KR20070060441A - Effective intrusion detection device and the method by analyzing traffic patterns - Google Patents

Abstract

An apparatus and a method for detecting a network attack through traffic pattern analysis are provided to efficiently operate a network by actively detecting aggression or an abnormal situation on the network and preventing a network attack previously or coping with an attack act early enough. An apparatus for detecting a network attack through traffic pattern analysis comprises a pattern DB(40), a packet inspection part(10), a packet extraction part(20), a traffic analysis part(30), a traffic countermeasure part(50), and a traffic monitoring part(60). The pattern DB(40) stores abnormal traffic patterns, based on external attacks, and normal traffic patterns. The packet inspection part(10) checks an abnormal symptom of inputted packet flows. The packet extraction part(20) collects packet flows showing an abnormal symptom, and extracts a traffic pattern for the packet flows. The traffic analysis part(30) compares the extracted traffic pattern with traffic patterns stored in the pattern DB(40), and analyzes whether the extracted traffic pattern is by an external attack. The traffic countermeasure part(50), if the extracted traffic pattern is by an external attack, determines a countermeasure for the traffic. In case the extracted traffic pattern is not by an external attack, the traffic monitoring part(60) monitors traffic patterns for a preset time, extracts traffic patterns after the preset time, and transfers them to the traffic analysis part(30).

Description

Effective Intrusion Detection Device and the Method by Analyzing Traffic Patterns}

1 is a block diagram illustrating an apparatus for detecting a network attack by analyzing a traffic pattern according to an embodiment of the present invention.

2 is a structural diagram of a pattern DB according to an embodiment of the present invention.

3 is a flowchart illustrating a network attack detection method by traffic analysis according to an embodiment of the present invention.

4 is a flowchart illustrating a traffic pattern analysis process according to an exemplary embodiment of the present invention.

 Explanation of symbols on the main parts of the drawings

10: packet inspection unit 20: pattern extraction unit

30: traffic analysis unit 40: pattern database (DB)

50: traffic counter 60: traffic monitor

The present invention relates to an attack detection for a network, and in particular, by analyzing a traffic pattern of each flow unit for traffic flowing into the network equipment, early detection and prevention of a network attack is possible by detecting a network attack caused by abnormal traffic. An apparatus and method for detecting network attacks by analyzing traffic patterns, and a computer-readable recording medium having recorded thereon a program for executing the method.

As of 1990, more and more cases of viruses or deliberate intentions approach the network, causing abnormal traffic and causing damage to the network. The research on security is also being actively conducted to cope with this. However, there is no way to prevent such situation early by responding intelligently. Instead, real-time network monitoring is used to identify abnormal traffic occurrences and cope with them.

This situation is unchanged over time, and network protection will be the mainstream research on the early detection and rapid response of abnormal traffic occurrences and the prevention of abnormal traffic of the same type.

Methods for this include a method of performing traffic measurement by applying a flow concept such as NetFlow. In case of intrusion, it increases the network load by generating one packet flow in a short time and paralyzes the network. In this case, if a sudden increase in traffic is detected as a result of real-time monitoring using a device such as NetFlow, This is how you see it.

However, these methods are based on the results obtained by observing the actual traffic, and are often a situation in which a lot of intrusions are already in progress or after being attacked. In order to reduce such damage cases, it is efficient to detect a little bit faster and respond a little bit faster, but little research has been conducted on this.

Accordingly, the present invention has been proposed to solve the above-described problems, a network attack detection apparatus by analyzing a traffic pattern to detect a network attack by abnormal traffic early by analyzing the pattern of the traffic when the traffic flows into the network; The purpose is to provide a method.

In addition, another object of the present invention is to provide an apparatus and method for detecting network attacks that can more accurately identify abnormal traffic through efficient traffic pattern analysis.

Furthermore, another object of the present invention is to provide a computer-readable recording medium having recorded thereon a program for executing the network attack detection method on a computer.

Network attack detection apparatus according to the traffic pattern analysis of the present invention for achieving the above object, Pattern DB for storing a plurality of abnormal traffic patterns and normal traffic patterns by the external attack; A packet inspecting unit which inspects an abnormal signal of an input packet; A pattern extracting unit for collecting a packet having an abnormal indication and extracting a corresponding traffic pattern when an abnormal traffic pattern is found from the packet; A traffic analysis unit comparing the extracted traffic pattern with the traffic pattern stored in the pattern DB and analyzing whether the traffic pattern is a traffic pattern caused by an external attack; In the case of the traffic pattern by the external attack, the traffic counter to determine the countermeasures for the traffic and corresponding to the countermeasure; And a traffic monitoring unit configured to monitor the traffic pattern for a set time, extract a traffic pattern after the set time, and deliver it to the traffic analyzer if no abnormal traffic pattern is found from the packet.

In one embodiment of the present invention, the packet inspection unit checks at least one of the transmission IP address, the port number and the traffic volume of the packet to check for abnormal symptoms.

In one embodiment of the present invention, the traffic correspondence unit discards or blocks the inflow of the packet.

In one embodiment of the present invention, the traffic monitoring unit extracts one of a normal traffic pattern or an abnormal traffic pattern after the set time.

In an embodiment of the present invention, the pattern extractor collects traffic on the port to which the packet is input, investigates an abnormal traffic pattern, and extracts an abnormal traffic pattern if found.

In an embodiment of the present invention, the pattern DB is a traffic port number as a key value, and includes a table including information including a start byte position, an end byte position, a pattern, a state, and a search byte range of traffic. Preferably it includes a first table for storing normal traffic patterns and a second table for storing abnormal traffic patterns.

In one embodiment of the present invention, the traffic analysis unit compares the port number for the extracted traffic pattern and the port number for the abnormal traffic pattern stored in the pattern DB to analyze whether the traffic pattern is a traffic pattern by an external attack do.

In addition, the network attack detection method according to the traffic pattern analysis according to the present invention for achieving the above object, the inspection step of inspecting the abnormal signs of the incoming packet; An extraction step of collecting a packet having an abnormality and extracting a corresponding traffic pattern when an abnormal traffic pattern is found from the packet; An analysis step of analyzing whether the traffic pattern is a traffic pattern caused by an external attack by comparing the extracted traffic pattern with an abnormal traffic pattern stored in a pattern DB; A storage step of storing the traffic pattern as an abnormal traffic pattern caused by an external attack when the traffic pattern is caused by an external attack; And a corresponding step of processing a response to the traffic pattern.

In an embodiment of the present invention, the checking step checks at least one of a transmission IP address, a port number, and a traffic volume of the packet to check for abnormal symptoms.

In an embodiment of the present disclosure, if the abnormal traffic pattern is not found from the packet, the extracting step may include monitoring the traffic pattern for a predetermined time, extracting the traffic pattern after the predetermined time, and delivering the traffic pattern to the traffic analyzer. It may further include.

In an embodiment of the present disclosure, the analyzing step may include a first checking step of checking whether there is a same traffic pattern by comparing the extracted traffic pattern with a normal traffic pattern stored in the pattern DB; If there is no identical pattern, comparing the traffic pattern with an abnormal traffic pattern stored in the pattern DB and checking whether there is the same traffic pattern; And a detailed analysis step of performing detailed analysis by collecting data of the traffic when the same pattern exists as a result of the confirmation of the second verification step.

In an embodiment of the present disclosure, after the analyzing step, if the traffic pattern is not caused by an external attack, the method may further include storing a normal traffic pattern in the pattern DB. In this case, the method may further include determining whether the traffic pattern is a new application pattern and storing the new application pattern in the pattern DB as a new application pattern.

The present invention also provides a computer-readable recording medium having recorded thereon a program for executing the above-described network attack detection method of the present invention.

The present invention provides an apparatus and method for early detection of an attack on a network, and a computer-readable recording medium having recorded thereon a program for executing the method. In particular, the present invention provides an apparatus and method for early detection of an attack on a network by analyzing a pattern of traffic of the packet when the packet flows into an inlet edge router of the network and determining whether the packet is abnormal. do. As such, the present invention uses the pattern of traffic to realize early detection of network attacks. This invention is not an exclusive alternative to real-time traffic monitoring, but at least allows early response by detecting signs of network attack as soon as possible.

In the following, a detailed description of a preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, in the case where it is determined that detailed descriptions of related well-known functions or configurations may unnecessarily obscure the subject matter of the present invention, detailed descriptions thereof will be omitted so as not to obscure the subject matter of the present invention. will be.

1 is a block diagram illustrating an apparatus for detecting a network attack by analyzing a traffic pattern according to a preferred embodiment of the present invention.

Referring to Figure 1, the network attack detection device 100 of the present invention, the packet inspection unit 10, pattern extraction unit 20, traffic analysis unit 30, pattern DB 40, traffic response unit 50 And a traffic monitoring unit 60. The network attack detection apparatus 100 of the present invention having such a configuration is preferably located in the network equipment or in front of the network equipment to detect the traffic for the network attack early on the traffic flowing into the network.

First, the pattern DB 40 stores the traffic pattern. In particular, the pattern DB 40 stores a traffic pattern that has already been discovered or a traffic pattern set by an operator. Preferably, as shown in the example of FIG. 2, the pattern DB 40 may store the normal traffic pattern and the abnormal traffic pattern. Referring to the structural diagram of the pattern DB 40 according to an embodiment of the present invention shown in FIG. 2, the pattern DB 40 includes two types of tables 210 and 220. That is, it includes a normal traffic pattern table 210 for storing a normal traffic pattern and an abnormal traffic pattern table 220 for storing an abnormal traffic pattern. In particular, the abnormal traffic pattern includes an abnormal traffic pattern by an external attack. The key value for the entry of each table is the port number for the corresponding traffic. In this way, the port number is a key value, the start byte position field, the end byte position field of the traffic, the pattern information field of the traffic, the status information field indicating whether the traffic is currently being inspected, and the search byte specifying the range of packets to be searched. It consists of a range field. The pattern DB 40 configured as described above stores various traffic pattern information, and these pieces of information are then compared to determine whether the traffic pattern is for a network attack.

The packet inspection unit 10 inspects the abnormal signs of the packets flowing into the network. In particular, the packet inspecting unit 10 checks at least one of a packet's transmission IP address, a port number, and a traffic amount with respect to an incoming packet and checks for an abnormality. The abnormality indication may be preferably determined using the information of the corresponding packet, and the criterion for determining whether the abnormality is abnormal may be set in advance by the operator.

The pattern extractor 20 collects a packet determined by the packet inspecting unit 10 as a packet having an abnormal indication, and extracts a corresponding traffic pattern when an abnormal traffic pattern is found from the collected packet. The pattern extractor 20 checks a port number to which a packet having an abnormal indication is input, collects packets in a corresponding port, and extracts a corresponding traffic pattern if an abnormal traffic pattern exists in the packet.

The traffic analysis unit 30 compares the traffic pattern extracted by the pattern extraction unit 20 with the traffic pattern stored in the pattern DB 40 and analyzes whether the traffic pattern is a traffic pattern caused by an external attack. In particular, the traffic analysis unit 30 compares the port number for the extracted traffic pattern with the port number for the abnormal traffic pattern stored in the pattern DB and analyzes whether the extracted traffic pattern is a traffic pattern caused by an external attack. . The traffic analyzer 30 first checks whether the same traffic pattern as the extracted traffic pattern exists in the normal traffic pattern table 210 of the pattern DB 40, and if so, determines that the traffic pattern is a normal traffic pattern to network the packet. To send. However, if it does not exist, it is checked whether the same traffic pattern as the extracted traffic pattern exists in the abnormal traffic pattern table 220 of the pattern DB 40. If not, it is determined as a new application pattern and stored. Data about the traffic is collected and detailed analysis thereof is performed.

The traffic response unit 50 determines a countermeasure for the traffic and responds according to the countermeasure when the extracted traffic pattern is a traffic pattern caused by an external attack as a result of the analysis by the traffic analyzer 30. . For example, the traffic response unit 50 may protect the network by discarding or blocking the incoming packet.

The traffic monitoring unit 60 monitors the traffic pattern for a preset time when no abnormal traffic pattern is found from the incoming packet by the pattern extraction unit 20, and the predetermined traffic pattern after the set time elapses. Extract it and transfer it to the traffic analysis unit 30. The traffic monitoring unit 60 has an abnormality in the packet, but if no special traffic pattern is found, the traffic monitoring unit 60 continuously monitors the traffic pattern, and after a predetermined time passes, the traffic monitoring unit 60 determines whether the traffic pattern is normal or abnormal traffic pattern. Extract traffic patterns.

The network attack detection apparatus 100 of the present invention having such a configuration does not rely only on detecting abnormal patterns of traffic by observing the traffic volume of incoming packets, and analyzes these abnormal traffic patterns, and obtains them through the analysis. By using this information, it is possible to prevent network attack in advance.

3 is a flowchart illustrating a network attack detection method by traffic analysis according to an embodiment of the present invention.

Referring to FIG. 3, when a packet arrives into the network (S300), an abnormality indication of the packet is checked (S304). Here, as shown in the figure, when a packet arrives in the network may optionally store the flow of the packet in a temporary table (S302). The abnormal symptom check of the packet preferably checks for at least one of a transmission IP address, a port number, and a traffic volume of the packet to check for abnormal symptoms.

If no abnormality is found as a result of the inspection of the packet, the packet is transmitted to the destination (S308), and if an abnormality is found, it is examined whether an abnormal traffic pattern is found in the packet (S310).

If an abnormal traffic pattern is found as a result of the inspection of the packet, the abnormal traffic pattern is extracted, and the extracted traffic pattern is compared with the abnormal traffic pattern stored in the pattern DB 40 to determine that the extracted traffic pattern is a traffic pattern caused by an external attack. The cognition is analyzed (S312, S314, S316). At this time, the traffic pattern analysis at step S316 determines whether the same or similar traffic pattern as the extracted abnormal traffic pattern exists in the pattern DB 40, and if there is the same or similar traffic pattern, the traffic pattern is traffic by an external attack. Analyze if it is a pattern.

If no abnormal traffic pattern is found, the traffic pattern is continuously monitored in the packet for a set time, and after the set time has elapsed, a predetermined traffic pattern is extracted (S312, S318, S320, and S322).

As a result of the analysis in step S316, if the extracted traffic pattern is an abnormal traffic pattern caused by an external attack, the corresponding traffic pattern is stored in the pattern DB 40, and a response to the traffic pattern is determined, and then the corresponding traffic pattern is processed. (S324,326, S328). The traffic pattern processed as described above is converted into a check completion state (S330). At this time, the traffic pattern is stored in the abnormal traffic pattern table 220 in the pattern DB (40).

On the other hand, as a result of the analysis in step S316, if the extracted traffic pattern is not an abnormal traffic pattern by an external attack, it is determined whether the new application pattern (S331). If the determination result is a new application pattern, the traffic pattern is stored in the normal traffic pattern table 210 in the pattern DB 40 and converted into a check completion state (S336).

4 is a flowchart illustrating a traffic pattern analysis process according to an exemplary embodiment of the present invention.

Referring to FIG. 4, in order to analyze the traffic pattern, the traffic pattern extracted from the packet with the abnormal indication is compared with the normal traffic pattern stored in the normal traffic pattern table 210 in the pattern DB 40 (S400).

In the step S400, if the same traffic pattern as the extracted traffic pattern exists in the normal traffic pattern table 210 (S402), check whether the corresponding traffic pattern is the last traffic pattern (S410), and if not the last traffic pattern The above process is repeated for the pattern. If the same traffic pattern as the extracted traffic pattern does not exist in the normal traffic pattern table 210 (S402), the abnormal traffic pattern stored in the traffic pattern and the abnormal traffic pattern table 220 in the pattern DB 40 again. Is compared (S404).

In step S404, if the same traffic pattern as the extracted traffic pattern exists in the abnormal traffic pattern table 220 (S406), data of the packet is collected and detailed analysis thereof is performed (S408). If the same traffic pattern as the extracted traffic pattern does not exist in the abnormal traffic pattern table 220 (S406), check whether the corresponding traffic pattern is the last traffic pattern (S410). Repeat to run.

In the network attack detection method by traffic analysis according to the present invention, data for traffic analysis is collected and the corresponding traffic pattern is analyzed in detail by comparing the traffic pattern stored in the pattern DB 40 using these data. This checks whether the traffic pattern is a network aggressive traffic pattern. If it is a network aggressive traffic pattern, it is stored in the abnormal traffic pattern table 220 in the pattern DB 40, and an action for abnormal traffic is taken. If it is not the network aggressive traffic pattern, it is checked whether it is a new application pattern, and if it is a new application pattern, it is stored in the normal traffic pattern table 210 in the pattern DB. As described above, the normal traffic pattern and the abnormal traffic pattern stored in the pattern DB 40 are used when analyzing a traffic pattern for a packet newly introduced into the network.

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of a carrier wave (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

In the drawings and specification described above, optimal embodiments of the present invention have been disclosed. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the network attack detection apparatus and method according to the present invention, by detecting aggression or abnormal situation to the network early in a more aggressive manner to prevent the network attack in advance or to respond to the attack early to operate the network more efficiently Can be.

Claims (14)

A pattern DB for storing abnormal traffic patterns and normal traffic patterns due to a plurality of external attacks; A packet inspection unit that checks an abnormal symptom for an input packet flow; A pattern extraction unit for collecting a packet flow having an abnormal symptom and extracting a traffic pattern for the packet flow; A traffic analysis unit comparing the extracted traffic pattern with the traffic pattern stored in the pattern DB and analyzing whether the traffic pattern is a traffic pattern caused by an external attack; In the case of the traffic pattern by the external attack, the traffic counter to determine the countermeasures for the traffic and corresponding to the countermeasure; And A traffic monitoring unit that monitors the traffic pattern for a set time when the traffic pattern is not caused by an external attack, extracts the traffic pattern after the set time, and delivers the traffic pattern to the traffic analyzer; Network attack detection device by traffic pattern analysis, comprising a. The method of claim 1, wherein the packet inspection unit, The network attack detection apparatus according to the traffic pattern analysis, characterized in that for checking at least one of the transmission IP address, the port number and the traffic volume of the packet to check for abnormal symptoms. The method of claim 1, wherein the traffic correspondence unit, Network attack detection device by traffic pattern analysis, characterized in that for discarding or blocking the packet. The method of claim 1, wherein the traffic monitoring unit, Network attack detection apparatus according to the traffic pattern analysis, characterized in that for extracting one of a normal traffic pattern or an abnormal traffic pattern after the set time elapses. The method of claim 1, wherein the pattern extraction unit, Collecting traffic from the packet input port to investigate the abnormal traffic pattern, and extracts it when the abnormal traffic pattern is found. The method of claim 1, wherein the pattern DB, A network attack detection device based on traffic analysis, comprising a table comprising information on the traffic port number as a key value and including a start byte position, an end byte position, a pattern, a state, and a search byte range of the traffic. The method of claim 1, wherein the packet inspection unit, The network attack detection apparatus according to traffic analysis, characterized in that for checking the abnormal symptoms for the initial packets belonging to the flow of the incoming packet. The method of claim 1, wherein the traffic analysis unit, A network attack by analyzing the traffic pattern is characterized by analyzing the port number for the extracted traffic pattern and the port number for the abnormal traffic pattern stored in the pattern DB to analyze whether the traffic pattern is a traffic pattern by an external attack. Detector. A checking step of checking an abnormal symptom of an input packet flow; An extraction step of collecting a packet flow having an abnormal symptom and extracting a traffic pattern for the packet flow; An analysis step of analyzing whether the traffic pattern is a traffic pattern caused by an external attack by comparing the extracted traffic pattern with an abnormal traffic pattern stored in a pattern DB; A storage step of storing the traffic pattern as an abnormal traffic pattern caused by an external attack when the traffic pattern is caused by an external attack; And A corresponding step of processing a correspondence to the traffic pattern; Network attack detection method by traffic pattern analysis comprising a. The method of claim 9, wherein the inspecting step, And detecting at least one of a transmission IP address, a port number, and a traffic volume of the packet to check for an abnormal symptom. The method of claim 9, wherein after the analyzing step, Monitoring the traffic pattern for a preset time when the traffic pattern is not caused by the external attack, and extracting the traffic pattern after the set time has elapsed. The method of claim 9, wherein after the analyzing step, If the traffic pattern is not caused by an external attack, the network attack detection method by traffic pattern analysis, characterized in that it further comprises the step of storing in the pattern DB as a normal traffic pattern. The method of claim 12, Determining whether the traffic pattern is a new application pattern, and if the application pattern is a new application pattern, storing the traffic pattern as a new application pattern in the pattern DB. The method of claim 9, wherein the analyzing step, A first checking step of checking whether there is a same traffic pattern by comparing the extracted traffic pattern with a normal traffic pattern stored in the pattern DB; If there is no identical pattern, comparing the traffic pattern with an abnormal traffic pattern stored in the pattern DB and checking whether there is the same traffic pattern; And A detailed analysis step of performing detailed analysis by collecting data of the traffic when the same pattern exists as a result of the checking of the second checking step; Network attack detection method by traffic pattern analysis comprising a.

Images