KR20080076638A - Method of curing computer viruses and patching programs in networked computers using communication control and system for the same - Google Patents

Abstract

A method and a system for curing viruses and patching programs to networked computers based on communication control are provided to cure the viruses in a state preventing the viruses from being transferred to other networked computers by finding the infected computer among the networked computers in an early stage, and interrupting communication of the infected computer when the infected computer is found. A virus detecting module(20) determines virus infection with packets received from networked computers(T1-Tn) by connecting to a switch(10) or a mirroring port for the networked computers, and provides address information of the infected computer to a communication controlling module(30) when the infected computer is found. The communication controlling module blocks communication of the infected computer, supports the communication for curing the infected computer, and releases blocking the communication of the infected computer when a predetermined condition is satisfied. A virus curing module(50) cures the viruses by accessing the infected computer in response to a virus cure request. A patching module(55) upgrades a security level of the computer by installing the latest patch file to the computer requesting the patch file.

Description

TECHNICAL FIELD The present invention relates to a virus control and a patching method based on communication control for networked computer devices,

1 is a block diagram of a system for early detection and removal of viruses in a network composed of a plurality of computers according to a preferred embodiment of the present invention.

2 is a block diagram of a system for early detection and removal of viruses in a network composed of a plurality of computers according to another preferred embodiment of the present invention.

FIG. 3 illustrates a system configuration for early detection and removal of viruses in a network composed of a plurality of computers according to another preferred embodiment of the present invention.

4 is a block diagram of a system for early detection and removal of viruses in a network composed of a plurality of computers according to another preferred embodiment of the present invention.

FIG. 5 is a flow chart illustrating an exemplary procedure for implementing the method for early detection and treatment of viruses in the system of FIG. 1;

FIG. 6 is a flow chart exemplarily showing an execution procedure of a method for early detection and treatment of virus in the system of FIG. 2;

Description of the Related Art [0002]

10: Network switching equipment 20: Virus detection module

30: Communication control module 40: Policy DB module

50: Virus treatment module 55: Patch module

60: gateway (router) 70: external network 80: internal network

T1, T2, ..., Tn: a computer connected to the internal network

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to network protection, and more particularly, to a technology for protecting computer devices connected to a network from malicious programs such as worms and viruses (hereinafter collectively referred to as 'viruses').

Organizations such as corporations, schools, and government offices usually have systems that connect many computer devices over a network. The computer devices may be grouped into a single network or grouped into a plurality of subnets, and then the subnets are grouped into a single network. These networks are connected to the Internet and have connectivity with external computer systems.

This network environment is a very convenient and efficient tool for acquiring and spreading information faster and more widely. However, it makes computer devices more vulnerable to attacks such as worms and viruses, spreads worms and viruses more widely But also the problems that arise. In particular, recent cases of damage caused by worm viruses occur frequently. A worm virus spreads to a large number of computer systems over a short period of time through a network such as the Internet, causing computer systems infected with a worm to turn into a worm attack machine, causing a huge amount of network traffic. This causes serious damage to the computer system, such as failure to perform normal service.

A worm is a self-copying computer program similar to a computer virus. Viruses become part of other executable programs themselves, but they do not have to be part of another program to be included in itself and to deliver itself. Worms generate large amounts of network traffic on a large number of computers, causing damage to vulnerable computer systems on the Internet, as well as causing Denial of Service (DOS) attacks on the network, resulting in significant economic losses. In addition, if a worm-infected computer system is connected to an internal network, such as a company, via a wired LAN, wireless LAN, VPN, dial-up network, or other means, The attack will cause serious harm to the internal network of the company. Therefore, on the network operating side, strong countermeasures are needed not only for the virus attacking the information stored in the computer itself or the computer, but also for the worm attacking the network.

A recent countermeasure against a worm is Korean Patent Laid-Open Publication No. 10-2006-0116741 entitled "Method and apparatus for identifying and disabling a worm in a communication network". According to this method, the worm probe tracks packets with destination unreachable errors based on their respective source IP addresses, so that the number of errors is reduced to a predefined local threshold value, for example within a predefined local time period of the worm probe When exceeded, the number of such errors and the source IP address are sent as alerts in the network to all other worm probes, and if the number of such errors exceeds a predefined network threshold, for example within a predefined global time, And blocks traffic from the endpoint having the identified source IP address to prevent the endpoint device from further spreading the worms. However, this method does not provide a measure against worms being transferred to other devices of the network when a specific device in a network is infected with the worm.

An example of prior art known as countermeasures against viruses in the network is Korean Patent Registration No. 10-0468372 entitled " Network Transfer Virus Detection and Blocking Device and Method Thereof Using Smb / cifs Monitoring ". In this patent, a device for detecting and blocking viruses is installed for each Pc, and a virus checker examines a packet that is connected to the smb / cifs from a driver terminal that is connected to the pc, and the packet is detected as a virus , It saves the source IP / MAC information connected to the PC by smb / cifs and blocks the data packet coming into the source IP / MAC. However, this method is not only troublesome to install the blocking device on each PC, but also upgrading the vaccine programs installed in each PC to the latest version can effectively block the risk factors. In addition, this method has a limitation that it only blocks packets coming into the packet smb / cifs of virus infected PC coming to the PC.

The important thing about worm or virus countermeasures is to minimize damage by discovery of infections or infiltration early and disabling them quickly. In particular, it takes some time from the discovery of the infected fact to the treatment of the infected worm or virus, which must be accompanied by measures to minimize the damage by preventing the worm or virus from being transferred to other computer devices in the network .

On the other hand, patches of related programs are continuously provided to compensate for weaknesses of computer devices such as worms and viruses. When such a patch program becomes new, it needs to be installed quickly on computer devices within the network. If the patch is installed late, it may be attacked because it is vulnerable to viruses and security. If the user of the computer device or the network operator can not install the patch program properly, it is necessary to force the installation of the patch. In particular, when a new computer apparatus is added to a network, the apparatus is vulnerable to viruses, security, and the like, so that at least a patch level required by the network needs to be installed quickly.

In view of the above-described needs, the present invention provides a computer program for detecting early detection of a worm or a virus infection of computer devices in a network, blocking communication of the infected computer device when detecting an infected computer device, And to provide a method for treating a virus, which can take a therapeutic action while preventing the virus from spreading.

The present invention also monitors in real time whether or not a patch for computer devices in the network is required to be installed. If a computer apparatus requiring installation of a patch is found, So that a patch can be received.

The present invention further aims to provide a system for carrying out the above methods.

In the present invention, a network to which a plurality of computer devices are connected is referred to as a worm or a virus (hereinafter referred to as "virus", collectively referred to as "worm" and "virus" Provide a way to protect. This method monitors in real time what computer devices in the network are infected with the virus. If a computer device infected with a virus is detected during such monitoring, it immediately blocks the infected computer device and isolates it from other computer devices in the network. However, only limited communication is allowed if necessary for virus treatment. The infected computer is taken care of by the infection control computer. And when the predetermined condition such as the completion of the treatment of the infected virus, the elapse of the preset time, etc. is met, the communication interruption to the infected computer device is released.

According to a preferred aspect of the present invention, monitoring packets sent by computer devices in a network to analyze whether the computer devices are infected with viruses or install patches; If the analysis results in the detection of a computer device infected with a virus or a computer device that requires the installation of a patch, installation of that infected computer device or patch is required, except for the treatment of the virus or for patch installation Blocking communications of the computer device; And a step of ensuring communication between the virus-infected computer device and the virus treatment means or patch means so that the virus treatment means or the patch means installs the virus treatment or the patch file on the virus-infected computer apparatus A communication control based virus treatment / patching method for networked computer devices is provided.

In order to block communication of a virus-infected computer device or a computer device that requires patch installation, the above-described method may be configured such that the MAC address of the other computer devices and the gateway in the network is changed to a MAC address other than the original MAC address And unicast the ARP packet manipulated by the MAC address of the virus-infected computer device or the patch-installed computer device. In addition, the method may further include a step in which the communication control device includes a MAC address of a computer device that requires the virus-infected computer device or patch installation to be manipulated to a MAC address other than the original MAC address, for example, the MAC address of the communication control means And unicast the ARP packet to the other computer devices and the gateway in the network. Further, in the method, when the communication control unit receives the request message for communication from the computer apparatus requiring the virus-infected computer apparatus or the patch installation, the communication control unit transmits the request message to the virus treatment unit or the patch unit, And controlling to perform a procedure for virus treatment or patch installation while communicating with the virus-infected computer device through the communication control means or directly. Furthermore, the method may further comprise the steps of: i) when the virus has been treated to the virus-infected computer device, ii) when a predetermined time has elapsed since the start of treatment of the virus, and iii) ) The manager is instructed to cancel the communication interruption, and if the condition such as the case where the administrator instructs the cancellation of the communication interruption is satisfied, The method further includes the steps of: broadcasting in the network an ARP packet in which the communication control means manipulates the MAC address of the virus-infected computer device to the MAC address of the communication control means; And providing the ARP packet in which the MAC addresses of the devices are manipulated with the MAC address of the communication control means by 'unicasting' method. In the above method, an object to be analyzed as to whether or not a virus is infected or installed in a patch is analyzed may be at least one of a packet to be exported through a gateway of the network and a packet to be exchanged between computer devices in the network We can branch.

According to a preferred embodiment of the present invention, there is provided a communication control based virus treatment / patching method for a computer device in which a plurality of computer devices are connected to a network via a switching device, A first step of analyzing whether or not the computer devices are infected with virus by receiving a communication packet in real time via the switching device; A virus detecting means for detecting a virus infected computer device as a result of the analysis and providing at least an IP address and a MAC address of the virus infected computer device to the communication control means; And the communication control means operates the ARP table of the virus infected computer by providing an ARP packet manipulating the MAC address of the gateway with the MAC address of the other computer devices in the network to the virus infected computer device, A third step of causing a communication packet sent by the computer device to be transmitted only to the communication control means; And a fourth step in which the virus treatment means performs a virus treatment on the virus-infected computer apparatus. The computer-based virus treatment / patching method for network-connected computer devices is provided.

The method further comprises the step of providing an ARP packet in which the communication control means has operated the MAC address of the virus infected computer device to a MAC address other than the original MAC address for each of the other computer devices in the network, And blocking the communication between the other computer devices in both directions. In addition, the method may further comprise, between the second step and the third step, an ARP packet in which the communication control means has manipulated the MAC address of the virus-infected computer device to the MAC address of the communication control means in the network Further comprising the step of broadcasting.

The method further includes the step of, when the communication control means receives the request message for communication from the computer apparatus requiring the virus-infected computer apparatus or the patch installation, transmits the request message to the virus treatment means or the patch means, And performing a procedure for virus treatment or patch installation while communicating with the virus-infected computer device through the communication control means or directly. In this case, when the communication control unit receives the communication packet transmitted from the virus-infected computer device after performing the third step to perform the fourth step, To perform virus treatment or patch installation for the virus-infected computer apparatus.

In the above method, when the virus treatment means is present in the network, the execution of the virus treatment comprises i) the virus treatment means provides a page for requesting a virus treatment to the virus-infected computer apparatus; ii) sending the virus treatment request message to the virus treatment means by the virus-infected computer device; iii) According to the request for treatment, it is preferable that the virus treatment means performs virus treatment on the infected computer apparatus. In addition, when the virus remedy exists outside the network, the virus remedy may be performed in response to a request packet sent by the virus-infected computer device, Providing a page for the user; ii) when the virus-infected computer device sends the virus-care-request message, the communication control means receives the treatment-request message and relays the message to the virus-treatment means; And iii) in response to the request for treatment, the virus treatment means performs virus treatment on the virus-infected computer apparatus.

Furthermore, the method may further include a patch step of analyzing a necessity of installing a security patch of the computer devices and installing a security patch on a computer apparatus that requires installation. Wherein the patching step comprises the steps of: i) detecting patches connected in-line with the switching equipment in real time via the switching equipment in real time to send packets to the outside of the network, ≪ / RTI > ii) the patch detection means includes at least providing an IP address and a MAC address of the computer equipment requiring installation of the patch to the communication control means; The communication control means blocking communication by a method similar to the communication blocking method taken for the virus infected computer to a computer apparatus requiring installation of a patch; And a step of relaying the request to the patching means when the apparatus requiring the patch installation issues a patch request, and the communication control means receives the request and relays the request to the patching means.

According to another aspect of the present invention, there is provided a system in which a plurality of computer devices are connected via a switching device to form a network, the system being connected inline with the switching device at a position outside the network, The computer devices are connected to a mirroring port of the ports of the plurality of computer devices to analyze whether the computer devices are infected with viruses using the packets sent by the plurality of computer devices, Virus detection means for providing at least the address information of the computer device to the communication control means described below; And a switching device connected to the switching device, wherein when the virus detecting means informs the address information of the computer device infected with the virus, communication of the infected computer device is blocked except for the treatment of the virus, And communication control means for supporting communication for virus treatment of the computer device and canceling communication interruption of the virus infected computer device when a predetermined condition is satisfied, A communication control based virus treatment / patching system is provided.

Wherein the system is directly connected to the switching computer apparatus or is located outside the network and comprises a virus treatment means for accessing the virus infected computer apparatus in response to a virus treatment request to perform virus treatment for the infected computer apparatus .

The system may also be connected in-line with the switching equipment at a location out of the network or connected to a mirroring port for a port of the plurality of computer devices provided in the switching equipment, Patch detection means for analyzing whether or not the computer apparatuses need to install a patch using one of the packets and providing at least the address information of the computer apparatus to the communication control means when a computer apparatus requiring installation of the patch is found; And installing a latest patch file for the computer device which is directly connected to the switching equipment or which is located outside the network and which requests installation of a computer device or patch detected as requiring installation of the patch, And the communication control means preferably supports communication for installing the patch.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

First, FIG. 1 shows a configuration of a system according to a preferred embodiment of the present invention. This system is a system in which a plurality of computer devices T1, T2, T3, ..., Tn are connected to one network 80 through the switching equipment 10, and includes a virus detection module 20, (30), a policy DB (40), and the like.

The virus detection module 20 is connected in-line with the switching device 10 at a position of a path that goes out through the gateway 60 from the internal network 80. [ The path position of the network 80 is determined by the fact that the packets sent by the computer devices T1, T2, T3, ..., Tn in the internal network 80 to the outside of the network 80 through the gateway 60 , The virus detection module 20 can receive all the packets going out of the network 80.

In contrast, the communication control module 30 is connected to the switching equipment 10 so as to be at the same level as the computer devices T1, T2, T3, ..., Tn in the network. The computer devices T1, T2, T3, ..., Tn cover not only personal computers (PCs) but also various devices widely connected to the network. It also includes devices connected wirelessly as well as wired to the network. The switching equipment 10 is connected to the external network 70 through the gateway 60. [ The gateway 60 may be implemented with equipment such as a router, for example. The virus remediation module 50 is located outside the network. May be located at a location that can be connected through the external network 70, or may simply be external to the internal network 80. The external network 70 may be, for example, the Internet or another network in the organization.

The communication control module 30 has a policy DB 40, which is a database defining a communication control policy. When the virus detection module 20 or the patch detection module 22 receives a report that a computer device infected with a virus is detected in the internal network 80 or a computer device requiring installation of a patch is detected in the policy DB 40 , Communication control policies for computer devices (T1, T2, ..., Tn) in the network to be applied to control the diffusion of viruses and effective treatment, installation of patches, and the like.

Other network devices such as a firewall (not shown) may be disposed between the switching device 10 and the gateway 60 as well as the illustrated system, but only the equipment related to the present invention will be shown in this figure.

The virus detection module 20 detects whether the devices of the internal network 80 are infected with a virus and notifies the communication control module 30 of the detection. That is, it is a module having a function of detecting a violation of the security policy related to the operation of the network such as a computer apparatus infected with various viruses, an apparatus abnormally accessing the network, and notifying the detection result to the communication control module 30 .

The patch detection module 22 is a module having a function of detecting a computer device that has not installed the latest security patch among the computer devices of the internal network 80 and informing the communication control module 30 of the detection result.

The communication control module 30 interrupts the communication with the other computer devices in the network 80 by the virus detection module 20 or the patch detection module 22 to detect the virus infection Thereby maintaining optimal network conditions. In addition, a computer that requires the installation of the virus-infected computer or patch may be allowed to communicate only with the virus-handling module 50 or the patch module 55, or the virus-infected computer or the patch- Respectively. Further, when the predetermined condition is satisfied, the communication block which has been taken before is canceled, so that the corresponding computer device can communicate normally using the network. The predetermined condition may be, for example, when the virus is treated or patch installation is completed, a predetermined time has elapsed, an instruction from the network operator is given, or the like.

The policy DB 40 stores a communication control policy to be applied when a virus infected computer device, a computer device not equipped with the latest security patch, and an abnormal network access device occur. The network control operator may prepare the communication control policy in advance. The policy DB 40 also stores information related to the detection of a virus infected computer device, information on a virus treatment result for the infected computer device, information on a computer device requiring patch installation, and information on a patch installation result For example, in the form of log information. The communication control policy defined in the policy DB 40 is referred to by the communication control module 30. [ That is, the communication control policy in the policy DB 40 obtains instructions on the communication control to be applied in connection with the virus treatment or patch installation.

The virus module 50 is a module for removing a virus by treating a computer device infected with a virus, and the patch module 55 is a module for updating the latest computer device It installs a patch file and upgrades the security level of the computer device. The virus remedy module 50 and the patch module 55 are not particularly newly proposed in the present invention, but can be selected from among the known and anticipated virus remediation systems and patch systems.

FIG. 5 is a flowchart exemplarily showing execution procedures of a virus detection and treatment method in the system of FIG. 1; 1 and 5, the method for detecting and treating viruses according to the present invention will be described in detail.

In the system of Fig. 1, the packets sent by the computer devices T1, T2, ..., Tn in the network are always delivered to the destination via the switching equipment 10. [ A packet whose destination is outside the network is transmitted to the outside of the network through the backbone via the switching equipment 10 and is also transmitted to the virus detection module 20 installed in line with the switching equipment 10 in the process. The virus detection module 20 analyzes the packet transmitted from the switching device 10 and analyzes whether the sending computer of the packet is infected with the virus. The present invention does not propose a new method for analyzing whether a virus is infected. There are no particular limitations on the known analytical methods or analytical methods to be known in the future, which are adopted as a part of the present invention. Herein, a detailed description of a method of analyzing whether or not the virus is infected will be omitted.

If the virus detection module 20 determines that the packet is infected with a virus as a result of analysis of the received packet, the virus detection module 20 immediately notifies the communication control module 30 of the fact. At this time, the information informing the communication control module 30 includes at least the IP address and the MAC address of the computer device infected with the virus. In addition to this address information, you may be able to provide more virus scan results, such as the name of an infected virus. In the figure, the computer apparatus T1 is an abnormal apparatus infected with a virus and the remaining computer apparatuses T2, T3, ..., Tn are assumed to be normal apparatuses not infected with viruses.

Similarly to the virus detection module 20, the patch detection module 22 analyzes the packets transmitted from the switching device 10 and checks whether the sending computer device has installed the latest patch file. If the latest patch file is not installed, the communication control module 30 notifies the computer device of the fact that the patch file is an object of installation of the patch file, together with the address information (i.e., the IP address and the MAC address) of the computer device.

The communication control module 30 immediately determines a communication control policy for a virus-infected computer (T1) or a computer required to install a patch, which is notified by the virus detection module 20, and performs communication control accordingly. Which communication control policy is to be applied is determined by referring to contents defined in the policy DB 40. [ The communication control policy that should be applied to the virus infected computers and the patch target computers is basically to quickly block the communication between the computers and the other devices in the network to prevent the virus from being transferred to the other computers, Related attacks from the attacker. However, if the communication of the internal network 80 is completely blocked, the virus can not be treated or the patch file can not be installed. Therefore, it is necessary to allow restricted communication in a controlled state so that virus treatment or patch file can be installed. In a limited communication allowance, the communication control rules may be slightly different depending on the location and treatment method of various devices related to the detection and treatment of viruses.

When the fact that a computer T1 in the network 80 is infected with a virus is detected by the virus detection module 20, the virus is transferred from the infected computer T1 to other computer devices T2, T3, ... , Tn) in order to prevent the transition. The communication control module 30 is a module for allowing a virus infected computer (T1) to transmit data to a computer (not shown), except for a device that permits communication (that is, a device for allowing virus treatment or patch file installation, To block communication between the virus infected computer (T1) and other computer devices (T2, T3, ..., Tn) in the network so that it can not communicate with other devices.

One way to do this is to block communication so that the virus infected computer T1 can not communicate with other computer devices T2, T3, ..., Tn or the gateway 60 of the network. That is, the communication control module 30 receives address information of other computer devices T2, T3, ..., Tn in the network connected to the switching equipment 10 and the gateway (e.g., the Ethernet port of the gateway 60) (MAC address of the communication control module 30) to an address other than the original address (for example, the MAC address of the communication control module 30), and provides the unicast to the virus infected computer T1. Accordingly, the content of the ARP table of the virus infected computer (T1) is also manipulated to the address of the received ARP packet. Therefore, after that, the infected computer (T1) communicates according to the address of the manipulated ARP table. As a result, the virus-infected computer T1 is transmitted to the address where the packet sent by the virus-infected computer T1 is wrong, that is, the address of the communication control module 30 (for example, the communication control module).

Table 1 below shows the ARP table of the virus infected computer (T1) having the normal address information before the communication control module 30 operates the address. Table 2 shows the ARP table of the communication control module 30 (T1) is the ARP table of the infected computer (T1). The MAC address of another computer (T2, T3, ..., Tn) in the network and the MAC address of the gateway are stored in the MAC address of the communication control module 30 (MAC- 30 ') to unicast the virus-infected computer (T1).

[Table 1] The ARP table (IP address / MAC address of the computer devices of the network is normal information) possessed by the virus infected computer (T1)

equipment IP address MAC address T2 IP-B MAC-B T3 IP-C MAC-C ... ... ... Tn IP-n MAC-n  The gateway 60, IP-x MAC-x The communication control module (30) IP-30 MAC-30

[Table 2] The ARP table (the IP address / MAC address of the other computer devices in the network is the malfunction information which is manipulated) held by the virus infected computer (T1)

equipment IP address MAC address T2 IP-B MAC-30 T3 IP-C MAC-30 ... ... ... Tn IP-n MAC-30  The gateway 60, IP-x MAC-30 The communication control module (30) IP-30 MAC-30

As shown in Table 2, after receiving the ARP packet including the manipulated address from the communication control module 30, the infected computer T1 transmits the MAC address of all the other computer devices in the network 80 to the communication control module ("MAC-30") operated by the control unit 30. A packet sent by the virus infected computer T1 to a destination outside the network 80 via the other computer devices T2, T3, ..., Tn in the network or the gateway 60 is always transmitted to the communication control module 30, Only. When the communication control module 30 receives a packet transmitted by the virus infected computer T1 to the other computer devices T2, T3, ..., Tn in the network or the gateway 60, The virus infected computer T1 is blocked from communicating with other computer devices T2, T3, ..., Tn in the network or outside the network 80. [ Also, the communication control module 30 reports the address of the packet received from the virus infected computer (T1) and can know that it is a packet sent by the virus infected device. The communication control module 30 may not receive the packet transmitted from the virus infected device and may not be affected by the virus if the packet is immediately discarded without copying the packet to the internal memory. Therefore, it is inherently blocked that the virus on the virus infected computer (T1) is transferred to another computer apparatus (T2, T3, ..., Tn) or network outside the network (80).

Another way to block communication between a virus infected computer T1 and other computer devices T2, T3, ..., Tn in the network is bidirectional blocking. Only manipulating the address of the ARP table of the infected computer T1 can only block communications from the infected computer T1 to other devices in the network (i.e., 'one-way blocking'), It does not prevent the devices T2, T3, ..., Tn and the gateway 60 from delivering packets to the infected computer T1. However, when the address information of the ARP table is normally recovered from the virus infected computer (T1) in the course of communication between the computer devices (T2, T3, ..., Tn) and the gateway (60) May also occur. Then the communication blocking action taken on the virus-infected computer (T1) can be solved. The computer devices T2, T3, ..., Tn and the gateway 60 also send a packet to the virus infected computer T1 in order to prevent such a situation, To be transmitted. That is, it is necessary to force a 'two-way communication blocking' between the virus infected computer T1 and other computer devices T2, T3,..., Tn and the gateway in the network.

As one method of implementing bidirectional communication blocking, when the communication control module 30 determines that the MAC address of the virus infected computer T1 is different for each of the computer devices T2, T3, ..., Tn and the gateway 60 And a method of unicasting an ARP packet manipulated by a MAC address. Of course, as described above, this method unicasts the manipulated MAC addresses of other devices in the network to the virus infected computer (T1), and operates the ARP table of the infected computer (T1) as shown in Table 2 . Table 3 below shows an example of the ARP table that the communication control module 30 holds after the computer terminal T2 operates the MAC address of the virus infected computer T1 with respect to the computer device T2 . According to the IP address / MAC address information of the computer devices in the network recorded in the ARP table, the MAC address of the virus infected computer T1 is manipulated by the MAC address (MAC-30) of the communication control module 30 , And the MAC addresses of the remaining devices (T3, ..., Tn) and the gateway 60 are still maintained at the original address. And manipulates the ARP table of the remaining computer devices T3, ..., Tn in the same manner. After the address operation, for example, a packet transmitted from the computer T2 to the infected computer T1 is transmitted to the communication control module 30 whose MAC address is 'MAC-30'. As a result, communication between the infected computer T1 and the computer T2 is interrupted in both directions. In the case of the gateway 60, if the ARP table is manipulated as described above, it may be troublesome to communicate with the computer T1 for virus treatment through the communication control module 30. To avoid such a hassle, the ARP table of the gateway 60 may not be manipulated. In this case, the virus remediation module 50 or the patch module 55 located outside the network 80 may directly access the virus infected computer T1 to perform virus remediation or patch installation.

[Table 3] ARP table of computer T2 (after MAC address manipulation of virus infected computer (T1))

equipment IP address MAC address T1 IP-A MAC-30 T3 IP-C MAC-C ... ... ... Tn IP-n MAC-n The gateway 60, IP-x MAC-x The communication control module (30) IP-30 MAC-30

Other methods of intercepting the above two-way communication may be modified and implemented as follows. That is, the communication control module 30 broadcasts an ARP packet obtained by manipulating the MAC address ("MAC-1") of the infected computer T1 to the MAC address ("MAC-30" T2, ..., Tn, 60 in the network 80 to the MAC of the communication control module 30 for the virus infected computer T1 in parallel with the ' ("MAC-30") is provided in a "unicasting" manner. Of course, this method may not operate or operate the ARP table of the gateway 60 as described above. This method is the same as the above-described ARP table operation method in the content of the ARP table of each equipment obtained as a result of the operation.

After the virus-infected computer (T1) is isolated from the network (80) by blocking the communication with the virus-infected computer (T1) in one way or both directions in the same manner as described above, Perform a clean or patch file installation. The treatment of the virus or the installation of the patch file is different from the procedure and consideration of where the equipment for it is located, i.e., either inside or outside the network 80.

Virus treatment can be implemented in several ways. The infected computer T1 may be connected to other equipments T2, T3, ..., Tn or the gateway 60 in the network, The packet sent for communication is always transmitted to the communication control device 30, and the virus control can be controlled by utilizing this point.

One way to treat viruses is when a virus infected computer (T1) sends a request to communicate with another device (for example, when sending a request to a specific URL by opening a web browser to use the Internet) In response to a request, the first step on the virus-infected computer (T1) screen is to become a web page for virus treatment requests. According to this method, when the ARP table of the infected computer (T1) is manipulated, the request message sent by the infected computer (T1) is always transmitted to the communication control module (30) Message to the virus treatment module 50 as a virus treatment request message of the infected computer (T1). In response to such a request for treatment message, the virus remediation module 50 proceeds to provide the infected computer T1 with a web page necessary for proceeding to the virus remediation procedure. Through this process, the virus remediation module 50 can perform the virus remedy against the infected computer T1.

As another method for virus treatment, the communication control module 30 generates a 'virus treatment request page' as a response to the request message of the virus infected computer T1 and returns the generated page to the virus infected computer T1. The page includes, for example, a fact that a virus-infected computer (T1) is infected with a virus, a notice of the necessity of performing a virus treatment, and a button for requesting to perform a virus treatment. The page is displayed on the screen by the browser on the infected computer (T1). The user of the infected computer (T1) requests virus treatment by clicking the treatment request button displayed on the page. When the virus remedy request button is clicked on the infected computer (T1), the treatment request is transmitted to the communication control module (30). The communication control module 30 transfers the request for the treatment of the infected computer T1 to the virus treatment module 50. [ The delivery method of the request for treatment may be a method such as redirect or packet forwarding. The virus treatment request of the virus-infected computer (T1) is transmitted to the virus remediation module (50) by the communication control module (30) serving as a messenger in the middle.

The virus remediation module 50 that received the virus remedy request performs a virus remedy against the virus infected computer (T1). The virus treatment method can be appropriately adopted from known methods or newly proposed methods in the future, or a combination thereof can be used. The present invention does not particularly propose a new method for treating a virus. The virus infected computer T1 is communicated to the virus remediation module 50 through the relay of the communication control module 30 when communicating between the virus remedy module 50 and the virus infected computer T1 in the process of performing the virus remedy The virus remedy module 50 can directly communicate with the virus infected computer T1 without the intermediary process (when there is no operation on the ARP table of the gateway 60) . Of course, when the MAC address of the infected computer (T1) is manipulated by the MAC address of the communication control module (30) in the ARP table of the gateway (60), the virus remediation module (50) Lt; RTI ID = 0.0 > T1. ≪ / RTI >

It is preferable that the communication interruption to the virus infected computer (T1) is released when the virus treatment is completed. It is necessary to notify the fact to the communication control module 30 when the treatment is completed. One way of letting the communication control module 30 know that virus treatment has been completed is to install an agent program having a function of detecting completion of virus treatment on a virus infected computer T1. When the virus treatment for the virus-infected computer (T1) is completed, the agent program reports the completion of the virus treatment to the virus treatment module (50). However, since the report is transmitted to the virus treatment module 50 through the communication control module 30, the communication control module 30 also knows the completion of the virus treatment.

When the communication control module 30 receives the completion report of the virus treatment, it takes measures to cancel the communication interruption that the virus infected computer T1 has taken. Even if the conditions other than the completion of the treatment of the virus are satisfied, it is also possible to take measures to cancel the communication interruption. If the communication blocking module 30 does not provide a device that allows the user to know whether virus treatment has been completed (i.e., an agent program having a function completion detection function), it is necessary to cancel the communication blocking under different conditions. For example, this can be an example of a case where a predetermined time has elapsed after the communication is interrupted, or when the network operator instructs the cancellation of the communication interruption can be canceled.

 The disconnection of communication can be resumed by restoring the operation of the IP address / MAC address that was taken for the communication interruption. That is, the IP address / MAC address information recorded in the ARP table of the virus infected computer (T1) is changed from the contents of Table 2 to the contents of Table 1. To this end, the communication control module 30 sends an ARP packet containing the correct IP address / MAC address information of the other computers T2, T3, ..., Tn in the network 80 and the gateway 60, Unicast to the computer T1. As a result, the ARP table of the infected computer (T1) is restored to the IP address / MAC address information of Table 1, and after that, the infected computer (T1) performs communication based on the restored address information normally. And can normally communicate with the external network through the computers T2, T3, ..., Tn or the gateway 60. [

If the ARP table of the other computers T2, T3, ..., Tn and the gateway 60 in the network 80 is set to the communication control module 30 ) MAC addresses, you should also take action to restore these devices. To this end, the communication control module 30 creates an ARP packet containing the correct IP address / MAC address of the virus infected computer T1 and transmits it to the other computers T2, T3, ..., Tn in the network 80 Gateway 80, respectively. Thus, the other computers T2, T3, ..., Tn and the gateway 60 in the network can communicate directly with the virus infected computer T1.

Although the virus infection has been described above as an example, the same procedure is followed when patch files are installed in the computers in the network 80. [ That is, when the patch detection module 22 connected in-line with the switching equipment 10 receives a packet transmitted to the outside of the network 80 through the switching equipment 10 and the gateway 60, If a computer T1 that requires installation of a security patch is detected, the computer T1 is analyzed to determine whether a patch is needed. Since the computer T1 is vulnerable to virus infiltration, Take it first. Then, a patch file for the computer T1 is installed, and then a procedure for canceling the communication blocking action is performed. More specifically, the description related to the virus infection can be referred to, so that a detailed description thereof will be omitted.

On the other hand, FIG. 2 shows a system according to another embodiment. The system of FIG. 1 is in a position where the virus treatment module 50 and the patch module 55 can be connected outside the network, that is, via the external network 70, And the patch module 55 are directly connected to the switching equipment 10 and are present inside the network 80. [ In this configuration, the virus cure module 50 and the patch module 55 also need to be treated as equipment connected to the network.

FIG. 6 is a flow chart exemplarily showing an execution procedure of a method for early detection and treatment of virus in the system of FIG. 2; And the difference in comparison with FIG. 5 will be mainly described. The virus detection module 20 not only notifies the virus control module 30 as well as the virus control module 50 that the virus infection module 50 is located in the network 80, It is preferable to directly inform the address information (IP address / MAC address) of the computer T1 and the inspection result. After this notification, the communication control module 30 must take measures to block the communication with the virus-infected computer (T1). An ARP packet whose MAC address has been manipulated is used to block the virus infected computer T1 from blocking communication with the other computer devices T2, T3, ..., Tn and the gateway 60 in the network 80 Manipulating the ARP table (one-way communication blocking and two-way communication blocking) may be performed in the same manner as described above.

After the communication for the virus infected computer T1 is blocked, the virus remedy module 50 may perform the virus remedy while communicating with the virus infected computer T1 using the relay action of the communication control module 30 , It is common that the virus itself is equipped with a safety measure from the virus, so that virus treatment can be performed while directly communicating with the virus infection apparatus (T1). In this case, there is no need to interrupt communication between the virus cure module 50 and the virus infection equipment T1. This also applies to the patch module 50.

After action is taken to block the communication, virus treatment is performed, which can be done in two ways. One is a pulling method in which, when a virus infected computer (T1) makes a request for treatment to the virus treatment module (50), the virus treatment module (50) responds to it and performs treatment of the virus. According to this method, the virus remediation module 50 receives the virus detection result and the address information (IP address / MAC address) of the infected computer T1 from the virus detection module 20 and, based on the received information, Creates a page for requesting treatment and provides it to the infected computer (T1). The treatment page includes, for example, a fact that a virus-infected computer (T1) is infected with a virus and that a virus treatment needs to be performed, and a button for requesting to perform a virus treatment, as mentioned above. The user of the virus infected computer (T1) requests virus treatment by clicking the button, and the request is directly transmitted to the virus treatment module (50). The virus treatment module 50 performs virus treatment in response to the request. After the virus treatment is started, if the predetermined condition is satisfied, the communication interruption to the virus infected computer (T1) is canceled. For example, when the virus treatment is completed, the agent program previously installed in the virus-infected computer (T1) reports the completion of the virus treatment to the virus treatment module (50) and the communication control module (30) (Eg, sufficient time for virus remediation) has elapsed, or the network operator has instructed, take immediate action to unblock the infected computer (T1). That is, the communication control module 30 transmits the normal IP address / MAC address of the other party to each of the virus infected device T1 and the other computers T2, T3, ..., Tn and the gateway 60 And provides an ARP packet to be included. As a result, the virus-infected computer (T1) can perform normal communication.

Another treatment method is a method in which the virus treatment module 50 performs a pushing operation to perform virus treatment first using information about the virus infected computer T1 received from the virus detection module 20 or the communication control module 30. [ Method. Since the virus remediation module 50 knows the address information about the virus infected computer (T1) and the virus infected state, it is possible to treat the virus even if there is no request from the virus infected computer (T1). When the virus detection module 20 receives the virus detection result and the IP address / MAC address information of the infected computer T1, the virus remediation module 50 immediately executes the virus remedy against the virus infected computer T1 . It is preferable that an agent program having a function of recognizing and reporting completion of the virus treatment is installed in advance in the virus infected computer T1 prior to the start of the virus treatment. Then, when the virus treatment of the virus infected computer (T1) is completed, the fact can be reported to the virus treatment module (50) and the communication control module (30).

In FIGS. 2 and 6, the detection of the devices requiring the installation of the security patches and the disconnection of the communication blocks and the installation of the patch files after the communication is interrupted are related to the detection of virus infected computers, .

On the other hand, another system is shown in Fig. The system shown in FIG. 3 is characterized in that the positions of the virus detection module 20 and the patch detection module 22 are different from those of the systems of FIGS. 1 and 2. That is, the switching equipment 10 is provided with a mirroring port (not shown) for the ports of these devices T1, T2, ..., Tn in addition to the ports of the computer devices T1, T2, 14 are further provided, and the virus detection module 20 and the patch detection module 22 are connected to the mirroring port 14 thereof. The contents of the packet recorded in each port of the computer devices T1, T2, ..., Tn are copied to the mirroring port 14 as it is. Therefore, the virus detection module 20 and the patch detection module 22 are not limited to the packets sent by the computer devices T1, T2, ..., Tn in the network via the gateway to the outside of the network through the mirroring port 14 But you can browse all the packets that are exchanged between them. 1 and 2, the virus detection module 20 and the patch detection module 22 can detect that the computer devices (T1, T2, ..., Tn) And only the packets going out of the network through the switching equipment 10 can be received.

In the case of the system shown in FIG. 3, packets transmitted and received between the computer devices (T1, T2, ..., Tn) in the network as well as packets going out of the network through the gateway can be always read, You can find it early. For example, if the computer T1 is communicating with other computer devices (T2, T3, ..., Tn) in the network before communicating with the outside of the network after being infected with a virus, in the system of Figures 1 and 2, The fact of the virus infection can not be detected, but detection is possible in the system of Fig. The system of FIG. 3 is advantageous for early detection of a virus infection. On the other hand, if the processing power does not support it, it may cause a bottleneck in the communication traffic because all the packets going in and out of the network should be read and analyzed for virus infection. This need to be taken into account in the adoption of the system of FIG.

Figure 4 shows another system. The feature of the system shown is that the switching equipment 80 is different from conventional switching equipment having only a switching function. That is, while the switching equipment 10 employed by the system of FIGS. 1 to 3 is responsible for packet switching processing for communication of network equipment only, the switching equipment 80 of FIG. 4, in addition to such switching function, It analyzes the packets sent and received to detect the virus infection and analyzes the necessity of installing the latest security patch. In the system of FIG. 4, the virus detection unit and the patch detection unit included in the switching device 80 may be regarded as being disposed at substantially the same positions as the virus detection module 20 and the patch detection module 22 of FIG. Therefore, virus detection, communication control and release, virus treatment and the like are the same as the system of Fig.

In the systems of FIGS. 3 and 4, the parts relating to the security patch are the same as described above for the virus.

Although a single network has been described above, the above-described method can be applied to a large-scale network including a plurality of subnetworks. In this case, the positions of the virus detection module, the virus detection module, the patch detection module, and the patch module may be appropriately determined according to the specific form of the network, and an optimal communication control method may be selected according to the determined form. The selection criteria related to this can be determined by referring to the above description.

In the present invention, when a computer device constituting a network is infected with a worm or a virus, or when a security patch is required, communication of the corresponding device is blocked, so that the transfer of the virus is completed So that the damage of the virus can be minimized.

Claims (23)

Monitoring the packets sent by the computer devices in the network to analyze whether the computer devices are infected with the virus or whether patch installation is necessary; If the analysis results in the detection of a computer device infected with a virus or a computer device that requires the installation of a patch, installation of that infected computer device or patch is required, except for the treatment of the virus or for patch installation Blocking communications of the computer device; And And a step of ensuring communication between the virus-infected computer apparatus and the virus treatment means or the patch means so that virus treatment or installation of a patch file is performed by the virus treatment means or the patch means on the virus-infected computer apparatus A method for virus control / patching based on communication control for networked computer devices. The communication control apparatus according to claim 1, wherein, in order to block communication of a virus-infected computer apparatus or a computer apparatus requiring patch installation, the communication control apparatus sets the MAC address of the other computer apparatuses and the gateway in the network to a MAC address different from the original MAC address And unicast the manipulated ARP packet to the infected computer device or the computer device requiring patch installation. 3. The method as claimed in claim 2, wherein the communication control device transmits an ARP packet including contents of the MAC address of the computer device that requires the virus-infected computer device or patch installation to a MAC address other than the original MAC address, And unicast to the other computer devices and the gateway. 4. The method according to claim 2 or 3, wherein the different MAC address is the MAC address of the communication control means for providing the ARP packet. [Claim 4] The method according to claim 3, wherein when the communication control means receives a request message for communication from the virus-infected computer apparatus or a computer apparatus requiring patch installation, the communication control means transmits the request message to the virus treatment means or the patch means, Further comprising the step of controlling the computer to perform a procedure for virus treatment or patch installation while communicating with the virus-infected computer device via the communication control means or directly. The method according to claim 1, further comprising the step of releasing the communication cut-off action that has been taken by the communication control means when a predetermined condition is satisfied with respect to the computer apparatus that has taken the communication cutoff measure. 7. The method according to claim 6, wherein the predetermined condition is one of the following: i) when the virus treatment for the virus-infected computer apparatus is completed, ii) when a predetermined time has elapsed from the start of treatment of the virus, and iii) And instructing the release of the blocking. The method as claimed in claim 1, wherein the analyzing step comprises analyzing at least one of a packet to be exported through a gateway of the network and a packet to be exchanged between computer devices in the network through a switching device. 3. The system according to claim 2, wherein the communication control means broadcasts, in the network, an ARP packet in which the MAC address of the virus-infected computer device is manipulated by the MAC address of the communication control means, Further comprising the step of providing 'unicasting' the ARP packet in which the MAC address of the other devices is manipulated with the MAC address of the communication control means itself. A communication control based virus treatment / patching method for computer devices connected to a network by a plurality of computer devices via a switching device, A first step of analyzing whether the computer devices are infected with a virus by receiving a communication packet transmitted from the computer devices to the outside of the network in real time via the switching device; A virus detecting means for detecting a virus infected computer device as a result of the analysis and providing at least an IP address and a MAC address of the virus infected computer device to the communication control means; And The communication control means operates the ARP table of the virus infected computer by providing an ARP packet in which the MAC address of the gateway and the other computer devices in the network are manipulated with its own MAC address to the infected computer device, A third step of allowing a communication packet sent by the device to be delivered only to the communication control means; And And a fourth step in which the virus treatment means performs a virus treatment on the virus-infected computer apparatus. The method as claimed in claim 10, wherein the analysis target of the analysis step is at least one of a packet to be exported through a gateway of the network and a packet to be exchanged between computer devices in the network through a switching device. The method according to claim 10 or 11, wherein the communication control means provides an ARP packet for each of the other computer devices in the network, the MAC address of the virus infected computer device being manipulated to a MAC address other than the original MAC address Further comprising the step of blocking communication between the virus infected computer device and the other computer devices in both directions. 11. The method according to claim 10 or 11, further comprising, during the second step and the third step, transmitting, by the communication control means, the ARP packet manipulated by the MAC address of the communication control means to the MAC address of the virus- Further comprising the step of broadcasting within the network. The method according to claim 10 or 11, wherein the communication control means, when receiving a request message for communication from the virus-infected computer device or a computer apparatus requiring patch installation, transmits the request message to the virus treatment means or the patch means, Or the patch means further comprises performing a procedure for virus treatment or patch installation while communicating with the virus-infected computer device through the communication control means or directly. 15. The computer-readable medium according to claim 14, wherein, when the communication control unit receives the communication packet sent by the virus-infected computer apparatus after performing the third step to perform the fourth step, And controlling the patch means to perform virus treatment or patch installation for the virus-infected computer device. 11. The method of claim 10, wherein if the virus treatment means is present in the network, performing the virus treatment comprises: i) providing a virus treatment request page to the virus-infected computer device; ii) sending the virus treatment request message to the virus treatment means by the virus-infected computer device; and iii) performing the virus treatment on the infected computer device by the virus treatment means according to the treatment request. The method according to claim 10, wherein, when the virus remedy exists outside the network, the execution of the virus remedy comprises: i) in response to the request packet sent by the virus infected computer apparatus, Providing a page for requesting a virus treatment; ii) when the virus-infected computer device sends the virus-care-request message, the communication control means receives the treatment-request message and relays the message to the virus-treatment means; And iii) in response to the request for treatment, the virus treatment means performs virus treatment on the virus-infected computer device. The method according to claim 10, further comprising a patch step of analyzing a necessity of installing a security patch of the computer devices and installing a security patch on a computer apparatus requiring installation. 19. The method of claim 18, wherein the patching step comprises the steps of: i) patch detecting means connected in-line with the switching equipment to receive packets sent out of the network through the switching equipment in real- Analyzing whether installation of a patch is necessary; ii) the patch detection means includes at least providing an IP address and a MAC address of the computer equipment requiring installation of the patch to the communication control means; The communication control means blocking communication by a method similar to the communication blocking method taken for the virus infected computer to a computer apparatus requiring installation of a patch; And relaying the request to the patching means when the device requiring the patch installation issues a patch request, and the communication control means receives the request and relays it to the patching means. The method according to claim 10, further comprising the steps of: i) when the virus treatment for the virus-infected computer apparatus is completed; ii) when a predetermined time has elapsed since the start of treatment of the virus; and iii) Further comprising the step of releasing the communication blocking action for the virus-infected computer device if the communication control means is in any one of the following cases: a case where the administrator of the network instructs to cancel the communication blocking; 1. A system in which a plurality of computer devices are connected via a switching device to constitute a network, Wherein the plurality of computer devices are connected in in-line with the switching device at a location out of the network or connected to a mirroring port of a port of the plurality of computer devices provided in the switching device, Virus detection means for analyzing whether or not the computer devices are infected with a virus and providing at least the address information of the computer device to the communication control means when the infected computer device is found; And Wherein the virus detecting unit is connected to the switching device and when the virus detecting unit informs the address information of the computer apparatus infected with the virus, communication of the virus infected computer unit is blocked except for the case of the virus treatment, And communication control means for supporting communication for virus treatment of the apparatus and for canceling communication interruption of the virus infected computer apparatus when a predetermined condition is satisfied, Control based virus treatment / patching system. 22. The method of claim 21, further comprising the steps of: accessing the virus infected computer device in response to a virus remediation request, either directly connected to the switching computer device or external to the network, Further comprising: 23. The computer system of claim 21, further comprising: a plurality of computer devices connected in in-line with the switching device at a location out of the network or connected to a mirroring port for a port of the plurality of computer devices provided in the switching device, Patch detection means for analyzing whether or not the computer apparatuses need to install a patch using one of the packets and providing at least the address information of the computer apparatus to the communication control means when a computer apparatus requiring installation of the patch is found; And installing a latest patch file for the computer device which is directly connected to the switching equipment or which is located outside the network and which requests installation of a computer device or patch detected as requiring installation of the patch, Further comprising a patch means for upgrading the patch, wherein the communication control means supports communication for installation of the patch.

Images