KR20090132787A - System and method for intercepting and controling source address spoofed abnormal traffic - Google Patents

Abstract

PURPOSE: A system and a method for intercepting source address spoofed abnormal traffic are provided to intercept effectively abnormal traffic in network traffic and to control a host for generating spoofed traffic. CONSTITUTION: A plurality of network terminals are connected to a terminal network(100). An edge router(300) connects the terminal network with an external communication network in order to perform routing. A traffic control device(200) transfers a packet between the terminal network and the edge router. The traffic control device inquires a source data link address and a source network address of the moving packet to the inside or the outside to a source address matching table. The traffic control device intercepts the moving state of the packet when the source address is spoofed.

Description

System and method for intercepting and controling source address spoofed abnormal traffic

The present invention relates to a system and method for blocking abnormal traffic, and more particularly, to an abnormal traffic blocking system and method for blocking traffic having a forged source datalink address and a source network address occurring in a terminal network. .

TCP / IP, a protocol currently used on the Internet, is fundamentally vulnerable to forgery and alteration since the user can arbitrarily change the contents of addresses such as source and destination. These vulnerabilities have been exploited by malicious hackers since the Internet first appeared and continue to this day.

Denial-of-service attacks, known as DoS attacks, which began to be known in the world since 1997, appeared as a random alteration of source network addresses. Initially, denial of service attacks attacked the destination service host by spoofing the source address by several or dozens of computers.

Decentralized Denial of Service (DDoS) attacks have since appeared and, except for multiple distributed forms of attack, it also makes it difficult to trace back exactly where and how it has been tampered with by changing the source address. Unlike worms, the number of host computers infected with bots called botnets is increasing, and the damage to the Internet continues.

Therefore, various methods are currently being developed to prevent or forge a source network address. For example, a method called 'source routing' may be mentioned.

By setting 'source routing' as an option for IP, you can specify some or all of the network routes in advance so that the destination can trace back the route to verify that the source network address is correct. This method has been found to be exploitable by hackers. To avoid routing decisions, this option is currently disabled on most network devices or hosts.

Next, there is a method called 'ingress filtering'. In contrast, for all packets coming from the router, the reverse path is traced, and if it goes to the same interface as the incoming interface, it is assumed to be a normal source address and vice versa.

However, even in this case, there is a performance penalty to trace back all the packets, and if the network is designed asynchronously, there is a possibility that a normal packet may be mistaken as abnormal.

Next, there is a method called 'rp_filter', which is similar to ingress filtering, in which the host responds to packets coming from all interfaces and rejects packets that cannot go to the interface. This also has no effect if you use only one interface.

As described above, attempts have been made to prevent the movement of a packet having a forged source network address, but have not yet given a concrete and clear solution.

The present invention has been made to solve such a conventional problem, the network by detecting the movement of a packet having a forged source network address, effectively blocking the abnormal traffic in the network traffic, the network by controlling the host generating the forged traffic An object of the present invention is to provide an abnormal traffic blocking system and method for increasing the reliability of a service.

To achieve the above object, the abnormal traffic blocking system according to the present invention includes a terminal network, an edge router, and a traffic control device.

A plurality of network terminals are connected to the terminal network, and the edge router connects the terminal network to an external communication network to perform routing.

In addition, the traffic control apparatus forwards the packet between the terminal network and the edge router, and inquires about the source data link address and the source network address of the packet moving into and out of the terminal network in an address matching table, indicating that the source address is forged. If determined, block the movement of the packet.

With this configuration, by detecting the packets with the forged source data link address and the source network address, effectively block abnormal traffic leaked to the outside from the external terminal network, and control the host generating the forged traffic, increase the reliability of the network service. Can be.

When the moving packet is an ARP response packet that goes out of the terminal network, the traffic control device inquires whether the source data link address and the source network address of the response packet are registered in the source address matching table, and searches for an unregistered source address. Can be registered in the source address matching table. As a result, a large amount of source information of a packet corresponding to normal traffic can be secured, and movement of other packets can be made faster by using the secured information.

If the outgoing packet is not an ARP response packet but a packet having a destination network address, the traffic control device inquires whether the source data link address and the source network address of the packet having the destination network address are registered in the source address matching table. It can block the movement of unregistered packets.

In other words, since a packet whose source address is not registered in the address matching table is regarded as a changed packet, even a packet with abnormal traffic may be blocked to completely block the abnormal traffic.

In addition, if the moving packet is a packet coming into the terminal network and having a data link address, the traffic control device inquires whether the source data link address and the source network address of the incoming packet are registered in the source address matching table. The non-registered source address can be registered in the source address matching table.

As a result, a large amount of source information of a packet corresponding to normal traffic can be secured, and movement of other packets can be made faster by using the obtained information.

When the incoming packet is a packet having a destination network address, the traffic control device inquires whether the source data link address and the source network address of the packet having the destination network address are registered in the source address matching table, In this case, packet movement can be blocked.

Through this, it is possible to effectively block abnormal traffic such that the source address of the incoming packet is the same as the source address of the destination.

In addition, the traffic control device may transmit information on the traffic according to the movement of the packet to the outside. That is, it can be informed of the abnormal behavior information of any network terminal to be able to detect and manage the network abnormal behavior using the abnormal traffic.

The abnormal traffic blocking system according to the present invention may further include a central management server that receives and analyzes traffic information transmitted from one or more traffic control devices, generates statistical information, and manages traffic.

As a result, it is possible to identify and analyze various abnormal traffics occurring in the network to predict the appearance of worms or bots, or to identify zero-day attacks as soon as possible to minimize the damage and to alert the target network or host to the attack. can do.

In addition, the present invention embodies the above-described forged internet address blocking system in the form of a method.

According to the present invention, a packet having a forged source data link address and a source network address is detected to effectively block abnormal traffic leaked from an external terminal network, and control a host generating forged traffic to improve reliability of a network service. It can increase. In addition, various abnormal traffic generated in the network can be identified and analyzed to predict the appearance of worms or bots, or zero-day attacks can be identified as soon as possible to minimize the damage.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. In order to more clearly understand the present invention, the same reference numerals are used for the same components in different drawings.

1 is a diagram illustrating an embodiment of an abnormal traffic blocking system according to the present invention. The abnormal traffic blocking system for blocking a packet having a forged source network address includes a terminal network 100, an edge router 300, a traffic control device 200, and a central management server 500.

A plurality of network terminals 110 are connected to the terminal network 100, and the edge router 300 connects the terminal network 100 to an external communication network to perform routing.

In addition, the traffic control device 200 refers to a facility or apparatus using a technique for blocking abnormal traffic using a data link address and a network address, and transmits a packet between the terminal network 100 and the edge router 300. The source data link address (L2 address, MAC address) and source network address (L3 address, IP address) of the packet moving into and out of the terminal network 100 are queried in the address matching table, indicating that the source address is forged. If determined, block the movement of the packet.

The method of determining whether the source address is forged or not by querying the source address (source data link address and source network address) of the packet to the address matching table is based on the traffic control apparatus 200 to the terminal network 100 in which the packet is internal. It depends on whether you are coming in or out to the external edge router 300.

In the case of outgoing packets, the packet movement is blocked when the source address of the packet is not registered in the source address matching table of the traffic control apparatus 200. In the case of the incoming packet, the source address of the packet is If it is registered in the source address matching table, the packet movement is blocked.

When the moving packet is an ARP response packet that goes out of the terminal network 100, the traffic control apparatus 200 inquires whether the source data link address and the source network address of the response packet are registered in the source address matching table, and registers it. Source addresses that are not already registered can be registered in the source address matching table.

In this case, the moving packet means a packet moving from the network terminal 110 of the terminal network 100 to the edge router 300, not the packet moving to the external network through the edge router 300. This may be regarded as normal traffic, and as a result, a large amount of source information of a packet corresponding to normal traffic may be secured, and thus, the obtained information may be used to more quickly move out of another packet.

When the outgoing packet is not an ARP response packet and a packet having a destination network address, the traffic control apparatus 200 registers a source data link address and a source network address of a packet having a destination network address in a source address matching table. By querying whether there are any, it is possible to block the movement of unregistered packets.

In this case, the moving packet may mean a general packet going to the edge router 300, and may be regarded as normal traffic when the source address of the packet is registered in the address matching table.

For example, when the source address of the packet is registered or the packet is blocked as described above, the terminal network 100 address is' C. 1. If 100 ', the network number' 1. 1.1 is fixed and only the host number '100' can be changed. If the network address of a packet not stored in the address matching table is' 1. 1. If it is' 101 ', the fixed network number is the same, so the address of this packet is registered, and the network address is' 1. 2. 1. If it is 100 ', the network number to be fixed has changed, so it is regarded as abnormal traffic and blocks the movement of packets.

That is, when it is confirmed that the source address of the packet is changed as described above (if it is regarded as abnormal traffic), the packet may be blocked. Therefore, by applying the traffic control device 200 to a service network such as an ISP (Internet Service Provider), it is possible to fundamentally block abnormal traffic such as a distributed denial of service attack to reduce the damage to the Internet.

In addition, when the moving packet is a packet coming into the terminal network 100 and having a data link address, the traffic control apparatus 200 includes a source data link address and a source network address of the packet coming into the source address matching table. It is possible to inquire whether or not is registered at, and register an unregistered source address in the address matching table.

In this case, the moving packet may mean an ARP response packet of the edge router 300 coming into the terminal network 100 from the edge router 300 and may be regarded as normal traffic. As a result, a large amount of source information of a packet corresponding to normal traffic can be secured, and a movement into another packet can be made faster by using the secured information.

If the incoming packet is a packet having a destination network address, the traffic control apparatus 200 inquires whether the source data link address and the source network address of the packet having the destination network address are registered in the source address matching table. If registered, the movement of the packet can be blocked.

In this case, the moving packet refers to a general packet coming from an external communication network through the edge router 300.

 The fact that the source data link address and the source network address of the packet flowing from the external network are registered in the source address matching table means that the external source address and the internal source address match, and thus may be regarded as abnormal traffic.

In addition, the traffic control apparatus 200 may transmit information on the traffic according to the movement of the packet to the outside. In other words, it can be informed of the abnormal behavior information of any network terminal 110 to be able to detect and manage the network abnormal behavior using the abnormal traffic.

With this configuration, by detecting a packet having a forged source data link address and a source network address, it effectively blocks abnormal traffic leaked from the internal network to the outside, and controls the network terminal 110 to generate forged traffic. It can increase the reliability.

The central management server 500 may receive and analyze traffic information transmitted from one or more traffic control devices 200, generate statistical information, and manage traffic. The type of analysis may include a terminal network generating abnormal traffic. The frequency and amount of abnormal traffic occurrence, the terminal network attacking the abnormal traffic, the type of service attacked by the abnormal traffic, and the correlation analysis of the abnormal traffic occurring simultaneously.

In this way, by identifying and analyzing various abnormal traffic generated in the terminal network 100 to predict the appearance of worms or bots, or to identify the zero-day attack as soon as possible to minimize the damage, The attack destination terminal network 100 or the network terminal 110 may be alerted.

2 is a diagram illustrating data link address and network address translation of the terminal network 100 and the traffic control apparatus 200.

Each network terminal 110 includes a data link address and a network address of a source, a data link address and a network address of a target (destination), a data link address is a MAC address, and a network address means an IP address. .

In the table shown in FIG. 2, one of a plurality of network terminals 110 is taken as an example, a destination address matching table 112 storing a data link address and a network address of a target that the network terminal 110 has, and traffic. A source address matching table 210 that the control device 200 has.

The source address matching table mentioned in the above description of FIG. 1 refers to the source address matching table 210 of the traffic control apparatus 200, and the source address matching table 210 is connected to the terminal network 100. Data network addresses and network addresses of all network terminals 110 are stored.

The illustrated table will be described with reference to the description of FIGS. 3 and 4 to be described later.

3 is a flowchart illustrating an embodiment in which the traffic control apparatus 200 operates when a packet goes out of the terminal network 100.

For outgoing packets from inside to outside, the datalink address and network address of the destination cannot be forged. The reason is that if the data link address and network address of the destination are forged, the packet is not correctly delivered to the destination network terminal 110 even if the packet does not go out or does not go out at all.

Therefore, in the case of hackers or malicious programs with bad intentions, the destination address to be attacked is not forged, and the source address is changed to make tracking impossible.

When the source address is forged, there may be a case where only the source datalink address is forged, only the source network address is forged, and both the source datalink address and the source network address are forged.

In all of these cases, by managing the data link address matching table and the network address matching table separately, the source forgery can be known, and the packet in the above-mentioned case causing abnormal traffic can be detected and blocked.

First, the traffic control apparatus 200 checks whether the packet outgoing from the terminal network 100 to the external edge router 300 is an ARP response packet including a data link address for the ARP request broadcast from the edge router 300. (S100).

 The packet to be transmitted to the outside may be an IP packet, an IP packet such as PCT / UDP, an ARP response packet, and the like. If the packet to be transmitted to the outside is an ARP response packet, the traffic control apparatus 200 performs source matching. Manage the table (S110).

At this time, the source matching is performed by using the source address matching table 210 as shown in FIG. 2. The source data link address of the ARP response packet is stored in the source data link address and the source network address stored in the source address matching table 210. And query whether the source network address is included, and register if the source address is not registered in advance.

That is, the terminal network 100 may inquire which network address range, which network terminal 110 responds, and the like, and is not registered among the source data link address and the source network address of the ARP response packet. You can manage the table by registering the source address.

In this case, the criterion of whether to register a packet for which a source address is not registered or to regard it as abnormal traffic can be known by changing the network number in the network address as described with reference to FIG. 1.

Then, as described above, the packet having a newly registered source address is transmitted to the outside (S140).

Next, if the outgoing packet in the terminal network 100 is not an ARP response packet but a general packet having a network address of the destination (S120), this packet means a packet going out to the external communication network through the edge router 300. .

The traffic control apparatus 200 compares whether a source address of a packet having a destination network address is registered in the source address matching table 210 (S130), and if so, delivers the packet to the outside of the terminal network 100. If not registered (S140), the packet is blocked (S150). The reason for blocking the packet is because the source network address has been changed and was considered forged.

If the packet going out of the terminal network 100 in step S120 is not both an ARP response packet or a general packet having a destination network address, the layer tray is other than 2, 3, for example, an IP packet such as PCT / UDP, an RGMP packet, or the like. In case of another tray packet, the packet is transferred directly to the outside (S140).

Then, the traffic control apparatus 200 includes all packets (datalink addresses or network addresses) transmitted to the outside of the terminal network 100 and registered in the source address matching table 210 of the traffic control apparatus 200. Packets, and packets that are layer trays other than Layer 2 and Layer 3, and blocked packets (packets that include the network address but whose source address is not registered in the source address matching table 210 of the traffic control apparatus 200). The traffic information for the central management server 300 is transmitted (S300).

4 is a flowchart illustrating an embodiment in which the traffic control apparatus 200 operates when a packet enters the terminal network 100.

First, it is checked whether the packet coming into the terminal network 100 is an ARP response packet from the edge router 300 including the data link address (S200).

That is, when there is no data link address of the edge router 300 in the destination address matching table 112 of one of the network terminals 110 of the terminal network 100, the data link address is included in the corresponding edge router 300. When sending an ARP request packet requesting, it is to check whether the incoming packet is an ARP response packet from the edge router 300 for this request.

 When the incoming packet is an ARP response packet from the edge router 300, the traffic control apparatus 200 performs source matching and manages a table (S210).

Source matching uses the source address matching table 210 as shown in FIG. 2 to query whether the source address of the edge router 300 included in the ARP response packet is registered in the source address matching table 210. will be.

As a result of the inquiry, if it is not registered, the unregistered source data link address and source network address are registered in the address matching table 210 to manage the table, and from the edge router 300 corresponding to the newly registered source address. The ARP response packet is transmitted to the destination network terminal 110 that is inside the terminal network 100 (S240).

Next, if the packet coming into the terminal network 100 from the edge router 300 to the inside (general packet) having the network address of the destination (destination) (S220), the source of the generic packet coming into the interior from the traffic control device 200 Inquiry is made whether the address is registered in the source address matching table 210 (S230).

If it has a source network address that is the same as the internal terminal network address despite coming in from the outside, it is changed and blocks the packet (S250). If it has a source network address different from the internal terminal network address, the packet corresponds to the destination address. Transfer to the network terminal 110 (S240).

If the packet coming into the terminal network 100 is not a packet including a data link address or a destination network address, for example, a packet in which the layer tray is a tray other than 2 and 3, and is inside the terminal network 100. Immediately transfer to the network terminal 110 (S240).

Then, all packets delivered to the inside of the terminal network 100 (packet including the data link address or the network address and the source address registered in the source address matching table 210 of the traffic control apparatus 200, and the layer). Traffic information about packets that are layer trays other than Layer 2 and Layer 3 and blocked packets (packets including network addresses but whose source addresses are not registered in the source address matching table 210 of the traffic control apparatus 200). Transmission to the central management server 300 (S300).

5 is a flowchart illustrating in detail a step of generating traffic statistics information generated in the central management server 500. In FIG. 5, a step of generating statistical information on abnormal traffic will be described.

First, the traffic information is received from the traffic control device 200 (S400).

Next, normal traffic suitable for the source address matching table 210 of the traffic control apparatus 200 as the traffic information on the packet moving into and out of the network terminal 110 is described with reference to FIGS. 1 to 4. If (S500), and generates and stores statistical information about the normal traffic (S600).

In this case, the statistical information may include the number of traffic generated during a predetermined period and a source address or a destination address for the corresponding traffic.

On the other hand, if the traffic information is abnormal traffic that is not suitable for the source address matching table 210 of the traffic control apparatus 200 (S500), first, the source of the traffic control apparatus 200 to estimate the generation location of the abnormal traffic The data link address of the abnormal traffic is registered in the address matching table 210 (S510).

In this case, if the data link address is registered, the network terminal 110 of the network address corresponding to the registered data link address may be regarded as generating abnormal traffic (S520), and if the data link address is not registered, the data Both the link address and the network address may be regarded as forged (S530), and the location where the abnormal traffic is generated may be regarded as generated in the terminal network 100 because the abnormal traffic is for the outgoing packet from the inside.

If the generation position of the abnormal traffic is estimated, it is checked whether the next abnormal traffic is a network address of the same destination (S540). That is, when information by repeated traffic is accumulated, the information is analyzed. The network address information of the network terminal, which is an attacked destination, is cumulatively updated (S550), whereby a plurality of network terminals 110 provide network devices having a predetermined network address. If you continue to attack, you can find the destination network address that is being attacked.

Next, it is checked whether repeated abnormal traffic is a transport service of the same destination (S560). That is, when information by repeated traffic is accumulated, the information is analyzed, and when the service information of the target network device under attack is cumulatively updated (S570), when multiple network devices continue to attack the network device of the same destination service, the attack is performed. The service type of the receiving network terminal 110 may be found.

The abnormal traffic statistics information generated through the above steps is stored (S600).

The central management server 500 uses the stored abnormal traffic statistics information and the normal traffic statistics information to the terminal network 100 generating the abnormal traffic, the frequency and amount of occurrence of the abnormal traffic, the network device to which the abnormal traffic is attacked, and the abnormal traffic. The type of the attacking service and the abnormality of traffic occurring simultaneously can be found.

In addition, the information obtained through the statistical information can be used to predict the appearance of worms or bots or to warn network devices that are targeted for attack.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

1 is a view showing an embodiment of an abnormal traffic blocking system according to the present invention.

2 is a diagram illustrating data link address and network address translation of a terminal network and a traffic control apparatus.

3 is a flowchart illustrating an embodiment in which a traffic control apparatus operates when a packet goes out of a terminal network.

4 is a flowchart illustrating an embodiment in which a traffic control apparatus operates when a packet enters a terminal network.

5 is a flow chart illustrating in detail the steps of generating traffic statistics information generated in the central management server.

Claims (13)

A terminal network to which a plurality of network terminals are connected; An edge router connecting the terminal network and an external communication network to perform routing; And It is determined that the source address is forged by transferring a packet between the terminal network and the edge router and querying a source data link address and a source network address of a packet moving into and out of the terminal network. If the traffic control device for blocking the movement of the packet; An ideal traffic blocking system that includes. The method of claim 1, The traffic control device, If the moving packet is an ARP response packet that goes out of the terminal network, it is inquired whether the source data link address and the source network address of the response packet are registered in the source address matching table, and the source address is not registered. Abnormal traffic blocking system, characterized in that registered in the address matching table. The method of claim 1, The traffic control device, If the outgoing packet is not an ARP response packet and includes a destination network address, it is checked whether the source data link address and the source network address of the packet having the destination network address are registered in the source address matching table. The abnormal traffic blocking system characterized by blocking the movement of a packet which is not registered. The method of claim 1, The traffic control device, If the moving packet is an ARP response packet coming into the terminal network, it is checked whether the source data link address and the source network address of the ARP response packet are registered in the address matching table, and the unregistered source address is obtained from the source address. Abnormal traffic blocking system, characterized in that registered in the matching table. The method of claim 1, The traffic control device, If the incoming packet is a packet having a destination network address, it is checked whether the source data link address and the source network address of the packet having the destination network address are registered in the source address matching table. Abnormal traffic blocking system, characterized in that to block the movement of. The method of claim 1, The traffic control device, Abnormal traffic blocking system, characterized in that for transmitting the information about the traffic according to the movement of the packet to the outside. The method of claim 6, A central management server that receives and analyzes traffic information transmitted from one or more traffic control devices, generates statistical information, and manages traffic; The abnormal traffic blocking system further comprises. In the method for blocking the abnormal traffic in the traffic control device located between the terminal network and the edge router connecting the outside, (a) the traffic control apparatus managing the source address matching table in which source addresses of network terminals included in the terminal network are registered using source addresses of packets moving in and out of the terminal network; And (b) blocking the movement of the packet if it is determined that the source address is forged by querying the source address matching table for the source address of the packet moving into and out of the terminal network; Abnormal traffic blocking method comprising a. The method of claim 8, In the step (a), If the packet is an ARP response packet outgoing from the terminal network, the abnormal traffic, wherein the source address of the ARP response packet not registered in the source address matching table is registered to manage the source address matching table. How to block. The method of claim 8, In the step (a), If the packet is an ARP response packet from the edge router coming into the terminal network, the source address matching table is registered by registering a source address of an ARP response packet from the edge router not registered in the source address matching table. The abnormal traffic blocking method characterized in that the management. The method of claim 8, In step (b), If the packet is a general packet including a network address going out of the terminal network, it is checked whether the source address of the general packet is registered in the source address matching table, and if it is not registered, blocking the movement of the general packet. The abnormal traffic blocking method, characterized in that. The method of claim 8, In step (b), If the packet is a general packet including a network address coming into the terminal network, it is checked whether the source address of the general packet is registered in the source address matching table, and if the packet is registered, blocking the movement of the general packet. An abnormal traffic blocking method characterized by the above. The method of claim 8, After step (b), (c) receiving abnormal traffic information of the blocked packet at a central management server; (d) the central management server detecting a source of abnormal traffic according to whether a source data link address corresponding to the abnormal traffic information is registered in the source address matching table; (e) detecting, by the central management server, a network address of an attacked destination by examining a network address repeatedly appearing in the accumulated abnormal traffic information; (f) detecting, by the central management server, a service type of an attacked destination by examining a transport service repeatedly appearing in the accumulated abnormal traffic information; (g) generating, by the central management server, statistical information of the detected result, and managing abnormal traffic using the statistical information; The abnormal traffic blocking method further comprises.

Images