KR20150110065A - Method and System for Detecting Malware by Monitoring Executable File - Google Patents

Abstract

The intranet protection system of a control system having a least one local control network and a control center according to an embodiment of present invention includes a malignant code including the control center; and an execute file monitoring agent which is located in the connection point of the local control network and the control center. The execute file monitoring agent generates execute file information from a packet exchanged between the local control network and the control center or the inside of the local control network, and transmits it to the malignant code. A malignant code detecting device can determine where the malignant code of a corresponding execute file is infected based on the received execute file information.

Description

TECHNICAL FIELD [0001] The present invention relates to a malicious code detection method and system based on execution file monitoring,

The present invention relates to an execution file monitoring based malicious code detection technique for protecting a control system from a cyber attack using a vulnerability of a control system, and is intended to provide a safe operating environment of a control system in which availability is a top priority.

In general, the control system includes various field devices such as sensors and actuators, and control equipment such as PLC (Programmable Logic Controller), RTU (Remote Terminal Unit) and DCS (Distributed Control System). There may be a human-machine interface (HMI), a supervisory control and data acquisition (SCADA) server, etc. for efficiently monitoring the devices located remotely according to the size and purpose of the control system. The fieldbus protocol such as DNP (Distributed Network Protocol) or MODBUS using serial in the past has been mainly used, but the application of fast and efficient technology such as industrial Ethernet is gradually becoming a trend. In other words, the application of IT technology makes it easier to access the control system and convenience, but the security threat is also increasing. In addition, the growing interest in hackers' control systems, while lacking awareness of the security of the control system, is steadily increasing security threats to the control system.

In general, a control system may be operated as a single independent control network, a plurality of horizontal or hierarchical control networks may be connected, or may be interworked with an internal business network as needed. The system has many connection points such as linkage with the internal business network, external organization (external network), and inter-system communication within the control network. However, it is not easy to manage security policies and so on. Basically, the control system is operated separately from the external network, but many control systems are connected to the external business network or external organization to transmit and receive data. Even if the information protection system is operated in such a network connection section, unauthorized access may be possible depending on the setting inattention. In addition, the control system is composed of a plurality of sub-networks (a control network consisting of systems that directly control equipment) and a central network (a Scada network that integrally controls a plurality of control networks) rather than a single network There is a great risk that a failure or an infringement in a system inside the control network will be transferred to the entire control system. That is, if a hacker or a malicious insider intruding into a specific control network falsifies or modulates a control command or monitoring information of the control system, it may cause not only physical damage and economic damage but also social confusion.

Malicious codes such as Stuxnet, Duqu, Night dragon and Flame, which target control systems, show this tendency. Here, Stuxnet, the first control system malicious code found in June 2010, was the first malicious code to extend the range of cyber attacks not only to PCs but also to PLCs. It is the first malicious code in Natanz, Destroyed centrifuges and alarmed the field of control systems and cybersecurity. As shown in FIG. 1, Stuxnet has a feature capable of spreading both on-line and off-line, and has a malicious code propagation and infection function utilizing a security vulnerability of a Windows operating system or a USB medium. In particular, malicious code propagation using USB memory generally takes into consideration the characteristics of a control system operated separately from the Internet, and security technologies are required to protect the control system from such cyber threats. However, since the control system is a system in which availability is the highest priority, unlike an IT system that emphasizes confidentiality, it is practically difficult to directly install software that can impair availability in a control system. Therefore, a type of network security technology that is not installed and operated directly in the control system is suitable for security of the control system. As such network security technology, firewall technology for control system, unidirectional data transfer device technology, intrusion detection system for control system, and central security management system technology are studied and developed. In addition, there is a technique to define the normal characteristics of the control system as Whitelist instead of detecting the existing attack signature, and propose security monitoring based on this.

However, since most of these techniques rely on a wide range of access controls, there is a limit to detecting and blocking malicious code infections or propagation that have gone through misconfiguration or other bypass paths.

In conclusion, there is a need for a technique to efficiently detect and respond to malicious code infections and propagation while ensuring the availability of the control system, and additionally tracing the infected and propagated paths of these malicious codes to prevent them from originating.

In order to solve such a problem, the present invention provides a technique for detecting and responding to infection and propagation of a malicious code while ensuring the availability of a control system. More specifically, various embodiments of the present invention provide a malicious code detection technique based on executable file monitoring by monitoring the distribution of executable files based on network packets transmitted and received within the control system intranet, We intend to provide a secure control system intranet environment that can efficiently detect, track, and respond to not only various types of malicious code infections but even the first distribution system.

An intranet protection system of a control system including a control center and at least one local control network according to an embodiment of the present invention includes: a malicious code detection device included in the control center; And an executable file monitoring agent located at a connection point between the control center and the local control network, the executable file monitoring agent executing from a packet exchanged in the local control network or between the control center and the local control network File information to the malicious code detection device, and the malicious code detection device can determine whether the execution file is infected with the malicious code based on the received execution file information.

The control center may be connected to an external network, and the execution file monitoring agent may be located at a connection point between the control center and the external network.

The local control network may also be connected to a control facility or control sensor of the control system.

The control center or the local control network may also include an HMI (Human Machine Interface) device.

The execution file monitoring agent may further include: A method for collecting packets transmitted to and from a network or transmitted and received within a network, searching for packets related to an executable file among the collected packets, identifying a session to which the associated packet belongs, combining packets included in the identified session The file can be extracted.

The execution file information may include transmission / reception session information and identification information corresponding to the executable file.

Also, the session information may include 5-tuple information including a protocol, a source address (SRC IP), a destination address (DST IP), a source port, and a destination port.

The identification information may include at least one of a size of the executable file and a hash value of the executable file.

The malicious code detection device judges the execution file itself as a malicious code except for a special case such as an update. In a special case, when the file is updated in the intranet, for example, When the source analyzed in the session information of the execution file information is a self-update server located in the intranet, or when the file is updated in cooperation with an external network, the source is not an intranet internal device capable of normally updating through the external network, The device distributing the executable file may be blocked from the network except for the case where the information analyzed in the identification information of the executable file information is the identification information for the executable file classified as safe.

A method for protecting an intranet of a control system including a control center and at least one local control network from malicious code according to an embodiment of the present invention is characterized in that in a malicious code detection apparatus, Receiving executable file information from an executable file monitoring agent located in the executable file monitoring agent; And determining whether the execution file is infected with the malicious code based on the execution file information. The executable file information may be generated based on packets exchanged within the local control network or between the control center and the local control network.

The method may further include, when it is determined that the executable file is infected with a malicious code, blocking the device that has distributed the executable file based on the executable file information in the network.

The execution file information may include transmission / reception session information and identification information corresponding to the executable file.

The executable file monitoring agent also collects packets entering or exiting the network or transmitted and received within the network, retrieving packets of the collected packets associated with the executable file, identifying the session to which the associated packet belongs, And extracts the executable file.

The executable file monitoring agent may generate corresponding executable file information including session information and identification information based on the extracted executable file and may transmit the executable file information to the malicious coat detection apparatus, When the source analyzed in the session information of the executable file information is a self-update server located in the intranet, it is not an intranet internal device capable of normally updating through the external network, or the information analyzed in the identification information of the executable file information is The device distributing the executable file can be blocked from the network except for a special case (update, etc.) such as the case of identification information for an executable file classified as safe.

As described above, the present invention provides a technology for rapidly detecting malicious code infections and propagation attempts that can cause anomalous behavior due to cyber terror action on the main infrastructure control system. This effectively detects the infringement factors that might hinder the safe operation of the control system and enables stable control system operation. Accordingly, the present invention provides a malicious code detection technique based on executable file monitoring for protecting a control system intranet, and provides a service reliability and availability of a control system from various security threats from the outside and inside of the intranet of the control system .

Fig. 1 shows a propagation concept diagram of a malicious code such as a Stuxnet which targets a control system.
2 is a conceptual diagram of an intranet protection system according to an embodiment of the present invention.
FIG. 3 illustrates a process of generating and delivering executable file information according to an embodiment of the present invention.
4 shows a malicious code detection method according to an embodiment of the present invention.
5 illustrates a malicious coat detection method according to another embodiment of the present invention.
6 illustrates a malicious coat detection method according to another embodiment of the present invention.
7 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention.

Various embodiments of the present invention will now be described in detail with reference to the accompanying drawings. Note that, in the drawings, the same components are denoted by the same reference symbols as possible. Further, the detailed description of well-known functions and constructions that may obscure the gist of the present invention will be omitted. In other words, it should be noted that only parts necessary for understanding the operation according to the embodiment of the present invention will be described, and descriptions of other parts will be omitted so as not to disturb the gist of the present invention.

2 is a conceptual diagram of an intranet protection system according to an embodiment of the present invention.

Referring to FIG. 2, the control system 10 for intranet control may include a control center 11, at least one local control network 13, and a control facility or control sensor 15 connected to the local control network 13.

The control center 11 may be a Scada network including an HMI, an engineering workstation, a data historian server, a PC, and other electronic devices. The control center 11 may further include a malicious code detection / tracking device 100 according to an embodiment of the present invention.

The local control network 13 may include devices such as PLC, TRU, DCS, etc. that directly control the control facility or control sensor 15, and other electronic devices such as HMI, PC, and the like. The local control network 13 may include a control console, such as an HMI console, included in the control center, depending on its size and other settings.

The general control system 10 may be configured as an independent intranet system for the network 20 outside the intranet, but may be connected to the external network 20, such as a business network or the Internet, via the control center 11. In a modified embodiment of the present invention, the control system 10 may be connected to the external network 20 via the local control network 13.

At the connection point between the control center 11 and the local control network 13, the execution file monitoring agent 200 according to an embodiment of the present invention may be located. The executable file monitoring agent 200 can be located at a connection point interconnecting network units (control center, local control network, etc.) constituting the intranet of the control system. For example, an execution file monitoring agent 200A is connected to a point connecting the control center 11 and the local control network A, and an execution file monitoring agent 200B is connected to a control center 11 and an external network 20, the execution file monitoring agent 200E can be located.

The executable file monitoring agent 200 extracts information on executable files distributed between the control center 11 and the local control network 13 and transmits the extracted information to the malicious code detection apparatus 100. The executable file monitoring agent 200 can also extract information about executable files distributed within one unit area control network 13. [ To this end, the executive file monitoring agent 200 may be located at the connection center of the devices constituting the local control network 13, or may allow data transmission and reception of the constituent devices to pass through the executable file monitoring agent 200.

The malicious code detection apparatus 100 can determine whether the executable file corresponding to the executable file information is a malicious code or infected with a malicious code based on the executable file information received from the at least one executable file monitoring agent 200. [ If the malicious code detection apparatus 100 determines that the executable file is a malicious code, the malicious code detection apparatus 100 can trace the malicious code infection path based on the executable file information. As a result of the infection path tracing, if the device included in the local control network 13 is determined to be a malicious code distribution device (that is, if it is infected through a USB or external hard disk connected to the device) . If it is determined that a malicious code has been input from the external network 20, the malicious code detection apparatus 100 identifies an IP (address) or a port to which an executable file related to the malicious code is distributed from the executable file information, It can block packets from the port or isolate access to the device.

In the present specification, an intranet protection system or a protection system can be understood as a concept including the malicious code detection apparatus 100 and the executable file monitoring agent 200. However, in some modified embodiments, an intranet protection system, malicious code detection (and / or tracking) system (or device) may simply refer to malicious code detection device 100.

FIG. 3 illustrates a process of generating and delivering executable file information according to an embodiment of the present invention.

Referring to FIG. 3, the executable file monitoring agent 200 may collect packets exchanged between a network and a network or inside a network. The packet may include a general control network packet and a packet associated with the executable file. The executable file monitoring agent 200 monitors packets on the network and collects packets transmitted to and from the network where the agent 200 is located or transmitted and receives the common characteristics of the packets related to the executable file, File, a DOS header side 2-byte string begins with MZ (0x4D5A), or 4 bytes from offset 60 start with a string of PE00 (0x50450000) Can be searched. The agent 200 can continuously select a session to which the associated packet belongs, and extract the executable file by combining the packets belonging to the session. The executable file monitoring agent 200 can generate executable file information including the session information and the executable file identification information from the extracted executable file and transmit the executable file information to the malicious code detection / tracking system 100.

The session information includes 5-tuple information including a protocol, a source address (SRC IP), a destination address (DST IP), a source port (SRC Port), and a destination port (DST Port) . The identification information may include the size (size) of the extracted executable file, a hash value based on executable file content information, and other identifiable information.

The malicious code detection apparatus 100 can store the received executable file information in a database and perform analysis on the executable file information based on the managed executable file information. The malicious code detection apparatus 100 includes a self update server address located in the intranet (e.g., when updating a file on an intranet without an external network), address information on internal devices included in the control system 10 (e.g., (For example, updating a file), or identification information about an executable file classified as safe (for example, common to an intranet or an external network) in advance in a database and registering previously registered or registered data and executable file information It is possible to judge whether the malicious code is infected or not. For example, the malicious code detection apparatus 100 can determine the malicious code itself as the malicious code except for the special cases registered for updating as described above. The malicious code detection apparatus 100 refers to the data registered in advance as described above, (SRC IP) is the address of a self-update server located inside the intranet, or is not the address of an intranet internal device (except in this case, for business PCs or other workstations contained in a Scada network such as Control Center 11 Or when it is determined that the server can normally update via the external network 20), or if the received executable file information is judged to be a secure executable file, malicious code may not be detected. The malicious code detection apparatus 100 can use the session information to identify the first infected system even when the malicious code is transmitted to other systems / devices in a sequential manner not only in the case where the apparatus is infected first, but also in the second or third order have.

4 shows a malicious code detection method according to an embodiment of the present invention. 4 shows malicious code infections and propagation modes into the control center 11 via USB, external hard disks, and other bypass paths. Here, the bypass route means an access without using the contact with the official external network 20 connected to the control system intranet.

4, after the HMI device 400 included in the control center 11 is infected with a malicious code through a USB or other detour path, the other device 401 of the control center 11, the PLC device 402 located in the local control network A, And attempts to spread the malicious code to the PLC device 403 located in the control network B. [

According to an exemplary embodiment of the present invention, the malicious code propagation attempt is transmitted to the malicious code detection apparatus 100 by the execution file monitoring agents 200A, 200B, and 200E that are monitoring the execution file at the connection points of the respective networks. That is, propagation from the HMI device 400 to another device 401 inside the control center 11 is performed by the agent 200E monitoring the inside of the control center 11, the propagation of the local control network A to the PLC 402 by the agent 200A, Propagation to 403 may be carried out by the agent 200B to the malicious code detection device 100 in which the executable file information associated with each case is located within the control center 11. [

The malicious code detection apparatus 100 can detect the propagation of the malicious code from the received executable file information and can take countermeasures such as isolation of the infecting system, that is, the HMI device 400. 4, even if the PLC 402 of the local control A infects the PLC 403 of the local control B, the malicious code detection apparatus 100 can detect the malicious code based on the session information and executable file identification information received from the executable file monitoring agent 200B The data that is stored and managed in the database can be referred to and the first infected device can be tracked to be the HMI device 400 located in the control center 11. [

5 illustrates a malicious coat detection method according to another embodiment of the present invention. Figure 5 shows the malware infection and propagation mode into the local control network A via USB or other bypass path. In the following description, the contents overlapping with those described above will be omitted.

The example shown in FIG. 5 shows that after a particular device 500 in the local control network A has been infected with malicious code through USB and other detour paths, the device 502 of another device 501 in the same network or another local control network (network B) And the malicious code is attempted to be transmitted to the device 503 in the control center. Such a malicious code propagation attempt is transmitted to the malicious code detection apparatus 100 by the execution file monitoring agent 200A located at the contact point of the local control network A and the execution file monitoring agent 200B located at the contact point of the local control B, Code detection and tracking will occur.

6 illustrates a malicious coat detection method according to another embodiment of the present invention. 6 shows the malicious code infection and propagation mode into the control center 11 through the normal path. 6 shows an example of a malicious code inflow through an external network 20 such as a business network or the Internet.

In general, various network security devices (eg, firewalls, intrusion detection systems, and the like) are installed in the contact points directly connected to the external network 20 such as the Internet. However, Can be used. In other words, a system / device of a control center such as a Scada network directly connected to the external network 20 can be attacked by using such a security vulnerability. Accordingly, after the specific system 600 in the control center 11 is infected through the normal path as shown in Fig. 6, the malicious code may be propagated in the same / similar form to that described in Fig. In addition, the detection method therefor can also be replaced with the above description. However, in case of malicious code infection and propagation through USB and other bypass path, it is possible to trace to the first infection system. In case of infection and propagation through normal path, it also tracks the intrusion IP outside the control system intranet It is possible. In other words, it helps security setting of pre-installed network security equipment, and it is possible to actively respond to the attack IP. In other words, although an executable file initially received from the external network 20 is also monitored by the executable file monitoring agent 200E, the executable file may not be judged to be a malicious code. This is because a normal update may be made via the external network 20. However, when the execution of the executable file is started from the system 600 to another system / device 601, 602, 603, etc., the malicious code detection apparatus 100 judges the executable file as a malicious code and tracks the first external intrusion IP .

7 is a flowchart illustrating a malicious code detection method according to an embodiment of the present invention.

Referring to FIG. 7, in step S710, the executable file monitoring agent 200 configures the control system 10 or monitors an executable file transmitted / received in the network connected to the control system 10. [ The agent 200 may collect data packets sent and received from the network and retrieve packets associated with the executable file therefrom. The agent 200 can identify the session to which the packet associated with the executable file belongs and extract the executable file by combining the packets included in the identified session. The agent 200 generates executable file information based on the extracted executable file (S720), and can transmit the executable file information generated in S730 to the malicious code detection apparatus 100. [ Upon receiving the executable file information from the agent 200, the malicious code detection apparatus 100 can determine whether the executable file indicated by the executable file information is a malicious code (or infected with a malicious code) based on the executable file information in S740 . In S750, when malicious code detection device 100 judges that an executable file is malicious code, it infects malicious code or isolates a device that originally distributed malicious code from the network to which the device belongs (for example, disconnects network connection) .

The malicious code detection method based on executable file monitoring for the control system intranet protection as described above provides an effective malicious code detection technique while maximizing the availability of the control system, thereby preventing the threat of cyber terrorism . It also enables the establishment of effective security measures within the control intranet by accurately detecting the initial infection and propagation points. Above all, malicious code detection based on executable file monitoring using network packets has an advantage in that it can easily respond to various kinds of malicious codes that may appear in addition to known malicious codes.

It should be noted that all embodiments and conditional examples disclosed herein are intended to assist the reader in understanding the principles and concepts of the present invention by those of ordinary skill in the art, It will be understood that the invention may be embodied in various other forms without departing from the spirit or essential characteristics thereof. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (1)

1. An intranet protection system of a control system comprising a control center and at least one local control network,
A malicious code detection device included in the control center; And
And an executable file monitoring agent located at a connection point between the control center and the local control network,
The executable file monitoring agent generates executable file information from a packet exchanged in the local control network or between the control center and the local control network and transmits the executable file information to the malicious code detection apparatus,
Wherein the malicious code detection device determines whether the execution file is infected with a malicious code based on the received execution file information.

Images