KR20050075950A - Apparatus for optimizing log of intrusion detection system with consideration of the vulnerability of the network devices - Google Patents

Abstract

The present invention affects the vulnerability of assets among all attacks occurring in real time in the intrusion detection system by filtering threat and alarm information not directly related to the vulnerability of network assets in the intrusion detection system that detects various cyber threats or attack behaviors on the network. The present invention relates to a technology that can effectively respond to threats and alerts.

To this end, the present invention lowers the probability of false positives by generating an alarm only for intrusions caused by vulnerabilities that are directly related to vulnerabilities of the system among intrusions occurring in the network including the system when the security for a specific system is performed. As a result, there is a technical feature to enable the security manager to effectively respond to cyber attacks.

Description

Apparatus for optimizing log of intrusion detection system with consideration of the vulnerability of the network devices}

The present invention relates to a log optimization device of an intrusion detection system considering a vulnerability of a network asset, and more particularly, a threat that does not have a direct relationship with a vulnerability of a network asset in an intrusion detection system that detects various cyber threats or attack behaviors on a network. The present invention relates to a technology for filtering alert information to effectively respond to threats and alerts that affect the vulnerability of assets among all attacks occurring in real time in the intrusion detection system.

Conventional intrusion detection systems manage threats and attacks managed by the Instrusion Detection System (IDS) regardless of the vulnerability of individual assets that make up the network when attacking network assets. Based on the information and the risk information of the attack specified by the user, it is determined whether an intrusion occurs when a specific attack occurs. As a result, a large number of alarms or logs are generated for intrusion attempts that are not related to the network asset being managed or that are not already a threat to the asset (already patched or upgraded for the attack).

This is called a false positive, and the increase in the number of false positives adds to the burden on the people who operate the network and also causes a lot of problems for security incidents. In addition, the conventional intrusion detection system has a problem that the alarm is generated without considering the value of the network assets, causing confusion in determining the response priority when various intrusion attempts occur.

Meanwhile, the conventional intrusion detection system builds a DB of threat patterns based on a list of vulnerabilities provided by the CVE list (Common Vulnerabilities and Express List), and a list of threats related to vulnerabilities provided by the CERT, etc. When the traffic generated corresponding to the threat pattern is intercepted, the alarm and alarm are triggered to inform the threat.

For reference, information assets on the network have known or unknown software vulnerabilities. These vulnerabilities are managed in the form of Meta DB, which is called ICAT, at the National Institute of Security Technology (NIST). It is processed into a refined DB given by CVE (Common Vulnerability and Exposure) ID, and N (Network) -IDS or VAS company builds DB of related system using these DB and various known vulnerability information. Intrusion detection system detects cyber attacks using the DB.

The performance of these intrusion detection systems is determined by how many intrusions can be detected or how accurately they can be detected. Therefore, the probability of false positives increases with increasing threat and vulnerability lists. There is a problem.

Due to the above problems, in the network of the Internet communication service provider, the results of detection by the intrusion detection system are too many to analyze, or it is difficult to distinguish between the incorrect detection and the accurate detection, and there are many difficulties in operating the intrusion detection system.

In addition, the existing intrusion detection system has a high probability of false positives because it uses a method of detecting all intrusions that have nothing to do with the vulnerability of network assets. As a result, it is difficult to accurately analyze which assets are under attack and how much risks are generated based on the detection result of the intrusion detection system.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, and its object is to generate an optimized log considering only the threats related to the vulnerability of a specific asset, thereby reducing false positives to effectively respond to cyber attacks. For the purpose of

In addition, the present invention is another object to prioritize when there are multiple threats in consideration of the importance of the assets to efficiently respond to cyber attacks.

In order to achieve the above object, the log optimization apparatus of the intrusion detection system in consideration of the vulnerability of the network asset according to the preferred embodiment of the present invention, a vulnerability for analyzing the vulnerability of the system using the resource information of the system to be secured An analysis unit; An intrusion detection unit detecting an intrusion of a network including the system; Vulnerability filtering unit for extracting only the remaining vulnerability from the vulnerability analysis result of the vulnerability analysis unit; A log optimizer configured to generate log information only for an intrusion result associated with the residual weakness among the intrusion results of the intrusion detection unit; And an alarm generating unit generating an alarm according to the intrusion detection based on the log information.

According to the present invention, the vulnerabilities can be classified as shown in FIG.

The contents of the vulnerability analysis system DB, which summarizes the vulnerabilities disclosed in the CVE list, that is, the number of known vulnerabilities (V1), are not an indication of the number of vulnerabilities of a particular asset, but a list of vulnerabilities that various network assets can have. At this time, if a specific asset is not patched against a threat that can attack the vulnerability of the asset, the asset may have a plurality of unique vulnerabilities (V2), and typically, the number of V2 is less than or equal to V1. do.

If an active patch is performed on the asset, only some of the remaining vulnerabilities remain. If the number of remaining vulnerabilities is V3, V1, V2, and V3 have a relationship as in <Equation 1>.

V1 ≥ V2 ≥ V3 <Equation 1>

Using this relationship, the present invention avoids independent vulnerability analysis and intrusion detection of network assets, and performs selective detection only on intrusions or threats that attack only the remaining vulnerabilities of assets under management based on the vulnerability analysis results. Security alarm system is implemented.

In the present invention, the asset is limited to various systems on the network that provide information transmission functions and transmission equipment that provides information distribution functions, which are basic services provided by the network, for example, various switches, routers, access equipment, and the like.

Vulnerability is supposed to be a software flaw that can be exploited to get the system to perform abnormal behavior.

Threats can be defined as potential factors that can have undesirable effects on information assets, and if such threats occur in reality, they are recognized as attacks.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

2 is a block diagram of a log optimization device of an intrusion detection system considering the vulnerability of network assets according to an embodiment of the present invention.

As shown in Figure 2, the log optimization apparatus of the intrusion detection system in consideration of the vulnerability of the network assets according to an embodiment of the present invention, resource management unit 130, vulnerability analysis unit 140, intrusion detection unit 150, Log optimization unit 160, and the statistical engine 170 is provided.

The resource manager 130 performs a function of managing asset information for the system 110 when a system 110 to be managed by a security manager (or a system operator) is input. In the present invention, the security manager inputs the value of the asset as a quantified value so that the importance of the asset of the system 110 can be considered. The resource manager 130 includes a resource management interface 12 for receiving resource management from a security manager and a resource DB 134 for storing the asset information. Resource information stored in the resource DB 134 is a system OS, a system IP, a system name, a system administrator, an administrator contact number, an e-mail, and the like.

The vulnerability analysis unit 140 transmits a vulnerability test message corresponding to the disclosed vulnerability through the CVE list to the system 100 corresponding to the asset information stored in the asset DB 134 and based on the response of the system 110. ) Vulnerability analysis, and stores the analyzed vulnerability analysis results in the DB (144). Information about the vulnerability stored in the vulnerability analysis result DB (144) is the system OS, system IP, vulnerability port, vulnerability protocol, vulnerability name, CVE-ID, risk.

The intrusion detection unit 150 is transmitted on the network including the system 110 using a threat pattern DB built on the list of vulnerabilities provided by the CVE list and the threat list related to the vulnerabilities provided by the CERT and CVE lists. When the traffic corresponding to the threat pattern is generated by intercepting the traffic, the intrusion detection result for the traffic is stored in the DB 154. Information about the intrusion detection result stored in the intrusion detection result DB (154) includes attack start time, attacker IP, attacker port, target IP, target port, attack name, attack detection / end time, protocol, risk, CVE-ID, etc. to be.

The log optimizer 160 generates an intrusion detection result for the remaining weak points of the system 110 by using the vulnerability analysis result stored in the vulnerability analysis result DB 144 and the intrusion detection result stored in the intrusion detection result DB 154. Optimize the log according to the intrusion detection, and performs the function of storing in the optimization log DB (160).

The statistical engine 170 provides statistical information about the vulnerability analysis result stored in the vulnerability analysis result DB 144, the intrusion detection result stored in the intrusion detection result DB 154, and log values stored in the optimization log DB 164. Perform the function.

The alarm engine 180 generates alarm information on the log value stored in the optimization log DB 164 and delivers it to the security manager. The alarm engine 180 displays a risk level of the alarm and the like based on the log information stored in the optimization DB 164, so that the security manager can check the priority of the alarm.

Each system, engine, DB, etc. shown in FIG. 2 may be operated in one server and a PC, or may be built on a distributed server or personal computer (PC).

3 is a detailed configuration diagram of the log optimizer 160 shown in FIG. 2.

As shown in FIG. 3, the log optimizer 160 intrudes through the vulnerability filtering engine 210 and the delivery layer 120 that filter only the information corresponding to the residual vulnerability in the DB 144 that stores the vulnerability check result. Interface 220 for receiving the detection result, vulnerability summary DB 230 through which the vulnerability data filtered through the vulnerability filtering engine 210 is stored, and the intrusion detection result is received from the interface 220 and divided into a predetermined unit to log. Log optimizer 250 for supplying to the optimizer 250, the log optimizer 250 for generating optimization log information by analyzing the correlation between the remaining vulnerability and intrusion detection results stored in the vulnerability summary DB 230, and the optimization It consists of an optimization log DB 260 is stored the log information. The log optimizer 250 tracks the correlation between the chip detection result and the residual weakness using at least one of a CVE ID, an IP address, and a service port. The interface 220 of the log optimization engine 162 of the log optimizer 160 supports IAP, IDEF, APSEC, ASEN, and Socket.

Residual vulnerability in the present invention, It refers to a vulnerability in which a security vulnerability has been improved through a security patch. In most cases, the vulnerability remains until the vulnerability is known and related to the patch. The residual vulnerability corresponds to the region V3 of FIG. 1 and is generally represented by a set that is less than or equal to the inherent vulnerability.

With reference to the above-described configuration and the flowchart shown in Figure 4 will be described in detail the log optimization method of the intrusion detection system in consideration of the vulnerability of the network asset according to an embodiment of the present invention.

When the security manager inputs information of a system to be a security management object through the resource management interface 132 of the resource manager 130 (S2), the system information is stored in the resource DB 134. At this time, the information stored in the resource DB 134 is a system OS, a system IP, a system name, a system administrator, an administrator contact number, and an E-Mail.

The vulnerability analysis system 142 of the vulnerability analysis unit 140 transmits various vulnerability test messages to the system 110 through the delivery layer 120, and transmits the system to the system 110 based on whether the vulnerability test message is answered. After analyzing the vulnerability, the vulnerability analysis result is stored in the DB 144 (S6). The vulnerability analysis results stored in the vulnerability analysis result DB 144 are system OS, system IP, vulnerability port, vulnerability protocol, vulnerability name, CVE-ID, risk, etc., and the vulnerability analyzed by the vulnerability analysis system 142 is shown in FIG. 1. It corresponds to V2 area of.

Subsequently, the vulnerability filtering engine 210 of the log optimization engine 162 of the log optimizer 160 performs filtering on the vulnerability analysis result stored in the vulnerability analysis result DB 144 to extract the residual vulnerability, and then extract the remaining vulnerability. The extraction point information is stored in the vulnerability summary DB 230 (S6).

On the other hand, the intrusion detection system 152 detects the intrusion of the malicious through the traffic transmitted on the network including the system 110 that is the security management target. As described above, the intrusion detection system 152 refers to the CVE list, and if the specific traffic belongs to the CVE list, the intrusion detection system 152 determines the traffic as traffic for intrusion.

The intrusion detection system 153 stores the intrusion detection result in the DB 154. The intrusion detection result stored in the intrusion detection result DB 154 is a log supplier 240 through the interface 220 of the log optimization unit 160. The log supplier 240 unitizes the intrusion detection result transmitted through the interface 220 in order to easily recognize the intrusion detection result in the log optimizer 250. 260).

Accordingly, the log optimizer 162 of the log optimization engine 162 performs log optimization by using the remaining vulnerability stored in the vulnerability summary DB 230 and the intrusion detection result received from the log supplier 204 (S38). The log optimization extracts an intrusion detection result corresponding to the residual vulnerability from the intrusion detection results based on the system IP included in the intrusion detection result and the system IP included in the residual vulnerability information. After generating a log corresponding to the, the log information is stored in the optimization log DB (164).

Thereafter, the alarm engine 180 generates an alarm according to the intrusion detection using the log information stored in the optimization log DB 162 and transmits the alarm to the security manager. Based on the information stored in the detection result DB (154) and the optimization log DB (180) generates and manages statistical data in response to the request to the security manager. In this case, since the generated alarm is displayed in consideration of the importance of the assets input during the resource registration process and the risk of intrusion / fragility, the security manager can determine the intrusion response priority.

According to the present invention, an alarm is generated to the security manager only when an intrusion of a vulnerability associated with the system 100 to be secured is detected as described above, thereby reducing the burden on the security manager to respond to a false intrusion. This will enable them to respond effectively to cyber attacks.

According to the present invention as described above, by linking the vulnerability analysis system and intrusion detection system to each other and filtering for alarms and logs that are not associated with the system to be secured, the security manager can improve the efficiency and false positive rate of the log analysis. It is effective in effectively responding to attacks.

In addition, the present invention has the effect of being able to respond to the importance of the asset when there are multiple threats in consideration of the importance of the asset.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

1 is a classification of vulnerabilities applied to the present invention.

Figure 2 is a block diagram of a log optimization device of the intrusion detection system according to an embodiment of the present invention.

3 is a detailed configuration diagram of the log optimization unit shown in FIG. 2.

4 is a flowchart illustrating a log optimization method of an intrusion detection system according to an embodiment of the present invention.

Claims (7)

Vulnerability analysis unit for analyzing the vulnerability for the system using the resource information of the system to be a security target; An intrusion detection unit detecting an intrusion of a network including the system; Vulnerability filtering unit for extracting only the remaining vulnerability from the vulnerability analysis result of the vulnerability analysis unit; A log optimizer configured to generate log information only for an intrusion result associated with the residual weakness among the intrusion results of the intrusion detection unit; And And an alarm generator configured to generate an alarm according to the intrusion detection based on the log information. The log optimization apparatus of the intrusion detection system considering the vulnerability of the network asset. The method of claim 1, wherein the vulnerability filtering unit Log optimization device of intrusion detection system in consideration of the vulnerability of network assets, characterized in that to calculate the residual vulnerability by filtering the weakness already improved in the vulnerability analysis result. The apparatus of claim 2, wherein the vulnerabilities that have been improved are security vulnerabilities. According to claim 1, wherein the intrusion detection unit If traffic belonging to the CVE list is detected among the traffic transmitted on the network, the intrusion is considered to be detected, attack start time, attacker IP, attacker port, target IP, target port, attack name, attack detection end time, protocol, A device for optimizing logs of intrusion detection systems in consideration of vulnerability of network assets, which manages intrusion detection result information including risk and CVE-ID. According to claim 1, wherein the vulnerability analysis unit The vulnerability test message is sent to the system to analyze the vulnerability based on the response result sent from the system, and the system OS, system IP, vulnerability port, vulnerability protocol, vulnerability name, CVE-ID, and risk for the analyzed vulnerability Log optimization device of intrusion detection system considering the vulnerability of network assets, characterized in that for managing the vulnerability analysis results, including. The method of claim 4 or 5, wherein the log optimization unit Intrusion detection that takes into account the vulnerability of the network asset, extracting an intrusion result associated with the residual vulnerability using at least one of a system IP, a CVE-ID, and a port number from the intrusion detection result and the vulnerability analysis result. Log optimizer for the system. The method of claim 1, And a statistical processing unit which performs predetermined statistics based on the intrusion detection result, the log information, and the vulnerability analysis result. 10. The log optimization apparatus of the intrusion detection system considering the vulnerability of the network asset.