KR20120053661A - Intrusion detection system and method using application hosting - Google Patents

Abstract

PURPOSE: An intrusion detection system and method thereof are provided to reduce overload of an IDS(Intrusion Detection System) processing unit by controlling flows related to IDS. CONSTITUTION: A traffic outflow module(210) establishes an application flow table(212). A packet processing module(207) assorts packet flows by searching the application flow table. The packet processing module transmits the inserted packets to IDS application(213) by using an application hosting method. The IDS application transmits the inserted packets to the packet processing module.

Description

Intrusion Detection System and Method {INTRUSION DETECTION SYSTEM AND METHOD USING APPLICATION HOSTING}

The present invention relates to an intrusion detection system (IDS), and more particularly, to an effective and portable intrusion detection system and method in one communication system based on application hosting technology.

Intrusion Detection System (hereinafter referred to as "IDS") detects and responds to intrusion attempts by outside intruders to illegally use the system's resources without proper authority, or intrusion attempts by internal users to misuse and abuse their rights. A system for the purpose of doing so is generically known. In recent years, as the IT dependence of assets has increased and the possibility and damage of information assets have increased, the importance of IDS equipment has been emphasized, and all communications such as mobile network such as wireless network as well as existing wired network are emphasized. There is a strong demand for security solutions with dedicated security equipment in the system.

In other words, the intrusion detection system detects unwanted manipulation of the system and is used to detect all kinds of malicious network traffic and computer usage that traditional firewalls cannot detect.

The IDS can be largely classified as follows based on a data source.

(1) Network Intrusion Detection System

(2) Host based detection system

(3) hybrid detection system

The network intrusion detection system collects packet data of a corresponding network and uses the same to determine whether an intrusion exists, and targets the entire network area where IDS is installed. The host-based detection system uses the surveillance data generated and collected from the host to determine whether it is an intrusion, and makes the host a detection area. The hybrid system is a combination of the above two methods (network intrusion detection system and host-based detection system).

On the other hand, since IDS equipment requires many complicated operations, most of them are installed as one independent system. 1 is a typical example of installing an existing IDS as one independent component.

1 illustrates a network configuration including IDS according to the prior art.

Referring to FIG. 1, the network includes a first IDS device, a second IDS device, a firewall, and a router. 1 is only to help understand the description of the present invention. Depending on the implementation, the network may include more or fewer IDS equipment, firewalls, routers, and the like.

The firewall is a security system having the ability to select, accept, reject, and modify information transmitted between a network inside an enterprise or an organization and the Internet. By installing a system with a function such as a building firewall, such as a router or an application gateway, at the boundary of the external Internet and the internal dedicated communication network, all information flows only through them.

The first IDS device and the second IDS device detect all kinds of malicious network traffic and computer usage that the firewall cannot detect. The first IDS device and the second IDS device may be installed as one of various IDS devices (network intrusion detection system, host-based detection system, hybrid detection system, etc.) according to the request of the operator.

The router is a device that relays different networks. The router establishes an optimal path for data transmission between two or more networks and the network, and helps the data communicate from one network to another along the corresponding path. It is equipment. That is, it is a device that reads the address of the destination contained in the data and transmits it to another communication network using the most appropriate communication path when transmitting and receiving information through the network.

In the case of constructing IDS equipment as an independent system like this, equipment purchase and maintenance costs are required, and when IDS is integrated in one system to overcome these problems, IDS processing severely affects the processing performance of the system. .

In addition, hacking technology is rapidly evolving, requiring frequent changes such as signatures to detect key intrusions in IDS systems.

Therefore, even after the IDS is built, it is necessary to cope with frequent changes of the detection engine of the system. In addition, IDS itself is a function that requires very complex computational power. In an integrated system in which the "data plane" and the "control plane" are not separated, the processing of the IDS itself affects the system performance. To prevent this, some dedicated IDS equipment may be placed, but this adds significant additional deployment and maintenance costs.

Therefore, there is a need for an effective and portable intrusion detection system and method in one communication system.

An object of the present invention is to provide an intrusion detection system and method in which a data plane and a control plane are separated in one communication system.

Another object of the present invention to provide an intrusion detection system and method based on the Application Hosting Platform (AHP).

It is still another object of the present invention to provide an intrusion detection system and method for easily porting various types of IDS programs.

It is another object of the present invention to provide an intrusion detection system and method that operate efficiently in one system without an independent IDS device.

According to a first aspect of the present invention for achieving the above objects, in an intrusion detection system (IDS), in the packet processing apparatus, a traffic leakage module for setting an application flow table, and the application flow table A packet processing module for searching and selecting an incoming packet flow, and transmitting the incoming packet to the corresponding IDS application by using application hosting; and the corresponding IDS application for retransmitting the incoming packet to the packet processing module. Characterized in that.

According to a second aspect of the present invention for achieving the above objects, in an intrusion detection system (IDS), in the packet processing method, the traffic leakage module, the process of setting an application flow table, and packet processing Selecting, by the module, the packet flow by searching the application flow table; transmitting the incoming packet to the corresponding IDS application by using application hosting; and by the corresponding IDS application, the incoming packet is stored. And retransmitting to the packet processing module.

As described above, by providing an intrusion detection system based on an Application Hosting Platform (AHP), there is an advantage that IDS can be efficiently operated in one system without an independent IDS device. In addition, using application hosting technology, various types of IDS applications can be ported through simple interworking with the packet API. In addition, since IDS operates as one application within the same application, even if a new algorithm is applied later, it can be easily applied by simply modifying the application.

On the other hand, since the IDS processing part operates as an entity that is completely independent from the packet data processing part, the IDS processing is hardly affected by general packet processing. In addition, since flows related to IDS processing can be defined, load of the IDS processing portion can be reduced.

1 is a block diagram of a network including IDS according to the prior art,
2 is a block diagram of an overall intrusion detection system according to an embodiment of the present invention;
3 is a flow chart for operating an intrusion detection system according to an embodiment of the present invention;
4 is a flowchart for setting an application flow table in an intrusion detection system according to an embodiment of the present invention;
5 is a flow chart for delivering a packet to an IDS application using an application hosting technique in an intrusion detection system according to an embodiment of the present invention;
6 is a flowchart for retransmitting a packet from a control processing area to a data processing area in an intrusion detection system according to an exemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings. In the following description of the present invention, detailed descriptions of related well-known functions or configurations will be omitted if it is determined that the detailed description of the present invention may unnecessarily obscure the subject matter of the present invention. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the specification.

Hereinafter, the present invention will be described with reference to an effective and portable intrusion detection system (hereinafter referred to as "IDS") and method in one communication system based on an application hosting technology. In particular, a technique of operating an IDS integrated in one communication system using an application hosting technology will be described.

The application hosting is a service that enables the use of the application using the Internet. For example, programs such as word processors and spreadsheets do not run directly on their computers, but on the Internet and on their servers. You don't need to buy any software, and you can run it on a computer that doesn't have it installed.

Hereinafter, in the description of the present invention, a communication system includes a data plane such as a network processor for high-speed packet processing, a dedicated network processor unit (NPU) such as a field programmable gate array (FPGA), and the like. It is assumed that it is divided into parts for complicated control processing (hereinafter referred to as a control plane).

In addition, the IDS equipment may be implemented as a separate equipment in the communication system, or may be implemented together with other equipment in the communication system. For example, the WiBro system may be implemented with equipment such as a radio access station (RAS) or an access control router (ACR).

2 is a block diagram of an overall intrusion detection system according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the intrusion detection system is physically divided into operations of a data plane 201 and a control plane 202 in one communication system.

The data processing unit 201 includes a packet processing module 207 to perform packet delivery order determination function and packet related additional service function for high speed packet processing.

In addition to the present invention, when the packet processing module 207 receives a packet through the interface 203, the IDS flow identifier 208 retrieves the application flow table 212 (hereinafter referred to as application hosting). The application packet is determined whether to transmit the received packet 215 to the control processor 202 or to the outside through the external interface 206 after performing the packet processing. Then, the reception processor 219 of the data processing unit 201 transmits the packet retransmitted from the control processing unit 202 to the control processing unit 202 (that is, the block that was processing the retransmission packet). Send to (209).

Here, when the received packet 215 is sent to the IDS application 213 of the control processing unit 202, metadata 216 and retransmission information 217 are added to the packet 215. The meta information 216 is various additional information for an application hosting process, and the retransmission information 217 is configured to send the packet 215 to the data processor 201 after the IDS application 213 performs an IDS operation. Required when retransmitting.

Meanwhile, the packet processing module 207 may further receive a packet flow through the other interfaces 204 and 205.

The control processing unit 202 outputs the information necessary for the application flow table 212 to the outside, including a traffic export module (210). The externally output information is stored in a memory (not shown). That is, application flow table 212 is stored in memory to allow access to IDS flow identifier 208. The input of the traffic export module 210 is composed of a packet API 218 or a command line interface (CLI) 218.

Hereinafter, a method of setting the application flow table 212 by the packet API 218 or the command line interface (CLI) 218 will be described with reference to FIG. 4, and the data processor 201 receives the packet received from the system in FIG. 5. The flow of retrieving the application flow table 212, transmitting the packet to the corresponding IDS program using the application hosting is described, and the packet is transmitted from the control processing unit 202 to the data processing unit 201 in the system in FIG. We will explain the flow of retransmission.

3 is a flowchart illustrating an intrusion detection system operation according to an exemplary embodiment of the present invention.

Referring to FIG. 3, the intrusion detection system receives a packet flowing from a network through an interface in step 301.

In step 303, the intrusion detection system searches the application flow table 212 set by the packet API 218 ′ or the command line interface (CLI) 211 when the packet is received. The application flow table 212 is a list of flows for performing an intrusion detection function.

In step 305, when the flow corresponding to the received packet exists in the application flow table, the intrusion detection system proceeds to step 307. When the flow corresponding to the received packet is not present in the application flow table, Proceed to step 323.

In step 307, the intrusion detection system adds 'meta data 216' to the rear part of the payload of the packet, and transmits the packet to which the meta information is added in step 309 to the control plane. The above structure selectively performs IDS operation on a specific flow, thereby preventing performance degradation of packet processing performed in the existing data processing area regardless of IDS.

Here, the flow table search may be performed in various processes of the entire packet processing of the data processing region. To distinguish this, resend info is defined to mean location information (hereinafter, referred to as a hooking point) of a packet processing process that will be returned to the data processing area after transmission to the control processing area.

Meanwhile, 'meta data' transmitted with the packet is various additional information for 'Application Hosting' processing. That is, the corresponding 'application identifier' and 'retransmission information' are basically included in the metadata, and other additional information for controlling 'Application Hosting' operation is included.

Thereafter, the intrusion detection system performs an application hosting process in step 311. That is, the intrusion detection system transfers the packet to the IDS application 213 based on the 'application hosting' after the packet is transmitted to the control processing area. The application hosting delivers the packet to the IDS application 213 based on the application identifier Application_ID included in the metadata of the packet. Here, the identifier of the IDS application 213 is set by the packet API or CLI.

On the other hand, an IDS application such as "Snort" is configured in conjunction with the packet API 218. That is, any application with IDS can be combined with the packet API, and the packet API performs the following functions.

First, the information on the flow to be transmitted to the control processing area for IDS processing is set through the traffic leakage module 210. Second, when it is determined that the packet is normal in the IDS application, the packet processing module 207 retransmits the packet.

In step 313, the intrusion detection system uses the IDS application 213 to perform IDS processing. In step 315, when the packet is delivered to the IDS application, the intrusion detection system filters the packet to check whether the packet is harmful.

If it is determined that the packet is harmful, in step 316, the packet is dropped in the IDS application.

In contrast, if it is determined that the packet is not harmful, the packet is retransmitted to the data processing region in step 317.

In step 319, the intrusion detection system identifies a hooking point of the retransmitted packet based on the retransmission information. Here, hooking means intercepting an execution path of another process, and the hooking point means a position of a processor to process the retransmitted packet.

In step 321, the intrusion detection system sends the retransmitted packet to the point where the packet was processed in the original data processing area before transmitting the retransmitted packet to the IDS application.

In step 323, the intrusion detection system processes the remaining processes for the packet, and sends the processed packet through the external interface in step 325.

As described above, in the data processing region, only a specific flow for processing the IDS is selected and transmitted to the IDS application existing in the control processing region. Through this process, it is possible to reduce the load of packets to be processed in the IDS application while maintaining the same packet processing performance in the existing data processing area.

4 is a flowchart illustrating an application flow table setting in the intrusion detection system according to an exemplary embodiment of the present invention. FIG. 4 illustrates only functional blocks related to application flow table setting in the intrusion detection system block diagram of FIG. 2.

Referring to FIG. 4, the application flow table 405 is located in a memory area accessible from both the data processing area and the control processing area, and the traffic leakage module 404 is a packet API 403 or a command line interface (CLI). From the tuple, information such as flow information and application identifier (Application ID) is set in the application flow table 405. The tuple is a set of values arranged in order. For example, {Flow Info, Application ID} is an example of a tuple.

The packet API 401 is set when the application is initialized. When the packet API 401 is set, the CLI 403 can be set dynamically at any time after the initialization.

FIG. 5 illustrates a flow of delivering a packet to an IDS application using an application hosting technique in an intrusion detection system according to an exemplary embodiment of the present invention. FIG. 5 shows only a functional block for delivering a packet to an IDS application using an application hosting scheme in the intrusion detection system configuration of FIG. 2.

Referring to FIG. 5, as described above, in the "IDS flow identifier", the IDS application determines which IDS application the packet is transmitted by referring to the information set in the "application flow table." The packet to be sent to the IDS application is transmitted by adding "meta data" which contains various packet control information to the end of the packet.

The metadata may include a variety of additional information to control the operation of the application hosting itself, the application identifier and retransmission information must be included. In addition, it may include additional information such as packet processing level and time stamp. The IDS application receives the packet to be processed according to the application identifier.

6 is a flowchart illustrating retransmission of a packet from a control processing area to a data processing area in an intrusion detection system according to an exemplary embodiment of the present invention. FIG. 6 shows only functional blocks for retransmitting packets from the control processing area to the data processing area in the intrusion detection system configuration of FIG.

Referring to FIG. 6, the IDS application 604 examines the received packet by its policy, drops the harmful packet and retransmits the harmful packet to the data processing area. Here, the packet API 605 combined with the IDS application 604 performs a retransmission function. When the packet is retransmitted to the data processing region, 'resend info' 608 of the packet received from the data processing region is added to the end of the payload of the packet and transmitted.

The receiving processor 606 of the data processing area analyzes retransmission information attached to the packet after receiving the packet from the IDS application 604, and branches the packet to the processing point after the previous processing.

For example, after a packet received by the system has been processed up to " Block 4 " 601 and then sent by the IDS flow identifier 602 to the IDS application 604, the receive processor 606 retransmitted the packet. Is sent to the next block, Block 5 (607).

As described above, it is possible to construct a system in which the IDS processing hardly affects the data processing performance of the existing system. In addition, since the IDS processing engine is provided in the form of one application program, even when a new intrusion prevention method or the like is changed, it can respond very quickly, and if necessary, an entirely different IDS processing engine can be easily ported.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

2

Claims (16)

In the Intrusion Detection System (IDS), in the packet processing apparatus,
A traffic leakage module that sets up an application flow table,
A packet processing module for searching the application flow table to select an incoming packet flow and then transmitting the incoming packet to a corresponding IDS application by using application hosting;
And the corresponding IDS application for retransmitting the incoming packet to the packet processing module.
The method of claim 1,
The traffic leakage module,
Device for setting the application flow table using a packet application programming interface (API) or a command line interface (CLI).
The method of claim 1,
The packet processing module,
An interface for receiving the incoming packet;
An IDS flow identifier for searching whether the flow information corresponding to the incoming packet is included in the application flow table,
And the packet processing module attaches meta information to the incoming packet and transmits the meta information to the corresponding IDS application.
The method of claim 3, wherein
The meta information includes at least one of an application identifier, retransmission information, and a level and a time stamp of the incoming packet.
The method of claim 1,
And the corresponding application and a packet application programming interface (API) combine to perform an application hosting function.
The method of claim 1,
Receiving the incoming packet from the application, and further comprising a receiving processor for transmitting the incoming packet to the processing block based on the retransmission information,
The packet processing module,
And continuing to perform the remaining work from the corresponding processing block.
The method according to claim 6,
And the retransmission information includes at least one of a processing level and a time stamp of the incoming packet.
The method of claim 1,
The intrusion detection system is divided into a data processing area and a control processing area,
The traffic leakage module and the corresponding IDS application are included in the control processing area, and the packet processing module is included in a data processing area.
In the intrusion detection system (IDS), in the packet processing method,
The traffic leakage module configures the application flow table,
Filtering, by the packet processing module, the incoming packet flow by searching the application flow table;
Transmitting the incoming packet to the corresponding IDS application by using application hosting;
And retransmitting, by the corresponding IDS application, the incoming packet to the packet processing module.
The method of claim 9,
The application flow table is set by the packet application programming interface (API) or the command line interface (CLI).
The method of claim 9,
In the packet processing module, the process of selecting an incoming packet flow by searching the application flow table may include:
Receiving the incoming packet;
Detecting whether flow information corresponding to the incoming packet is included in the application flow table,
When the incoming packet is transmitted to the corresponding IDS application, meta information is attached to the incoming packet and transmitted to the corresponding IDS application.
The method of claim 9,
The meta information includes at least one of an application identifier, retransmission information, and a level and a time stamp of the incoming packet.
The method of claim 9,
And combining the corresponding application with a packet application programming interface (API) to perform an application hosting function.
The method of claim 9,
Retransmitting the incoming packet from the application and transmitting the incoming packet to a corresponding processing block based on retransmission information;
And continuing to perform the remaining work from the corresponding processing block.
The method of claim 9,
The retransmission information includes at least one of a processing level and a time stamp of the incoming packet.
The method of claim 9,
The intrusion detection system is divided into a data processing area and a control processing area,
The traffic leakage module and the corresponding IDS application are included in the control processing area, and the packet processing module is included in a data processing area.

Images