KR20050030186A - A method for the detection of network traffic anomalies using netflow data - Google Patents

Abstract

A method for detecting a network traffic anomaly by using netflow information is provided to use a correlation between the number of flows and the number of bytes obtainable from netflow information through regression analysis when detecting an anomaly, thereby expanding utility of the netflow information. A system receives flows per second and bytes per second from a flow collector daemon(S401). The system obtains regression coefficients based on a current time from a regression coefficient generator(S402). The system calculates an upper limit and a lower limit of a reliable section from a regression model based on the flows per second(S403). The system decides whether the number of the bytes is between the upper limit and the lower limit(S404). If not, the system outputs a network traffic anomaly(S405).

Description

Network traffic normal detection method using NetFlow information {A METHOD FOR THE DETECTION OF NETWORK TRAFFIC ANOMALIES USING NETFLOW DATA}

The present invention relates to network traffic normal (hereinafter, abbreviated as 'normally') detection using NetFlow information provided by Cisco network equipment. More specifically, the number of flows, packets, and It relates to a method for detecting anomaly through regression analysis of the correlation of the number of bytes.

As is well known, the importance of information flow through the network is being emphasized as the industry, government, and even general personal life become more and more dependent on the Internet today. However, intrusions or attacks on networks or major server computers by hackers paralyze the network, leading to severe social disruption resulting from Internet service outages as well as serious economic losses such as e-commerce service outages. Intrusion detection system technology to protect the network from such attacks mostly uses a method of detecting an attack by pattern matching based on well-known attack signature (signature). However, these existing methods are unable to protect the network from unknown attacks (also known as anomaly).

Methods for normal detection are network based and host based. Early anomaly detection detected an attack using a host-based error of a Unix server or operating system service. These attacks deviate from the normal pattern of system calls, and anomaly detection identifies these abnormal system call patterns. On the other hand, the network infrastructure recognizes normal usage patterns of network traffic and then monitors the traffic and detects network traffic that is outside these normal usage patterns as anomaly. These network traffic anomalies fall into four categories: attacks such as denial of service or flooding attacks, hardware failures, flash crowds, and measurement failures. Determining these network traffic normals quickly and accurately is very important for efficient operation of the network.

Conventional network traffic normal detection methods can be classified into two types. The first method detects anomaly based on monitoring the head information of the packet, that is, the TCP / IP protocol property. This is because most attacks today use unusual TCP flags or IP options, invalid sequence numbers, invalid checksums, spoofed addresses, and so on. The second method is to model network traffic as a time series, determine statistical deviations from this modeling to define normal traffic, and then detect network deviations from the traffic.

These conventional network traffic normal detection methods have a problem of managing and processing a large amount of TCP / IP protocol information and setting many related parameters for time series modeling.

The present invention has been proposed to solve such a conventional problem, and the correlation between the number of flows, the number of packets, and the number of bytes that can be obtained from the NetFlow information provided by a Cisco network device (for example, a router or a switch) is provided. By using regression analysis for anomaly detection, NetFlow information is further utilized, and its purpose is to provide convenience of implementation and use compared to existing anomaly detection.

Network traffic normal detection method using the NetFlow information according to the present invention for realizing the above object is a Cisco router for providing NetFlow information, a flow collector daemon for collecting NetFlow information, and a regression coefficient using the collected information It includes a regression coefficient generation daemon for generating a flow collector daemon and an anomaly detection daemon that collects related information from the regression coefficient generation daemon to determine the anomaly.

There may be a plurality of embodiments of the present invention. Hereinafter, preferred embodiments will be described in detail with reference to the accompanying drawings. This embodiment allows for a better understanding of the objects, features and advantages of the present invention.

1 is a diagram illustrating a network configuration to which anomaly detection using NetFlow information is applied. The router 102 provides NetFlow information, the flow collector daemon 105 collecting NetFlow information, and generates coefficients of a regression model. An anomaly detection daemon 107 that detects network traffic anomalies by collecting related information from the managing regression coefficient generation daemon 106, the flow collector daemon 105, and the regression coefficient generation daemon 106, and these three daemons. That is, it is a network diagram consisting of a computer 104 for operating the flow collector daemon 105, the regression coefficient generation daemon 106, and the normally detected daemon 107.

The router 102 that connects the external Internet network 101 and the internal intranet network 103 includes in-bound traffic from the Internet network 101 to the intranet network 103 and the Internet network in the intranet network 103. It must be a Cisco product that can provide NetFlow information to the computer 104 for out-bound traffic information destined for (101), and the NetFlow version is NetFlow version 5, which provides the number of flows, packets, and bytes. Information 108 (hereinafter referred to as NetFlow V5 Protocol Data Unit (PDU)). Of course, you can use any version of NetFlow PDU that provides these three pieces of information.

2 is a two-dimensional coordinate configuration for obtaining a simple linear regression model coefficient in accordance with the present invention.

As shown, the regression coefficient generation daemon 106 uses the NetFlow V5 PDU 108 collected by the flow collector daemon 105 to show the average number of flows per second (fps) and the average number of bytes (bps: bytes per second) and expressed as a single point 204, and these points 204 collected for 24 hours a day are two-dimensional, i.e. flows per second on the x-axis (201) and bytes per second (202) on the y-axis. A simple linear regression line 203 based on a scatter diagram to represent these linear relationships are represented by a simple linear regression model as shown in Equation 1 below.

Here, the regression coefficient β ₀ is a constant or intercept and β ₁ is a slope.

These simple linear regression models are created using the NetFlow V5 PDU 108 collected during the day, thus generating different regression coefficients of the simple linear regression line 203 for each day of the week. The items of the created table are shown in the example of Table 1.

TABLE 1

In order to obtain a more accurate regression coefficient compared to Table 1, when the regression coefficient generation daemon 106 creates a simple linear regression model using the NetFlow V5 PDU 108 collected for one hour from the flow collector daemon 105, Regression coefficients of different linear regression lines 203 are generated for each time zone. The items of the created table are as shown in Table 2.

TABLE 2

In the case of a network with severe traffic characteristics by season, (Table 1) or (Table 2) can be maintained by season or month. Also, by using exponential smoothing according to the characteristics of the network, the regression coefficient intercept at time point t as And tilt Can be calculated and used as a regression coefficient.

However, not all observations of y are explained by the regression equation (1). That is, there is an error in predicting y value from x. Therefore, the prediction regression equation of the i th observation x _i is given by Equation 3 below.

Given the new number of flows x ₀ that the normally detected daemon 107 obtains from the flow collector daemon 105 in units of 5 minutes, the 100 (1-α)% prediction interval is as follows.

Where t _{(α / 2, n-2)} is the n-2 degree of freedom t distribution, MS _E is the residual mean square, to be.

The anomaly detection daemon 107 takes the corresponding regression coefficients β ₀ and β ₁ stored in the regression coefficient generation daemon 106 and uses (Equation 3) to obtain a new flow number x ₀ received from the flow collector daemon 105. Expected Bytes For Calculate

3 is a two-dimensional coordinate configuration for detecting anomaly according to the present invention.

As shown in the figure, the upper limit 301 and the lower limit 302 can be obtained, respectively.

4 is a flowchart for detecting anomaly according to the present invention.

As shown, after receiving the average number of streams and the average number of bytes from the flow collector daemon 105 (S401), the regression coefficient generator 106 receives a regression coefficient based on the current time, and then regresss based on the average number of flows. After calculating the upper and lower bounds of the confidence interval from the model (S403), it is determined whether the number of bytes falls between these upper bounds 301 and the lower bound 302 (S404), and when it is out of these boundaries, network traffic normal detection (S405). Outputs

In the above description, but limited to one embodiment of the present invention, it is obvious that the technology of the present invention can be easily modified by those skilled in the art. Such modified embodiments should be included in the technical spirit described in the claims of the present invention.

As described above, the present invention relates to a method for detecting network traffic anomaly using NetFlow information provided by Cisco network equipment. The present invention relates to a correlation between flow number and byte number provided by NetFlow information through regression analysis. As it is used for detection, there is an advantage of further expanding the usability of NetFlow information.

In addition, unlike the conventional anomaly detection methods that require setting and using many types of parameters for time series modeling and complex statistical data, the present invention determines and implements only the regression model coefficients and confidence interval parameters. It has the effect of providing convenience of use.

1 is a network configuration to which anomaly detection using NetFlow information according to the present invention,

2 is a simple linear regression analysis coordinate configuration according to the present invention,

3 is a coordinate configuration diagram for anomaly detection according to the present invention;

4 is a flowchart of anomaly detection decision according to the present invention;

<Description of the code | symbol about the principal part of drawing>

101: internet network 102: router

103: intranet network 104: computer

105: flow collector daemon 106: regression coefficient generation daemon

107: Normally Detection Daemon 108: NetFlow V5 PDU

Claims (6)

In the method for detecting network traffic anomaly using NetFlow information provided by Cisco network equipment, A flow collector daemon that collects NetFlow information, A regression coefficient generation daemon for generating a simple linear regression model coefficient in conjunction with the flow collector daemon; And a net detection information connected to the flow collector daemon and a regression coefficient generation daemon to detect a network traffic normal. The method of claim 1, An apparatus for detecting network traffic anomaly using NetFlow information, wherein a simple linear regression model coefficient is maintained and used in units of a day, a time, a season, or a month, or a regression coefficient can be used using an exponential smoothing method. The method of claim 1, The regression coefficient generation daemon detects network traffic anomaly using NetFlow information including variable transformation and nonlinear regression modeling in addition to the simple linear regression model. The method of claim 1, The anomaly detection daemon obtains an upper limit and a lower limit according to a confidence interval by obtaining a regression coefficient from a regression daemon based on the average number of flows and the average number of bytes received from the flow collector daemon, and then checks whether the average number of bytes exists within these two boundaries. And detecting the network traffic by using the NetFlow information. The method of claim 4, wherein The flow collector daemon calculates the average number of packets in addition to the average number of flows and the average number of bytes from the received NetFlow information, and the regression coefficient generation daemon applies various combinations of these three calculations to model and trust the regression model. Method for detecting network traffic normal using NetFlow information, including detecting normal by applying interval The method of claim 4, wherein The flow collector daemon calculates the maximum or minimum flow number, byte number, and packet number instead of calculating the average flow number, byte number, and packet number from the received NetFlow information, and the regression coefficient generation daemon calculates these three calculations. A network traffic normal detection method using NetFlow information comprising modeling a regression model by applying various combinations of values and detecting the normality by applying a confidence interval.