KR20060027748A - Dynamic simulation system and method reflecting user's input on network security simulation - Google Patents

Abstract

The present invention relates to a dynamic simulation system and method for modeling human judgment behavior in network security simulation. The network security dynamic simulation system of the present invention models the behaviors of hacker role users and defender role users in modeling and simulating large-scale cyber attacks (Internet worms, denial of service attacks) using SSFNet (Scalable Simulation Framework Network Models). It is a system to simulate the dynamic defensive behavior. Through the network security dynamic simulation system of the present invention, it is possible to establish effective defense measures by comparing and analyzing cyber defense behaviors and the results.

Dynamic Simulation, Network Security, SSFNet, Modeling, Denial of Service Attacks, Internet Worms

Description

DYNAMIC SIMULATION SYSTEM AND METHOD REFLECTING USER'S INPUT ON NETWORK SECURITY SIMULATION}             

1 is a block diagram of a network security dynamic simulation system according to the present invention;

2 is a detailed configuration diagram of a simulation server host module according to the present invention;

3 is an overall configuration diagram of a simulation system according to the present invention;

4 is a flowchart of a network security dynamic simulation method according to the present invention.

<Explanation of symbols for the main parts of the drawings>

101: user server 102: simulation server

103: Simulation Studio 104: Database Connector

105: daemon connector 106: database unit

107: Network DML Generator 108: Simulation Engine

109: net module 110: host module

The present invention relates to a network security dynamic simulation system and method, and more particularly, when a user (attackor, defender) inputs a judgment behavior during simulation in relation to a system for modeling and simulating a large cyber attack / defense. It is about the function that is reflected and simulated.

Recently, with increasing interest in cyber terrorism, the development of network security simulation system that adds information protection element to network simulation is required.

However, due to the vastness of the network, the complexity of the intrusion and defense, and the difficulty of expressing the diversity, it is also an area where much research has not been made yet.

In order to obtain data on network behavior changes and defenses against specific intrusions, it is best to attempt cyber attacks on real networks and observe the network behavior changes at that time.

However, attempting to obtain all the possible intrusions and obtaining the necessary data is not only dangerous, but also practically limited. An alternative to this is the simulation technique, and efforts to develop a network security simulation system for doing this have been continued.

Simulations of large-scale cyber terrorism began in the Internet Attack Simulator (IAS) of Mostow, et al., Where IAS can simulate three intrusion scenarios: denial of service attacks, unauthorized access, and spoofing. A simulation system was produced. Donald Welch, et al. In the information warfare simulation framework, simulations were conducted on the effects of password sniffing and intrusion prevention system.

However, these network security simulation systems are currently unable to properly represent real-world networks and cyber intrusions and defenses, so that they can model virtual intrusions using scalable simulation framework network models (SSFNet) and perform network behavior change simulations accordingly. A simulation system has been proposed. SSFNet is a Java model that implements protocols (IP, TCP, UDP, BGP4, OSFP, etc.) and network components (hosts, routers, links, LANs, etc.) as classes to model and simulate the real Internet.

However, the above-described simulation system can determine everything in advance and perform simulation only for a given situation and cannot express dynamic elements such as human behavior.

Therefore, the present invention is to solve the above-mentioned conventional problems, the object of the present invention is to model a security-related system (intrusion prevention system and intrusion detection system) on a large network, cyber attack (Internet worm and denial of service attack) The present invention provides a dynamic simulation system and method that reflects user input during network security simulation that enables the effective analysis of defense measures by dynamically changing the settings of a security-related system when performing a simulation.

The network security dynamic simulation system for achieving the object of the present invention as described above, the user server to provide a graphical user interface, and transmits the user's input to the simulation server, and provides a corresponding simulation result, and the user It is configured as a simulation server for storing the change message input from the server in a database, and simulates the changed set information and transmits the changed message to the user server.

In the network security dynamic simulation method for achieving the object of the present invention as described above, when the attacker of the user server while performing the simulation to perform the operations such as changing the target of the attack or change the type of attack, Changing the configuration of the intrusion prevention system according to the result of the intrusion detection system, and performing a defensive action; storing the information changed by the user in a host information database and a scenario database through a database connector, and resetting by the simulation engine Delivering the changed message to the net module, modifying the database according to the change message by the net module, and invoking a host module; Own property After changing the information, it executes the method.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a network security dynamic simulation system according to the present invention. As shown in FIG. 1, the simulation system includes a user system 101 and a simulation server 102.

The user system is classified into an attacker side system and a defender side system according to its role, but has the same structure in terms of the structure of the system.

First, the user system 101 is composed of a simulation studio 103, a database connector 104, a daemon connector 105, the simulation studio is a program that provides a graphical user interface to accept the user's input to the database The input information is transmitted to the connector 104 or the daemon connector 105, and the user is provided with a process of performing the simulation.

The database connector 104 transmits the user's input received from the simulation studio to the simulation server 102, and the daemon connector 105 sends commands such as start / stop of simulation and change of host settings generated in the simulation studio. It passes to the simulation engine 108 of the server 102.

On the other hand, the simulation server 102 is composed of a database unit 106, network DML generator 107, simulation engine 108, net module 109, host module 110.

The database unit 106 includes a network information database in which network topology, bandwidth, and latency, which are network information, is stored, a host information database in which configuration information of each host is stored, and scenario information storing simulation scenario information. The database is separate and can be accessed separately.

The network DML generator 107 is a module that converts network information written graphically into a domain modeling language (DML) that can be understood by the simulation engine 108.

The simulation engine 108 creates a net server process when the simulation is first executed, and allocates the generated net server process to the corresponding simulation studio. Thereafter, communication between the studio and the simulation server 102 is all made through the generated net server process.

Accordingly, the changed message set during the simulation is transferred to the net server process, and the net server process calls the net module 109 to enable the corresponding operation.

The net module 109 stores setting change information transmitted to the host information database and calls a function of the corresponding host.

The called host function changes its state to match the new setting by referring to its property in the host information database.

As shown in FIG. 2, the host module 110 includes an SFS (Simulation File System) 111 for classifying and storing the file system existing in the real host and the host state information for performing the simulation for each host, and It reads and initializes the properties of each host from the SFS 111 and initializes them, and dynamically creates the cyber intrusion / defense by the accelerator 112 to enable communication between the hosts. It includes an actor 113 modeling behavior and a service 114 that implements services http, ftp, telnet, etc. provided by each host to be similar to actual protocols.

The simulation system shown in FIG. 3 includes one simulation server 202 and a plurality of user systems 210 and 203.

The user systems 210 and 203 accept the user's input, show the simulation situation transmitted from the simulation server 202 to the user, and deliver the input configuration change information to the simulation server 202.

4 is a flowchart of a network security dynamic simulation method according to the present invention.

As shown in FIG. 4, in the secure dynamic simulation method, after a user executes a simulation user program, the network is edited in the simulation user program.

In the network editing, network devices (routers, switches, etc.) are arranged, and hosts and the like are connected in solid lines to form a desired topology.

Then, set the properties of the hosts that exist in the network and edit the intrusion scenarios in which you want to perform the simulation.

In other words, during the simulation, the attacker can view the status of worm and DDos attacks, change the target of attack or change the type of attack, and if the defender is based on the result of the intrusion detection system, change the configuration of the intrusion prevention system. And perform a defensive act (S300).

In this way, the changed information is transmitted to the simulation server 102 through the database connector 104, and stored in the host information database and the scenario database of the simulation server 102 (S310), and sends a reset message to the simulation engine 108. Transfer (S320).

The simulation engine 108 transmits the transmitted configuration change message to the net module 109, and the net module 109 modifies the database according to the changed information (S330) and then calls the host module 110. (S340).

The host module 110 executes the method after changing its property information (S350).

As such, storing host information and scenario information in a separate database in the DML of the simulation server 102 is because the DML cannot be modified during the simulation. Accordingly, dynamic simulation can be implemented by including only network structure information that does not require modification in the DML, and storing host information and scenario information that need modification during simulation in a separate database that can be easily modified.

Although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the above-described embodiments, and the present invention is not limited to the above-described embodiments without departing from the spirit of the present invention as claimed in the claims. Of course, any person skilled in the art can make various modifications, and such changes are within the scope of the claims.

As described above, according to the present invention, the complexity of the real world can be modeled due to various scenarios and response behaviors of users, so that effective defense measures can be established according to various scenarios and response behaviors, and useful for education of managers. Used.

Claims (5)

A user system that provides a graphical user interface, passes the user's input to a simulation server and provides the generated simulation results; And a simulation server configured to store a change message input from the user system in a database, and transmit a result generated by performing a simulation with the changed set information to the user system. The method of claim 1, wherein the simulation server A database unit comprising a network information database having information such as network topology, bandwidth, latency, a host information database having configuration information of each host, and a scenario information database having simulation scenario information; A network DML generator for converting network information graphically written in the network information database into DML; A simulation engine for generating a net server process when executing a simulation with the information transmitted from the database and allocating the generated net server process to the corresponding simulation studio requested; A net module for storing setting change information transmitted to the host information database; And And a host module for retrieving and resetting its data from the host information database. The method of claim 2, wherein the database unit Network security dynamic simulation system, characterized in that separate access to the network information, host information, Sanrio information database. The method of claim 2, wherein the host module A simulation file system (SFS) for classifying and storing a file system existing in a real host and host state information necessary for performing a simulation for each host; An actuator that reads and initializes attributes of each host from the SFS and enables communication between the hosts; An actor dynamically generated by the accelerator to model cyber intrusion and defense behavior; And Network security dynamic simulation system comprising a service (Service) for implementing similar services http, ftp, telnet provided from each host to the actual protocol. During the simulation, the attacker of the user server can view the attack status, change the target of attack or change the attack type, and if it is the defender, rely on the result of the intrusion detection system to change the configuration of the intrusion prevention system to defend. Performing the act; Storing the information changed by the user in a host information database and a scenario database through a database connector and delivering a reset message by a simulation engine; Delivering a configuration change message transmitted from the simulation engine to a net module, modifying a database according to the message changed by the net module, and then calling a host module; And executing the method after the host module changes its property information.

Images