KR20060067077A - Apparatus for recognizing abnormal and destructive traffic in network and method thereof - Google Patents

Abstract

The present invention detects anomalous harmful traffic such as denial of service attack traffic or port scan attack traffic in real time in a giga-class high-speed network environment, and an apparatus and method for detecting anomalous traffic based on a heuristic analysis technique. It is about.

The abnormal harmful traffic detection apparatus disclosed herein checks whether the amount of parsed incoming traffic exceeds a predetermined traffic amount threshold and whether a time threshold is exceeded to detect abnormal harmful traffic in the incoming traffic. Sensing unit; And a reference pattern providing unit which provides a reference pattern for determining the presence of the abnormal harmful traffic to the abnormal harmful traffic detecting unit to achieve the object and technical problem of the present invention.

Description

Apparatus for recognizing abnormal and destructive traffic in network and method

FIG. 1 is a diagram illustrating a concept of an abnormal harmful traffic detection method using a heuristic analysis technique based on a traffic amount and a time threshold.

2 is a view showing the configuration of a preferred embodiment of the present invention.

FIG. 3A is a diagram illustrating an implementation procedure of a detection function of a denial of service attack traffic by the abnormal malicious traffic detection unit shown in FIG. 2, and illustrates a preferred embodiment of the present invention.

FIG. 3B is a view showing an implementation procedure of a port scan attack traffic detection function by the abnormal malicious traffic detection unit shown in FIG. 2, and showing a flow of another preferred embodiment of the present invention.

4 is a diagram illustrating a procedure for initializing a count value in the time threshold checker of the abnormal harmful traffic detector of FIG. 2.

FIG. 5 is a diagram for describing a technique for efficiently performing IP entry management by the IP entry manager of the abnormal traffic detection unit shown in FIG. 2.

FIG. 6 is a diagram illustrating a configuration method of each table for providing an abnormal harmful traffic detection function in real time in the abnormal harmful traffic detection unit shown in FIG. 2.

The present invention relates to an apparatus and method for detecting abnormal harmful traffic on a network. More particularly, the present invention relates to an abnormal harmful traffic such as denial of service attack traffic or port scan attack traffic in a high-speed network environment of Giga-class. The present invention relates to an apparatus and method for detecting abnormal harmful traffic based on a heuristic analysis technique.

With the advent of Denial of Service (DoS) in the late 1990s, the network has become the foundation of cyber attacks, and even the medium of proliferation. As a result, the number of security attacks has increased significantly, and the complexity of attacks is increasing.

A denial of service attack is the most common method of hacking, which sends a large amount of data for the purpose of interfering with the normal service of the system, thereby rapidly degrading the performance of the target network or system and preventing the use of the services provided by the target system. . Early denial-of-service attacks, where there were not many Internet users, were mainly dominated by 1: 1 types of victims of attackers targeting single systems or services.

Recently, however, the N: 1 type has become mainstream, with N unspecified systems attempting to attack a single network under the name of distributed denial of service (DDoS) attacks. Such attacks are carried out by infecting a large number of unspecified systems through proactive tasks such as port scans, and have the destructive power to paralyze not only a single system but the entire network by simultaneously attempting to attack from infected systems.

This type of N: 1 attack method takes a lot of time by hand, so automated attack tools are often used. Therefore, if the characteristics of the attack tools are properly understood, countermeasures can be prepared. Therefore, measures for countermeasures are actively being made. More important as well as countermeasures are the detection of signs of attack. Since such an attack uses a large network, it causes abnormal network flow. Therefore, early detection of attack signs enables quick response to the attack.

Along with this trend, many systems have been developed that are interested in intrusion through the network, but the high speed of the network such as the Gigabit Ethernet environment and the transmission and reception of large data based on it require the change of the existing low speed intrusion detection technique. . In other words, in order to adequately cope with ever-increasing speed and capacity of network environments and more diverse intrusion attempts, a technique for analyzing a large amount of data in a shorter time is required.

In other words, a new type of intrusion detection system is required. However, most existing intrusion detection systems are generally designed and applied to a single system environment or a small area, making it difficult to expand to a large network. Even if it had a structure that could be extended, the detection in the application area had a performance limitation.

The technical limitation of the existing intrusion detection system is the performance problem of the intrusion detection system such as packet loss rate and intrusion detection rate. Performance has been steadily improved by many developers, but this is a costly and time-consuming task. Nevertheless, improving performance is a top priority. In addition, changes in network environments, such as the Gigabit Ethernet environment, are becoming increasingly important.

In the network intrusion detection system, various methods for detecting abnormal traffic such as DoS or port scan attack have been applied.However, the most accurate detection method compares and inspects packets entering the network and known intrusion patterns. To check the frequency.

Most intrusion detection systems use a software-based approach, but these detection engines are limited in speed. That is, it is almost impossible to provide a high-speed intrusion detection function without overcoming the performance limitations of the intrusion detection system. Therefore, real-time search for known denial-of-service attacks or port scan attack types is very important, and a technique is needed to check these types of attacks in real time.

The present invention has been devised to solve the above problems and meet the above requirements, and an object of the present invention and the technical problem to be achieved are based on heuristic analysis to detect abnormal harmful traffic in a giga-class network environment. It is an object of the present invention to provide an abnormal harmful traffic detection apparatus and method for enabling the detection and analysis of abnormal harmful traffic.

Abnormal harmful traffic detection device disclosed in the present specification to achieve the above object and technical problem is

An abnormal harmful traffic detector configured to detect whether there is an abnormal harmful traffic by checking whether an amount of parsed inflow traffic exceeds a predetermined traffic amount threshold and a time threshold; And

In order to achieve the object and technical problem of the present invention, a reference pattern providing unit is provided to provide the reference pattern for determining the presence of the abnormal harmful traffic.

Abnormal harmful traffic detection method disclosed in the present specification in order to achieve the above object and technical problem is

(a) comparing the reference pattern with the parsed incoming traffic and determining whether there is abnormal harmful traffic in the incoming traffic;

(b) searching for a predetermined IP address corresponding to an IP address of the incoming traffic when determining that the two patterns match each other;

(c) when the corresponding IP address is found, checking whether the increased count value reaches the count threshold of the reference pattern by increasing a count value of a reference pattern that matches the pattern of the incoming traffic;

(d) checking the time threshold; And

(e) when exceeding the count threshold and the time threshold, to achieve the object and technical problem of the present invention, including generating the path information for the incoming traffic.

Another method of detecting abnormal harmful traffic disclosed herein to achieve the above object and technical problem is

(a) comparing the reference pattern with the parsed incoming traffic and determining whether there is abnormal harmful traffic in the incoming traffic;

(b) searching for a preset IP address corresponding to the IP address of the incoming traffic when the two patterns match;

(c) comparing the port value of the incoming traffic with a preset port value when the corresponding IP address is found;

(d) if the two port values do not match, checking whether the increased count value reaches the count threshold of the reference pattern by increasing the count value of the reference pattern that matches the pattern of the incoming traffic;

(e) checking the time threshold; And

(f) if the count threshold and the time threshold is exceeded, generating the path information for the incoming traffic to achieve the object and technical problem of the present invention.

For the convenience of understanding and explanation of the present invention, the core of the technical idea provided by the present invention is first presented, and the core of the technical idea provided by the present invention is a heuristic based on a traffic amount and a time threshold for incoming traffic. Based on the analysis, an analysis is performed to determine whether abnormal traffic is included.

Enables high-speed analysis of incoming traffic, enabling accurate and fast detection of anomalous traffic such as denial of service attacks and port scan attacks on the network (the attack traffic or intrusion traffic is also used in the same concept). To make sense.

Hereinafter, in order to clarify the technical spirit of the present invention, the configuration and operation thereof will be described in detail with reference to the accompanying drawings based on the embodiments of the present invention. Although the same reference numerals have been given even in different drawings, it will be appreciated that components of other drawings may be cited when necessary in describing the drawings.

FIG. 1 is a diagram illustrating a concept of an abnormal harmful traffic detection method using a heuristic analysis technique based on a traffic amount and a time threshold.

A diagram showing a state transition diagram of abnormal harmful traffic detection by a packet amount and a time threshold using a timer are shown. In general, anomalous traffic on a network, such as a denial of service attack or a port scan attack, is characterized by the occurrence of a large amount of traffic (packets, packets and traffic are all represented by the same concept). Even if it matches this attack traffic, it is difficult to determine it as attack traffic (intrusion traffic) immediately.

Therefore, when a large amount of traffic of the same pattern is introduced, judging as attack traffic provides higher accuracy and reliability. Therefore, when traffic matching the attack traffic is first introduced, the transition from the initial state 110 to the progress state 111 increases as the count for the amount of traffic is increased (count ++), and the traffic matching the attack traffic continues to flow. When the count reaches a predetermined threshold (count_threshold), the transition to the final state 112 to generate an alert message. After the alert message is generated, the state transitions back to the initial state 110 (114).

However, since the state transition that depends only on the traffic amount may cause false alarms due to the prolongation of the count even when the incoming traffic is small, the state transition concept considering the time threshold is introduced in the present invention to prevent this. Here, the time threshold means a prediction setting threshold for the maximum time taken to reach the final state from the time when the initial attack traffic flows.

Therefore, if the time threshold is set in advance, and the time threshold by the timer is measured during the state transition process and the time threshold (time_threshold) is reached, the time-out signal time_over is sent, and the progress state 111 is transmitted to the initial state 110. (113). This state transition method can increase the accuracy of detection of abnormal traffic on the network such as denial of service attacks and port scan attacks.

2 is a view showing the configuration of a preferred embodiment of the present invention.

Referring to FIG. 2, an embodiment of the device disclosed in the present disclosure is an inflow traffic controller 20 for parsing and controlling network traffic in order to perform an abnormally harmful traffic detection function, and parsed information. Based on the heuristic analysis, the abnormal harmful traffic detection unit 22 and the abnormal harmful traffic detection unit 22 that determine whether there is abnormal harmful traffic in the reference pattern (reference) for determining the presence of abnormal harmful traffic It consists of a reference pattern providing unit 24 for providing to the abnormal harmful traffic detection unit 22.

The inflow traffic controller 20 is composed of three external interface units 201, 207, and 208 and five controllers 202, 203, 204, 205, and 206. The three external interface units include a traffic inflow interface unit 201 for introducing traffic from the outside, a traffic transmission interface unit 207 for transmitting the incoming traffic to the outside, and an alarm message transmitting the alert message shown in FIG. 1 to the outside. It consists of an interface unit 208.

The five controllers include a transport protocol checker 202 for checking a transport protocol for incoming traffic, an inflow traffic buffer 203 for buffering inflow traffic, and a transmission traffic buffer 205 for buffering outgoing traffic. In order to compare the information of the incoming traffic and the reference pattern information, the incoming traffic parsing unit 204 and the abnormal harmful traffic detector parsing each field information of the incoming traffic to the abnormal harmful traffic detector 22. And an alert message generation unit 206 for generating an alert message by combining the alert information from 22 and the traffic information of the transmission traffic buffer 205.

Through five control units and three external interface units, real-time traffic control is possible, and real-time response to abnormal harmful traffic (preventing external transmission of harmful traffic, etc.) is possible.

The harmful traffic detection unit 22 receives the incoming traffic information parsed from the parsing unit 204 of the inflow traffic control unit 20 and compares the pattern comparison unit 221 with a reference pattern for determining the presence of intrusion traffic. CAM (abbreviation of Content Addressable Memory, which retrieves the IP address of the traffic that matches the pattern. It represents the memory that can directly access the data by using some of the stored contents. It is used for quick data retrieval in hardware implementation.) The 222, the IP address information management unit 223 and IP address information storage table 224, which manages the information of the IP address of the incoming traffic, the abnormal harmful traffic included in the incoming traffic is traffic that matches the port scan attack pattern. In this case, the port value comparison unit 225 and the port value storage table 226 that compare the existing port values with the abnormal pattern match with the reference pattern. The counter 227 and the counter table 228 for counting the traffic, the time threshold checker 229 for checking the time threshold, the time threshold storage table 2210, and path information on the traffic exceeding the counter threshold in the time threshold are provided. The alert information generating unit 2211 is generated.

The reference pattern providing unit 24 receives a reference pattern (intrusion pattern) for determining whether there is abnormal harmful traffic from the application and transmits the abnormal harmful traffic detecting unit 22 to the abnormal harmful traffic detecting unit 22. Update, add, delete, or apply intrusion patterns in real time (continuously). Here, the application manages and controls the reference pattern, and adds, modifies, and deletes the reference pattern applied to the hardware logic.

FIG. 3A is a diagram illustrating an implementation procedure of a function of detecting a denial of service attack traffic by the abnormal harmful traffic detection unit 22 shown in FIG. 2, and illustrates a preferred embodiment of the present invention.

In general, denial of service attacks and distributed denial of service attacks are attacks aimed at a few target systems, so detection of intrusion traffic is performed based on the destination IP address (the IP address where the intrusion traffic came from). do. Therefore, the detection and analysis of intrusion traffic is performed under a structure in which counters are set and managed by the number of reference patterns (intrusion patterns) provided by the reference pattern providing unit 24 based on individual IP addresses.

The pattern comparison unit 221 receives the information of the inflow traffic parsed from the inflow traffic parser 204 of the inflow traffic control unit 20, and compares the inflow traffic pattern with the reference pattern (S301). As a result of the comparison (S302), if the pattern of the incoming traffic matches the reference pattern, the CAM IP retrieval unit 222 retrieves the existing IP address stored in the IP address information storage table 224 (S303). If the two patterns do not match, the pattern comparison unit 221 compares the next incoming traffic pattern with the reference pattern (S301).

The IP address information management unit 223 compares the existing IP address retrieved by the CAM IP search unit 222 with the IP address of the incoming traffic (S304). If the IP address information management unit 223 does not match, new IP address information (IP entry) for the incoming traffic is not matched. Information) is newly generated in the IP address information storage table 224, and all count values associated with the generated new IP address are initialized and the process returns to step S301.

On the contrary, if the IP address of the incoming traffic matches the existing IP address, the IP address information management unit 223 updates the IP address information (S306), and the counter 227 determines the reference pattern associated with the updated IP address information. The count value is increased (S307). The counter 227 compares the incremented count value with a preset count threshold value of the reference pattern (S308). If the count threshold is reached, the counter 227 requests the path information generator 2211 to generate alarm information for incoming traffic, and counts the count value. Initialize (S309) and return to step S301 to process the new incoming traffic. The route information generation unit 2211 generates the route information in response to the request (S310).

If the count threshold is not reached, the above procedure is repeated from step S301 for new incoming traffic. Through this procedure, abnormal malicious traffic such as a denial of service attack and a distributed denial of service attack are detected in real time.

FIG. 3B is a view showing an implementation procedure of the port scan attack traffic detection function by the abnormal malicious traffic detection unit 22 shown in FIG. 2, and showing the flow of another preferred embodiment of the present invention.

In general, like a denial of service attack, a port scan attack is a form of attack that targets a few target systems. Therefore, detection of intrusion traffic is performed based on a destination IP address. Therefore, although the detection procedure shown in FIG. 3A can be applied as it is, since the form of the port scan attack is performed by changing the port value to obtain the port information of the target system, the detection procedure shown in FIG. Further comparison is required to increase the count value of the reference pattern.

That is, after the IP address information is updated (S306), the port value comparison unit 225 compares the port value in the port value storage table 226 with the port value of the incoming traffic (S3061). As a result of comparison (S3062), if the port value of the incoming traffic matches the port value existing in the port value storage table 226, new traffic information is received without increasing the count (S31). If it does not match, the port value storage table 226 is updated to include the new port value (S3063), and the counter 227 increments the count value of the reference pattern (S307). Other procedures are the same as described in FIG. 3A. This procedure detects abnormal traffic such as port scan attacks in real time.

4 is a diagram illustrating a procedure for a count value initialization function in the time threshold checker 229 of the abnormal harmful traffic detector 22.

The count value initialization referred to in FIGS. 3A and 3B is also performed by the time threshold checker 229, which, as mentioned above, is anomalous harmful such as a denial of service attack and a port scan attack. In order to eliminate the possibility of false alarms caused by long-term counts for a small amount of traffic upon detection of traffic, the counter table 228 of the reference pattern is initialized according to a predetermined time threshold. In other words, even if the incoming traffic pattern matches the reference pattern, if the incoming traffic is small, it takes a long time to count it. Therefore, the intrusion traffic detection procedure shown in FIGS. 3A and 3B is within a predetermined time (within time threshold). To be done.

In order to perform the initialization function, the time threshold checker 229 first initializes a time value of a timer connected to a reference pattern (S401), and compares the time value after the timer operation with time thresholds of each reference pattern (S402). . As a result of the comparison, when the time value exceeds the time threshold value of the specific reference pattern, the count of the reference pattern is initialized (S403) and the time value is also initialized (S401).

If the time value does not reach the time threshold value of the specific reference pattern, the comparison with the time threshold value according to the increase of the time value of the timer is repeated. Such an initialization procedure is commonly applied to the procedures shown in FIGS. 3A and 3B, thereby increasing the accuracy of the count-based abnormal harmful traffic detection function.

FIG. 5 is a view for explaining a technique for efficiently managing IP address information by the IP address management unit 223 of the abnormal harmful traffic detection unit 22. IP address information through efficient use of limited memory resources. Demonstrate techniques for managing

For example, if the search result for the IP address of the incoming traffic from the CAM IP search unit 222 uses a 7-bit CAM, the CAM memory may contain only 128 IP address information. Therefore, the configuration of the IP address information storage table 224 for this should be 128. If the IP address information storage table 224 is completely filled with IP addresses, the number of inflows (emergences) for the IP addresses of the incoming traffic will be given. And maintenance time management allow you to specify the storage location for the new IP address.

That is, if the 128 IP address information storage tables 224 are all filled with IP addresses, and the IP address of the incoming traffic is a new IP address that does not exist in the IP address storage table 224, one of the existing stored IP addresses is selected. Need to be relocated.

To this end, the IP address information storage table 224, as shown in Figure 5, the four of the frequency 4 link (link_3) in the frequency 1 link (link_0) according to the inflow frequency for the IP address of the incoming traffic. Comprising a link, the IP address information management unit 223 reconfigures each link according to the inflow frequency of the IP address of the inflow traffic. That is, only link_0 exists initially, but if the frequency of the IP address information belonging to link_0 becomes 2, the IP address information is transferred to link_1. In this way, the link_2 and link_3 can be transferred. In link_3, the IP address is managed by rearranging the link order whenever the frequency increases. Here, the number of links is for example, and may be adjusted according to traffic characteristics.

Here, the IP address information of each link is arranged in the order of inflow, so that at the beginning of each link, the IP address information that has been introduced longest in the link is located, and the IP address information that has recently been introduced as the end is located. Position it. For example, if the IP address search result of the incoming traffic, if the address corresponding to the IP_n (501) address information located in link_0 is a search result value by the CAM IP search unit 222, IP_n (501) address information is the frequency According to the increase, it is connected to the link up 503 position of link_1.

That is, through this procedure, if all 128 entries are used, and if an address for a new IP address is required, the address of IP_0 (500), which is the least frequent and oldest IP address information, is returned, and the corresponding address is returned. The CAM memory belonging to is updated to include the IP address of the incoming traffic, and the IP address information of the updated IP address is located at the end of the link as the new tail 502.

However, when IP address information is transferred to a higher frequency link due to an increase in the inflow frequency, IP address information existing at the start of each link will continue to exist even though there is no inflow of traffic for the corresponding IP address. Needs to be specified as IP address information to be updated according to the retention time.

For example, as shown in FIG. 5, if the IP entry information existing at the beginning of link_0 (link_1, link_2, link_3) does not change for 2 seconds (10 seconds, 50 seconds, 100 seconds), the information of the new IP address. When a request is made, it is necessary to return information on the IP address for this and perform a new link configuration. This holding time is for example and is a value that can be adjusted according to traffic characteristics. Through such management of IP address information, it becomes possible to manage IP addresses on a limited memory.

FIG. 6 is a diagram illustrating a configuration method of each table for providing an abnormal harmful traffic detection function in real time by the abnormal harmful traffic detecting unit 22.

The memory constituting each of the tables 224, 226, and 228 shown in FIG. 6 is a 32-bit data table searched with a 9-bit address, and 512 entries can be stored for 32-bit data. First, the pattern comparison unit 221 is a 16-bit pattern comparison result of each 16 bit compared to the reference pattern for the denial of service attack or the port scan attack pattern and 32 bits of the incoming traffic having the corresponding pattern. A 32 bit IP value and a 16 bit port value of incoming traffic in the case of a port scan attack pattern are output.

Here, the 16-bit result value means that the maximum number of reference patterns is 16. If there is a reference pattern that matches the incoming traffic, it indicates the result value of setting the order bit corresponding to the reference pattern to 1. For example, if the pattern of incoming traffic matches the first reference pattern, then the result value is 0x0001. Thus, it can support multiple matching for existing patterns.

Based on the result, the CAM IP search unit 222 compares the IP address of the CAM memory with the IP address of the incoming traffic, and outputs a 7-bit search result. As shown in FIG. 5, this means an address index for 128 IP entry storage tables 224. Here, the IP entry storage table 224 should have a 9-bit address, but uses the addresses filled with zeros for the eighth and ninth bits for managing 128 entries.

Based on this, the IP address information storage table 224 is updated, and the information of the port value storage table 226 and the counter table 228 connected thereto is also updated. Here, the port value storage table 226 is used only when detecting a port scan attack, and updates the port value while comparing the port value of the incoming traffic while also retaining the previous port value with 4 revisions in the memory location corresponding to the address value. . Since the port value is 16 bits, it has a structure that can read and write four port values at one time using two memories.

The counter table 228 needs to manage all counters for 16 reference patterns, and thus generates 16 16-bit count values. To do this, two memories are used, and the eighth and ninth bits of the memory address are adjusted to manage count values for each pattern. That is, the first to fourth pattern count values are stored in the memory address value having the above bit value 00, and the fifth to eighth pattern count values are stored in the memory address value 01. The remaining 7-bit address value uses the result of the CAM IP search unit 222. Through this structure, the count value of patterns for a specific IP address is managed.

As a result of the search performed by the CAM IP search unit 222, in the case of a non-existent IP address, the CAM memory, the port value storage table 226, and the counter according to the updated IP address information returned from the IP address information storage table 224. The table 228 and the like are initialized. Through such a memory configuration, abnormal harmful traffic on the network is detected.

As such, the present invention provides an apparatus and method for receiving actual network attack traffic, measuring the amount of traffic, and detecting abnormal harmful traffic based on a heuristic analysis according to the traffic amount threshold and the time threshold.

The present invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention.

Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the equivalent scope will be construed as being included in the present invention.

As described above, the present invention proposes a method for detecting abnormal harmful traffic based on heuristic analysis in order to detect and respond to abnormal traffic in a giga-class high-speed network environment in real time. In other words, by applying heuristic analysis technique based on traffic volume and time threshold, it provides more efficient and accurate detection of abnormal traffic on network such as denial of service attack and port scan attack.

Accordingly, the present invention enables faster and more accurate abnormal traffic detection function, thereby enabling efficient response in the wide area network to abnormal traffic, thereby minimizing damage on the network.

Claims (11)

An abnormal harmful traffic detector configured to detect whether there is an abnormal harmful traffic by checking whether an amount of parsed inflow traffic exceeds a predetermined traffic amount threshold and a time threshold; And And a reference pattern providing unit for providing a reference pattern for determining the presence or absence of the abnormal harmful traffic to the abnormal harmful traffic detecting unit. According to claim 1, wherein the abnormal harmful traffic detection unit A pattern comparison unit which receives the parsed inflow traffic information and compares the inflow traffic pattern with the reference pattern to determine whether the inflow traffic has the rejected attack traffic; A CAM IP searching unit searching for an IP address preset in the sensing unit corresponding to the IP address of the incoming traffic when the two patterns match; A counter for checking whether the increased count value reaches the count threshold of the reference pattern by increasing a count value of a reference pattern that matches the pattern of the incoming traffic when the corresponding IP address is found; A time threshold checker checking the time threshold; And When the count threshold and the time threshold is exceeded, an abnormal harmful on the network, characterized in that for detecting a denial of service attack traffic or distributed denial of service attack traffic, including an alert information generation unit for generating the path information for the incoming traffic Traffic detection device. According to claim 1, wherein the abnormal harmful traffic detection unit A pattern comparison unit which receives the parsed inflow traffic information and compares the inflow traffic pattern with the reference pattern to determine whether the inflow traffic has the rejected attack traffic; A CAM IP searching unit searching for an IP address preset in the sensing unit corresponding to the IP address of the incoming traffic when the two patterns match; A port value comparison unit comparing the port value of the incoming traffic with a preset port value when the corresponding IP address is found; A counter for checking whether the increased count value reaches the count threshold of the reference pattern by increasing a count value of a reference pattern that matches the pattern of the incoming traffic when the two port values do not match; A time threshold checker checking the time threshold; And And an alarm information generator for generating path information on the incoming traffic when the count threshold and the time threshold are exceeded, and detect an abnormal harmful traffic on the network. The method of claim 2, An IP address management unit for generating information of a new IP address if the IP address of the incoming traffic and the preset IP address do not match, and updating the information of the preset IP address if they match; And And an IP address information storage table for storing information of the IP address, wherein the IP address management unit manages the inflow frequency for the information of the IP address of the incoming traffic and the maintenance time of the information of the preset IP address. An apparatus for detecting abnormal harmful traffic on a network, wherein the storage location of the newly introduced IP address can be designated in the storage table. The method of claim 4, wherein the IP address storage table is implemented as a link according to the inflow frequency, and the information of the IP address of the inflow traffic is higher than the frequency link to which it belongs when its inflow frequency increases. The abnormal harmful traffic detection apparatus on the network, characterized in that the transition to a few links, the retention time is specified for each link. The abnormal harmful traffic detection apparatus of claim 5, wherein the oldest information of the IP address information of each link is deleted if the information corresponding to the IP address does not flow within the holding time. The method of claim 3, wherein An IP address management unit for generating information of a new IP address if the IP address of the incoming traffic and the preset IP address do not match, and updating the information of the preset IP address if they match; And And an IP address information storage table for storing information of the IP address, wherein the IP address management unit manages the inflow frequency for the information of the IP address of the incoming traffic and the maintenance time of the information of the preset IP address. An apparatus for detecting abnormal harmful traffic on a network, wherein the storage location of the newly introduced IP address can be designated in the storage table. 8. The method of claim 7, wherein the IP address storage table is implemented as a link according to the inflow frequency, and the information of the IP address of the inflow traffic is higher than the frequency link to which it belongs when its inflow frequency increases. The abnormal harmful traffic detection apparatus on the network, characterized in that the transition to a few links, the retention time is specified for each link. 9. The abnormal harmful traffic detection apparatus of claim 8, wherein the oldest information of the IP address information on each link is deleted if information corresponding to the information does not flow within the holding time. (a) comparing the reference pattern with the parsed incoming traffic and determining whether there is abnormal harmful traffic in the incoming traffic; (b) searching for a predetermined IP address corresponding to the IP address of the incoming traffic when determining that the two patterns match each other; (c) when the corresponding IP address is found, checking whether the increased count value reaches the count threshold of the reference pattern by increasing a count value of a reference pattern that matches the pattern of the incoming traffic; (d) checking the time threshold; And and (e) generating path information on the incoming traffic when the count threshold and the time threshold are exceeded. (a) comparing the reference pattern with the parsed incoming traffic and determining whether there is abnormal harmful traffic in the incoming traffic; (b) searching for a preset IP address corresponding to the IP address of the incoming traffic when the two patterns match; (c) comparing the port value of the incoming traffic with a preset port value when the corresponding IP address is found; (d) if the two port values do not match, checking whether the increased count value reaches the count threshold of the reference pattern by increasing the count value of the reference pattern that matches the pattern of the incoming traffic; (e) checking the time threshold; And and (f) generating path information on the incoming traffic when the count threshold and the time threshold are exceeded.

Images