KR20160052978A - Ids system and method using the smartphone - Google Patents

Abstract

The present invention relates to a system for monitoring intrusion detection of a server by using a smart phone and a method thereof and, more specifically, to a system for monitoring intrusion detection of a server by using a smart phone and a method thereof which parse data with respect to a packet through an intermediate driver realized between a miniport driver and a protocol driver which is an network driver interface specification (NDIS) driver to monitor and block a current network state through an application of a smart phone in case of an attack and an action with malicious intentions against a computer of a user.

Description

TECHNICAL FIELD [0001] The present invention relates to an IDS system and a method for monitoring intrusion detection of a server using a smart phone,

The present invention relates to a system and a method for intrusion detection monitoring of a server using a smart phone, and more particularly, to a system and method for intrusion detection and monitoring of a server using a smart phone. More particularly, the present invention relates to an intermittent driver implemented between a Protocol Driver (NDIS (Network Driver Interface Specification) A server using a smart phone that can monitor and block the current network status through a smartphone through an application when the user attacks and acts on the user's computer with a malicious intention To an intrusion detection monitoring system and method.

In the increasing number of server hosts connected to the Internet, server administrators have been attacked by hackers in addition to services through accessing ordinary users. The damage caused by hackers' attacks is gradually increasing, and the method is also diversified, so it can not be enough to prevent hackers from attacking with only the server itself. So many PCs are using firewalls or intrusion detection techniques to deal with them. However, it is hard to monitor these attacks continuously 24 hours a day without knowing when they will happen and not miss them. Especially, small and medium sized enterprises have a lot of time and economic burden to manage these agents by detecting them.

In Windows OS, Windows Firewall is basically provided.

It is a firewall function internally provided by the OS itself for users from Windows SP2. It accesses Windows Firewall from the Windows Control Panel, allowing the user to easily enable or disable the firewall. Also, if you do not use a firewall, you will be notified that you will not use it. On the other hand, if you want to set up a more detailed security policy and want to manage computers, you can filter packets in both inbound and outbound according to process, per port, and IP-specific rules. And you can change the policy to the policy that you saved through export or import.

On the other hand, there is a vaccine that includes a firewall feature developed by AhnLab, one of the domestic security companies. It is basically an antivirus engine that provides PC security and includes a personal firewall. In addition, it offers a variety of additional functions, such as cookies, temporary Internet files, the ability to delete the history of pages opened, and the complete deletion function to prevent the recovery of personal and company confidential data, And various functions that are useful when the user uses the PC, such as maintaining the system state. In addition, the functions related to the firewall are designed to monitor all traffic flowing into / out of the network and to block malicious codes causing abnormal traffic such as worms, trojan horses, and the like.

In addition, since the intrusion prevention pattern is updated in real time, it is possible to block the malicious code with the updated pattern in real time.

However, the above conventional techniques have a limitation in that they can not be separately monitored or confirmed.

Meanwhile, a free firewall program provided by an overseas security company, PC tools, has functions such as application program control and logging. First, the main screen supports enabling / disabling of real-time PC protection through firewall protection function, application control, profile and recording activity setting.

Basically, when the user or the system operates a specific program, the user (firewall rule) is checked for permission and the program rule is stored in the corresponding item according to the rule designated by the user. It also includes the ability to provide detailed information about network traffic and firewall activity records. With this function, it is possible to check what action occurred at what time.

On the other hand, Korean Patent Registration No. 1446280 (filed on September 24, 2014) discloses "a system and method for detecting and blocking malicious codes of variants using an intermediate driver ". The above patent discloses a model that analyzes system and network status changes using the NDIS (Network Driver Interface Specification) Intermediate driver, and detects and blocks malicious codes with irregular patterns in the kernel mode. The present invention relates to a malicious code detection and blocking system and method using an intermediary driver, the malicious code detection and blocking system comprising: analyzing a malicious code using an intermediate driver; A step in which the code detection and blocking system finds a specific signature after analyzing the malicious code and transmits the signature-analyzed packet to a protocol driver of an upper layer; and a step in which the malicious code detection / Is periodically monitored by a state analysis model, When the process detects the abnormal state of the packet on a port is configured to include the steps of blocking the process and the port in the kernel mode.

However, the above-described conventional systems and methods have limitations in that they are continuously monitored in the event that they do not know when an intrusion of hackers will occur, and can not be missed and detected.

The present invention has been proposed in order to solve the above-mentioned problems. The present invention is not only to detect and block security threats, but also to detect a threat even outside the device, if a manager is carrying the smartphone anytime and anywhere, The present invention provides a system and method for intrusion detection monitoring of a server using a smart phone, which can support quick and safe management by adding a function of remotely operating in real time.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other matters not mentioned can be clearly understood by those skilled in the art from the following description.

In order to accomplish the above object, according to the present invention, there is provided a system and method for intrusion detection monitoring of a server using a smart phone, including an application and system 10 that can be applied to an Android platform, a window application and system 20, Card 40 and an intermittent driver 30. The intermittent driver 30 includes a driver initialization unit 31 that can be installed and uninstalled and initializes callback routines, A packet processing unit 32 for collecting and combining packets traversing between the drivers and parsing the packets to monitor the packets, a logging unit 33 for recognizing the malicious packet through pattern matching and leaving a log, And an intrusion detection unit (34).

SUMMARY OF THE INVENTION The present invention has been made to overcome the above problems, and it is an object of the present invention to promptly detect illegal access and intrusion of a PC server and promptly inform a server manager of a remote place using a smartphone app.

FIG. 1 is a schematic diagram of an intrusion detection and monitoring system for a server using a smartphone according to the present invention;
2 is a schematic configuration diagram of a driver of an intrusion detection monitoring system of a server using a smartphone according to the present invention;
FIG.
FIG. 4 is a block diagram of the Intermediate Driver Part
FIG. 5 is a flowchart illustrating a direct I / O method data transfer sequence
FIG. 6 shows a Bufferd I / O method data transfer sequence
FIG. 7 shows a sequence of packet transmission callback functions
Figure 8 shows an NDIS_BUFFER combination picture
FIG. 9 is a diagram illustrating an Aho-Corasick Failure applied tir
FIG.
11 shows a packet monitoring estimation UI
12 is a graphical representation
13 shows an expected UI.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an intrusion detection and monitoring system for a server using a smartphone according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a schematic block diagram of a driver of an intrusion detection monitoring system of a server using a smartphone according to the present invention, and FIG. 3 is a block diagram of the intrusion detection and monitoring system of a server using a smart phone according to the present invention. Figure 4 shows the NDIS Driver. Figure 4 shows the Intermediate Driver Part. Figure 5 shows the direct I / O data transfer. Figure 6 shows Bufferd I / O data transfer. Figure 7 shows the packet transfer callback function. Figure 8 shows the NDIS_BUFFER combination. Corasick Failure tir Figure 10 shows the application UI. Figure 11 shows the expected packet UI. Figure 12 shows the GCM architecture. Figure 13 shows the expected UI.

In the drawings, the same reference numerals are given to the same elements even when they are shown in different drawings. In the drawings, the same reference numerals as used in the accompanying drawings are used to designate the same or similar elements. And detailed description of the configuration will be omitted. Also, directional terms such as "top", "bottom", "front", "back", "front", "forward", "rear", etc. are used in connection with the orientation of the disclosed drawing (s). Since the elements of the embodiments of the present invention can be positioned in various orientations, the directional terminology is used for illustrative purposes, not limitation.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It is to be understood, however, that the intention is not to limit the embodiments according to the concepts of the present invention to the specific disclosed embodiments, but includes all changes, equivalents, or alternatives falling within the spirit and scope of the present invention,

In accordance with one embodiment of the present invention,

As shown in FIG. 1, includes an application and system 10 that can be applied to an Android platform, a window application and system 20, a network interface card 40, and an intermittent driver 30 .

As shown in FIGS. 2A and 2B, the intermittent driver 30 allows a user to monitor or block the network status of his / her computer. In other words, the malicious intention is to monitor and block the current network status through the application when attacking and acting on the user's computer. This function installs an Intermediate Driver (30) between a protocol driver and a miniport driver, which are NDIS Driver (Network Driver Interface Specification Driver) You can get information about.

In particular, the intermittent driver 30 parses information in a packet between a protocol driver and a miniport driver, compares malicious patterns with a payload, and detects malicious actions to inform the user.

2A, the intermediate driver 30 includes a driver initialization unit 31 that can perform installation and uninstallation and initialize callback routines, packets collected between the protocol driver and the miniport driver A packet processing unit 32 for parsing and monitoring the information in the packet, and a logging unit 33 and an intrusion detection unit 34 for detecting a malicious packet through pattern matching and leaving a log, .

As shown in FIG. 2B, when a user uses the computer to access the Internet, data is output through the respective layers. Each layer has data. The TCP header has a port number, the IP header has an IP address, the Ethernet header has a LAN card address, and computer address information. It can be seen that communication is performed based on such information.

The intermittent driver 30 belongs to the DataLink layer in order to monitor and block the network status of the user's computer in the upper layer. Since the NDIS driver is a lower layer, it can access the headers already added, access all of the Ethernet header, IP header, TCP header and data part, but not the Ethernet header in the Transport layer or Network layer .

As described above, the NDIS driver includes a protocol driver 35, an intermediate driver 36, and a miniport driver 37.

The protocol driver 35 is located above the NDIS driver layer and can be implemented independently of hardware. The protocol driver 35 communicates with a lower miniport driver or an intermediate driver through an NDIS interface, and is connected to an upper TDI layer Protocols such as TCP / IP are defined. In addition, the protocol driver can be added by the developer, and when added, it is added not in place of replacing the existing protocol driver but in parallel, so that even if a user creates and loads a protocol driver and blocks a specific packet, Has a limitation that it can not be blocked with respect to the packet.

The miniport driver 37 is located at the bottom of the NDIS driver layer and manages the NIC including sending and receiving data through the NIC, communicates with upper level drivers such as the intermediate driver, , IP header, TCP header, and Data information. However, because the miniport driver manages the NIC, there is a hardware-environment-dependent limitation.

The intermittent driver 36 is located between the protocol driver and the miniport driver and communicates with the protocol driver and the miniport drivers.

That is, as shown in FIG. 3, at the lower edge, the intermediate driver exposes Protocol XXXs, which are protocol entry points that are called to communicate with the miniport driver. When the port driver sees the intermediate driver in advance, the intermediate driver becomes the protocol driver.

At the Upper Edge, the intermediate driver exposes Miniport XXX, which is the miniport entry point that it calls to communicate with the protocol driver. When the protocol driver sees the intermediate driver, the intermediate driver becomes the miniport driver.

The Intermediate driver is also a Data Link layer, which has Ethernet header, IP header, TCP header, and Data information.

Intermediate driver 37 is not hardware dependent and allows packet capturing, packet blocking, packet filtering, packet reprocessing, modulation, and the like.

The Android application and system 10 can provide a push using GCM so that an intrusion can be detected immediately, and a firewall can be operated remotely in a PC application.

The window application and system 20 are designed using a MFC to control a device driver through communication with a device driver and to enable a user to manipulate traffic volume and various policies. .

Since the Android application and the system 10 and the window application and the system 20 can receive and manipulate information about a firewall in a smart phone, malicious behavior through packet sniffing is possible. Therefore, a packet is encrypted and a GCM It is preferable to use a protocol that complements the transmission and transmission order of messages.

Communication between the NDIS Intermediate driver 30 and the application requires transmitting a network packet and various pieces of information (source IP, port, MAC address, etc.) and payload to the user application, It must be speed and safe because it must be received from the user application.

The buffer type of the data for the I / O request is divided into three types: direct I / O, buffered I / O, and old I / O can do.

First, Direct I / O is often used to avoid the overhead of allocating memory and copying data between the data buffer and the system buffer defined by the thread requesting the I / O. When the driver selects Direct I / O, the I / O manager uses the MDL structure to indicate the data buffer associated with the I / O request to read and store data. An MDL structure is a structure that is not directly accessible by the driver.

The Direct I / O scheme is more efficient than the Buffered I / O scheme when the data buffer is large, but the driver must be able to handle the MDL directly. Direct I / O is especially useful when the driver can not use any virtual address space to use when transferring data. It is also useful when transferring MDLs from low-level drivers that use the DMA data transfer method.

In Bufferd I / O, the I / O manager copies the data passed from the thread requesting I / O from the buffer provided by the thread to the system buffer. It also copies the necessary data from the system buffer allocated by the I / O manager to the buffer provided by the thread in order to pass the processed data to the thread requesting the I / O. In this way, the I / O manager allocates the system buffer related to the buffer allocated by the thread requesting I / O to process the data transfer. The Bufferd I / O scheme uses the intermediate buffer in the system area as a data buffer. The I / O manager takes care of data movement between the data buffer of the thread requesting I / O and the intermediate buffer, Releases the system buffer when the IRP representing the I / O request completes last.

Figure 4 shows how Bufferd I / O is used as a system buffer.

The disadvantage of using the buffered I / O scheme is that the I / O manager implements additional data copy for data transfer, which degrades the performance of the system. Bufferd I / O is the most popular method because it is the simplest way to deal with the buffers provided by the thread requesting I / O, though this is not a good way to maximize system performance.

In Neither I / O, the I / O manager provides the driver with the virtual address of the thread that requested I / O to the data buffer. The data buffers used in the Neither I / O scheme are not protected in memory and there is no intermediate buffering that can occur during data copying. The virtual address of the thread requesting I / O is passed to the UserBuffer field of the IRP.

Because the virtual address of the thread requesting the I / O is valid only in the context of the process requesting the I / O, drivers that can use Neither I / O can only be used by drivers that receive and process I / O requests directly from the I / O manager. have.

The following three methods are compared.

Direct I / O Buffered I / O Neither I / O Data Buffer Location MDL structure Intermediate buffers in the system area The virtual address of the thread that requested I / O Data protection Data Protection by I / O Manager No data protection No data protection Paging I / O impossible possible possible Data storage fields in IRP IRP -> MDL Address IRP -> Associated IRD, SystemBuffer IRP -> User Buffer Context Any thread context Any thread context The thread context that requested the I / O

There are three ways to use these methods: METHOD_BUFFERD, METHOD_IN_DIRECT, METHOD_OUT_DIRECT, METHOD_NEITHER. The comparison of these three methods is shown in the table below.

METHOD_BUFFERD METHOD_IN_DIRECT METHOD_OUT_DIRECT METHOD_NEITHER How the input buffer is used Bufferd I / O Bufferd I / O Bufferd I / O Neither I / O Storage location of input buffer in IRP IRP -> Associated IRP, System Buffer Current I / O Stack Location-> Parameters. DeviceloControl.Type3 inputBuffer Input Buffer Length Storage Location Current I / O Stack Location-> Parameters. DeviceloControl.Type3 inputBufferLength How the output buffer is used Bufferd I / O Direct I / O Direct I / O Neither I / O Storage location of output buffer in IRP IRP -> Associated IRP, System Buffer IRP -> MDL Address IRP -> MDL Address IRP -> UserBuffer Output Buffer Length Storage Location Current I / O Stack Location-> Parameters. DeviceloControl.Type3 inputBufferLength

Meanwhile, the intrusion detection technology (IDS) of the present invention is as follows.

The transmission of network packets is a callback function structure in the protocol driver, the intermediate driver, and the miniport driver.

The protocol driver receives data from the upper layer, passes the data to the miniport driver through the intermediate driver, and sends the transmission completion message back to the miniport if it has transferred data out of the computer.

So we filter the packets in the MPSend part of the intermediate driver and apply IDS technology. NDIS To use this packet structure, we use the structure called NDIS_PACKET to have the first point of the packet, where we can get the NDIS_BUFFER structure. The pointer to the next NDIS_BUFFER structure exists in the kernel as a list of expressions obtained from the current NDIS_BUFFER structure. That is, the larger the data capacity, the longer the number of chains in NDIS_BUFFER.

Figure 5 shows the structure.

In this way, pattern matching is performed to combine data in the NDIS buffer of the NDIS packet to determine whether the payload is malicious.

There are several ways of pattern matching, but the method used in IDS requires many types of patterns to be compared at the same time, so it is difficult to achieve good performance with algorithms used in simple pattern matching. Therefore, we apply pattern matching algorithm which can compare various patterns to detect various attack patterns. That is, a multi-pattern matching technique is used. In this method, a valid automata is generated in a preprocessing step and a pattern is retrieved based on the generated automata.

The Aho-Corasick method can be used as a pattern matching method using these algorithms.

This method is based on a hyphen, which has the advantage of extracting the results of several patterns in a single scan to prevent malicious behavior.

A common pattern matching technique would be to scan all four query words one at a time if four patterns are searched simultaneously. However, if Aho-Corasick pattern matching is adopted and scanning is performed, four search words are used to form a hyphen in the preprocessing step, and pattern matching is performed based on the configured hyphens.

Fig. 7 is a hyphen using this Aho-Corasick Failure.

Aho-Corasick pattern matching is the concept of failure nodes based on hyphens. Failure refers to the failure nodes by searching the dashes in the BFS and checking the failure node to see if there is a node having the same string key value as the corresponding node among the transition nodes from the failure node of the parent node of the corresponding node. The Aho-Corasick method is a pattern matching method using the Aho-Corasick tire as a hyphen after assigning failure nodes in this format.

The window application and system can be used by a user to select an application such as a firewall status, a traffic graph, a port list, a policy setting, an Android setting, and a log by using an MFC so that a user can check the status of his or her computer And stores the specified firewall settings and various policies so that they can be used at the next execution. At this time, the storage format is stored using XML.

In order to check the status of the firewall, the user can check the operation status of the firewall by clicking the button, and select the operation status to select the off and on. In addition, a graph is displayed so that the user can intuitively confirm the traffic amount, and the traffic amount is displayed for each type of protocol as data of the graph.

Also, the process and port list output information list of processes of the current computer and information such as IP, port, and protocol of the source and destination of the port used by each process at a glance in a list format.

The policy setting is a part where the administrator can set a basic policy of the firewall, and can confirm or modify the currently set policy. The policy can block both inbound and outbound through the IP and port information of the origin and destination. It also allows you to save policy settings or retrieve stored content.

The Android setting allows the user to set the communication settings between the MFC application and the Android application. Register your password and device ID so that only one smartphone can manipulate the firewall settings or receive danger intrusion detection.

The log allows you to check the logs of the firewall created by the driver when capturing the danger. The log information stores IP, port information, a source, a destination, and a communication method.

Figure 8 is an embodiment of an overall UI of an MFC application.

In the above-mentioned Android application and system, the functions of the Android application implement the functions of the PC application. Through the notification of dangerous activity, which is the most important function, it is possible to perform the function of showing the corresponding packet, the traffic information viewer currently being exchanged, user policy setting, firewall start / stop, and the like. However, it is desirable to exclude the log function because it may require excessive traffic.

Anti-Decompilation and Anti-Reversing techniques are applied to prevent malicious intentional users from decompiling an application. Android based on VM is inevitably vulnerable to Decompile. However, there are several techniques that can make Decompile difficult or delayed.

As an example, there is code obfuscation. Obfuscation means conversion of a person to be hard to read, and can be roughly divided into layout obfuscation, control obfuscation, and data obfuscation. Layout obfuscation is a technique that prevents decompiled source code from having meaning by renaming a variable or moving the position of an identifier in a class file. Control obfuscation is a technique that inserts code that is not intentionally executed or unnecessary to make it difficult to grasp the control flow. Also, if a well - known design pattern is used, it can be obfuscated because it is easy to recognize the pattern. Data obfuscation is a technique of making one array into a two-dimensional or three-dimensional array and alternating between holes and pairs.

However, such decompile techniques increase the cost of decompile but can not be completely prevented. To make up for this, there is a way to use native methods through Android NDK. However, this is also not safe for Reversing, so Anti Reversing technology is applied.

Anti-Decompile should be applied to Android classes and methods that can not be created by NDK, and Anti-Reversing technology should be applied to parts that can be created by NDK.

The communication between the window application and the Android application includes various kinds of information. Actions such as notification of a risk to a pattern detection or manipulating a policy of a window application can be audited or manipulated by packet sniffing. To prevent this, all packets transmitted and received are encrypted and transmitted and received. The encryption algorithm uses the AES algorithm. The AES algorithm is a newly publicized and promulgated cryptographic algorithm as DES, previously used as a US government standard, is relatively slow and its stability is threatened. It is possible to use a variable length block and a variable length key, and is aiming at simplicity of speed and code simplicity. Based on these advantages, IEEE 802.11n recommends encryption using AES.

The embodiments of the present invention described above and shown in the drawings should not be construed as limiting the technical idea of the present invention. The scope of protection of the present invention is limited only by the matters described in the claims, and those skilled in the art will be able to modify the technical idea of the present invention in various forms. Accordingly, such improvements and modifications will fall within the scope of the present invention if they are apparent to those skilled in the art.

10: Android Applications and Systems
20: Windows application
30: Intermittent driver
40: Network card

Claims (1)

An application and system 10 that can be applied to an Android platform, a window application and system 20, a network interface card 40 and an intermittent driver 30,
The intermittent driver 30 includes a driver initialization unit 31 that can perform installation and uninstallation and initialize callback routines, and packets that are transmitted between the protocol driver and the miniport driver, And a logging unit 33 and an intrusion detection unit 34 for detecting a malicious packet through pattern matching of a monitored result and leaving a log. Intrusion Detection Monitoring System of Server using Smart Phone.

Images