KR20070032425A - Method and System for Detecting of Virus Intrusion - Google Patents

Abstract

A method and a system for providing a virus intrusion detection service are provided to take precautions against the infiltration of unknown viruses as well as known viruses by establishing and monitoring a virtual site that receives the same packet data equivalent to a mobile Internet service. A system for providing a virus intrusion detection service comprises a mobile terminal(110), an RNC(Radio Network Controller)(130), a base station(120), an SGSN(Serving GPRS support Node)(140), a GGSN(Gateway GPRS support Node)(150), and an IDS(Intrusion Detection Server)(160). The mobile terminal(110) executes voice call through wireless communication, and uses mobile Internet services including financial transactions and homepage management. The RNC(130) controls Tx power for the mobile terminal(110), and determines a handoff. The base station(120) executes wire/wireless conversion between the mobile terminal(110) and the RNC(130), and transmits/receives radio signals. The SGSN(140), interworking with the RNC(130) through an Iu interface, supports GPRS(General Packet Radio Services) to the mobile terminal(110). The GGSN(150), interworking with the SGSN(140), supports the transmission of packet data between the mobile terminal(110) and an external packet network. The IDS(160) detects the intrusion of viruses for a virtual site, and notifies a network manager(190) and a vaccine site provider(192) of it.

Description

Method and System for Detecting of Virus Intrusion

1 is a block diagram showing a system for providing a virus intrusion detection service according to an embodiment of the present invention,

2 is a block diagram showing a virus intrusion detection server according to an embodiment of the present invention,

3 is a flowchart illustrating a method of providing a virus intrusion detection service according to a preferred embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

110: mobile communication terminal 120: base station

130: wireless network controller 140: service packet wireless service support node

150: gateway packet wireless service support node

160: intrusion detection server 170: the Internet

180, 182: Virtual Site 190: Network Administrator

192: vaccine site vendor

The present invention relates to a method and system for providing a virus intrusion detection service. More specifically, the present invention relates to a method and system for providing a virus intrusion detection service that opens and monitors a virtual site receiving packet data corresponding to a wireless Internet service and detects a virus intrusion and notifies a network administrator and an antivirus site company. will be.

There are many kinds of viruses and malwares on the Internet, causing huge damage to organizations, corporations and individuals. Furthermore, as the cases of viruses infiltrating into mobile communication terminals continue to emerge, damages to mobile communication terminals are on the rise.

Since the mobile application vaccine program for the mobile terminal has not been developed until now, the security of the wireless Internet is only a very early stage. Although the security level of the wireless Internet is in its infancy, the service level of the wireless internet has been considerably upgraded, which has led to the development of many aspects of banking, commercial transactions and homepage management as mobile terminals.

Although the wireless Internet service level by the mobile communication terminal has been improved, the wireless Internet security level is very low, which causes a problem of being exposed to the virus unprotected when a financial transaction is performed in the mobile communication terminal.

In order to solve the above-mentioned problems, the present invention provides a virus intrusion detection service that opens and monitors a virtual site receiving packet data corresponding to a wireless Internet service, detects a virus intrusion, and notifies a network administrator and an antivirus site company. It is an object of the present invention to provide a method and system.

According to a first object of the present invention, there is provided a virus intrusion detection service that opens and monitors a virtual site receiving packet data corresponding to a wireless Internet service, detects a virus intrusion, and notifies a network administrator and an antivirus site company. A system, comprising: a mobile communication terminal for performing a voice call for wireless communication and for providing the wireless Internet service including banking transaction, commercial transaction, and homepage management; A wireless network control system, comprising: a wireless network controller controlling a transmission output to the mobile communication terminal, determining a handoff, and operating the wireless network; A network termination device directly connected to the mobile communication terminal, comprising: a base station converting wired / wireless and transmitting / receiving a wireless signal between the mobile communication terminal and the wireless network controller; CLAIMS What is claimed is: 1. A GPRS service support system, comprising: a service packet radio service support node supporting the GPRS service to the mobile communication terminal by interworking with the radio network controller through an lu interface; A gateway packet radio service that interworks with an external packet network and interworks with the service packet radio service support node to an IP backbone network through a GN interface to transmit packet data between the mobile communication terminal and the external packet network. Support node; And an intrusion detection server that detects an invasion of a virus to the virtual site and notifies the network administrator and the vaccine site company.

According to a second object of the present invention, there is provided a virus intrusion detection service that opens and monitors a virtual site receiving packet data provided through a wireless Internet service, detects a virus intrusion, and notifies a network administrator and an antivirus site company. A method comprising: (a) establishing and monitoring a virtual site receiving the packet data from an external packet network providing a wireless Internet service to a mobile communication terminal via a gateway packet wireless service support node and the Internet; (b) collecting the packet data flowing into the virtual site from the external packet network; (c) processing and abbreviating the packet data to determine whether the packet data containing a virus invaded the virtual site; (d) determining whether packet data containing the virus has invaded the virtual site; (e) if it is determined in step (d) that packet data including the virus invades the virtual site, collecting behavior information of the packet data and leaving log information; And (f) informing the network administrator and the vaccine site company of the behavior information and log information of the packet data including the virus determined to have invaded the virtual site. The purpose is to provide a way to provide.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are designated as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a diagram showing a wireless Internet system for providing a virus intrusion detection service according to an embodiment of the present invention.

As shown in FIG. 1, the wireless Internet system 100 for providing a virus intrusion detection service according to an exemplary embodiment of the present invention includes a mobile communication terminal 110, a base station 120, and a radio network controller (RNC). Network Controller (130), Service Packet Wireless Service Support Node (SGSN) 140, Gateway Packet Wireless Service Support Node (GGSN) (150), Intrusion Detection Server (IDS: Intrusion Detection) Server) 160, Internet 170, virtual sites 180, 182, network administrator 190, and antivirus site provider 192.

The mobile communication terminal 110 performs a voice call through wireless communication and is provided with a wireless internet service such as financial transactions and so-called 'mini homepage' management which is being recently serviced.

Mobile communication terminal 110 according to a preferred embodiment of the present invention is a PDA (Personal Digital Assistant), cellular phone, PCS (Personal Communication Service) phone, hand-held PC (Hand-Held PC), GSM (Global System for Mobile) Various wireless communication terminals, such as a phone, a wideband CDMA (WCDMA) phone, a Code Division Multiple Access (CDMA) 2000 phone, and a Mobile Broadband System (MBS) phone, may be included.

The base station 120 is a network endpoint device that performs wired / wireless conversion and wireless signal transmission and reception between the mobile communication terminal 110 and the wireless network controller 130 and is directly connected to the mobile communication terminal 110.

The wireless network controller 130 is a wireless network control system, which controls the base station 120, allocates and releases radio channels to the mobile communication terminal 110, and controls transmission outputs of the mobile communication terminal 110 and the base station 120. It performs soft handoff and hard handoff decision, transcoding and vocoding, and operation and maintenance of wireless access network.

The service packet wireless service support node 140 is a GPRS service support system. The service packet wireless service support node 140 interworks with the wireless network controller 130 through the Iu interface and the gateway packet wireless service support node 150 through the GN interface. 110) GPRS service is supported. The Iu interface refers to an interface between the wireless network controller 130 and the core network. The GN interface refers to an interface between the service packet wireless service support node 140 and the gateway packet wireless service support node 150 in the same operator network. Say.

The gateway packet radio service support node 150 interoperates with an external packet switching network and interworks with a service packet radio service support node 140 via an GN interface to an IP backbone network, thereby communicating with the mobile communication terminal 110 and an external device. It supports to transmit packet data service between packet networks.

The intrusion detection server 160 takes necessary measures such as monitoring an intrusion of a user who does not have a legitimate use right in a network system and forcibly disconnecting it. The intrusion detection server 160 detects a virus for the virtual sites 180 and 182 and notifies the network administrator and the antivirus site company when a virus is detected.

Intrusion detection server 160 is usually operated with a firewall, the firewall is a system for detecting external intrusion, the intrusion detection server 160 is a system for monitoring the intruder's behavior inside the firewall. In addition, the intrusion detection server 160 may not only detect CGI attacks or buffer overflows that cannot be prevented by the firewall, but may also monitor illegal activities that members of the LAN may commit.

In the Internet 170, the gateway packet wireless service support node 150 interoperates with an external packet switching network to provide packet data services to the virtual sites 180 and 182 from the external packet network.

2 is a diagram showing the internal structure of a virus intrusion detection server according to a preferred embodiment of the present invention.

As shown in FIG. 2, the virus intrusion detection server 160 includes an information collector 210, a system setting unit 220, a pattern database 230, an information analyzer 240, a log storage unit 250, The event report unit 260, the system manager 270, and the pattern generator 280 are configured to be included.

The information collecting unit 210 collects information on the activity and content of the packet data flowing into the virtual sites 180 and 182 from the external packet network, and collects the information about the packet data in the system setting unit 220 and Transmit to pattern database 230. The system state information of the virtual sites 180 and 182 is collected and transmitted to the system setting unit 220 and the pattern database 230.

The system setting unit 220 stores state information when the virtual sites 180 and 182 are normal without being infected by packet data including a virus.

The pattern database 230 stores pattern information about activities and contents of the standardized packet data in the virtual sites 180 and 182. It also stores pattern information about the activity and content of packet data, including existing viruses.

The information analyzer 240 compares the packet information flowing into the virtual sites 180 and 182 from the external packet network with the pattern information on the activity and contents of the packet data including the existing virus received from the pattern database 230. Then, it is determined whether the packet data flowing into the virtual sites 180 and 182 from the external packet network contains a virus.

The information analyzing unit 240 is not infected by packet data including viruses of the virtual sites 180 and 182 received from the system setting unit 220, and the virtual site after the state information and the packet data flows in the normal state. By comparing the state information of (180, 182), it is determined whether the packet data flowing into the virtual site (180, 182) from the external packet network contains a virus.

The information analyzer 240 transmits the determination result to the log storage unit 250 when it is determined that the packet data flowing into the virtual sites 180 and 182 from the external packet network includes a virus.

After receiving the determination result indicating that the packet data contains the virus from the information analyzer 240, the log storage unit 250 determines the log information of the packet data and transmits the virus to the event report unit 260. Send a signal to indicate that it contains.

The event report unit 260 transmits activity, log, and content information of packet data including a virus to the system manager 270.

The system manager 270 checks the activity, the log and the content information of the packet data including the virus, and then sends the warning message for the wireless Internet service including the packet data to the mobile communication terminal 110 by an e-mail or a short message. To be sent).

The pattern generator 280 receives information on packet data including a virus from a system administrator, and then generates a new pattern of packet data including a virus and stores the pattern in the pattern database 230.

3 is a flowchart illustrating a method of providing a virus intrusion detection service according to a preferred embodiment of the present invention.

Intrusion detection server 160 is a virtual site that receives the packet data provided to the wireless Internet service provided to the mobile communication terminal 110 from the external packet network via the gateway packet wireless service support node 150 and the Internet 170. (180, 182) is opened, and the virtual sites 180, 182 are monitored (S310).

The information collection unit 210 of the intrusion detection server 160 collects packet data flowing into the virtual sites 180 and 182 from the external packet network (S320).

The system setting unit 220 and the pattern database 230 of the intrusion detection server 160 process and abbreviate the collected packet data so as to determine an intrusion, that is, whether a virus is included (S330).

The information analyzing unit 240 analyzes the processed and reduced packet data in operation S330 to determine whether the packet data has invaded the virtual site (S340).

If it is determined that the packet data has invaded the virtual site, the log storage unit 250 collects the behavior information of the packet data and leaves the log information (S350).

The event report unit 260 of the intrusion detection server 160 transmits the behavior information and log information of the packet data determined to have invaded the virtual site to the system manager 270, and the system manager 270 is the network manager 190. Notify the vaccine site company 192 and the mobile terminal (S360).

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, by opening and monitoring a virtual site provided with the same packet data corresponding to the wireless Internet service provided to the mobile communication terminal, not only prevents the penetration of known viruses, but also unknown viruses. It is possible to prepare against the penetration of.

Claims (9)

In the system that provides a virus intrusion detection service that opens and monitors a virtual site that receives packet data provided by a wireless Internet service, detects the infiltration of the virus and notifies the network administrator and vaccine site companies, A mobile communication terminal for performing a voice call through wireless communication and receiving the wireless Internet service including financial transactions and homepage management; A wireless network control system, comprising: a wireless network controller controlling a transmission output to the mobile communication terminal, determining a handoff, and operating the wireless network; A network termination device directly connected to the mobile communication terminal, comprising: a base station converting wired / wireless and transmitting / receiving a wireless signal between the mobile communication terminal and the wireless network controller; A system for supporting a General Packet Radio Services (GPRS) service, comprising: a service packet radio service support node for supporting the GPRS service to the mobile communication terminal by interworking with the wireless network controller through an Iu interface; A gateway packet radio service that interworks with an external packet network and interworks with the service packet radio service support node to an IP backbone network through a GN interface to transmit packet data between the mobile communication terminal and the external packet network. Support node; And An intrusion detection server that detects the intrusion of the virus to the virtual site and notifies the network administrator and the vaccine site company. System for providing a virus intrusion detection service comprising a. The method of claim 1, The system for providing the virus intrusion detection service further includes an Internet for providing the packet data from the external packet network to the virtual site through the gateway packet wireless service support node. System. The method of claim 1, And the intrusion detection server detects whether packet data including the virus intrudes into the virtual site from inside the firewall. The method of claim 1, The Iu interface is an interface between the radio network controller and the core network, and the RN interface is an interface between the service packet radio service support node and the gateway packet radio service support node in the same operator network. Providing system. The method of claim 1, wherein the intrusion detection server, An information collector configured to collect information on the activity and contents of the packet data flowing into the virtual site; A system setting unit configured to set state information of a normal system of the virtual site by the intrusion detection server; A pattern database for storing information on activity and contents of packet data including an existing virus; An information analyzer which analyzes information on the activity and contents of the packet data to determine whether the packet data has invaded the virtual site; A log storage unit for storing log information of the packet data when it is determined that the packet data including the virus invades the virtual site; An event report unit for reporting activity, logs, and content information of the packet data determined to have invaded the virtual site to a network administrator; And The pattern generator for generating a new pattern for the activity, log and content information of the packet data determined to invade the virtual site and stores it in the pattern database System for providing a virus intrusion detection service comprising a. The method of claim 5, wherein The information analyzing unit receives the state information of the normal system of the virtual site received from the system setting unit, information on the activity and contents of packet data including the existing virus received from the pattern database, and the information collecting unit. System for providing a virus intrusion detection service characterized in that for analyzing the information on the activity and content of the packet data. The method of claim 5, wherein And the system manager transmits a warning message for the wireless Internet service including the packet data determined to invade the virtual site to the mobile communication terminal. In the method of providing a virus intrusion detection service to open and monitor the virtual site receiving the packet data provided by the wireless Internet service, to detect the intrusion of the virus and to notify the network administrator and vaccine site companies, (a) opening and monitoring the virtual site receiving the packet data from an external packet network providing a wireless Internet service to a mobile communication terminal via a gateway packet wireless service support node and the Internet; (b) collecting the packet data flowing into the virtual site from the external packet network; (c) processing and abbreviating the packet data to determine whether the packet data containing a virus invaded the virtual site; (d) determining whether packet data containing the virus has invaded the virtual site; (e) if it is determined in step (d) that packet data including the virus invades the virtual site, collecting behavior information of the packet data and leaving log information; And (f) informing the network administrator and the vaccine site company of the behavior information and log information of packet data including the virus determined to have invaded the virtual site. Method for providing a virus intrusion detection service comprising a. The method of claim 8, wherein in step (d), The method for providing a virus intrusion detection service, characterized in that the intrusion is determined according to whether or not the packet data contains the virus.

Images