KR20070092009A - Apparatus and method of forming statistics data in relation to network security - Google Patents

Abstract

A device and a method for generating statistics information related to network security are provided to secure network stability by generating the statistics information related to the network security after analyzing reception information of network traffic data and enable a user to easily understand the statistics information by generating a report with the statistics information related to the network security. A collecting module collects the network traffic data. A statistics information generating module(110) extracts the reception information from each collected network traffic data and generates the statistics information of the network traffic data based on the extracted reception information. A statistics information database stores the generated statistics information. A report generating module generates the report by using the stored statistics information. A discriminating module discriminates harmful traffic data among the collected network traffic data. The statistics information generating module extracts each kind of reception information from the discriminated harmful traffic data and generates the statistics information of the harmful traffic data based on the extracted reception information.

Description

Apparatus and method of forming statistics data in relation to network security}

1 is a block diagram of a conventional network security system.

2 is a block diagram of an apparatus for generating network security related statistical information applied to the first embodiment according to the present invention.

3A and 3B illustrate the formats of Transmission Control Protocol (TCP) and Internet Protocol (IP) headers.

4 is a flowchart illustrating a method for generating network security related statistical information applied to the first embodiment according to the present invention.

5 is a flowchart illustrating a process of generating and storing statistical information of FIG. 4 in detail.

          <Description of the symbols for the main parts of the drawings>

10,100: Network security system 11: Rule DB

12: management module 13: detection rule DB

14: detection / blocking module 110: statistical information generation module

120: statistical information and reports DB 130: Web server

140: PC

The present invention relates to an apparatus and method for generating network security related statistical information for securing the stability of a network.

1 is a block diagram of a network security system 10 according to the related art.

A rule database (DataBase, hereinafter referred to as 'DB') 11 stores the entire rule. The management module 12 controls the rule selected by the administrator to be stored in the detection rule DB 13 among all the rules stored in the rule DB 11, and detects and blocks by the detection / blocking module 14. Control to start.

The detection / blocking module 14 sequentially reads the rules stored in the detection rule DB 13 and sequentially compares the read rules with the input network traffic data in packet units. A detection operation and network traffic data including a packet matching the read rule are determined as harmful traffic data and blocked.

However, the conventional network security system constructed and operated as described above used network traffic data only for detection and blocking of intrusion.

Therefore, statistical information is required to predict the future intrusion of network traffic data and to secure the stability of the network.

Accordingly, the present invention was created to meet the above requirements, and the apparatus and method for generating network security related statistical information by analyzing received information of network traffic data and generating network security related statistical information to ensure the stability of the network. The purpose is to provide.

In addition, another object of the present invention, the network security related statistical information generating device and method for making it easier to understand the statistical information by further generating a report by using the network security-related statistical information generated by analyzing the received information of the network traffic data To provide.

In accordance with a first aspect of the present invention, there is provided a network security related statistical information generating apparatus comprising: a collecting module for collecting network traffic data; And a statistical information generation module for extracting respective received information from the collected network traffic data and generating statistical information of the network traffic data based on the extracted received information.

Network security related statistical information generating apparatus according to the first embodiment of the present invention, the statistical information DB for storing the generated statistical information; And it may further include a report generating module for generating a report by using the stored statistical information.

The apparatus for generating network security related statistical information according to the first embodiment of the present invention further includes a classification module for classifying harmful traffic data among the collected network traffic data, and the statistical information generating module includes the classified harmful traffic. Each of the received information may be further extracted from the data, and statistical information of the harmful traffic data may be further generated based on the extracted received information.

The statistical information generating module may extract the received information from a TCP (Transmission Control Protocol) and an IP (Internet Protocol) header included in the network traffic data.

The statistical information generation module may extract the received information from a TCP (Transmission Control Protocol) and an IP (Internet Protocol) header included in the harmful traffic data.

The received information may include at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port.

The statistical information accumulates daily, hourly, and minute bit per second (BPS) and packet per second (PPS) information on the received information extracted from the network traffic data. Can be generated.

The statistical information accumulates daily, hourly, and minute bit per second (BPS) and packet per second (PPS) information on the received information extracted from the harmful traffic data. The generated information may further include information in which the number of times of extracting harmful traffic data of each received information by day, time, and minute is sorted.

In addition, the method for generating network security related statistical information according to the first embodiment of the present invention includes a first step of collecting network traffic data; A second step of extracting respective received information from the collected network traffic data; And generating a statistical information of the network traffic data based on the extracted received information.

In addition, the method for generating network security-related statistical information according to the first embodiment of the present invention, the fourth step of storing the generated statistical information; The method may further include generating a report using the stored statistical information.

The first step may further include a lower first step of classifying harmful traffic data among the collected network traffic data, and the second step may further extract respective received information from the classified harmful traffic data, The third step may further generate statistical information of the harmful traffic data based on the extracted received information.

In the second step, the received information may be extracted from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the network traffic data.

In the second step, the received information may be extracted from a Transmission Control Protocol (TCP) and an Internet Protocol (IP) header included in the harmful traffic data.

The received information may include at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port.

The statistical information accumulates daily, hourly, and minute bit per second (BPS) and packet per second (PPS) information on the received information extracted from the network traffic data. Can be generated.

The statistical information accumulates daily, hourly, and minute bit per second (BPS) and packet per second (PPS) information on the received information extracted from the harmful traffic data. The generated information may further include information in which the number of times of extracting harmful traffic data of each received information by day, time, and minute is sorted.

According to the configuration and flow as described above, the apparatus and method for generating network security related statistical information according to the present invention analyzes the received information of network traffic data to generate network security related statistical information, and further, generates the generated statistical information. To generate more reports.

Hereinafter, an apparatus and method for generating network security related statistical information will be described in detail with reference to the accompanying drawings.

FIG. 2 is a block diagram of a network security related statistical information generating apparatus applied to a first embodiment according to the present invention, and FIGS. 3A and 3B illustrate formats of a TCP (Transmission Control Protocol) and an IP (Internet Protocol) header. It is.

In the network security related statistical information generating apparatus applied to the first embodiment according to the present invention, the network security system 100 is received in units of packets (or bits), in addition to the detection and blocking operations for intrusions which have been conventionally performed. Network traffic data is collected and harmful traffic data is distinguished from the collected network traffic data.

In addition, the statistical information generating module 110 receives the received information from the TCP (Transmission Control Protocol) and IP (Internet Protocol) headers included in the network traffic data and the harmful traffic data collected by the network security system 100. Extract. The extracted received information includes at least one or more of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port (see FIGS. 3A and 3B). ).

In addition, the statistical information generating module 110 generates statistical information of network traffic data and harmful traffic data based on the extracted received information.

The statistical information generating process will now be described in detail.

The statistical information generating module 110 accumulates the BPS (Bit Per Second) and PPS (Packet Per Second) information for the extracted reception information by day, hour, minute, and the like. By generating BPS and PPS cumulative information of network traffic data and harmful traffic data, and in particular, sorting the number of times of harmful traffic data extraction by day, time and minute for each received information Generates harmful traffic data extraction frequency sorting information.

After the statistical information of the network traffic data and harmful traffic data is generated as described above, the statistical information generating module 110 reports the generated statistical information (BPS and PPS cumulative information and harmful traffic data extraction frequency sorting information) into statistical information and reports. Stored in the DB (120).

When the report generation is requested from the PC 140, or the web server 130, or every designated report generation period (per day, week, month), the statistical information and After reading the statistical information stored in the report DB 120, using the read statistical information to generate a real-time or daily or weekly or monthly report, the generated report Store the statistical information and the report in the DB (120).

Subsequently, upon requesting a report output (screen or page) from the PC 140 that has undergone the authentication procedure by accessing the web server 130, the web server 130 reads the statistical information and the report stored in the report DB 120. The PC 140 transmits the report to the PC 140 on the screen or the page.

4 is a flowchart illustrating a method for generating network security related statistical information applied to the first embodiment according to the present invention, and FIG. 5 is a flowchart for explaining in detail the process of generating and storing statistical information of FIG. 4.

Hereinafter, the operation of the apparatus for generating network security related statistical information configured as described above will be described in detail with reference to FIGS. 4 and 5.

First, the network security system 100 collects network traffic data received in packet (or bit) units (S401) and classifies harmful traffic data among the collected network traffic data (S402).

Subsequently, the statistical information generating module 110 receives the received information from the TCP (Transmission Control Protocol) and IP (Internet Protocol) headers included in the network traffic data and the harmful traffic data collected by the network security system 100 { A protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol) and a port} are extracted (S403).

The statistical information generating module 110 generates statistical information of network traffic data and harmful traffic data based on the extracted received information, and stores the generated statistical information in the statistical information and the report DB 120 (S404). .

The operation of generating and storing statistical information in the step 404 (S404) will be described in more detail with reference to FIG. 5 as follows.

First, the statistical information generation module 110, the received information (protocol, source IP (Internet Protocol) and port, destination IP (receipt) of the extracted network traffic data and harmful traffic data ( It accumulates BPS (Bit Per Second) and PPS (Packet Per Second) information for each day, hour, and minute for the Internet Protocol) and the port}. In addition, the statistical information generating module 110, for each received information {protocol, source IP (Internet Protocol) and port, destination IP (Internet Protocol) and port} ( Sort the number of times the harmful traffic data is extracted by day, hour, and minute (S404-1).

As such, after the BPS and PPS accumulation information and harmful traffic data extraction frequency sorting information of the network traffic data and harmful traffic data are generated, the statistical information generating module 110 changes every minute (S404-2). For example, the generated minute BPS and PPS accumulated information and harmful traffic data extraction frequency sorting information are stored in the statistical information and the report DB 120 (S404-3).

In addition, the statistical information generating module 110 changes the BPS and PPS accumulated information and harmful traffic data extraction frequency sorting information for each generated time every time the time is changed (YES in S404-4). And it is stored in the report DB (120) (S404-5).

In addition, the statistical information generating module 110 changes the BPS and PPS cumulative information and harmful traffic data extraction frequency sorting information for each generated day every time the day is changed (YES in S404-6). And it is stored in the report DB (120) (S404-7).

In this way, after the statistical information generation and storage operation is completed (Yes in S404-8), the web server 130, whenever a report generation is requested in real time from the PC 140 or a specified report generation period {day For each day, week, month, and the like, and reads the statistical information and the statistical information stored in the report DB 120, and uses the read statistical information in real time or daily. After generating a star or a weekly or monthly report (S405), the generated report is stored in the statistical information and report DB 120 (S406).

Subsequently, upon requesting a report output (screen or page) from the PC 140, which has undergone the authentication procedure by accessing the web server 130 (YES in S407), the web server 130 is connected to the statistical information and the report DB 120. The stored report is read and transmitted to the corresponding PC 140, and the PC 140 outputs the transmitted report on a screen or a page (S408).

As described above, the present invention has been described with reference to the embodiments shown in the drawings, which are merely exemplary, and those of ordinary skill in the art to which the present invention pertains should not depart from the spirit and scope of the present invention. It will be apparent that various modifications, changes and equivalent other embodiments are possible without departing. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the network security related statistical information generating apparatus and method according to the present invention, by analyzing the received information of the network traffic data to generate statistical information to ensure the stability of the network, more systematic real-time network security management is achieved It is a very useful invention.

In addition, the present invention is a very easy invention in consideration of the position of the network security administrator to make it easier to understand the statistical information by generating a report using the generated statistical information.

Claims (18)

A collection module for collecting network traffic data; And And a statistical information generating module for extracting respective received information from the collected network traffic data and generating statistical information of the network traffic data based on the extracted received information. The method of claim 1, Statistical information DB for storing the generated statistical information; And And a report generation module for generating a report using the stored statistical information. The method according to claim 1 or 2, Further comprising a classification module for classifying harmful traffic data from the collected network traffic data, The statistical information generation module, And further extracting respective reception information from the classified harmful traffic data, and further generating statistical information of the harmful traffic data based on the extracted received information. The method of claim 1 or 2, wherein the statistical information generating module, And extracting the received information from a transmission control protocol (TCP) and an internet protocol (IP) header included in the network traffic data. The method of claim 3, wherein the statistical information generating module, And extracting the received information from a transmission control protocol (TCP) and an internet protocol (IP) header included in the harmful traffic data. The method of claim 1 or 2, wherein the received information, Network security related statistical information generating device comprising at least one of a protocol, a source IP (Internet Protocol) and port, a destination IP (Internet Protocol) and port. The method of claim 6, wherein the statistical information, Network security associated with the extracted reception information is generated by accumulating the BPS (Bit Per Second) and PPS (Packet Per Second) information for each day, time, minute Statistical information generating device. The method of claim 3, wherein the received information, Network security related statistical information generating device comprising at least one of a protocol, a source IP (Internet Protocol) and port, a destination IP (Internet Protocol) and port. The method of claim 8, wherein the statistical information, It is information generated by accumulating BPS (Bit Per Second) and PPS (Packet Per Second) information for each day, time, minute, and the like for the extracted received information. And network information related to the number of times of extracting the harmful traffic data by day, time, and minute for each of the received information. First step of collecting network traffic data A second step of extracting respective received information from the collected network traffic data; And And generating a statistical information of the network traffic data based on the extracted received information. The method of claim 10, A fourth step of storing the generated statistical information; And And generating a report using the stored statistical information. The method according to claim 10 or 11, wherein The first step is, Further comprising a lower first step of classifying harmful traffic data among the collected network traffic data, The second step further extracts each received information from the classified harmful traffic data, The third step may further generate statistical information of the harmful traffic data based on the extracted received information. The method of claim 10 or 11, wherein the second step, And extracting the received information from a transmission control protocol (TCP) and an internet protocol (IP) header included in the network traffic data. The method of claim 12, wherein the second step, And extracting the received information from a transmission control protocol (TCP) and an internet protocol (IP) header included in the harmful traffic data. The method of claim 10 or 11, wherein the received information, And at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port. The method of claim 15, wherein the statistical information, Network security associated with the extracted reception information is generated by accumulating the BPS (Bit Per Second) and PPS (Packet Per Second) information for each day, time, minute How to generate statistical information. The method of claim 12, wherein the received information, And at least one of a protocol, a source IP (Internet Protocol) and a port, a destination IP (Internet Protocol), and a port. The method of claim 17, wherein the statistical information, It is information generated by accumulating BPS (Bit Per Second) and PPS (Packet Per Second) information for each day, time, minute, and the like for the extracted received information. Network security related statistical information generation method further comprises the information of the number of times of extracting the harmful traffic data by day, time, minute for each of the received information; .

Images