KR20160076167A - System and Method for Anomaly Detection - Google Patents

Abstract

Disclosed in the present invention are an anomaly detection system and a method thereof. According to an embodiment of the present invention, the anomaly detection system includes: at least one agent which is installed in a user PC, collects data related to processes of all programs run on the PC, and transmits the data through a network; a storage/analysis device which stores the data collected by the agent in a storage; and a detection device which checks if a check-target action outside the predefined normal action range exists based on the data related to the processes. The storage/analysis device searches for data related to the all processes regarding the check-target action in the storage and checks if the check-target action is an anomaly using the clustering result using the found data and the clustering result about the predefined abnormal programs.

Description

{System and Method for Anomaly Detection}

The present invention relates to a program anomaly detection technology, and more particularly, to a system and method for detecting anomalous activity that can detect an abnormal operation using a process during execution of a program.

With the rapid development of the Internet infrastructure and the increasing penetration rate of the Internet, malicious programs that threaten the security of user PCs become increasingly intelligent and diversified, and the damage caused by malicious programs is also increasing day by day.

Malicious programs are programs that infiltrate a user's PC to handle unrelated tasks or perform abnormal functions, and collectively refer to programs such as viruses, worms, Trojan horses, backdoors, and spyware.

Malicious programs can exist in various forms, but they can access other programs or operating systems to change code, extract information, send and receive abnormal network packets, or stealth to hide their presence from security programs. There is a common feature that it performs abnormal behavior different from general program.

Conventional malicious behavior detection methods include a method of analyzing malicious program code to create a pattern signature that can remove a malicious program and detecting and blocking the malicious behavior by detecting the same signature. However, this method could not be detected except for known attacks, as signature identity was confirmed with high accuracy.

SUMMARY OF THE INVENTION It is an object of the present invention to provide an abnormal behavior detection system and method capable of detecting an abnormal behavior using process information of a program.

The objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided an abnormal behavior detection system comprising: at least one agent, which is provided in a user PC, collects information related to a process of all programs executed in the PC and transmits the collected information to a network; A storage / analysis device that stores information collected by the agent in a repository; The information processing apparatus according to claim 1, further comprising: a detection device for verifying the existence of an operation to be verified that is out of a predetermined normal operation range from the information related to the process, wherein the storage / And the clustering result using the retrieved information and the clustering result of the predetermined abnormal program are used to confirm whether the verification target behavior is an abnormal behavior.

According to the present invention, an abnormal behavior can be detected using process information of a program.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a diagram showing the relationship between a program, a process and network traffic according to the present invention; Fig.
FIG. 2A and FIG. 2B are flowcharts illustrating a clustering process using a process of an abnormal program and a relationship of network traffic according to the present invention. FIG.
FIG. 3 is a block diagram illustrating an abnormal behavior detection system according to the present invention; FIG.
4 is a diagram for explaining an abnormal behavior judging process according to the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, advantages and features of the present invention and methods for accomplishing the same will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms " comprises, " and / or "comprising" refer to the presence or absence of one or more other components, steps, operations, and / Or additions.

Hereinafter, a method of generating a criterion used for abnormal behavior detection in an embodiment of the present invention will be described before describing the system configuration and the operation method of the present invention. Hereinafter, a method for generating an abnormal behavior detection criterion according to an embodiment of the present invention will be described with reference to FIGS. 1 and 2. FIG.

FIG. 1 is a diagram illustrating a relationship between a program, a process, and network traffic according to an exemplary embodiment of the present invention. FIGS. 2A and 2B illustrate a clustering process using an abnormal program process and a network traffic relationship according to an embodiment of the present invention. Fig.

1, when one program is executed in the PC, a plurality of processes (processes 1 to n) are generated through a process generation system call, and a part of the generated processes (processes 1, 2, 3, 4, n) It generates various types of network traffic.

According to the present invention, by using the feature of such a program, the behavior (characteristic) is calculated by using the relation between the process and the network traffic generated when a plurality of abnormal programs are executed, that is, the association rule or sequence pattern between the process and the network traffic And the abnormal behavior is detected using this.

The clustering of behaviors using the process of multiple abnormal programs and the relationship with network traffic can be performed as follows.

Referring to FIG. 2A, the abnormal behavior detection system 10 collects an abnormal program already known from a network, a database, or the like (S210). If the abnormal behavior detection system 10 already has process and network traffic of the abnormal program, this step may be omitted.

The abnormal behavior detection system 10 executes the collected abnormal programs to extract input variables (i.e., variables to be clustered) to be used in the clustering process (S220). Here, the input variables to be used for clustering are related to the process and network traffic generated during the execution of the abnormal program, and the concrete contents thereof will be described below.

The abnormal behavior detection system 10 clusters the input variables after selecting one clustering algorithm from among the plurality of clustering algorithms (S230). Here, the abnormal behavior detection system 10 can group abnormal programs having similar characteristics using the relationship between the process and the network traffic. At this time, a plurality of clustering algorithms and clustering processes can be derived from the present invention by those skilled in the art, so a detailed description thereof will be omitted.

In the above-described example, the abnormal behavior detection system 10 performs the abnormal behavior clustering process as an example. However, it is needless to say that the abnormal behavior detection system 10 may manually perform the above-described processes according to an instruction of the administrator.

On the other hand, the above input variables to be used in the clustering process are as follows.

- Number of processes created by the abnormal program

- The number of processes that have network connections among the processes created by the abnormal program.

- The total number of network connections for processes created by the abnormal program

- The total number of local network connections (127.0.0.1) of processes created by the abnormal program

- the type of network flow created by the processes created by the abnormal program

- The number of network connections whose target port is 80 among the network connections created by the processes created by the abnormal program

- The number of network connections whose target port is other than 80 among the network connections created by the processes created by the abnormal program.

- The maximum number of network connections for processes that have a maximum network connection among the processes created by the abnormal program.

- Percentage of processes that have network connections among processes created by abnormal programs

- Percentage of local network connections among the network connections created by the processes created by the abnormal program

- Percentage of network connections whose target port is 80 among the network connections created by the processes created by the abnormal program.

As shown in the left-hand side of FIG. 2B, the extracted input variables may be a plurality of points within the dotted ellipse. Here, the dotted ellipse can be simply a grouping of input variables.

As shown in the right side of FIG. 2B, when a plurality of input variables in an ellipse are clustered, they can be clustered like a plurality of solid line ellipses.

Hereinafter, an abnormal behavior detection system according to an embodiment of the present invention will be described with reference to FIG. 3 and FIG. FIG. 3 is a block diagram illustrating an abnormal behavior detection system according to an embodiment of the present invention, and FIG. 4 is a diagram for explaining an abnormal behavior determination process according to an embodiment of the present invention.

3, the abnormal behavior detection system 10 according to an embodiment of the present invention includes a plurality of agents 310_1 to n, a storage / analysis apparatus 330, a mass storage 340, (320). Here, the plurality of agents 310_1 to n, the storage / analysis apparatus 330, and the abnormal behavior detection apparatus 320 may be connected to the Internet.

Each of the agents 310_1 to 310-n collects process and network connection information of all programs executed in the installed user PC as software or hardware installed in each user PC. Here, the user may include a general user, an administrator, and the like.

Each of the agents 310_1 to 310-n transmits a plurality of collected processes and a plurality of network connection information to the storage / analysis apparatus 330.

Here, the plurality of processes and the plurality of network connection information include a process creation time, a host ID (e.g., a host IP address), a process ID, a parent process ID (parent process ID), and Src and Dst of a process involving network connection. IP address, Src. And Dst. And a port.

The storage / analysis apparatus 330 stores a plurality of processes and a plurality of network connection information received from the agents 310_1 to 310-n in the mass storage 340.

The abnormal behavior detection apparatus 320 detects a plurality of processes and a plurality of network connection information in the mass storage 340 at a predetermined time point and confirms whether there is an operation to be confirmed out of the predetermined normal operation range. In this case, the predetermined normal operation range may be defined as a result of monitoring the network usage status for at least a certain period of time in a situation where abnormal behavior does not occur. For example, the predetermined normal action range can be defined by the order of appearance of processes and network connection information.

When the abnormal behavior detection device 320 detects an action to be confirmed that is out of the predetermined normal action range, the abnormal behavior detection device 320 transmits the detection information to the storage / analysis device 330. For example, the detection information includes a detection time of an action to be confirmed and Src. And Dst. IP address, Src. And Dst. Port.

Upon receiving the detection information, the storage / analysis device 330 retrieves the process and network connection information in the mass storage 340 associated with the detection information and the detection information.

Then, the storage / analysis apparatus 330 confirms whether the process and network connection information related to the searched verification target behavior exists in the cluster.

Specifically, the storage / analysis apparatus 330 performs clustering using input data and process related to the object behavior to be classified as input variables, generates a classification result, and outputs the classification result to the predefined distribution group (the ellipse ).

If the classification result exists in the clustering group as in the point A in the ellipse of FIG. 4, the storage / analysis device 330 determines that the verification target behavior is an abnormal behavior. On the other hand, if the classification result does not exist in the clustering group like the point B outside the ellipse in FIG. 4, the storage / analysis device 330 can determine the verification target behavior as a normal operation.

As described above, the embodiment of the present invention can define the normal action range based on the network use situation, and can detect the abnormal action by using the clustering result of the abnormal program for the action to be confirmed that is out of the normal action range.

Accordingly, the embodiment of the present invention can remarkably reduce the occurrence of a false positive, which is a problem of a technique of detecting a known unknown attack, that is, a modified attack.

While the present invention has been described in detail with reference to the accompanying drawings, it is to be understood that the invention is not limited to the above-described embodiments. Those skilled in the art will appreciate that various modifications, Of course, this is possible. Accordingly, the scope of protection of the present invention should not be limited to the above-described embodiments, but should be determined by the description of the following claims.

Claims (1)

At least one agent each of which is provided in a user PC and collects information related to a process of all programs executed in the PC and transmits the collected information to a network;
A storage / analysis device that stores information collected by the agent in a repository;
And a detection device for verifying the presence or absence of an action to be verified that is out of the predetermined normal action range from the information related to the process,
The storage / analysis apparatus searches information related to all the processes related to the verification target behavior in the repository, and uses the result of the clustering using the retrieved information and the result of clustering of a predetermined abnormal program, An abnormal behavior detection system.

Images