KR20080090712A - Network forensic apparatus and method thereof - Google Patents

Abstract

An apparatus and a method for storing a network packet are provided to reduce a cost by quickly recovering a damage caused by a security accident. A packet capturing unit(220) receives a data packet transferred via a network interface. A packet processing unit(230) processes a packet to separately manage network traffic flow information with respect to the received packet and index information corresponding to an index file of the packet corresponding to the flow. A storage unit(240) stores the processed packet. The packet capturing unit includes a time stamp generating unit for generating a time stamp indicating a reception time of the data packet received via the network and adding it to the received data packet. The packet capturing unit further includes a sampling unit for sampling only a particular packet according to a selection of a manager.

Description

Network packet storage device and method thereof {Network forensic apparatus and method}

1 is a diagram illustrating an example in which a network packet storage device of the present invention is installed in a network device;

2 is a block diagram of a network packet storage device of the present invention;

3 is a detailed block diagram of the packet capture unit 220 of FIG.

4 is a diagram illustrating the structure of a network traffic flow record file, packet index file, and data packet file according to an embodiment of the present invention;

5 is a flowchart of a network packet storage method of the present invention.

The present invention relates to network security, and more particularly, to a network packet storage device and a method for storing data packets coming through a network for each network traffic flow.

All systems connected to the Internet are potentially targeted for malicious attacks. In addition, even if the private network is separated from the Internet, a system in which important information is stored by internal or external users may be targeted. Conversely, important information may be leaked to the outside by insiders. Many Internet service providers, businesses, and public organizations have been subject to security incidents and network attacks. To cope with this, firewalls or intrusion detection systems (IDS) are installed on the network. I correspond.

However, as the complexity of network attacks increases and the resulting damage increases, organizations are increasingly spending time and money recovering from security incidents. For this reason, network security technology is increasing in importance as a technology to protect sensitive information from the outside or to prevent leakage.

Network administrators can take steps to protect computer networks that store sensitive information from unauthorized access, intrusion attempts, and network attacks, including intrusion prevention, intrusion detection, and post-investigation. There is).

Intrusion prevention uses a system such as a firewall to proactively block suspected intrusions, and uses unauthorized access using virtual private network (VPN), encryption, and enhanced authentication. It is a technology that blocks intrusion attempts in advance.

Intrusion detection is a technology that detects network intrusion attempts using equipment such as intrusion detection systems. When intrusion detection occurs, the intrusion prevention technology described above can block intrusions, and such intrusion detection technologies include systems such as host-based IDS, network-based IDS, and virus scanners.

On the other hand, the post-analysis technology is a technology for quickly recovering the damage from the accident in the event of a security incident, preventing the recurrence of the same security incident, and secures evidence of the attack for future response. As described above, the attack that has been post-analyzed can be prevented by the above-described intrusion detection and intrusion blocking technology.

In most security incidents, known types of attacks can be blocked by intrusion detection and blocking technology, but new types of attacks should be identified through post-mortem analysis, and most of the time and cost in the event of a security incident. Is spent analyzing the attack.

Network forensic technology corresponds to the above-described post analysis technology. Forensic technology is a technology that obtains evidence and analyzes information to determine whether an accident has occurred in case of any accident, and as a result of such forensic analysis, can obtain legal evidence and prevent recurrence of similar events. have.

Forensic technology is classified into computer forensic and network forensic. Computer forensics is a technology that analyzes a suspect's computer in order to obtain evidence of a crime when a legal event occurs. When a computer system recorder is deleted or damaged, it recovers files stored in its original form to obtain evidence. .

Network forensics is a technology to collect and analyze related information when security breaches occur on the network to classify the types of attacks and to obtain evidence.

On the other hand, network intrusion detection technology is a technology for managing the security of the network by detecting intrusion attempts by external intruders or internal members connected to the Internet. Most network-based intrusion detection systems (IDS) have signatures that store patterns of traffic or application data that are allegedly malicious, and use them to inspect and alert packets entering your network. alert) or log generation.

This log information provides the network administrator with the information necessary for network security management. The security manager should update signatures periodically to manage network security. However, if a new type of intrusion occurs on the Internet, the network and the computer systems connected to the network are defenseless against the new attack until the type or signature of the intrusion is analyzed, resulting in the loss of important information and economic loss. have. Therefore, it is important to be able to quickly analyze and respond to new intrusions or attacks as they occur.

When an incident such as an intrusion or attack occurs on a network, a system that analyzes the type and type of attack is called a network intrusion forensic system. The most important function of a fore system is to help administrators quickly analyze what has happened on the network to find a response. Therefore, for the analysis of intrusion events, forensic system should store all packets on the network or important packets. In addition, it must provide the ability to quickly sort and retrieve stored packets.

In general, storing a packet (also called logging) in a forensic system should be performed in real time. After a network security incident, most of the time is spent in classifying and analyzing a large amount of logging packets provided by the forensic system.

Since logging packets transmitted and received through the network to the storage device and storing the statistical information, the size of the logging file increases and it takes a lot of time and money to analyze the file afterwards. In other words, as the network speed increases, the size of the logged file grows from hundreds of megabytes to tens of terabytes. Therefore, it is time-consuming and expensive to analyze such large files in the post-analysis process to identify evidence of the desired security breach and the damage situation.

For example, logging all packets occurring in a single direction on a 1 Gbps line would result in a file of approximately 450 giga bytes, which would take a lot of time to analyze and extract packets related to the desired event from these large files. If the packet information is needed more than the past hour, the packet logging file becomes larger, and the post-forensic analysis becomes more difficult.

In addition, due to the characteristics of forensic analysis, accurate packet analysis can be done by logging all packets. Therefore, packet filtering and sampling techniques can be selectively used during logging. Therefore, it takes a lot of time and money to analyze a large amount of logging files in post-analysis. .

Accordingly, an aspect of the present invention is to provide a network packet storage device and a method for storing packets collected on a network for each network traffic flow in order to perform a network forensic analysis process more quickly. will be.

According to the present invention, a packet capture unit for receiving a data packet transmitted through a network interface; A packet processing unit for processing the packet to separately manage network traffic flow information on the received packet and index information corresponding to an index file of a packet corresponding to the flow; And it is achieved by the network packet storage device characterized in that it comprises a storage unit for storing the processed packet.

The packet capture unit may further include a time stamp generation unit generating a time stamp indicating a reception time of a data packet received through the network and adding the time stamp to the received data packet.

The packet capture unit may further include a sampling unit sampling only a specific packet according to a manager's selection, or further including a filtering unit filtering and extracting only a packet corresponding to a specific network traffic flow.

The packet processing unit generates a flow record file that manages network traffic flow information for the received packet, and generates an index file indicating a location of packets belonging to the flow, and the flow record file is configured for each flow. It is desirable to process to have the location information of the index file.

On the other hand, according to another field of the present invention, the technical problem is a step of receiving a data packet through a network interface; Processing the packet to separately manage network traffic flow information on the received packet and index information corresponding to an index file of a packet corresponding to the flow; And it is also achieved by the network packet storage method comprising the step of storing the processed packet.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating an example in which a network packet storage device of the present invention is installed in network equipment.

In a place such as an enterprise, a school, a research institute, a plurality of computers 110 and 120 are connected to each other to form a local network 10, and these computers are connected to the Internet through a gateway 130 or a router 140.

The network packet storage device 20 stores all packets entering the local network 10 for later analysis of malicious attacks invading the local network 10, or selectively samples or filters and stores them according to the administrator's setting. . Stored packets can be forensic analyzed through a monitoring system. On the other hand, in addition to the packets coming into the local network 10 from the outside, it also stores the packets going out from the inside to determine the cause of the information leakage accident occurs.

2 is a block diagram of a network packet storage device of the present invention.

The network packet storage device 20 includes a packet capture unit 220, a packet processing unit 230, and a storage unit 240.

The packet capture unit 220 tags, that is, adds, a time stamp indicating a reception time of a packet received through the network interface devices 210a, 210b, and 210c installed in the target system to monitor the intrusion. In addition, all received network packets may be stored, or only packets of a specific packet or a specific network traffic flow may be sampled or filtered according to a manager's selection.

The network interface devices 210a, 210b, and 210c are cards, such as a network interface card (NIC), installed in a network device connected to the Internet, and use a tapper or splitter to send packets. All packets existing on the network line by mirroring are transferred to the packet capture unit 220.

The packet processing unit 230 generates network traffic flow information for the packet in order to facilitate post-forensic analysis, and generates an index file of the packet corresponding to the generated network traffic flow. That is, it generates a flow record file for managing the network traffic flow information for the received packet, and generates an index file indicating the location of the packets belonging to the flow, the flow record file is the location information of the index file for each flow Process to have A specific example of generation of network traffic flow information and generation of an index file will be described later with reference to FIG. 4. The storage unit 240 stores the packet processed by the packet processor 230.

The monitoring system 250 provides an environment for analyzing all packets stored in the storage unit 240 or analyzing network traffic flows for post-forensic analysis.

3 is a detailed block diagram of the packet capture unit 220 of FIG. 2.

The packet capture unit 220 includes a time stamp generator 310, a sampling unit 320, and a filtering unit 330. In this case, the sampling unit 320 and the filtering unit 330 may not operate according to a manager's selection. If the sampling unit 320 and the filtering unit 330 do not operate, the received packet is not filtered, and thus all packets on the network are stored.

The time stamp generator 310 creates a time stamp indicating a reception time of the packet received by the network interface device 210a, 210b, or 210c and adds it to the received packet. The sampling unit 320 filters a specific packet according to a manager's selection. For example, only one packet may be extracted every 10 packets received, or one packet may be extracted at a predetermined time. The filtering unit 330 extracts only packets for a specific network traffic flow according to a manager's selection. For example, you can configure to extract only packets that are sent from a specific IP address, or only packets that are created by a specific service port or application.

The sampling unit 320 and the filtering unit 330 may be set to operate or not operate according to the storage capacity of the storage unit 240. Although the sampling unit 320 or the filtering unit 330 does not monitor every packet operated, it may know an approximate attack pattern.

4 is a diagram illustrating the structure of a network traffic flow record file, packet index file, and data packet file according to an embodiment of the present invention.

In order to store the received packet in the network packet storage device of the present invention, a large capacity storage device is required, and a file system for managing the storage device is required. In the present invention, it is assumed that an operation on a general file system is performed for log file management for storing packets.

Referring to FIG. 4, the network packet storage device of the present invention additionally generates two files for one packet log file when storing the received packet in the file system. That is, a packet index file as a flow record file 410 for storing network traffic flow records in addition to the packet capture file 430 and an index file for the packet capture file 430. file) 420.

Hereinafter, the correlation between the packet capture file 430, the flow record file 410, and the packet index file 420 will be described in detail. The packet capture file 430 is a file for storing a packet received on a network. That is, headers are stored for each received packet. In this case, since the length of the packet on the network may vary from 64 bytes to 1518 bytes in the case of Ethernet, the packet position on the packet capture file 430 is not a specific position but a random position. Each packet is stored in the packet capture file 430 along with header information including the length information and time information of the packet.

The packet index file 420 is offset information indicating the location of the stored packet in the packet capture file 430 in order to enable the system administrator to randomly access the desired packet during post analysis. It stores a pointer (pointer, prev) for storing the location information of the previous packet belonging to the network traffic flow in the packet index file so that it can be connected to a single list for each network traffic flow to which the packet belongs.

As such, the packet index file 420 stores network traffic flow information and packet location information for each packet at a fixed location, thereby facilitating packet analysis during post-forensic analysis.

The flow record file 410 can think of various kinds of network traffic flows according to a method specified by the system administrator. In general, a network traffic flow for an IP protocol may generate a flow record by extracting attribute information of a packet belonging to Cisco Netflow version 5. The flow record format proposed by the present invention may follow the format suggested by the IETF IPFIX or may follow the Cisco netflow format. However, in order to indicate the packet belonging to each network traffic flow, a pointer field to distinguish the packet list of the packet index file must be added. Examples of network traffic flows include IP addresses and service ports.

5 is a flowchart of a network packet storage method of the present invention.

A process of receiving a packet, updating a flow record, and writing a packet to a packet index file and a packet capture file will be described with reference to FIG. 5. First, a packet on a network is received (S510). That is, the packet is received through the network interface card installed in the network equipment. The packet is processed to correspond to the network traffic flow information on the received packet and the index file of the packet corresponding to the network traffic flow. More specifically, by checking whether there is network traffic flow information for the received packet (S520), determining whether there is a network traffic flow (S530), and updating the network traffic flow information if it exists (S550). If not, the network traffic flow information is newly generated (S540).

In step S520, for example, the required network traffic flow information is extracted from the received packet and the network traffic flow having the same value is searched for on the flow table. Examples of network traffic flow information include IP addresses, service ports, and the like.

In addition, the packet index is generated and stored to correspond to the network traffic flow information thus updated or generated (S560), and the packet is also stored to correspond thereto (S570). After updating the network traffic flow information (S550) or generating the network traffic flow information (S540), the ID (identification) of the network traffic flow to which the received packet belongs can be known, and the network traffic flow ID to which the packet belongs and The location information in the logging file of the previous packet to which the network traffic flow belongs is stored in the packet index file (S560). By storing packets in such a sequential manner, network traffic flow information and network traffic flows to which each packet belongs can be efficiently stored in packet logging.

The network forensic system repeats the above-described process for packets captured on the network.

On the other hand, the above-described network packet storage method can be created by a computer program. Codes and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the program is stored in a computer readable media, and read and executed by a computer to implement a network packet storage method. The information storage medium includes a magnetic recording medium, an optical recording medium, and a carrier wave medium.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

As described above, according to the present invention, by dividing and storing packets for each network traffic flow, analysis time can be shortened by analyzing network traffic flow information and related packets during forensic analysis, and quickly recovering from damage caused by a security incident, Responsiveness can reduce costs.

For example, in a conventional packet logging system, after analyzing a stored packet, the security manager must read all logged packets sequentially and apply filter rules as necessary to search for a specific packet. In this case, the time required for the administrator to extract the desired packet can be calculated as follows.

Packet search time (seconds) = disk access speed (bytes / sec) * logging disk size (bytes)

Although the disk access speed may vary from system to system, assuming that the disk access speed is constant, the packet extraction time changes according to the size of the logged disk. In the post-analysis process, the size of the disk on which packets are logged can grow up to tens of terabytes.In the post-analysis process, analysis is performed through dozens to hundreds of packet searches and extracts. The time required for analysis increases in proportion to the number of packet searches.

However, in a system using the packet storage device and method according to the present invention, the time required for the administrator to extract a desired packet can be calculated as follows.

Packet search time (seconds) = (disk access speed * flow disk size) + (disk access speed * classified packet size)

The disk access speed has the same value as the conventional method, but the size of the flow disk is reduced from hundreds to thousands of times in some cases compared to the size of the logging disk, and only the packets classified by the flow are accessed. In contrast, analysis performance can be improved by reducing the size of the disk accessed by packet extraction from tens to thousands. This performance improvement can be obtained in proportion to the number of packet searches performed during the post analysis.

That is, a conventional forensic system that logs only packets requires a lot of time to search for a desired packet in a packet located irregularly in a log file during post-analysis, but according to the present invention, a packet is irregularly located in a packet log file. By creating and storing a separate index file with a certain size in accordance with a predetermined format, it is possible to easily retrieve a random packet from the logged packet.

In addition, by grouping the received packets into the network traffic flow to which each packet belongs in real time, it is possible to search the packets causing the accident more quickly through the search by the network traffic flow in the post-analysis process.

In addition, by regenerating the network traffic flow by the generated network traffic flow information for each key or combination of keys of the network traffic flow, it is possible to retrieve the desired statistical information and packets belonging to each network traffic flow more quickly and easily.

Claims (9)

A packet capture unit which receives a data packet transmitted through a network interface; A packet processing unit for processing the packet to separately manage network traffic flow information on the received packet and index information corresponding to an index file of a packet corresponding to the flow; And And a storage unit for storing the processed packet. The method of claim 1, wherein the packet capture unit And a time stamp generator for generating a time stamp indicating a reception time of a data packet received through the network and adding the time stamp to the received data packet. The method of claim 2, wherein the packet capture unit And a sampling unit for sampling only a specific packet according to a manager's selection. The method of claim 2, wherein the packet capture unit And a filtering unit for filtering and extracting only packets corresponding to a specific network traffic flow according to a manager's selection. The method of claim 1, wherein the packet processing unit Generate a flow record file for managing network traffic flow information for the received packet, and generate an index file indicating the location of packets belonging to the flow, wherein the flow record file is the location information of the index file for each flow Network packet storage device, characterized in that the processing to have. The method of claim 5, The packet index file has a pointer corresponding to index information storing position information of the first packet belonging to the flow in the flow record file, and the pointer corresponds to index information storing position information of the next packet. A network packet storage device, characterized in that it indicates a pointer. Receiving a data packet via a network interface; Processing the packet to separately manage network traffic flow information on the received packet and index information corresponding to an index file of a packet corresponding to the flow; And And storing the processed packet. The method of claim 7, wherein processing the packet, Determining whether network traffic flow information exists for the received packet; Updating the network traffic flow information if it exists, otherwise generating new network traffic flow information; And Generating a packet index so as to correspond to the updated or generated network traffic flow information. A computer-readable recording medium having recorded thereon a program for executing the network packet storing method according to claim 7 on a computer.

Images