requesting the authentication of the use of the sensor module, and requesting data when the authentication is made from the sensor module, and is transmitted from the sensor module. A system intrusion detection and prevention device, characterized in receiving data and querying the received data.