KR20050082681A - Honeypot system - Google Patents

Abstract

The present invention relates to a network-based cyber attacker surveillance and control technology, and more particularly, to a honeypot system that is a security solution that traces hackers by guiding hackers to fake servers with vulnerabilities and hacking techniques or hacking paths.

The present invention has been made with the aim of reducing operational costs and collecting more advanced hacking techniques by adding automatic recovery of important management files to existing honeypots. In addition, by adopting a keylog recording method that does not use a tty, a more powerful keylog function is implemented. In addition, it adds the hidden function of files and processes necessary for operation so that it can be operated more safely.

Description

Honeypot System {Honeypot System}

The present invention relates to a network-based cyber attacker surveillance and control technology, and more particularly, to a honeypot system that is a security solution that traces hackers by guiding hackers to fake servers with vulnerabilities and hacking techniques or hacking paths.

Until now, defense technologies against Internet cyber attacks have been developed based on intrusion prevention technology (Firewall) and intrusion detection system (IDS) technology. Many firewalls, however, do not have the flexibility to respond to which attacks, and intrusion detection techniques have not responded to new attacks in real time. Most IDSs don't have the latest intrusion patterns, making them appear helpless for new attacks.

To overcome these shortcomings, Honeypot and Decoy systems are being researched around the world and are actively seeking to protect and protect critical assets by invading and controlling intruders. However, this development is more complementary than simply being done individually, so integrated development is necessary. Honeypot, also known as 'honey pot', is an active security solution that can help hackers trace back to hackers by hacking into vulnerable servers and hacking techniques or hacking paths.

Existing honeypots attract hackers to fake hosts instead of just the original ones, monitoring the hacking attempts occurring there and analyzing the results. Therefore, the honeypot manager always needs to monitor hacking attempts, and if the hacker does not restore the hacked system to its original state, even if another hacker is directed to the honeypot, a new hack is performed on the already hacked system. Most likely not to try.

On the other hand, the honeypot monitoring includes a keylog, a processlog, and the like. Keylog monitoring adopts a method in which a hacker captures and logs a character of a tty assigned to each shell process when a hacker logs in to a honeypot. However, such keylog monitoring is impossible to record keylogs because ttys are not assigned to the shell if hacking does not go through a normal login process. Here, tty is a device that communicates with user and system in UNIX / Linux system. It is a kind of device that transmits keyboard input to system easily.

As mentioned above, it is not cost-effective for the administrator to continuously check for hacking of honeypots for 24 hours, and it is impossible to leave a keylog by capturing the tty only when a shell is generated that does not specify a tty.

Therefore, the first object of the present invention is to automatically recover the hacked system when hacking occurs in the honeypot.

It is a second object of the present invention to provide a shell-based keylog method that can cope with an attack method of a backdoor without a tty.

The first purpose is to make a list of important files essential to the system to be managed, and always check at the kernel level whether manipulation has occurred to the files, and to keep the original files stored when the contents of the files are changed. It is achieved by recovering immediately.

In addition, the second object is to monitor the execve system call (system call) of the system while recording the process ID of the shell executed at the moment the shell is executed in a hash table, and then monitor the read system call This is accomplished by configuring to capture incoming keystrokes standard-in to the process recorded in the hash table.

The honeypot, which plays a key role in the present invention, is composed of a virtual system that performs the same or similar function as the system to be protected. For example, the honeypot provides a service and accesses an attacker's packet derived from an intrusion induction system. Secure attacker's attack skills and tools, such as generating system logs of local attacks as well as attacker's keystrokes. In addition, by automatically recovering the system damaged by the attacker, and limiting the attacker's ability to prevent the attacker to attack other systems using the honeypot.

In summary, the honeypot in the present invention has the following features.

1) Automatic / manual recovery of critical system files damaged by the attack.

2) Monitor hacker activity with the Linux kernel module.

3) Hidden important files for honeypot operation at kernel level, invisible to users including root.

4) Sending honeypot logs to a log server using an SSL (Secure Sockets Layer) channel.

5) You can hide a particular process in the honeypot and automatically hide the child process of that process.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The honeypot system of the present invention can be divided into a server part and a management part, the server part is a part that implements the actual security solution technology and provides an interface for various settings, and the management part monitors and manages the overall security status through the server. That's the part. The server part can be divided into the daemon part and the kernel part again. The daemon part communicates with the management tool and changes actual settings. The kernel part handles UI requests and automatically recovers damaged resources.

1 is a block diagram of a honeypot system according to the present invention.

Referring to FIG. 1, the honeypot system of the present invention basically includes a honeypot 100, a repository server 120, a log server log server 122, and a honeypot manager 112. The functions of the systems are as follows.

(1) Honey Pot (100)

The attacker who is attracted from the network to which the honeypot belongs is the host that actually executes the attack. Monitor the attacker's attack and restore critical files modified by the attack.

(2) storage server 120

The storage server keeps the original and modified files of important files to be restored to help identify attackers' hacking patterns.

(3) the log server (122)

The log server collects the logs generated from the honeypot and enables the attacker to trace back later.

(4) Honeypot Manager

As a kind of management tool, it is responsible for the management of honeypots. In addition, it is responsible for the real-time viewer of the honeypot information and generated logs.

Hereinafter, a honey pot 100 that performs a key role in the present invention will be described in detail.

Honeypot 100 is composed of a daemon (114), a character device (Character device) 116, and a kernel (Kernel) module 118, the honeypot log to the log server 122 using the SSL channel Will be sent.

The daemon 114 communicates with the honeypot manager 112 and changes actual settings.

The kernel module 118 processes a UI request and automatically recovers damaged resources. The kernel module 118 includes a character device driver and a system call processing unit (not shown). Define a set of commands (init, cleanup, read, write, etc.) to handle the actual UI requests. Also, the system call processing unit replaces existing system calls with redefined system calls to support logging. Implement automatic recovery of system resources damaged by the attack.

In particular, the kernel module 118 is a Linux kernel module that hooks the following system calls for capturing keystrokes, monitoring process execution, monitoring file access and change, and the like.

(1) read system call: Capture user keylog.

(2) execve system call: Log all process execution.

(3) open system call: Log access to important files.

(4) write system call: Logs the changes made to important files and restores them when important files change.

(5) getdents64, stat64 system call: used to hide the files you want to hide.

Kill system call, used to hide a particular process from the user

(7) fork, clone system call: used to hide child processes derived from hidden processes.

The character device 116 is used for the daemon 114 and the kernel module 118 to communicate.

On the other hand, in the present invention, by making a list of important files essential to the system to the management target list to check at the kernel level whether the operation of the files occurred, the kernel module 118 is responsible for this function, the execve system call of the system Is configured to monitor and write the process ID of the executed shell to the hash table the moment it is executed, and then monitor the read system call and capture keystrokes coming into the standard-in for the process written to the hash table. .

A system resource recovery procedure in a honeypot system according to the present invention is as follows.

(1) The user can designate important files to be protected through the honeypot manager 112, and this information is recorded in a configuration file.

(2) The kernel module 118 loads a list of important files from the configuration file and stores them in a hash table in kernel memory.

(3) Periodically inspect the file change by the intruder, and if a critical file is damaged, set a dirty flag to indicate that the file is damaged.

(4) The system resources to be restored are stored in the storage server, and when the contents of the file are changed, the original file is restored immediately.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be evident to those who have knowledge of.

According to the present invention, the honeypot automatically recovers important files, thereby providing an advantage of easy management of the honeypot. In other words, by automatically recovering the hacked honeypot, it is easy to manage 24 hours, prevents the honeypot from becoming the foothold of the second hack, and restores the hack to its original state, thereby inducing the hacker to use the improved hacking technology. .

It also has the advantage of providing a powerful keylog function. In other words, it provides shell-based keylogs that are not tty-based, so keylogs for shells without ttys are possible.

In addition, it has the advantage of providing a variety of system management functions, it is possible to completely hide the processes and executable files necessary to manage the honeypot from all users, including root can increase the safety of the system.

1 is a block diagram of a honeypot system according to the present invention.

Explanation of symbols on main parts of drawing

100: honeypot 112: honeypot manager

114: daemon 116: character device

118: kernel module 120: storage server

122: log server

Claims (11)

A honeypot that simulates and responds to an attacker's attack, monitors an attacker's attack, and recovers critical files modified by the attack; A storage server for storing original and modified files of important files to be recovered; And And a log server that collects the logs generated from the honeypot and enables a trace back of an attacker later. The honeypot system according to claim 1, further comprising a honeypot manager for managing honeypots, managing important files, and displaying monitoring logs. The honeypot according to claim 1 or 2, A daemon for communicating with the honeypot manager and for changing actual settings; A kernel module that processes UI requests and automatically recovers damaged resources; And Honeypot system, characterized in that it comprises a character device that the daemon and the kernel module is used to communicate. 4. The honeypot system of claim 3, wherein the kernel module is a Linux kernel module. The honeypot system of claim 3, wherein the kernel module includes a character device driver and a system call processing unit. The honeypot system according to claim 5, wherein the character device driver defines a command set of the character device for communication with the UI to process a request of the actual UI. The honeypot system according to claim 5, wherein the system call processing unit replaces an existing system call with a redefined system call to support a logging function, and performs automatic recovery of system resources damaged by an attacker. 4. The honeypot system of claim 3, wherein the kernel module hooks system calls for keystroke capture, process execution monitoring, file access and change monitoring, and the like. The method of claim 7, wherein the system call logs a read system call related to capturing a user keylog, an execve system call to log all process executions, an open system call to log access to a critical file, and a change history of a critical file. A write system call to perform a restore on critical file changes, a getdents64 system call to hide files you want to hide, a stat64 system call to kill, a kill system call to hide a specific process from the user, and a child derived from a hidden process Honeypot system, including fork, clone system calls used to hide the process. The system of claim 3 or 8, wherein the kernel module monitors the system's execve system call and writes the process ID of the shell executed at the moment when the shell is executed to the hash table, and then monitors the read system call and then writes the hash table to the hash table. A honeypot system, characterized in that it is configured to capture incoming keystrokes to standard-in for the recorded process. The honeypot system according to claim 1, wherein the honeypot transmits a honeypot log to a log server using an SSL channel.