KR20120073022A - Pseudo packet monitoring system for address resolution protocol spoofing monitoring of malicious code and pseudo packet monitoring method therefor - Google Patents

Abstract

PURPOSE: A virtual packet monitoring system and method thereof are provided to easily determine the occurrence of an ARP(Address Resolution Protocol) spoofing by comparing ARP information within the SNMP(Simple Network Management Protocol) information of apparatuses. CONSTITUTION: A first ARP information extraction module(100) extracts first ARP information for apparatuses connected to a network of a host PC(Personal Computer). A second ARP information extraction module(200) constructs a virtual network in the host PC. The second ARP information extraction module extracts second ARP information within the SNMP information of the apparatus connected to the virtual network. An ARP information comparison module(300) determines the occurrence of an ARP spoofing attack by comparing the first ARP information with the second ARP information.

Description

Virtual packet monitoring system and method for monitoring address resolution protocol spoofing of malicious code {PSEUDO PACKET MONITORING SYSTEM

The present invention relates to a virtual packet monitoring system and method for monitoring address determination protocol spoofing of malicious codes, and to addressing ARP spoofing attacks by comparing ARP information collected through two paths. A virtual packet monitoring system and method thereof for spoofing monitoring.

Address Resolution Protocol Spoofing (ARP Spoofing) (hereinafter referred to as ARP Spoofing) is a data packet of a counterpart using an address resolution protocol message under a Local Area Network (LAN). Is a man-in-the-middle attack that intercepts an attacker. The attack exploits the loopholes in the ARP protocol used by LANs to fool its Media Access Control (MAC) addresses as if they were MACs of other computers. The ARP spoofing attack is also known as an 'ARP Cache Poisoning attack' because it randomly changes ARP cache information. In the past, it was easy to sniff in a dummy hub environment. However, in a recent switch environment, a packet is delivered only to a computer having a corresponding MAC, which makes sniffing easier than in a dummy environment. However, attackers can use ARP spoofing to sniff packets even in a switched environment by spoofing their MAC address to the MAC address of the router or target server they want to sniff. This attack is also used for attacks that attempt to tamper with and retransmit packets, rather than sniffing and stealing packets. No matter how secure a server is, it is easy to find that if there is an insecure server in the network that contains it, an ARP spoofing attack can easily leak or tamper with data. ARP spoofing can also be used for phishing / pharming attacks that impersonate financial institutions. When a user makes a DNS request to access a financial site, an attacker can use the ARP spoofing technique to send the user to the fake site by sending the IP address of the fake site to the user.

It is an object of the present invention to provide a virtual packet monitoring system and method for monitoring address resolution protocol spoofing of malicious code that can effectively determine the occurrence of an ARP spoofing attack.

In order to achieve the above object, the present invention provides a first ARP information extraction module for extracting first ARP information for devices connected to a network of a host PC, and configures a virtual network in the host PC, and accesses the virtual network. A second ARP information extraction module for extracting second ARP information included in the SNMP information of the device; and an ARP information comparison module for determining an ARP spoofing attack by comparing the first ARP information and the second ARP information; It provides a virtual packet monitoring system for spoofing the address determination protocol of malicious code comprising a.

The ARP spoofing determination module may further include determining an ARP spoofing attack by comparing the MAC address of the device connected to the host PC's network with ARP information. The ARP spoofing determination module receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and destination hardware of destination MAC address and ARP information registered in the received Ethernet frame. It may include a destination comparison module for comparing the address to determine the occurrence of the ARP spoofing attack. In addition, the ARP spoofing determination module receives an ARP request message, an ARP response message and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and the source MAC address and ARP information registered in the received Ethernet frame. It may include a source comparison module for comparing the source hardware address to determine the occurrence of the ARP spoofing attack. The ARP spoofing determination module receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and when two ARP response messages are received for one ARP request message. It may include a response message determination module for determining that the ARP spoofing attack occurs.

In addition, the present invention transmits an ARP information request message to the devices connected to the network of the host PC to receive an ARP response message, extracting the first ARP information included in the ARP response message, and virtual to the host PC Configuring a network, collecting SNMP information of each device connected to the virtual network, extracting second ARP information included in the corresponding SNMP information, and comparing the first ARP information with the second ARP information to spoof ARP. A virtual packet monitoring method for address determination protocol spoofing monitoring of malicious code may include providing an attack.

An ARP spoofing attack by receiving an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and comparing the destination MAC address registered in the received Ethernet frame with the destination hardware address of the ARP information. The method may further include determining occurrence. In addition, the ARP request message and the ARP response message and the Ethernet frame received between the devices connected to the network of the host PC is received, and the ARP by comparing the source hardware address of the ARP information and the source MAC address registered in the received Ethernet frame The method may further include determining a spoofing attack. Receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and determines that an ARP spoofing attack occurs when two ARP response messages are received for one ARP request message. It may further comprise the step.

The present invention compares ARP information (first ARP information) collected directly from devices connected to a network with ARP information (second ARP information) included in SNMP information of devices connected to a network to determine whether ARP spoofing has occurred. It is possible to provide a virtual packet monitoring system and method for monitoring address determination protocol spoofing of malicious code that can be easily determined.

In addition, the present invention is a virtual packet monitoring system for spoofing the address determination protocol of malicious code that can detect the ARP spoofing attack in advance to prevent the leakage of various confidential information that can be stored in the host PC, such as personal information, technical information And a method thereof.

1 is a conceptual diagram of a virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code according to the present invention;
2 is a flow chart of a virtual packet monitoring method for address resolution protocol spoofing monitoring of malicious code in accordance with the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

It will be apparent to those skilled in the art that the present invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, It is provided to let you know. Like reference numerals in the drawings refer to like elements.

1 is a conceptual diagram of a virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code according to the present invention.

As shown in FIG. 1, the virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code according to the present invention includes a first ARP information extraction module 100 for extracting ARP information about devices connected to a network of a host PC. And a second ARP information extraction module 200 for extracting ARP information included in SNMP information of each device by configuring a virtual network in the host PC, and each of the first ARP information extraction module and the second ARP information extraction module. ARP information comparison module 300 for comparing the extracted ARP information, and ARP spoofing determination module 400 for determining the occurrence of ARP spoofing based on the MAC address and ARP information.

The first ARP information extraction module 100 transmits an ARP information request message to devices connected to a network, receives an ARP response message, and extracts and stores ARP information included in the corresponding ARP response message in a first table. Here, ARP information stored in the first table is defined as first ARP information.

The second ARP information extraction module 200 configures a virtual network environment in the system, collects SNMP information of all network devices existing in the virtual network, extracts ARP information included in the corresponding SNMP information, and stores the ARP information in the second table. That is, the second ARP information extraction module 200 configures a virtual network environment in the system, sets up a gateway having a predetermined MAC address, sends an SNMP message to all network devices existing on the virtual network, and then sends the actual MAC address. Store in the second table in advance. Here, the ARP information stored in the second table is defined as the second ARP information.

The ARP information comparison module 300 compares the first ARP information stored in the first table with the second ARP information stored in the second table to determine whether ARP spoofing has occurred. That is, the ARP information comparison module 300 configures a virtual network with the first ARP information included in the ARP response message of the network and compares the second ARP information included in the SNMP information of each device. In this case, when the first ARP information and the second ARP information are different, the ARP information comparison module 300 determines that ARP spoofing has occurred. Of course, to do this, devices connected to the virtual network must have the SNMP service enabled.

The ARP spoofing determination module 400 determines the occurrence of ARP spoofing based on the MAC address and the ARP information. To this end, the ARP spoofing determination module includes a destination comparison module 410, a source comparison module 420, and a response message determination module 430.

The destination comparison module 410 receives an ARP request message and an ARP response message and an Ethernet frame transmitted and received between devices connected to a network, and when an Ethernet frame is received, a destination MAC address and a destination of the ARP information registered in the received Ethernet frame. It is determined whether ARP spoofing has occurred depending on whether hardware addresses are inconsistent. Of course, if there is a mismatch between the destination MAC address registered in the Ethernet frame and the destination hardware address of the ARP information, the destination comparison module determines that ARP spoofing has occurred.

The source comparison module 420 determines the occurrence of the ARP spoofing according to whether or not the source MAC address registered in the received Ethernet frame and the source hardware address of the ARP information are inconsistent. In this case, too, when the source MAC address registered in the received Ethernet frame and the source hardware address of the ARP information do not match, the source comparison module determines that ARP spoofing has occurred.

The response message determination module 430 determines whether ARP spoofing has occurred according to whether two ARP response messages are received for one ARP request message. In this case, when two ARP response messages are received for one ARP request message, the response message determination module determines that ARP spoofing has occurred.

As described above, the present invention compares ARP information (first ARP information) directly collected from devices connected to a network with ARP information (second ARP information) included in SNMP information of devices connected to a network. It is possible to provide a virtual packet monitoring system for spoofing an address determination protocol for malicious code that can easily determine whether spoofing has occurred. In addition, the present invention is a virtual packet monitoring system for spoofing the address determination protocol of malicious code that can detect the ARP spoofing attack in advance to prevent the leakage of various confidential information that can be stored in the host PC, such as personal information, technical information Can be provided.

Next, a virtual packet monitoring method for monitoring address determination protocol spoofing of malicious code according to the present invention will be described with reference to the accompanying drawings. In the following description, duplicate descriptions of the virtual packet monitoring system for monitoring the address determination protocol spoofing of the malicious code according to the present invention will be omitted or briefly described.

2 is a flowchart illustrating a virtual packet monitoring method for monitoring address determination protocol spoofing of malicious code according to the present invention.

In the virtual packet monitoring method for address determination protocol spoofing monitoring of malicious code according to the present invention, as shown in FIG. 2, the first ARP information is extracted (S1) and the second ARP information is extracted (S2). ), Comparing the ARP information (S3), and determining the occurrence of the ARP spoofing attack (S4).

In the extracting of the first ARP information (S1), an ARP response message is transmitted by sending an ARP information request message to devices connected to the network, and the ARP information included in the corresponding ARP response message is extracted, that is, the first ARP information is extracted. Store in the first table.

Extracting the second ARP information (S2) comprises configuring a virtual network, collecting SNMP information of each device connected to the virtual network, and extracting ARP information included in the corresponding SNMP information, that is, the second ARP information. 2 Save to table.

The step of comparing the ARP information compares the first ARP information stored in the first table with the second ARP information stored in the second table to determine whether an ARP spoofing attack has occurred. At this time, when the first ARP information stored in the first table and the second ARP information stored in the second table are different, it is determined that an ARP spoofing attack has occurred.

In step S4, the occurrence of the ARP spoofing attack is determined based on the MAC address and the ARP information. To this end, the step of determining the occurrence of the ARP spoofing attack (S4) includes comparing the destination address (S4-1), comparing the source address (S4-2), and determining the response message (S4-3). ).

Comparing the destination address (S4-1), an ARP request message, an ARP response message, and an Ethernet frame are transmitted and received between the devices connected to the network of the host PC, and the destination MAC address and ARP registered in the received Ethernet frame are received. The destination hardware address of the information is compared to determine the occurrence of the ARP spoofing attack. At this time, if the destination MAC address registered in the received Ethernet frame and the destination hardware address of the ARP information is different, it is determined that an ARP spoofing attack has occurred.

Comparing the source address (S4-2) receives an ARP request message and an ARP response message and Ethernet frames transmitted and received between the devices connected to the network of the host PC, the source MAC address and ARP registered in the received Ethernet frame The source hardware address of the information is compared to determine the occurrence of an ARP spoofing attack. Of course, comparing the source address (S4-2) also, if the source MAC address registered in the received Ethernet frame and the source hardware address of the ARP information is different, it is determined that an ARP spoofing attack has occurred.

Determining the response message (S4-3) receives an ARP request message, an ARP response message and an Ethernet frame transmitted and received between the devices connected to the network of the host PC, two ARP responses to one ARP request message If a message is received, it is determined that an ARP spoofing attack has occurred.

As described above, the present invention compares ARP information (first ARP information) directly collected from devices connected to a network with ARP information (second ARP information) included in SNMP information of devices connected to a network. A virtual packet monitoring method can be provided for spoofing an address determination protocol of malicious code that can easily determine whether spoofing has occurred. In addition, the present invention is a virtual packet monitoring method for monitoring the address resolution protocol spoofing of malicious code that can detect the ARP spoofing attack in advance to prevent the leakage of various confidential information that can be stored in the host PC, such as personal information, technical information Can be provided.

Although described above with reference to the drawings and embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit of the invention described in the claims below. I can understand.

100: first ARP information extraction module 200: second ARP information extraction module
300: ARP information comparison module 400: ARP spoofing determination module
410: destination comparison module 420: source comparison module
430: response message determination module

Claims (9)

A first ARP information extraction module for extracting first ARP information about devices connected to a network of a host PC;
A second ARP information extraction module for configuring a virtual network in the host PC and extracting second ARP information included in SNMP information of the device connected to the virtual network;
And an ARP information comparison module for comparing the first ARP information and the second ARP information to determine the occurrence of an ARP spoofing attack. The method according to claim 1,
Virtual packet monitoring system for monitoring the address determination protocol spoofing of malicious code, characterized in that it further comprises an ARP spoofing determination module to determine the occurrence of the ARP spoofing attack by comparing the MAC address and ARP information of the device connected to the network of the host PC . The method according to claim 2,
The ARP spoofing determination module receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and destination hardware of destination MAC address and ARP information registered in the received Ethernet frame. A virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code, comprising: a destination comparison module for determining an ARP spoofing attack by comparing addresses. The method according to claim 2,
The ARP spoofing determination module receives an ARP request message and an ARP response message and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and source hardware of the source MAC address and ARP information registered in the received Ethernet frame. A virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code, comprising: a source comparison module for determining an ARP spoofing attack by comparing addresses. The method according to claim 2,
The ARP spoofing determination module receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and when two ARP response messages are received for one ARP request message. A virtual packet monitoring system for monitoring address determination protocol spoofing of malicious code, comprising a response message determination module for determining that an ARP spoofing attack has occurred. Receiving an ARP response message by transmitting an ARP information request message to devices connected to a network of the host PC, extracting first ARP information included in the corresponding ARP response message;
Configuring a virtual network in the host PC, collecting SNMP information of each device connected to the virtual network, and extracting second ARP information included in the corresponding SNMP information; and
And comparing the first ARP information with the second ARP information to determine the occurrence of an ARP spoofing attack. The method of claim 6,
An ARP spoofing attack by receiving an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and comparing the destination MAC address registered in the received Ethernet frame with the destination hardware address of the ARP information. Virtual packet monitoring method for monitoring address determination protocol spoofing of malicious code, characterized in that it further comprises the step of determining the occurrence. The method of claim 6,
An ARP spoofing attack by receiving an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and comparing the source MAC address registered in the received Ethernet frame with the source hardware address of the ARP information. Virtual packet monitoring method for monitoring address determination protocol spoofing of malicious code, characterized in that it further comprises the step of determining the occurrence. The method of claim 6,
Receives an ARP request message, an ARP response message, and an Ethernet frame transmitted and received between devices connected to the network of the host PC, and determines that an ARP spoofing attack occurs when two ARP response messages are received for one ARP request message. The virtual packet monitoring method for monitoring the address determination protocol spoofing of malicious code further comprising the step of.

Images