KR20130105769A - System, method and computer readable recording medium for detecting a malicious domain - Google Patents

Abstract

PURPOSE: Malicious domain detection system, method and recording medium are provided to effectively detect a malicious domain by automatically generating a detection rule for malicious domain request action by collecting and updating the malicious domain information. CONSTITUTION: A malicious domain management server (100) collects information about malicious domains by input of a manger or automatic collection. The malicious domain management server manages, maintains, analyzes or inspects the information about the malicious domains. A threat management system manager (150) provides the information about the malicious domains to the malicious domain management server. The threat management system manager automatically generates a malicious domain detection rule from the information about the malicious domains. A threat management system sensor (140) detects inclusion of malicious domain related link information. [Reference numerals] (100) Malicious domain management server; (110) Internet; (120) Router; (130) Fire wall; (140) MDDS sensor; (150) MDDS manager; (160) Internal network switch; (170) Company intranet; (180) User device

Description

TECHNICAL FIELD [0001] The present invention relates to a malicious domain detection system, a method, and a computer readable recording medium.

The present invention relates to a malicious domain detection system, method and computer-readable recording medium, and more particularly, to a malicious domain detection system and method for detecting malicious domain request behavior by collecting and updating malicious domain information, .

In general, the Internet is an open network configured to freely connect and use a common protocol called TCP / IP to a remote computer to be accessed anywhere in the world and to anyone. It is an open network that not only transmits basic character information but also develops compression technology, And various services such as e-mail, file transfer, and World Wide Web (WWW), which are used for delivering the service, can be used.

As the use of the Internet has rapidly increased in Korea and the world, the importance of the Internet has been rapidly increasing as a strategic tool for improving efficiency and productivity throughout the existing industries. As a result, new business opportunities through the Internet have been continuously created , And the number of Internet service providers is also increasing.

On the other hand, as an element that hinders the communication environment through the Internet, an attack is made to attack desired information by using a malicious program to attack a specific target computer connected to the Internet.

A malicious program is a malicious code written for malicious purposes. It is also called malware, malicious code. It is also called a malicious code, ), Worm virus (Trojan Horse), and the like.

In addition, spyware, similar to malicious programs, is software that infiltrates another person's computer and extracts important personal information. In recent years, it has been developed to find out user names, IP addresses, favorite URLs, personal IDs and passwords. It is becoming a problem because there are many possibilities to be used maliciously. The main symptoms caused by such malicious programs are network traffic, system performance degradation, file deletion, e - mail sending, personal information leakage, remote control, etc. In addition, most malicious programs are applied various analysis disruption techniques so that the intention and behavior of the malicious program can not be easily noticed even if the malicious program is analyzed by security experts.

For example, a general malicious program (i.e., malware) detection process scans malware based on a signature as an example, and performs a malware processing process when malware is detected.

The signature-based malware diagnosis method is a method of collecting and diagnosing virus samples. In other words, when new computer viruses come into play, antivirus vendors have to figure out how to collect, diagnose and treat these samples and add them to the antivirus database. This method is referred to as a reactive method, and the sign of the virus is referred to as a 'signature'.

As described above, the conventional malicious program detection method generates a signature through expert analysis of previously discovered malicious programs, and when the same malicious program is used based on the generated signature, most of the detected malicious programs are very similar to malignant malicious programs Malicious programs that do not have exactly the same signature as the malicious program have limitations in that they can not be detected, and there is a problem that it is impossible to detect and cope with unknown malicious programs immediately.

On the other hand, as a technique for detecting such malicious programs or malicious sites, Korean Patent Registration No. 10-1044274 entitled "A malicious site detection apparatus, a method and a recording medium on which a computer program is recorded (AhnLab, A method of determining whether the current site is a dangerous site or a process that is currently running on the computer is abnormal by checking whether the certificate is included in the process at the time of executing the process of the program that is down at the site and whether the stack structure is normal .

However, the symptom and the spreading method due to the malicious program are gradually becoming complicated and intelligent, and there is a limitation in that such conventional antivirus program can not diagnose and treat various malicious programs.

On the other hand, an attack that accounts for the largest percentage of recent attacks is to request a malicious page or download a malicious file using HTTP (HyperText Transfer Protocol). That is, malicious files are downloaded and executed using various software and protocol vulnerabilities.

Therefore, there is a need for a technology for registering and maintaining a list of malicious domains according to recent cyber attack tendencies, and for alerting users to packets flowing on the network.

[Patent Document 1] Korean Registered Patent No. 10-1044274 Malicious site detection apparatus, method, and recording medium on which a computer program is recorded (AhnLab, Inc.) 2011.06.20

An object of the present invention is to provide a malicious domain detection system, method, and computer readable recording medium that collects and updates malicious domain information and automatically generates and applies detection rules for a malicious domain request behavior.

Another object of the present invention is to provide a malicious domain detection system, method, and computer-readable recording medium that collects and updates malicious domain information to automatically generate detection rules for a malicious domain request action and apply the rules to the threat management system have.

In order to achieve the above-described object of the present invention and to achieve the specific effects of the present invention described below, the characteristic structure of the present invention is as follows.

According to an aspect of the present invention, a malicious domain detection system is a malicious domain detection system that collects malicious domain information by input or automatic collection of an administrator, and manages, maintains, analyzes, or inspects information about the malicious domain server; A threat management system manager for receiving malicious domain information from the malicious domain management server and automatically generating a malicious domain detection rule from information on the malicious domain; And a threat management system sensor for receiving the generated malicious domain detection rule from the threat management system manager and detecting whether malicious domain related link information is included in a packet transmitted on the network.

Preferably, the malicious domain detection rule is implemented in the form of 'snort' which includes an action, a protocol, a sender IP, a sender port, a receiver IP, a receiver port, .

Preferably, the malicious domain management server comprises: a malicious domain collector for collecting a malicious domain list in at least one method and storing the collected malicious domain list in a malicious domain information database; A malicious domain registration unit for receiving a malicious domain input by a user and performing verification and registering the malicious domain in the malicious domain information database; A malicious domain analysis unit for determining whether each domain collected or registered by the malicious domain collecting unit and the malicious domain registering unit is malicious domain; A domain list classifying unit for classifying malicious domains stored in the malicious domain information database into a plurality of types; A domain activation checking unit for checking whether each domain stored in the malicious domain information database is activated; And a domain country discrimination unit for determining in which country each malicious domain stored in the malicious domain information database is located.

Preferably, the threat management system manager comprises: an analysis information receiver for storing information analyzed by the threat management system sensor in a packet analysis information database; An information request receiving unit for receiving an information request for an analysis result input from a user terminal; And a UI information generator for providing the packet analysis information stored in the packet analysis information database to the user terminal according to the information request received from the information request receiver.

Preferably, the threat management system sensor includes: a packet collection driver for collecting packet data transmitted over a network; A packet parser for parsing packets collected by the packet collection driver; A packet analyzer for analyzing the packet parsed by the packet parser; A link information request unit for requesting the threat management system manager for domain information corresponding to the extracted link information as a result of the analysis; A detection rule receiving unit for receiving detection rule information automatically generated corresponding to the corresponding domain information from the threat management system manager according to the request; And a malicious domain checking unit for checking the malicious domain by the received detection rule.

Preferably, the packet analyzer includes: a URL extractor for extracting URL information from request information included in the collected packet; A link information extracting unit for extracting all the link information from the data excluding the header of the HTTP packet and checking whether the domain of the link is a malicious domain; A response link extracting unit for extracting and inspecting a link in a redirect response based on a shortened URL request; A content extracting unit for extracting and inspecting a link from the content of the response code; And an XSS response link checking unit for checking whether a link corresponding to the XSS action is requested in response to the request.

According to another aspect of the present invention, a malicious domain detection system includes malicious domain management for collecting malicious domain information by input or automatic collection of an administrator, managing malicious domain information for managing, maintaining, server; A malicious domain detection rule is provided to the malicious domain management server and malicious domain detection rules are automatically generated from information on the malicious domain, A malicious domain detection system sensor for detecting whether or not link information is included; And a malicious domain detection system manager that receives a result detected by the malicious domain detection system sensor and provides the detected result to the user terminal at the request of the user terminal.

According to still another aspect of the present invention, a malicious domain detection method includes: collecting malicious domain information by input or automatic collection of an administrator from a malicious domain management server; Receiving a malicious domain information from the threat management system manager to the malicious domain management server and automatically generating a malicious domain detection rule from information on the malicious domain; And receiving the generated malicious domain detection rule from the threat management system manager in the threat management system sensor and detecting whether malicious domain related link information is included in the packet transmitted on the network.

According to still another aspect of the present invention, a malicious domain detection method includes: collecting malicious domain information by input or automatic collection of an administrator by a malicious domain management server; and managing, maintaining, Analysis or inspection; The malicious domain detection system sensor receives malicious domain information from the malicious domain management server, automatically generates a malicious domain detection rule from the malicious domain information, and transmits the malicious domain detection rule Detecting whether malicious domain related link information is included in the packet; And providing malicious domain detection system manager with the result detected by the malicious domain detection system sensor and providing the detected result to the user terminal at the request of the user terminal.

Meanwhile, the information for receiving the malicious domain detection method may be stored in a recording medium readable by a server computer. Such a recording medium includes all kinds of recording media in which programs and data are stored so that they can be read by a computer system. Examples include ROMs (Read Only Memory), Random Access Memory, CD (Compact Disk), DVD (Digital Video Disk) -ROM, magnetic tape, floppy disk, optical data storage device, (For example, transmission over the Internet). Such a recording medium may also be distributed over a networked computer system so that computer readable code in a distributed manner can be stored and executed.

As described above, according to the present invention, malicious domains can be effectively detected by the MDDS sensor or the TMS sensor by collecting and updating malicious domain information and automatically generating detection rules for malicious domain requesting actions.

In addition, according to the present invention, it is possible to maintain correct information on a malicious domain by periodically checking an activation state of a corresponding malicious domain by periodically requesting an entity to confirm a response.

In addition, according to the present invention, malicious domain management servers automatically generate detection rules for malicious domains and provide them to the MDDS sensor or TMS sensor, thereby reducing the load on the sensor for detecting malicious domains.

1 is a block diagram of a malicious domain detection system according to an embodiment of the present invention.
2 is a block diagram of a malicious domain detection system according to another embodiment of the present invention.
3 is a diagram illustrating a detailed configuration of a malicious domain management server according to an embodiment of the present invention.
4 is a view showing a detailed configuration of a TMS sensor according to an embodiment of the present invention.
5 is a diagram illustrating a detailed configuration of a TMS manager according to an embodiment of the present invention.
6 is a signal flow diagram illustrating a malicious domain detection procedure according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION The following detailed description of the invention refers to the accompanying drawings that show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

The present invention proposes a malicious domain detection apparatus and method for requesting malicious pages or downloading malicious files using various transmission protocols including HTTP protocol. That is, in the present invention, packets transmitted on the network are analyzed, and malicious domains are detected by comparing the link information included in the packet with the malicious domain list to warn the user. At this time, according to the embodiment of the present invention, malicious domain information is collected from a malicious domain management server collecting and maintaining malicious domain information, and malicious domain detection rules for the malicious domain are automatically generated to detect Malicious Domain Detection (MDDS) System as a malicious domain detection system sensor or a threat management system (TMS) sensor, thereby enabling effective malicious domain detection.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention.

First, a system according to an embodiment of the present invention will be described with reference to Figs. 1 and 2, and detailed configurations of respective apparatuses constituting the system will be described with reference to Figs. 3 to 5. Fig.

The malicious domain detection system is as follows.

1 is a block diagram of a malicious domain detection system according to an embodiment of the present invention. Referring to FIG. 1, a system according to the present invention includes a malicious domain management server 100, an Internet 110, a router 120, a firewall 130, an MDDS sensor 140, an MDDS manager 150, A user terminal 160, a company intranet 170, a user terminal 180, and the like.

First, the malicious domain management server 100 collects malicious domain information by input or automatic collection of an administrator, and manages, maintains, analyzes, or inspects information on the collected malicious domains. At this time, the malicious domain management server 100 communicates with the MDDS sensor 140 to analyze and compare malicious domain information and provide related information to the MDDS sensor 140. In particular, according to an embodiment of the present invention, a detection rule for each malicious domain is automatically generated so that the MDDS sensor 140 detects a malicious domain. The detailed configuration of the malicious domain management server 100 will be described later with reference to FIG. 3

The Internet 110 may be configured as a communication network, such as a wired network or a wireless network, and may be a personal area network (PAN), a local area network (LAN), a metropolitan area network , A metropolitan area network (WAN), and a wide area network (WAN). In addition, the Internet 520 may be a known World Wide Web (WWW), and may partially transmit radio transmission technology used for short-range communication such as Infrared Data Association (IrDA) or Bluetooth It can also be used.

Meanwhile, a packet destined for the user terminal 180 transmitted from the specific server is transmitted to the inside of the company 120 via the router 120, the firewall 130, the internal network switch 160, the company intranet 170, May be transmitted to each user terminal 180. At this time, according to the embodiment of the present invention, when the MDDS sensor 140 analyzes the transmitted packet to request a malicious page or download a malicious file, the MDDS sensor 140 alerts the user.

That is, the MDDS sensor 140 inspects a packet transmitted on the network, extracts a link, compares it with a malicious domain list, notifies the user of the malicious domain list, and stores the IP, MAC, host information, to provide. Details of the MDDS sensor 140 will be described later with reference to FIG.

The MDDS manager 150 provides the user with information compared to the malicious domain management server 100 with respect to the packet analyzed through the MDDS sensor 140 through a user interface (UI) or the like. At this time, the provided information may include IP, MAC, user Internet usage record, and the like. The detailed configuration of the MDDS manager 150 will be described later in the description of FIG.

1, in the MDDS sensor 140, all packets transmitted on the network are checked according to a method described later. At this time, the MDDS sensor 140 requests the malicious domain management server 100 for related information about each malicious domain (①). Accordingly, the malicious domain management server 100 automatically generates a detection rule for each malicious domain and provides the detection rule to the MDDS sensor 140 (2). Alternatively, the MDDS sensor 140 may request and receive malicious domain information from the malicious domain management server 100, automatically generate a detection rule for the malicious domain, and detect malicious domains It is also possible to do.

For example, an automatic rule generation method of the MDDS for detecting the malicious domain may be generated as follows.

Assuming that the URL of the malicious domain is "http://doublediet.com/w.php?f=16&e=2&quot ;, the detection rule that is automatically generated according to the embodiment of the present invention is generated as follows .

alert tcp any any -> any 80 (uricontent: "w.php? f = 16 & e = 2";

content: "Host | 3a20 | doublediet.com"; nocase;

The detection rule may be implemented in the form of 'snort' and may include an action, a protocol, a sender IP, a port, a receiver IP, a port, a content of a detection rule, etc. . That is, the detection rule in the above example means that an alarm signal is generated when the URL of the malicious domain is contained in all the IP packets inputted.

If the malicious domain is detected by the malicious domain detection rule in the MDDS sensor 140, the detection result is transmitted to the MDDS manager 150 (3). The MDDS manager 150 refers to the detection result and applies the security policy (4). For example, the internal network switch 160 may be controlled to block specific packets from entering the corporate intranet 170.

Meanwhile, the TMS (Threat Management System) is one of the integrated security management systems aimed at early detection of threats and reduction or elimination of threats in order to protect internal information assets from external threats. Which can actively respond to and defend against an attack, and can provide a relatively sophisticated and diverse range of information (information on top 5 attack IPs, ports, protocol analysis, recent 5 minute attacks, etc.) to be.

2, each of the functions performed in the MDDS sensor 140 and the MDDS manager 150 is stored in the TMS sensor 210 and the TMS manager 220, which are pre-built according to another embodiment of the present invention. It is also possible to implement it to be included.

2 is a block diagram of a malicious domain detection system according to another embodiment of the present invention. 2, the system according to the present invention includes a malicious domain management server 100, an Internet 110, a router 120, a firewall 130, a TMS sensor 210, a TMS manager 220, A user terminal 160, a company intranet 170, a user terminal 180, and the like.

First, the malicious domain management server 100 collects malicious domain information by input or automatic collection of an administrator as described above with reference to FIG. 1, and manages, maintains, analyzes, or examines information on the collected malicious domains . At this time, the malicious domain management server 100 communicates with the TMS manager 220 to analyze and compare malicious domain information and provide related information to the TMS sensor 210. In particular, a detection rule for each malicious domain is automatically generated according to an embodiment of the present invention, and the TMS sensor 210 detects a malicious domain. The detailed configuration of the malicious domain management server 100 will be described later with reference to FIG. 3

1, a packet destined for a user terminal 180 transmitted from a specific server is transmitted to the router 120, the firewall 130, the internal network switch 160, the corporate intranet 170 to each user terminal 180 within the company. At this time, according to the embodiment of the present invention, when the TMS sensor 210 analyzes the transmitted packet to request a malicious page or download a malicious file, the TMS sensor 210 alerts the user.

That is, the TMS sensor 210 inspects a packet transmitted on the network, extracts a link, compares the extracted packet with a malicious domain list, notifies the user of the malicious domain list, and stores the IP, MAC, host information, to provide. The details of the TMS sensor 210 will be described later with reference to FIG.

The TMS manager 220 provides the user with information compared to the malicious domain management server 100 with respect to the packet analyzed through the TMS sensor 210 through a user interface (UI). At this time, the provided information may include IP, MAC, user Internet usage record, and the like. The detailed configuration of the TMS manager 220 will be described later in the description of FIG.

2, the TMS sensor 210 checks all packets transmitted on the network according to a method described later. At this time, the TMS manager 220 first requests the malicious domain management server 100 for information related to each malicious domain (①). Accordingly, the malicious domain management server 100 automatically generates a detection rule for each malicious domain and provides the detection rule to the TMS manager 220 (2). Alternatively, the TMS manager 220 may be configured to request and receive malicious domain information from the malicious domain management server 100 and automatically generate a detection rule for the malicious domain (3) It is possible. The detection rule for the malicious domain thus generated is provided to the TMS sensor 210 (4), and the TMS sensor 210 detects the malicious domain information included in the packet transmitted by the automatically generated detection rule do.

At this time, the automatic rule generation method for malicious domain detection is as described in the description of FIG.

As described above, if the malicious domain is detected by the malicious domain detection rule in the TMS sensor 210, the detection result is transmitted to the TMS manager 220. The TMS manager 220 applies a security policy by referring to the detection result. For example, the internal network switch 160 may be controlled to block specific packets from entering the corporate intranet 170.

Hereinafter, the detailed structure of each component of the system constituting Figs. 1 and 2 will be described in detail with reference to Figs. 3 to 5. Fig. In the following description, the components (for example, malicious domain management server 100, TMS sensor 210, TMS manager 220, etc.) included in FIG. 2 are described, The malicious domain management server 100, the MDDS sensor 140, the MDDS manager 150, and the like) may be partially or wholly included in the components of FIG.

The malicious domain management server is as follows.

3 is a diagram illustrating a detailed configuration of a malicious domain management server according to an embodiment of the present invention. 3, the malicious domain management server 100 according to the embodiment of the present invention includes a malicious domain collecting unit 310, a malicious domain input unit 320, a malicious domain analysis unit 330, a malicious domain information database 340 A domain list classifying unit 350, a domain activation checking unit 360, and a domain country discriminating unit 370, for example.

The malicious domain collection unit 310 collects the list of malicious domains by various methods. For example, the malicious domain may be registered through a public domain or may be provided through various malicious domain collectors. Also, for example, a blacklist URL provided by the TMS may be registered

Meanwhile, the malicious domain registration unit 320 receives and registers the malicious domain inputted by the user. At this time, the malicious domain registered by the user is registered in the system after being verified.

Each domain collected or registered by the malicious domain collecting unit 310 and the malicious domain registration unit 320 is determined by the malicious domain analysis unit 330 whether the domain is a malicious domain. At this time, a method for determining whether or not the domain is a malicious domain can be variously implemented. For example, it can be analyzed through an external automatic analysis server 380. It is also possible to implement the malicious domain management server 100 as an alternative method. When the analysis for each domain is completed, the analyzed malicious domain information is stored in the malicious domain information database 340.

In addition, the stored malicious domains may be classified into a plurality of types through the domain list classifier 350 and stored. For example, malicious domains can be classified into botnets, IRCs, zeus, malware downloads, C & C servers, and js.

In addition, it is possible to determine whether the stored malicious domain is actually operating domains. That is, the domain activation check unit 360 periodically requests the corresponding domains to check the activation status of each domain by checking the information to be responded. The domain that is inactivated according to the inspection may be deleted from the malicious domain information database 340.

Meanwhile, the domain country discrimination unit 370 determines in which country each malicious domain stored in the malicious domain information database 340 is located. At this time, the domain country discrimination unit 370 can discriminate through the country discrimination server 390 provided with country information such as 'whois', domain inquiry site and the like.

The TMS sensor is as follows.

4 is a view showing a detailed configuration of a TMS sensor according to an embodiment of the present invention. 4, a TMS sensor 210 according to an embodiment of the present invention includes a packet collection driver 410, a packet parser 420, a packet analyzer 430, a link information requestor 440, A receiving unit 450, a malicious domain checking unit 460, and a result processing unit 470.

The packet collection driver 410 collects packet data transmitted over the network. The packet parsing unit 420 parses the packet collected by the packet collection driver 410. The packet analyzer 430 analyzes the packet parsed by the packet parser 420.

At this time, the packet analyzer 430 can analyze packets by various analysis methods. Accordingly, the packet analyzer 430 includes a URL extractor 431, a link information extractor 432, a response link extractor 433, a code content link extractor 434, an XSS response link checker 435, As shown in FIG.

The URL extracting unit 431 extracts URL information from the request information included in the collected packets. The link information extracting unit 432 extracts all the link information from the data excluding the header of the HTTP packet and checks whether the domain of the link is a malicious domain.

The response link extracting unit 433 extracts and inspects the link in the redirect response based on the shortened URL request. The code content extracting unit 434 extracts a link from the content of the response code and inspects it. The XSS response link checking unit 435 checks whether a response is received in response to the XSS action when there is a request.

When the packet analysis by the packet analyzer 430 is completed, the malicious domain management server 100 or the TMS manager 220 requests domain information corresponding to the extracted link information. In response to the request, the detection rule receiving unit 450 receives the detection rule information that is automatically generated corresponding to the corresponding domain information. Then, the malicious domain checking unit 460 examines the malicious domain according to the received detection rule, and processes the inspection result through the result processing unit 470. For example, as a result of the malicious domain inspection, the TMS manager 220 can be notified of the malicious domain as an alarm.

The TMS manager is as follows.

5 is a diagram illustrating a detailed configuration of a TMS manager according to an embodiment of the present invention. 5, the TMS manager 220 according to an embodiment of the present invention includes an analysis information receiving unit 510, a packet analysis information database 520, a UI information generating unit 530, an information request receiving unit 540, And the like.

The analysis information receiving unit 510 stores the information analyzed by the TMS sensor 210 in the packet analysis information database 520.

At this time, the information request receiving unit 540 receives the information request about the analysis result inputted from the user terminal 180, and the UI information generating unit 530 generates the UI information according to the information request received from the information request receiving unit 540 And provides the packet analysis information stored in the packet analysis information database 520 to the user terminal 180 in various forms.

The detailed structure of each device according to the embodiment of the present invention has been described with reference to FIGS. 3 to 5. FIG. Although the detailed functions of the TMS sensor 210 and the TMS manager 220 shown in FIG. 2 have been described above, according to another embodiment of the present invention, the MDDS sensor 140 and the MDDS manager 150 of FIG. May include, in whole or in part, the functions of < RTI ID = 0.0 >

Hereinafter, the malicious domain detection procedure will be described in detail with reference to FIG.

The malicious domain detection procedure is as follows.

6 is a signal flow diagram illustrating a malicious domain detection procedure according to an embodiment of the present invention. Referring to FIG. 6, the malicious domain management server 100 first collects malicious domain information and stores it in a database (S601). At this time, it is possible to further classify the collected malicious domain as described above, to check whether the domain is activated or to store the information by determining the country of the domain.

Next, when the TMS manager 220 requests malicious domain information from the malicious domain management server 100 (S602), the malicious domain management server 100 transmits the stored malicious domain information to the TMS manager 100 220 (S603). At this time, provision of the malicious domain related information may be provided according to a request of the TMS manager 220 as described above, or may be periodically or non-periodically provided according to various methods set.

Meanwhile, in the TMS sensor 210, packets transmitted on the network are extracted in real time and analyzed (S604). At this time, the TMS sensor 210 requests link information to the TMS manager 220 (S605), and the TMS manager 220 automatically generates a detection rule using the corresponding domain information in response to the request (S606). The generated detection rule is transmitted from the TMS manager 220 to the TMS sensor 210 in step S607 and the TMS sensor 210 checks the malicious domain by applying the transmitted detection rule in step S608.

When the malicious domain inspection is completed by the detection rule in the TMS sensor 210, the detection result is transmitted to the TMS manager 220 (S609). The TMS manager 220 stores the transmitted detection result in the database (S10).

At this time, if the user terminal 180 requests domain information from the TMS manager 220 in operation S611, the TMS manager 220 searches for information on the requested domain in operation S612 and transmits the domain information to the user terminal in operation S613. do. The user terminal 180 displays domain related information as a result of the request (S614).

Meanwhile, the embodiments according to the present invention may be embodied in the form of program instructions that may be executed by various computer means and may be recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape; optical media such as CD-ROM and DVD; magnetic recording media such as a floppy disk; Includes hardware devices specifically configured to store and perform program instructions such as megneto-optical media and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by specific embodiments such as specific components and the like. For those skilled in the art, various modifications and variations are possible from these descriptions.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

100: malicious domain management server 110: internet network
120: Router 130: Firewall
140: MDDS sensor 150: MDDS manager
160: Internal network switch 170: Company intranet
180: user terminal 210: TMS sensor
220: TMS manager 310: malicious domain collector
320: malicious domain input unit 330: malicious domain analysis unit
340: malicious domain information D / B 350:
360: Domain Activation Inspection Unit 370: Domain Country Identification Unit
380: Automatic analysis server 390: Country identification server
410: Packet collection driver 420: Packet parsing unit
430: packet analyzing unit 431: URL extracting unit
432: Link information extracting unit 433: Response link extracting unit
434: code content link extracting unit 435: XSS response link checking unit
440: Link information requesting unit 450: Detection rule receiving unit
460: malicious domain checking unit 470: result processing unit
510: Analysis information receiving unit 520: Packet analysis information D / B
530: UI information generating unit 540: Information request receiving unit

Claims (15)

A malicious domain management server for collecting malicious domain information by input or automatic collection of an administrator and managing, maintaining, analyzing or examining information on the collected malicious domain;
A threat management system manager for receiving malicious domain information from the malicious domain management server and automatically generating a malicious domain detection rule from information on the malicious domain; And
And a threat management system sensor that receives the generated malicious domain detection rule from the threat management system manager and detects whether the malicious domain related link information is included in a packet transmitted on a network.
The malicious domain detection method according to claim 1,
A malicious domain detection system implemented in the form of 'snort' which includes action, protocol, sender IP, sender port, receiver IP, receiver port and content of detection rules.
The malicious domain management server according to claim 1,
A malicious domain collecting unit collecting a malicious domain list by at least one method and storing the collected malicious domain list in a malicious domain information database;
A malicious domain registration unit for receiving a malicious domain input by a user and performing verification and registering the malicious domain in the malicious domain information database;
A malicious domain analysis unit for determining whether each domain collected or registered by the malicious domain collecting unit and the malicious domain registering unit is malicious domain;
A domain list classifying unit for classifying malicious domains stored in the malicious domain information database into a plurality of types;
A domain activation checker to check whether each domain stored in the malicious domain information database is in an activated state; And
And a domain country determination unit for determining in which country each malicious domain stored in the malicious domain information database is located.
The threat management system according to claim 1,
An analysis information receiver for storing information analyzed by the threat management system sensor in a packet analysis information database;
An information request receiving unit for receiving an information request for an analysis result input from a user terminal; And
And a UI information generator for providing packet analysis information stored in the packet analysis information database to the user terminal according to an information request received from the information request receiving unit.
The system of claim 1, wherein the threat management system sensor comprises:
A packet collection driver for collecting packet data transmitted over a network;
A packet parser for parsing packets collected by the packet collection driver;
A packet analyzer for analyzing the packet parsed by the packet parser;
A link information request unit for requesting the threat management system manager for domain information corresponding to the extracted link information as a result of the analysis;
A detection rule receiving unit for receiving detection rule information automatically generated corresponding to the corresponding domain information from the threat management system manager according to the request; And
And a malicious domain checking unit for checking the malicious domain by the received detection rule.
The packet analyzing apparatus according to claim 5,
A URL extracting unit for extracting URL information from the request information included in the collected packet;
A link information extracting unit for extracting all the link information from the data excluding the header of the HTTP packet and checking whether the domain of the link is a malicious domain;
A response link extracting unit for extracting and inspecting a link in a redirect response based on a shortened URL request;
A content extracting unit for extracting and inspecting a link from the content of the response code; And
And an XSS response link checking unit for checking whether an XSS action is requested in response to the response when there is an XSS action upon request.
A malicious domain management server for collecting malicious domain information by input or automatic collection of an administrator and managing, maintaining, analyzing or examining information on the collected malicious domain;
A malicious domain detection rule is provided to the malicious domain management server and malicious domain detection rules are automatically generated from information on the malicious domain, A malicious domain detection system sensor for detecting whether or not link information is included; And
And a malicious domain detection system manager which receives a result detected by the malicious domain detection system sensor and provides the detected result to the user terminal in response to a request of a user terminal.
Collecting information on a malicious domain by inputting or automatic collection of an administrator from the malicious domain management server;
Receiving a malicious domain information from the threat management system manager to the malicious domain management server and automatically generating a malicious domain detection rule from information on the malicious domain; And
And receiving, by the threat management system sensor, the generated malicious domain detection rule from the threat management system manager and detecting whether the malicious domain related link information is included in a packet transmitted on a network.
9. The method of claim 8,
Wherein the malicious domain is implemented in the form of 'snort', including action, protocol, sender IP, sender port, receiver IP, receiver port and content of detection rules.
The method according to claim 8, wherein the step of collecting information on malicious domains of the malicious domain management server comprises:
Collecting a malicious domain list in at least one method and storing the malicious domain list in a malicious domain information database;
Inputting a malicious domain inputted by a user and performing verification and registering the malicious domain in the malicious domain information database;
Determining whether the collected or registered domains are malicious domains;
Classifying malicious domains stored in the malicious domain information database into a plurality of types;
Checking whether each domain stored in the malicious domain information database is in an active state; And
And determining in which country each malicious domain stored in the malicious domain information database is located.
9. The method of claim 8, wherein automatically generating a malicious domain detection rule of the threat management system manager comprises:
Storing information analyzed by the threat management system sensor in a packet analysis information database;
Receiving an information request for an analysis result input from a user terminal; And
And providing packet analysis information stored in the packet analysis information database to the user terminal in response to the received information request.
9. The method of claim 8, wherein the detecting of the threat management system sensor comprises:
Collecting packet data transmitted over a network;
Parsing the collected packets;
Analyzing the parsed packet;
Requesting the threat management system manager for domain information corresponding to the extracted link information as a result of the analysis;
Receiving detection rule information automatically generated corresponding to the corresponding domain information from the threat management system manager according to the request; And
And checking the malicious domain by the received detection rule.
13. The method of claim 12, wherein analyzing the packet comprises:
Extracting URL information from the request information included in the collected packet;
Extracting all the link information from the data excluding the header of the HTTP packet and checking whether the domain of the link is a malicious domain;
Extracting and inspecting a link in a redirect response based on the shortened URL request;
Extracting a link from the contents of the response code and inspecting the link; And
And if so, checking if a response is made in response to an XSS action upon request.
Collecting information on malicious domains by an administrator's input or automatic collection by a malicious domain management server, and managing, maintaining, analyzing, or inspecting the collected malicious domains;
The malicious domain detection system sensor receives malicious domain information from the malicious domain management server, automatically generates a malicious domain detection rule from the malicious domain information, and transmits the malicious domain detection rule Detecting whether malicious domain related link information is included in the packet; And
Receiving a result detected by the malicious domain detection system sensor in the malicious domain detection system manager, and providing the detected result to the user terminal according to a request of the user terminal.
A computer-readable recording medium in which a program for executing the method of any one of claims 8 to 14 is recorded.

Images