KR20090040655A - System and method for enterprise signature management and distribution for network attacks - Google Patents

Abstract

A system and a method for managing and distributing an enterprise signature for network attacks are provided to manage each complicated security management system consistently based on a signature generated from a security system which generates signatures. A signature collector(100) classifies signatures generated from the each security system, which generates signatures, according to the information including each signature. In addition, the signature collector collects the signatures in analyzable internal structure form. In order to increase reliability, a signature analyzer analyzes the collected signatures. A signature distributing unit(400) distributes the analyzed signature to a security management system on other networks through a signature distribution protocol(600).

Description

System and Method for Enterprise Signature Management and Distribution for Network Attacks

The present invention relates to a system and method for integrated signature management and distribution of network attacks, and more particularly, to collect, integrate and analyze signatures generated in multiple security systems against various undefined attacks on a distributed network. A system and method for integrated signature management and distribution of network attacks for distribution to security management systems on the Internet.

The present invention is derived from the research conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development. Development of Signature Generation and Management Technology against Zero-day Attack].

Recently, as the network environment is advanced, the types of threat attacks such as worms and viruses are gradually diversified, and the attacks are also occurring in combination. Thus, it is increasingly difficult to detect and respond to this effectively. In response, various security technologies have been introduced into the network environment. In particular, techniques to defend against unknown attacks have been actively developed. For example, when a security vulnerability exists on a network, a zero-day attack that exploits the security vulnerability and attacks the network quickly before it is secured. Thus, conventionally, there have been a way for experts to extract a signature that defines a network attack that is not known manually and defend the network based on the signature.

However, these security technologies have had difficulty responding quickly to various undefined (unknown) external attacks. Therefore, the research to automatically generate signatures for these threat attacks and the development of security management systems for managing them are actively being carried out at home and abroad.

For example, Intel-CMU detects sessions suspected of attack in 2004 and 2005 using anomaly detection, and stores and combines all the payloads of the detected sessions. Introduced signature auto-generation technology called Autograph and Polygraph. The USCD released an automatic generation technology called Earlybird in 2004. Penn. State University is researching signature generation techniques for worm attacks based on IP clusters as a detailed task of the 2005 Evaluation Method for Internet Security Technology (EMIST) project. UC-Davis is constructing a virtual environment that simulates the contents of packets received from the network, and based on this, is developing a detection technology that detects codes that attack packets deprive the host of system control and uses them to generate signatures. In terms of accuracy, it may be higher than the previous method, but it is impossible to detect other attacks in the same network, and the detected signatures need to be propagated to the network in order to be used to protect the entire network.

Hereinafter, a conventional network environment will be described with reference to the drawings.

1 is a block diagram showing a network environment according to the prior art. As shown in Fig. 1, in the conventional network environment, a security management system 1, for example, an IDS and a firewall, is formed between the network 20 and the Internet 30. When the signature generation security system 3 generates and provides signatures for various attacks invading from inside and outside of the network 20, the security management system 1 can quickly protect the network 20 based thereon. do. In addition, the security management system 1 in such a single network environment is generally configured to individually configure the security management system 1 for each network 20 in a distributed network environment in which several networks exist. In addition, the signature generation security system 3 for generating a signature is included in the security management system 1 or is separately configured on the network.

As such, the network 20 may be attacked by worms, bots, viruses, etc. that cause abnormal traffic, for example, SQL Slammer, Nimda, Code-Red, Blaster, Security-related damages are likely to occur due to Sasser. Thus, the security management system 1, for example, a firewall, a virtual private network, an antivirus, an intrusion detection and prevention system, etc., may be able to generate such signatures from the signature generation security system 3 that generates signatures. It is provided with the signature that defines for and performs security processing such as blocking, deleting, and passing accordingly.

However, the signature generation security system 3 that generates signatures for various security management systems 1 in a distributed network environment generates and provides signatures such as worms, bots, viruses, etc. Since each network 20 is operated separately, it is difficult to quickly respond to the same undefined attack in the same network 20 as well as other network 20.

In other words, as the network environment expands from the core server of the enterprise to distributed network environments such as general user desktops, remote workers' access, mobile terminals such as laptops or PDAs, and so on, various security management systems are created. It is difficult to consistently manage each of the extensive and complex security management systems.

In addition, the signature generated for the undefined attack in the conventional security management system 1 has a problem that the reliability is low because the verification procedure is insufficient.

In addition, more and more signatures will be generated from signature-generating security systems that automatically generate signatures for unknown attacks that threaten network environments such as worms and viruses. Each signature generation in the network of major institutions and security companies The signatures generated by the security system need to be collected, integrated and managed by the security administrator, and further analyzed to extract new information by extracting unanalyzed information from a single signature. have. In addition, there is a need for a method of securely distributing and sharing such signature information to other security management systems in the form of a common signature message to operate cooperatively.

The present invention has been made to solve the above-mentioned problems, and the common signatures are analyzed by collecting the signatures generated in a plurality of signature generation security systems for various undefined attacks in an internal structure format and analyzing them to improve reliability. It provides a system and method for securely distributing to a security management system on another network in a message format.

Another object of the present invention is to provide a system and method for consistently managing each security management system that is extensive and complicated based on the signature generated from the signature generation security system.

The integrated signature management and distribution system of a network attack according to the present invention is an integrated signature management and distribution system of a network attack that collectively manages signatures generated by a plurality of signature generation security systems in a distributed network environment, wherein each signature generation is performed. A signature collector for classifying the signatures generated from the security system according to the information included in each signature and collecting the signatures in the form of an internal structure that can be analyzed; A signature analyzer for analyzing the collected signatures to improve reliability; And a signature distributor for distributing the analyzed signature to a security management system on another network through a signature distribution protocol. Characterized in that it comprises a.

In addition, the signature collector may parse the signature based on a parsing table classifying each information item included in the signature and normalize the signature into an internal structure.

In addition, the parsing table preferably includes at least one of a signature certificate information and a system connection state information class.

The certificate information class may include at least one of information, signature information, and verification information class of a terminal that has generated and verified a signature.

The signature information class preferably further includes network information and signature content information class.

In addition, the verification information class preferably includes one or more of verification block development vendor information, verification result information, packet collection information, and packet rule information class.

In addition, the signature analyzer may improve the reliability of the signature by applying one or more analysis methods of the collected signature to rule-based and learning-based.

In addition, the rule base may include at least one of an aggregation and a correlation scheme.

In addition, the learning base, it is preferable to include an artificial intelligence method.

In addition, the signature distributor may convert the analyzed signature into a signature distribution message exchange format (SDMEF) or a distributable format according to a security management system to distribute the analyzed signature.

In addition, the signature distribution protocol preferably supports an authentication connection through encryption and decryption and key distribution for the analyzed signature.

In addition, the signature integrated manager for managing based on the status information including at least one of authentication, configuration, management, failure received from a plurality of signature generation security systems and security management systems on other networks; It is preferable to further include.

On the other hand, the integrated signature management and distribution method of the network attack according to the present invention is integrated network attack of the integrated signature management and distribution system of the network attack for the integrated management of the signatures generated by a number of signature generation security systems in a distributed network environment A signature management and distribution method comprising: a signature collection step of classifying signatures generated from each signature generation security system according to information included in each signature and collecting the signatures in an internal structure form that can be analyzed; A signature analysis step of analyzing the collected signatures to improve reliability; And a signature distribution step of distributing the analyzed signature to a security management system on another network through a signature distribution protocol. Characterized in that it comprises a.

In the signature collection step, the signature may be parsed based on a parsing table classifying the information for each item of information included in the signature, and then normalized to the internal structure.

In addition, the parsing table preferably includes at least one of a signature certificate information and a system connection state information class.

In addition, the signature analysis step, it is preferable to improve the reliability of the signature by applying at least one analysis method of the collected signature-based rules and learning.

In addition, the signature distribution step may be converted into a signature distribution message exchange format (SDMEF) or a distributable format according to a security management system in order to distribute the analyzed signature.

In addition, the signature distribution protocol preferably supports an authentication connection through encryption and decryption and key distribution for the analyzed signature.

The present invention collects signatures generated from multiple signature generation security systems against various undefined attacks in an internal structure format, analyzes them to improve reliability, and distributes them to security management systems on other networks in a common signature message format. Therefore, even in a distributed network, it is effective to respond quickly to the same undefined attacks.

In addition, the present invention has the effect of consistently managing each of the extensive and complex security management system based on the signature generated from the signature generation security system.

In addition, the present invention has the effect of parsing the signature generated in the signature generation security system, normalizing and integrating the signature into an internal structure, and doubling the reliability of the signature generated by analyzing the signatures.

Hereinafter, the integrated signature management and distribution system for network attack according to an embodiment of the present invention will be described with reference to the accompanying drawings.

2 is a configuration diagram showing an example of an entire network environment to which the present invention is applied, and FIG. 3 is a configuration diagram showing another example of a network environment to which the present invention is applied.

As shown in Fig. 2, the integrated signature management and distribution system 10 of the network attack according to the present invention-an enterprise signature management and distribution (ESMD) system-is installed in a separate network 20 under a distributed network environment. It is configured in connection with the security management system (2). As shown in FIG. 3, the integrated signature management and distribution system 10 of a network attack according to the present invention collects various signatures generated by various signature generation security systems 700a, 700b, 700c of each individual network, It is configured to be distributed and shared to the security management system 2 of the individual network 20 after integration and analysis.

Here, each signature generation security system 700a, 700b, 700c is a file or a log defining signatures (eg, worms, viruses, etc.) for intrusions and threats from the outside or the inside of the Internet 30, or the like. Etc.) is generated and provided to the security management system 2 on the basis of this, to protect the network 20.

For example, the security management system 2 includes an Intrusion Prevention System (IPS) that secures based on signatures for undefined intrusions, and an Intrusion Detection System (IDS) that secures based on signatures for predefined intrusions. This includes firewalls that implement security based on partial protection signatures.

In addition, the integrated signature management and distribution system of the network attack of the present invention may be configured separately and connected to each individual network.

As described above, each component of the integrated signature management and distribution system of the network attack of the present invention configured in the above-described network environment may take one or more of one software, multiple sources, circuits, or terminals. In the description, a common configuration is generally omitted based on this.

4 is a block diagram illustrating a configuration of an integrated signature management and distribution system for network attack according to the present invention.

As shown in FIG. 4, the integrated signature management and distribution system 10 of a network attack according to the present invention includes a signature collector 100, a signature integrated manager 200, a signature analyzer 300, a signature distributor 400, It is composed of a DB processor 500 and a signature distribution protocol 600.

The signature collector 100 parses a signature generated by each signature generation security system 700 on a distributed network into a parsing table that classifies the signatures into information items included in each signature through the signature distribution protocol 600. Normalized to an internal structure form and collected, and transmits the collected signature to the signature integrated manager 200.

At this time, each signature generation security system 700 generates and provides various types or single types of signatures. For example, it may be provided in an XML schema format having various configurations or in a signature distribution message exchange format (SDMEF) that unifies the XML schema format. Alternatively, it is also possible to have a separate system that unifies the signatures generated by each signature generation security system 700 into a signature distribution message exchange format (SDMEF).

Here, the XML Schema Format is a Recommendation of the World Wide Web Consortium (W3C) that defines how to formally describe each element in an Extensible Generation Language (XML) document. In other words, an XML schema is an abstract representation of the relationships between attributes and elements of an XML object, defining structural analysis and each structural element to represent a schema in a document. For example, in a Web site, you define Web site elements, Web page elements, and other content elements using XML and HTML tags. It is somewhat more advantageous than languages like document type definition (DTD) or Simple Object XML (SOX), and because it is in XML, it can be handled directly without any intermediary by the parser, self-recording, automatic schema generation, XSL It is an expression format that has the advantage of defining ability through transformation (XSLT).

That is, the signature collector 100 takes various forms by normalizing the signatures generated from the signature generation security system 700 to the parsing table by mapping the signatures having the distributed message exchange form or other forms to the parsing tables, respectively. It is possible to integrate and manage multiple signatures.

The signature integrated manager 200 controls a series of processes of collecting, integrating, analyzing, and distributing signatures, integrating the signatures generated in each process, and storing and managing the signatures in a DB processor.

In addition, the signature integrated manager 200 may transmit and receive information on authentication / configuration / management / failure of respective security systems that generate the signature and manage accordingly.

The signature analyzer 300 processes the collected signatures into advanced information with reliability through primary and secondary analysis using rules-based and learning-based methods.

The signature distributor 400 converts the signature message exchange format (SDMEF) into a signature management protocol (SDMEF) through the signature distribution protocol 600 described below. (2) to share the integrated signature.

Thus, by collecting and sharing signatures that define undefined attacks generated by multiple signature generation security systems 700 under a distributed network, sharing them with the security management system, it is possible to maintain the security of the entire network from constantly changing attacks. do.

The DB processor 500 includes a DB (Data Base) for processing and storing collected signatures and analysis, storage, retrieval, and deletion operations thereof.

The DB processor 500 also includes a parsing table that classifies information items according to information included in the signature distribution message exchange format (SDMEF).

Signature distribution protocol 600 is a protocol that supports encryption and key distribution for secure communication of signatures in the collection and distribution of signatures.

That is, the signature distribution protocol 600 enables smooth transmission and reception with signature generation security systems or security management systems.

Hereinafter, the signature analyzer of the present invention will be described in detail.

FIG. 5 is a block diagram illustrating a detailed configuration of the signature analyzer of FIG. 4.

The signature collector 100 has a signature distribution message exchange format (SDMEF) having an XML Schema form from the signature distribution protocol 600 that supports authentication and encryption of signatures generated from the signature generation security system 700 that generates multiple signatures. The signature collection unit 110 for collecting signatures, and based on a parsing table stored in the DB processor 500 so that the collected signature distribution message exchange format (SDMEF) can be used in the integrated signature management and distribution system of a network attack. Signature parsing unit 120 for parsing by each signature information item, the signature normalization unit for converting the parsed information into the internal structure format for use in the signature integration manager 200 of the integrated signature management and distribution system of the network attack ( 130). The signature processing module 140 transmits the normalization signature information generated by the signature normalization unit 130 to the signature integration manager 200.

That is, the signature collector 100 automatically collects signatures of the signature distribution message exchange format (SDMEF) generated from the signature generation security system on the distributed network. The signature collector 100 compares the collected signatures with the signature information items and parses them into corresponding information based on a parsing table stored in the DB processor 500. The signature collector 100 converts the parsed signature into an internal structure format and normalizes it.

As such, the signature collector 100 may accurately analyze a plurality of signatures taking various forms by normalizing the plurality of signatures generated from the signature generation security system 700 to parsing tables and normalizing them into an internal structure of a form that can be analyzed. Can be.

Hereinafter, the signature parsing and normalization process in the signature collector 100 of the present invention will be described in detail.

6-10 are examples of parsing tables that classify signature distribution message exchange formats.

 In describing the parsing table according to the present invention, the parsing table is reference information for classifying signatures, and is classified as' class classification ',' class name ',' based on a group (class) to which information included in the signature belongs. Form ',' definition ', etc. In addition, 'class classification' is based on having subclasses in each class to easily classify signature information.

The parsing table according to the present invention shown in FIG. 6 includes the SDMEF-Message class, which is the highest signature information class, and the SDMEF-Message includes a certificate information 'Certificate' and a system connection status information 'Heartbeat' class. FIG. 7 illustrates a lower configuration of an 'Analyzer' class of the certificate information 'Certificate' class of FIG. FIG. 8 illustrates a configuration of a 'Signature' class of the certificate information 'Certificate' class of FIG. 6 and further includes a 'Network' class and a 'Content' class. 9 and 10 illustrate a configuration of a 'Validation' class of a 'Certificate' class, and includes a 'Vendor' class, a 'TaskResult' class, a 'CapturePacket' class, and a 'CaptureRule' class. Here, the 'TaskResult' class further includes the 'Vender' class and the 'Result' class, and the 'CaptureRule' class further includes the 'Vender' class, the 'Network' class, and the 'Parameter' class. The parsing table having such a configuration can be modified or added to the structure as an embodiment for implementing the present invention.

That is, the certificate information class (certificate) includes information of the terminal (Aalyzer), signature information (Signature) and verification information (Validation), etc. that generated and verified the signature. The signature information class (Signature) includes network information (Network) and signature content information class (Content). The verification information class (Validation) includes verification block development vendor information (Vender), verification result information (TaskResult), packet collection information (CapturePacket), packet rule information (CaptureRule) class and the like.

In addition, the present invention classifies the signatures collected on the basis of the parsing table stored in the DB processor 500, parses them, and normalizes them into an information that can be analyzed to integrate and manage the signatures collected from various security systems.

11 is an example of the signature distribution message exchange format of the security system, and FIG. 12 is a configuration diagram of a parsing table classifying the signature distribution message exchange format.

As shown in FIG. 11, the signature generated in the signature generation security system takes the signature distribution message exchange format (SDMEF) defined on the basis of XML.

In this case, the signature collector 100 collects signatures generated by a plurality of security systems, classifies the parsing table stored in the DB processing unit 500 as a reference, parses them into corresponding information, and normalizes the analyzed information.

For example, the signature distribution message exchange format illustrated in FIGS. 11 and 12 may include 'Certificate messageId' as the message identifier “70625001”, and “generationTime” as the certificate generation date and time “2007-06-25 20:12: 59 ”,“ Analyzer analyzerId ”is Analyzer identifier“ 70625001 ”,“ Validation category ”is“ ABVB ”which is a list of validation rule expression format,“ Validation category ”is“ SBVB ”and“ finalResult ”is final list of validation rule expression format. The results of “No Attack” and “finalReliability” represent “4.80” expressed as a percentage of the reliability of the final verification result.

That is, this signature has a certificate generated at 20:12:59 of June 25, 2007, has a message identifier of "70625001" and an Analyzer identifier, and has a validation rule expression format of "ABVB" and "SBVB". 4.80% probability that the signature has the reliability of the final verification result.

As such, the signature collector 100 extracts and normalizes the signatures by preparing the signature distribution message exchange format for the corresponding parsing table.

That is, the signature distribution message exchange format includes the signature information, and the signature collector 100 generates the XML-based signature distribution message exchange format or normalizes it to an internal structure format based on the information to the signature integration manager 200. Is sent.

In addition, the signature class information is classified and stored as a parsing table of the DB processor 500 by the signature integrated manager 200, and undergoes a process of changing a search, deletion, modification, or the like.

That is, the integrated signature management and distribution system of the network attack of the present invention can integrate individual information based on information classified by parsing each signature into a parsing table.

Hereinafter, the signature integrated manager of the present invention will be described in detail.

13 is a block diagram showing a detailed configuration of the signature integrated manager 200 according to the present invention.

As shown in FIG. 13, the signature integrated manager 200 processes or stores each corresponding information in the DB processor 500 and manages the authentication / configuration / management / failure of the various signature generation security systems 700. Send and receive information about

In addition, the signature integration manager 200 receives the information analyzed by the signature collection information processing unit 210 and the signature analyzer 300 to receive the message structure information parsed and normalized by the signature collector 100, and to analyze the signature analysis information. The processor 220, the signature distribution information processor 230 for processing the information for signature distribution according to the setting of the administrator, and the system management information processor for storing and managing the management information of each security system transmitted and received in the DB processor 500 ( 240, the signature management information processing unit 250 controls or processes information transmitted and received by each processing unit 210, 220, 230 of the signature integrated manager 200.

In addition, the system management information processing unit 240 transmits, controls, and manages state information of a plurality of signature generation security systems, integrated security management systems, and other integrated security systems. That is, the signature integrated manager 200 manages the entire security processing of the network based on the signature generated by the security system.

Hereinafter, the signature analyzer of the present invention will be described in detail.

14 is a block diagram illustrating a detailed configuration of the signature analyzer 300.

The signature analyzer 300 analyzes the collected signatures in various analysis methods to improve the reliability of the signature. The signature analyzer 300 is the signature primary analysis unit 320 and the signature secondary analysis unit 330, the signature analysis control unit 310 for controlling the analysis request by each method, the collected and stored signatures (Aggregation), It consists of a signature primary analysis unit 320 to analyze primarily through a rule-based, such as a correlation method, and a signature secondary analysis unit 330 to analyze secondarily through a learning base such as an artificial intelligence method. .

At this time, the signature analysis control unit 310 processes the first and second analysis alone or selectively performs the first and second analysis to specify the corresponding analysis orders (1, 2, 3).

Here, the rule-based method corresponds to a correlation analysis method for analyzing the relationships between the signatures, and a collection analysis method for processing the signatures.

In addition, the learning-based method is an artificial intelligence analysis that analyzes based on the classification statistics of the signatures collected.

That is, the signature analyzer 300 analyzes the signatures in stages to increase reliability by deleting, classifying, and adding signatures generated by errors in the signature generation security system.

Hereinafter, the signature distributor of the present invention will be described in detail.

15 is a block diagram showing a detailed configuration of the signature distributor 400.

As shown in FIG. 15, the signature distributor 400 converts a signature to be shared to a security management system on a network, and converts it into a signature distribution message exchange format as shown in FIG. 11 and forwards it to the signature distribution protocol 600. The signature distributor 400 requests a signature to be distributed to the signature integrated manager 200, receives the signature information from the DB processor 500, and delivers the signature information to the signature information converter 420. The signature information conversion unit 420 converts the distribution target signature into the signature distribution message exchange format and transmits the signature to the signature distribution protocol 600.

That is, the signature distributor 400 may refer to the signature analyzed in the security management system to improve reliability.

Hereinafter, the signature distribution protocol of the present invention will be described in detail.

16 is a block diagram showing the detailed configuration of the signature distribution protocol 600.

As shown in FIG. 16, the signature distribution protocol 600 supports encryption and key distribution for secure transmission of the signature. The signature distribution protocol 600 may include a signature collection communication unit 610 that processes communication for receiving signatures transmitted from various signature generation security systems 700 that are connected, and a security management system that is configured to connect signatures to be distributed by an administrator. 2) a signature distribution communication unit 620 that handles communication for transmission to 2), and a signature distribution protocol processing unit that authenticates and establishes various signature generation security system 700 or security management system 2 by supporting key distribution and encryption / decryption. (640) The signature collection and communication unit 610 and the signature distribution communication unit 620 to the signature authentication and decryption unit 630 to encrypt or decrypt the signature information transmitted and sent to the signature collector 100 and the signature distributor 400 It is composed.

Hereinafter, the integrated signature management and distribution method for network attack according to the present invention will be described with reference to the accompanying drawings.

17 is a flowchart illustrating an integrated signature management and distribution method of network attack according to the present invention. In the description, the same reference numerals as the above-mentioned drawings refer to performing the same function.

First, the signature collector 100 performs a step (S100) of collecting signatures generated from the signature generation security system 700.

Here, the signature collector 110 collects signatures generated from the plurality of signature generation security systems 700 in the signature distribution message exchange format (SDMEF) in the form of XML schema through the signature distribution protocol 600.

At this time, the signature collector 100 performs a step (S110) of normalizing and integrating each collected signature into an internal structure through a parsing process to check the parsing table.

That is, the signature parsing unit 120 uses the collected signature distribution message exchange format (SDMEF) signatures based on a parsing table stored in the DB processor 500 so that the signatures of the network attack can be used in the integrated signature management and distribution system. Parse by signature information item. The signature normalization unit 130 converts the parsed information into an internal structure format for use in the signature integration manager 200 of the integrated signature management and distribution system 10 of the network attack. The signature processing module 140 transmits the normalized signature information generated by the signature normalization unit 130 to the signature integration manager 200.

Next, the signature analyzer 300 performs an analysis step S120 of applying the various signatures to the collected signatures to increase the reliability of the signature.

Here, the signature analysis control unit 310 receives the information of the corresponding signatures from the DB processor 500 and sends an analysis request to each analysis unit 320 or 330. The signature primary analysis unit 320 primarily analyzes the signature through a rule base according to the analysis request of the signature analysis control unit 310. In addition, the signature secondary analysis unit 330 performs secondary analysis through the learning base.

Subsequently, the signature distributor 400 converts the signature distribution message exchange format (SDMEF) or the distributable format (S130) according to the corresponding security system for distributing the target signature.

Here, the signature distribution controller 410 requests the signature integration manager 200 to distribute the target signature to the signature integration manager 200, receives the signature information from the DB processor 500, and transfers the signature information to the signature information converter 420. The signature distribution controller 410 controls the signature distribution protocol 600 by transmitting and receiving setting change information such as an authentication and encryption method. The signature information converter 420 converts the signature to be distributed into the signature distribution message exchange format and transmits the signature to the signature distribution protocol 600.

Next, the signature distribution protocol 600 distributes the analyzed signature to the security management system on the network through the signature distribution protocol (S140).

Here, the signature collection communication unit 610 processes a communication for receiving a signature transmitted from various signature generation security systems that are connected. The signature distribution communication unit 620 processes the communication for transmitting the distribution target signature by the administrator to the connected security management system 2. The signature distribution protocol processor 640 supports key distribution and encryption / decryption to authenticate and establish various signature generation security systems 700 or security management systems 2 on the network. The signature authentication and encryption / decryption unit 630 encrypts or decrypts the signature information transmitted and received from the signature collection communication unit 610 and the signature distribution communication unit 620 and transmits the signature information to the signature collector 100 and the signature distributor 400. The processed signature is controlled by the administrator through the signature integration and manager 200 and stored in the DB processor 500.

In addition, the signature integration manager 200 performs the integrated management of the collection / integration / analysis / distribution process for the signature (S150) while going through the above-described series of processes (S100 to S140).

Here, the signature collection information processing unit 210 receives a signature of an internal structure type parsed and normalized by the signature collector 100 and transmits the signature to the signature management information processing module. The signature analysis information processor 220 receives the information analyzed by the signature analyzer 300 and transmits the information to the signature management information processor 250. The signature distribution information processing unit 230 processes information for signature distribution by setting of an administrator. The signature management information processing unit 250 controls the information transmitted / received by each processing unit 210, 220, 230 of the signature integrated manager 200 or stores and manages the processed signature information in the DB processor 500. The system management information processor 240 stores and manages management information of each security management system 2 transmitted and received in the DB processor 500. The system management information processing unit 240 transmits, controls, and manages state information of the plurality of signature generation security systems 700 or the security management system 2.

In addition, the signature integrated manager 200 manages according to status information including any one or more of authentication, configuration, management, and failure of the plurality of signature generation security systems 700 and the security management system 2 (S160). ).

As described above, the integrated signature management and distribution method of the network attack according to the present invention can automatically generate signatures to minimize and quickly respond to unknown attacks that threaten the network environment such as worms and viruses. Signatures from security systems can be collected, integrated, and managed to be distributed securely to the security management system on the network in the form of common signature messages.

In addition, the present invention parses a signature generated from a signature generation security system based on a parsing table and normalizes the signature to an internal structure, thereby making it possible to integrate and manage a plurality of signatures taking various forms.

In addition, the present invention can collect the signatures that define the undefined attacks generated in the multiple signature generation security system under a distributed network, distribute them to the security management system and share them so that the entire network can be secured from constantly changing attacks. do.

In addition, the present invention integrates, manages, and distributes automatically generated signatures for unknown network threat attacks to build a signature integrated management framework that can interoperate with the security management system to enable security managers to cooperatively and proactively and quickly respond. do.

On the other hand, the present invention is not limited only to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, the technical idea to which such modifications and variations are also applied to the claims Must see

1 is a block diagram showing a network environment according to the prior art.

2 is a configuration diagram showing an example of the entire network environment to which the present invention is applied.

3 is a configuration diagram showing another example of a network environment to which the present invention is applied.

4 is a block diagram illustrating a configuration of an integrated signature management and distribution system of a network attack according to the present invention.

5 is a block diagram showing a detailed configuration of the signature analyzer of FIG.

6-10 are examples of parsing tables that classify signature distribution message exchange formats.

11 is an example of a signature distribution message exchange format of a security system.

12 is a block diagram of a parsing table classifying signature distribution message exchange formats.

13 is a block diagram showing the detailed configuration of the signature integrated manager according to the present invention.

14 is a block diagram showing a detailed configuration of a signature analyzer.

15 is a block diagram showing a detailed configuration of a signature distributor.

16 is a block diagram showing a detailed configuration of a signature distribution protocol.

17 is a flow chart illustrating a method of integrated signature management and distribution of network attacks in accordance with the present invention.

<Description of the symbols for the main parts of the drawings>

2: security management system 10: integrated signature management and distribution system of network attacks

20: network 30: the Internet

100: signature collector 200: signature integration manager

300: signature analyzer 400: signature distributor

500: DB handler 600: Signature distribution protocol

700: signature generation security system

Claims (18)

An integrated signature management and distribution system for network attacks that collectively manages signatures generated by multiple signature generation security systems in a distributed network environment, A signature collector configured to classify the signatures generated from each signature generation security system according to the information included in each signature and to collect the signatures in the form of an internal structure that can be analyzed; A signature analyzer for analyzing the collected signatures to improve reliability; And A signature distributor for distributing the analyzed signature to a security management system on another network through a signature distribution protocol; Integrated signature management and distribution system of a network attack comprising a. The method of claim 1, The signature collector, And parsing the signature based on a parsing table classifying the information items included in the signature to normalize the signature into the internal structure. The method of claim 2, The parsing table, Integrated signature management and distribution system of a network attack, characterized in that it comprises one or more of the certificate information and system connection state information class of the signature. The method of claim 3, wherein The certificate information class is Integrated signature management and distribution system of a network attack, characterized in that it comprises one or more of the information, signature information and verification information class of the terminal that generated and verified the signature. The method of claim 4, wherein The signature information class is Integrated signature management and distribution system for network attack, further comprising network information and signature content information class. The method of claim 4, wherein The verification information class is Validation block development Signature management and distribution system in the integration of network attacks comprising one or more of the vendor information, verification result information, packet collection information and packet rule information classes. The method of claim 1, The signature analyzer, Integrated signature management and distribution system of a network attack, characterized in that to improve the reliability of the signature by applying one or more analysis methods of the collected signature-based rules and learning. The method of claim 7, wherein The rule base is, Integrated signature management and distribution system of a network attack, characterized in that it comprises at least one of an aggregation, a correlation (correlation) scheme. The method of claim 7, wherein The learning base, Integrated signature management and distribution system for network attacks, including artificial intelligence. The method of claim 1, The signature dispenser, And a signature distribution message exchange format (SDMEF) or a distributable format according to a security management system for distributing the analyzed signature. The method of claim 1, The signature distribution protocol is, Integrated signature management and distribution system for network attack, characterized in that for supporting the authentication connection through encryption and decryption and key distribution for the analyzed signature. The method of claim 1, A signature integration manager for managing based on status information including one or more of authentication, configuration, management, and failures received from multiple signature generation security systems and security management systems on other networks; Integrated signature management and distribution system of a network attack, characterized in that it further comprises. In the integrated signature management and distribution method of the network attack of the integrated signature management and distribution system of the network attack to collectively manage the signatures generated by multiple signature generation security systems in a distributed network environment, A signature collection step of classifying the signatures generated from each signature generation security system according to the information included in each signature and collecting the signatures in the form of an internal structure that can be analyzed; A signature analysis step of analyzing the collected signatures to improve reliability; And A signature distribution step of distributing the analyzed signature to a security management system on another network through a signature distribution protocol; Integrated signature management and distribution method of a network attack comprising a. The method of claim 13, The signature collection step, And parsing the signature based on a parsing table classifying the information items included in the signature to normalize the signature into the internal structure. The method of claim 13, The parsing table, And at least one of a certificate's certificate information and a system connection state information class. The method of claim 13, The signature analysis step, Integrated signature management and distribution method of the network attack, characterized in that to improve the reliability of the signature by applying one or more analysis methods of the collected signature-based rules and learning. The method of claim 13, The signature distribution step, And distributing the analyzed signature to a signature distribution message exchange format (SDMEF) or a distributable format according to a security management system to distribute the analyzed signature. The method of claim 13, The signature distribution protocol is, Integrated signature management and distribution method of a network attack, characterized in that for supporting the authentication connection through encryption and decryption and key distribution for the analyzed signature.

Images