KR20130014300A - Cyber threat prior prediction apparatus and method - Google Patents

Abstract

PURPOSE: A cyber threat prediction device and a method thereof are provided to predict extensive attacks for a global network by determining a botnet as a sign for cyber threats. CONSTITUTION: A DNS(Domain Name System) based C&C(Computer and Communications) server detecting unit(210) extracts a domain address which is doubted as a C&C server by analyzing DNS traffic. A network based abnormal detecting unit(220) detects information of zombie PC(Personal Computer) and detects an IP address of the zombie PC by analyzing network traffic. A cyber threat prediction unit(230) predicts cyber threat situations based on the information of the zombie PC. The network based abnormal detecting unit is installed in an international gate network. The DNS based C&C server detecting unit analyzes the DNS traffic based on an N-tier server, traffic characteristics, and a domain address. [Reference numerals] (210) DNS based C&C server detecting unit; (220) Network based abnormal detecting unit; (230) Cyber threat prediction unit; (AA) DNS server farm; (BB) International gate network

Description

[0001] The present invention relates to a cyber threat prediction apparatus and method,

The present invention relates to an apparatus and method for predicting cyber threats based on botnets.

In cyber space, a lot of threats are emerging. Threat factors on the internet are scattered, such as abusing or collecting personal information of a third party, exploiting forgiveness toward an unspecified majority, distributing advertising mails to gain financial advantage, or preventing competitors' services of information devices.

Threat Management System (RMS) and Risk Management System (RMS) technology to detect threats on the Internet in advance and to provide security policy setting criteria and countermeasures through early warning / alarm through analysis of vulnerability information and domestic and overseas network traffic Has been studied. TMS / RMS technology overcomes the shortcomings of existing security solutions and is emerging as an effective alternative. However, it is difficult to differentiate from existing security solutions because it focuses on warning / alarming the Internet based on the information about the already existing attack situation, there is a limit to local security solution, It is difficult to use it as a solution to detect the threat situation beforehand.

More than 60% of cyber threats such as distributed denial of service (DDoS) attack, spam transmission, personal information leakage,

A botnet is a network of computers infected with bot malicious software. In other words, it can be remotely controlled by bot masters who have the authority to control bots freely and can be infected with thousands of thousands of bots (also called zombies) and commands and controls (C & C and Control) A form of network connection of a server is called a botnet.

Early botnets were mainly focused on centralized botnets using IRC (Internet Relay Chat), which is flexible and widely used. In such a centralized botnet, a single C & C server commands / controls multiple bots, which makes it easy to detect C & C servers, and many bots are lost due to the detection and blocking of C & C servers, It comes. Therefore, in order to make the detection and response of C & C server more difficult, it is necessary to divide the HTTP protocol based on the web protocol or the centralized command / control structure (IRC, HTTP botnet) Method, that is, P2P botnet.

These evolving botnets are a serious threat to assets, along with serious attacks such as distributed denial-of-service attacks, spam transmission, and personal information disclosure.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems and provides a cyber threat dictionary Prediction apparatus and method.

According to an aspect of the present invention, there is provided a cyber threat prediction apparatus comprising: a DNS-based C & C server detection unit for analyzing DNS traffic to extract a suspected domain address as a C & C server; A network-based abnormal detection unit for detecting IP addresses of zombie PCs connected to the C & C server by analyzing network traffic and detecting information of zombie PCs; And a cyber threat prediction unit for predicting the cyber threat situation based on the information of the zombie PCs.

The network-based abnormal detection unit may be installed in the international gateway network.

The DNS-based C & C server detectors can analyze DNS traffic based on domain addresses, traffic characteristics, or N-tiers.

The network-based abnormal detection unit may detect the connection information of the zombie PCs to the C & C server.

The network-based abnormal detection unit can verify the C & C server based on the access information of the zombie PCs to the C & C server.

The network-based abnormal detection unit may detect the network structure-based threat information and the behavior-based threat information of the zombie PCs.

The network structure-based threat information may include a bot size, a number of accesses of the bots, or a number of bots propagated to the ISP domain.

The behavior-based threat information may include a spam attack, a scan attack action, a binary download action, or an exploit execution action.

The cyber threat prediction unit may predict a cyber threat situation based on the network structure-based threat information and the behavior-based threat information.

The cyber threat prediction unit may calculate a threat index quantified based on the network structure-based threat information and the behavior-based threat information, and may predict a cyber threat situation using the quantified threat index.

According to an aspect of the present invention, there is provided a cyber threat prediction method comprising: analyzing DNS traffic to extract a suspected domain address from a C & C server; Analyzing network traffic to detect IP addresses of zombie PCs accessing the C & C server and detecting information of zombie PCs; And predicting a cyber threat situation based on the information of the zombie PCs.

The step of detecting the information of the zombie PCs may analyze the network traffic of the international gateway network.

The step of detecting information of the zombie PCs may include detecting the connection information of the zombie PCs to the C & C server.

The step of detecting the information of the zombie PCs may include the step of verifying the C & C server based on the connection information of the zombie PCs to the C & C server.

The step of detecting information of the zombie PCs may include detecting the network structure-based threat information and the action-based threat information of the zombie PCs.

The step of predicting the cyber threat situation may predict a cyber threat situation based on the network structure-based threat information and the behavior-based threat information.

The step of predicting the cyber threat situation may include the steps of: calculating a threat index quantified based on the network structure-based threat information and the behavior-based threat information; And estimating the cyber threat situation using the quantified threat index.

According to the present invention, a botnet, which is a large-scale attack means for a cyber threat, is determined as a symptom of a cyber threat, and a threat can be predicted before a large-scale attack targeting the global network actually occurs.

1 shows an example of a botnet structure to which the present invention is applied.
FIG. 2 shows a configuration of a cyber threat prediction apparatus according to an embodiment of the present invention.
FIG. 3 shows a more specific configuration of the cyber threat prediction apparatus according to an embodiment of the present invention.
4 is a flowchart of a cyber threat prediction method according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In the following description and the accompanying drawings, substantially the same components are denoted by the same reference numerals, and redundant description will be omitted. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

1 shows an example of a botnet structure to which the present invention is applied. As shown in the figure, a botnet includes computers (zombies) 120 and 130 infected by a plurality of bots connected to the network, and a C & C server 110 for commanding / controlling them. As shown, the botnet may be a centralized structure 140 or a distributed structure 150, or a hybrid structure combining a centralized structure and a distributed structure.

In this botnet configuration, infected bots use DNS service to communicate with C & C server. The reason for using the DNS service here is that if a fixed C & C IP address is assigned, the C & C server can be easily blocked by a countermeasure such as forcibly blocking the corresponding IP address because IP tracking is easy. In order to avoid this countermeasure of attackers, many bots use the DNS service to access the C & C server through a domain address. In addition, DDNS (Dynamic DNS) Fast-Flux, where the IP address corresponding to the domain name is continuously changed in a more advanced manner, makes detection of the C & C server more difficult.

FIG. 2 shows a configuration of a cyber threat prediction apparatus according to an embodiment of the present invention. The cyber threat pre-prediction apparatus according to the present embodiment includes a DNS-based C & C server detection unit 210, a network-based abnormal detection unit 220, and a cyber threat prediction unit 230.

The DNS-based C & C server detection unit 210 is installed on the side of a DNS server or a DNS server farm and analyzes the DNS traffic to extract a suspected domain address as a C & C server. The DNS-based C & C server detecting unit 210 may be applied to an ISP (Internet Service Provider) network and a DNS server group region of a local network. The DNS-based C & C server detecting unit 210 transmits a DNS query to the DNS server to obtain the IP address of the extracted suspected domain address.

The network-based abnormal detection unit 220 analyzes the network traffic based on the network, detects the IP addresses of the zombie PCs connected to the suspect C & C server extracted by the DNS-based C & C server detection unit 210, It verifies the C & C server based on information, and detects threat information and behavior based threat information based on network structure of C & C servers and zombie PCs. It is preferable that the network-based abnormal detection unit 220 is installed in an international gateway network and analyzes network traffic passing through the international gateway network as shown in the figure. Since the C & C server mainly commands and controls the bots residing in the foreign countries and domestically, it can effectively detect the bots communicating with the C & C server by installing the network-based abnormal detection unit 220 in the international gateway network.

The cyber threat prediction unit 230 quantifies the cyber threat possibility based on the network structure-based threat information and the behavior-based threat information detected by the network-based abnormal detection unit 220 to calculate a quantified threat index, Use the index to predict the cyber threat situation. Then, the cyber threat prediction unit 230 provides information on the cyber threat situation to the administrator, and alerts / alarms the threat situation. Through the cyber threat prediction unit 230, the cyber threat at the global network level is recognized before the attack, so that a cyber threat example / alert becomes possible.

FIG. 3 shows a more specific configuration of the cyber threat prediction apparatus according to an embodiment of the present invention. The DNS-based C & C server detecting unit 210 includes a DNS traffic collecting unit 211, a DNS traffic analyzing unit 212, and a suspicious domain / IP database 213. The network-based abnormal detection unit 220 includes a network traffic collecting unit 221, a zombie IP detecting unit 222, a network analyzing unit 223, a C & C server verifying unit 224, and a relevance analyzing unit 225. The cyber threat prediction unit 230 includes a threat index calculating unit 231, a threat situation predicting unit 232, a user interface 233, and a black list / white list database 234.

In the DNS-based C & C server detecting unit 210, the DNS traffic collecting unit 211 collects DNS traffic and generates a DNS traffic dataset. The blacklist / whitelist database 234 has already known blacklist domains and whitelist domain information. The DNS traffic collection unit 211 collects blacklist domain information And white domain information to filter the collected DNS traffic.

The DNS traffic analyzer 212 analyzes the collected DNS traffic and extracts a suspected domain address from the C & C server. When DNS traffic is analyzed, the DNS traffic analyzing unit 212 can analyze the traffic based on the domain, the traffic characteristic, or the N-tier. In addition, the DNS traffic analyzing unit 212 may analyze two or more analysis techniques in combination.

For domain-based analysis, an N-gram algorithm or a ZipFian algorithm can be used. These algorithms are a technique for extracting domain addresses combined with characters that are not used well with normal domain addresses. When analyzing on the basis of traffic characteristics, botnets using DDNS or Fast-Flux analyze these characteristics as they have a very short time to live (TTL) and generate similar patterns of connections or instantaneous high-volume connections. Since the structure of botnets is diverse, it is effective to combine various analysis techniques rather than using one analysis method. Evolved C & C servers and bots tend to look random in their connection patterns, but unlike normal users, they have a certain pattern because they are commanded and controlled by infected bots. The DNS traffic analyzer 212 analyzes the DNS query sent to and received from the DNS server, and obtains the IP address of the domain address of the suspect C & C server from the DNS traffic that queries in a specific pattern. The domain address and the IP address of the suspicious DNS server are stored in the suspicious domain / IP database 213.

In the network-based abnormal detection unit 220, the network traffic collection unit 221 collects network traffic.

The zombie IP detecting unit 222 detects an IP address (hereinafter referred to as zombie IP) of the zombie PCs connected to the suspect C & C server using the domain address and the IP address of the suspect C & C server from the collected network traffic.

The network analyzer 223 detects connection information such as connection type, connection status, connection count, connection pattern, and the like of the detected zombie PC, detects the communication type of the zombie PC connecting to the domain address of the suspicious C & C server, do. Also, the network analyzer 223 analyzes the similarity of the network behavior between the zombie PCs accessing the domain address of the suspicious C & C server.

The C & C server verifying unit 224 analyzes the result of the analysis by the network analyzing unit 223, that is, the DNS-based C & C server detecting unit 210 based on the connection information and the communication type of the zombie PC, ) To detect suspicious C & C servers. Specifically, the C & C server verifier 224 determines whether there is an abnormality in network activity between the suspicious C & C server and the zombie PCs based on the analysis result of the network analyzer 223, C & C servers and zombie PCs are identified as active.

The association analyzer 225 analyzes the association between the active < RTI ID = 0.0 > state < / RTI > C & C server and the zombie PC. When the network-based anomaly detection unit 220 is applied to the international gateway network, the association between the C & C server and the domestic bots can be analyzed.

The association analyzer 225 calculates the size of the corresponding C & C bots, the number of accesses of the bots to the C & C server, and the degree of propagation of the bots in each ISP domain as an association between the C & C server and the zombie PC. These information can be represented as follows, which is information indicating the threats based on the network structure of the C & C servers and bots.

1. Bot Size B _size : Number of bots of all ISP domains connecting to the corresponding C & C server

2. Frequency between C & C and Bots B _frequency : Number of bots connected to the corresponding C & C server

3. Number of bots propagated to the ISP domain B _p : Number of bots propagated per each ISP domain (B _p ≤ B _size )

In addition, the association analyzer 225 analyzes the behavior of active bots. The association analyzer 225 can detect the malicious behavior of the bots by analyzing the contents of the command and control message packet transmitted from the C & C server to the zombie PC. The behavior of a bot can be classified into four types, for example, a spam attack, a scan attack, a binary download, and an exploit execution. Thus, the behavior of a bot can be represented as follows, which is information representing the behavior-based threat of the C & C server and bots.

1. none (W _n ): If you do not do anything

2. Spam (W _spam )

3. Scan (W _scan )

4. Binary code download (W _Binary )

5. Vulnerability attack (W _E )

Each action can be weighted according to the degree of risk. In general, vulnerability attacks are more dangerous than spam attacks. Therefore, the weight can be given by, for example, W _n = 1, W _spam = 2, W _scan = 3, W _Binary = 4, and W _E =

The association analyzing unit 225 transmits information on the number of bots, the number of connections, the number of bots propagated to each ISP domain, and the behavior information of the bots to the cyber threat prediction unit 230 as described above.

The DNS traffic analysis unit 212 and the network-based abnormal detection unit 220 may be installed in various DNS server farms and a plurality of international gateway networks. The cyber threat prediction unit 230 includes a plurality of DNS traffic analysis units 212 ) And the network-based abnormal detection unit 220 and can predict the threat situation of the global network.

In the cyber threat estimating unit 230, the threat index calculating unit 231 quantifies the cyber threat possibility based on the information received from the network-based abnormal detecting unit 220 to calculate a quantified threat index. The threat index calculating unit 231 can calculate the following threat index.

1. Threat level (D _T )

2. Degree of vulnerability of ISP domain (V _ISP )

< 1 (1에 근사할수록 해당 ISP 도메인은 취약함)

<1 (the closer to 1 the weaker the ISP domain is)

Here, the degree of threat (D _T ) indicates the degree of threat of the global network, and if calculated for a specific ISP domain, indicates the threat level of the corresponding ISP domain.

The threat situation prediction unit 232 predicts the threat situation using the threat index calculated by the threat index calculating unit 231. [ For example, the degree of threat (D _T ) or the degree of vulnerability of the ISP domain (V _ISP ) is compared with a threshold value, and if the threshold value is exceeded, it is determined that there is a threat. As another example, the level of threat potential may be defined according to the degree of threat (D _T ) or the degree of vulnerability of the ISP domain (V _ISP ). Potential threats can be judged on a global network or on a specific ISP domain.

The user interface 233 visualizes and displays the threat situation predicted by the threat situation prediction unit 232 so that the user or the administrator can recognize the threat situation. In accordance with an embodiment, the user interface 233 may issue a yes / alarm through the sound in addition to the visualization display.

As described above, the blacklist / whitelist database 234 stores known blacklist domains and whitelist domain addresses. The domain address of the active C & C server detected by the network-based abnormal detection unit 220 is updated to the black list domain of the black list / white list database 234. In addition, the blacklist domain and the whitelist domain may be provided to the user or the administrator via the user interface 233. [

4 is a flowchart of a cyber threat prediction method according to an embodiment of the present invention. The cyber threat prediction method according to the present embodiment is composed of the steps processed in the above-described cyber threat prediction apparatus. Therefore, even if omitted in the following description, the above description of the cyber threat prediction apparatus is also applied to the cyber threat prediction method according to the present embodiment.

In operation 410, the DNS-based C & C server detection unit 210 analyzes the DNS traffic and extracts a suspected domain address from the C & C server.

In step 420, the network-based abnormal detection unit 220 detects the IP addresses of the zombie PCs connected to the suspicious C & C server detected in step 410, verifies the C & C server based on the access information of the zombie PCs, It detects threat information and behavior based threat information based on network structure of zombie PCs.

In operation 430, the cyber threat prediction unit 230 quantifies the cyber threat possibility based on the network-based threat information and the action-based threat information detected in operation 420, calculates a quantified threat index, and uses a quantified threat index To predict the cyber threat situation.

In the present invention, the suspicious C & C server is firstly detected through the DNS analysis, and the suspicious C & C is verified by detecting abnormality of the network traffic based on the network. Network-based anomaly detection is effective to apply to international gateway network or international interworking network considering that C & C server mainly commands and controls bots residing abroad and domestic, You can verify the server and detect bots communicating with the C & C server.

The present invention can be applied regardless of the botnet structure, and can be effectively used when the C & C server resides abroad. Since the malicious domain is extracted based on DNS traffic, suspect objects are reduced, and botnet detection This is an advantage that the cyber threat situation can be recognized in advance.

 The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium. The computer-readable recording medium includes a storage medium such as a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM,

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (17)

A DNS-based C & C server detection unit for analyzing DNS traffic to extract suspect domain addresses to the C & C server;
A network-based abnormal detection unit for detecting IP addresses of zombie PCs connected to the C & C server by analyzing network traffic and detecting information of zombie PCs; And
And a cyber threat prediction unit for predicting a cyber threat situation based on the information of the zombie PCs. The method according to claim 1,
Wherein the network-based abnormal detection unit is installed in an international gateway network. The method according to claim 1,
Wherein the DNS-based C & C server detection unit analyzes DNS traffic based on a domain address, a traffic feature, or an N-tier. The method according to claim 1,
Wherein the network-based abnormal detection unit detects connection information of the zombie PCs to the C & C server. The method according to claim 1,
Wherein the network-based abnormal detection unit verifies the C & C server based on access information of the zombie PCs to the C & C server. The method according to claim 1,
Wherein the network-based abnormal detection unit detects network structure-based threat information and behavior-based threat information of the zombie PCs. The method according to claim 6,
Wherein the network structure-based threat information includes a bot scale, a number of accesses of bots, or a number of bots propagated to an ISP domain. The method according to claim 6,
Wherein the behavior-based threat information includes a spam attack, a scan attack, a binary download, or an exploit execution. The method according to claim 6,
Wherein the cyber threat prediction unit predicts a cyber threat situation based on the network structure-based threat information and the behavior-based threat information. The method according to claim 6,
Wherein the cyber threat prediction unit calculates a threat index quantified based on the network structure based threat information and the behavior based threat information and predicts a cyber threat situation using the quantified threat index, Device. Analyzing the DNS traffic to extract a suspected domain address from the C & C server;
Analyzing network traffic to detect IP addresses of zombie PCs accessing the C & C server and detecting information of zombie PCs; And
And predicting a cyber threat situation based on the information of the zombie PCs. 12. The method of claim 11,
Wherein the step of detecting the information of the zombie PCs analyzes the network traffic of the international gateway network. 12. The method of claim 11,
The step of detecting information of the zombie PCs comprises:
And detecting connection information of the zombie PCs to the C & C server. 12. The method of claim 11,
The step of detecting information of the zombie PCs comprises:
And verifying the C & C server based on access information of the zombie PCs to the C & C server. 12. The method of claim 11,
The step of detecting information of the zombie PCs comprises:
Detecting threats based on the network structure of the zombie PCs and behavior-based threat information. 16. The method of claim 15,
Wherein the step of predicting the cyber threat situation predicts a cyber threat situation based on the network structure based threat information and the behavior based threat information. 16. The method of claim 15,
The step of predicting the cyber threat situation comprises:
Calculating a threat index quantified based on the network-structure-based threat information and the behavior-based threat information; And
And estimating a cyber threat situation using the quantified threat index.

Images