KR20180042608A - Apparatus and method for analyzing network malicious behavior - Google Patents

Abstract

Disclosed are an apparatus and a method for analyzing a network malicious behavior. According to present invention, the apparatus comprises: a flow extracting part for extracting flow meta information of collected network traffic; a flow storage part for storing the extracted flow meta information in a table form of a database; and a malicious behavior analyzing part for transmitting a query corresponding to at least one of a persistent external connection query and a TCP SYN flooding query to the flow storage part and analyzing a network malicious behavior based on a response value of the query. Therefore, the apparatus may allow an analyst who lacks experience or knowledge to easily analyze the network malicious behavior.

Description

[0001] APPARATUS AND METHOD FOR ANALYZING NETWORK MALICIOUS BEHAVIOR [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to network malicious behavior analysis technology, and more particularly, to a technology for analyzing network malicious behavior using meta information of collected network traffic and network traffic.

Today, cyber attacks are used to cause social confusion, threaten national security, and cause financial harm to individuals. The types of cyber attacks are becoming more diverse, and typical network threats include botnets and distributed denial of service attacks (DDoS).

A botnet is a network of computers infected with bot malicious software. The bots are remotely controlled by bot masters who have the ability to control freely and perform various malicious acts.

Bots have various characteristics of malicious codes such as worms / viruses, backdoors, spyware, and rootkits. Most cyber attacks are possible through botnets such as DDoS, Ad-ware, Spyware, Spamming,

TCP SYN Flooding attack, which is one of the denial of service attacks, is an attack method that attacks network and system resources. It is an attack method using connection directivity in which TCP must first establish a connection before sending data.

That is, the TCP SYN Flooding attack uses SYN / ACK when the client sends a SYN flag to the TCP header when the client tries to connect to the server using the TCP protocol, and receives the ACK of the client again. It is an attack.

If an attacker arbitrarily tricks his or her IP address into an IP address that can not be replied to the server, the server sends a SYN / ACK to the client and waits to receive an ACK, which is the client's response thereto. Thus, the TCP SYN flooding attack makes the state that the queue space becomes full and can no longer receive the TCP SYN, and executes the attack.

In the event of cyber attacks, technologies have been developed to collect network traffic, extract network flow information, and detect and analyze cyber attacks using various search tools.

However, conventional cyber attack analysis techniques require various experiences and knowledge of analysts. In other words, users lacking experience or knowledge have difficulties in analyzing cyber attacks, and the performance of cyber attack analysis depends on the experience and knowledge of analysts.

Therefore, it is necessary to develop a technique that enables analysts lacking experience or knowledge to easily analyze network malicious behavior.

Korean Registered Patent No. 10-1623068, May 20, 2016 Announcement (Name: Network Traffic Acquisition and Analysis System)

The object of the present invention is to enable an analyst who lacks experience or knowledge to easily analyze network malicious behavior.

It is also an object of the present invention to analyze network malicious behavior of a botnet in which a bot infected system accesses a C & C system.

It is also an object of the present invention to analyze network malicious behavior of TCP SYN flooding.

According to an aspect of the present invention, there is provided an apparatus for analyzing network malicious behavior, comprising: a flow extractor for extracting flow meta information of collected network traffic; A flow storage unit for storing the extracted flow meta information in a table form of a database; And a malicious behavior analysis unit for sending a query corresponding to at least one of a persistent external connection query and a TCP SYN flooding query to the flow storage unit and analyzing network malicious behavior based on a response value of the query.

At this time, the malicious behavior analysis unit may perform the persistent external connection query, which analyzes an RST packet corresponding to a plurality of SYN packets transmitted from the first network equipment to the second network equipment.

At this time, the malicious behavior analysis unit may include a host of the second network equipment corresponding to the source IP, a port of the second network equipment, a host of the first network equipment corresponding to the destination IP, May be grouped.

At this time, if the number of ports of the first network equipment is equal to or greater than the threshold value, the malicious behavior analysis unit may detect malicious activity corresponding to the persistent external connection.

At this time, the malicious behavior analysis unit may perform the TCP SYN flooding query, which analyzes the number of packets corresponding to the destination IP and the destination port.

At this time, the malicious behavior analysis unit may group the number of flows corresponding to the destination IP, the destination port, and the destination port of the destination IP.

At this time, the malicious behavior analysis unit can detect malicious behavior corresponding to the TCP SYN flooding when the number of the flows is equal to or greater than the threshold value.

In this case, the flow storage unit may manage the index of the flow meta information in a bitmap form.

The flow meta information includes at least one of a source IP corresponding to the flow of the network traffic, a port number of the source, an IP of a destination, a port number of the destination, a number of packets, a number of bytes, a protocol, An accumulation value of the TCP flag information, a start time, and an end time.

At this time, the malicious behavior analysis unit can query the flow storage unit using the 6-bit TCP flag information.

Also, the network malicious behavior analysis method performed by the apparatus for analyzing network malicious behavior according to an embodiment of the present invention includes: extracting flow meta information of collected network traffic; Storing the extracted flow meta information in a table form of a database; Transmitting a query corresponding to at least one of a persistent external connection query and a TCP SYN flooding query to a database of the stored flow meta information; And analyzing network malicious behavior based on the response value of the query.

At this time, the transmitting of the query may transmit the persistent external connection query, which analyzes an RST packet corresponding to a plurality of SYN packets transmitted by the first network equipment to the second network equipment.

Wherein analyzing the network malicious behavior comprises: analyzing the network malicious behavior based on a host of the second network equipment corresponding to the source IP, a port of the second network equipment, a host of the first network equipment corresponding to the destination IP, And at least one of the number of ports of the equipment can be grouped.

At this time, when analyzing the network malicious behavior, malicious behavior corresponding to the persistent external connection can be detected when the number of ports of the first network equipment is equal to or greater than the threshold value.

At this time, the step of transmitting the query may transmit the TCP SYN flooding query, which analyzes the number of packets corresponding to the destination IP and the destination port.

At this time, the analyzing network malicious behavior may group the number of flows corresponding to the destination IP, the destination port, and the destination port of the destination IP.

At this time, when analyzing the network malicious behavior, malicious behavior corresponding to the TCP SYN flooding can be detected when the number of the flows is equal to or greater than a threshold value.

In this case, the step of storing the flow meta information may manage the index of the flow meta information in a bit map form.

The flow meta information includes at least one of a source IP corresponding to the flow of the network traffic, a port number of the source, an IP of a destination, a port number of the destination, a number of packets, a number of bytes, a protocol, An accumulation value of the TCP flag information, a start time, and an end time.

At this time, the network malicious behavior analysis may query the database of the flow meta information using the 6-bit TCP flag information.

According to the present invention, an analyst who lacks experience or knowledge can easily analyze network malicious behavior.

Also, according to the present invention, it is possible to analyze a network malicious behavior of a botnet in which a bot-infected system accesses a C & C system.

Also, according to the present invention, network malicious behavior of TCP SYN flooding can be analyzed.

FIG. 1 is a diagram schematically illustrating an environment to which a network malicious behavior analysis apparatus according to an embodiment of the present invention is applied.
2 is a block diagram illustrating a configuration of an apparatus for analyzing network malicious behavior according to an exemplary embodiment of the present invention.
3 is a flowchart illustrating a method for analyzing network malicious behavior according to an exemplary embodiment of the present invention.
4 is a diagram illustrating network flow meta information according to an exemplary embodiment of the present invention.
5 is a diagram illustrating a TCP flag according to an embodiment of the present invention.
6 is a diagram for explaining a persistent external connection query according to an embodiment of the present invention.
7 is a view for explaining a TCP SYN flooding query according to an embodiment of the present invention.
8 is a block diagram illustrating a computer system in accordance with an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the understanding of the present invention, the same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

FIG. 1 is a diagram schematically illustrating an environment to which a network malicious behavior analysis apparatus according to an embodiment of the present invention is applied.

As shown in FIG. 1, the network malicious behavior analysis system may include a traffic collection apparatus 100, a network malicious behavior analysis apparatus 200, and a database 300.

First, the traffic collecting apparatus 100 may correspond to the traffic monitoring system. Also, the traffic collecting apparatus 100 may perform a tap or mirroring process for copying and collecting traffic generated in real- ) Device or the like.

The traffic collecting apparatus 100 provides the collected network traffic to the network malicious behavior analysis apparatus 200. At this time, the traffic collecting apparatus 100 may provide the network malicious behavior analysis apparatus 200 with a packet capture (pcap) file in which network packets are stored.

pcap consists of an API for capturing network traffic. Unix-like operating systems include pcap in the libpcap library, and the Windows environment uses the libpcap porting called WinPcap. Packets captured using the libpcap and winpcap libraries can be saved as files.

The network malicious behavior analysis apparatus 200 is not limited to the network malicious behavior analysis apparatus 200. For example, the network malicious behavior analysis apparatus 200 may be configured to detect the network malicious behavior analysis apparatus 200, You can use the software to obtain the pcap file.

The network malicious behavior analysis apparatus 200 extracts network flow meta information from the pcap file.

Here, the network flow meta information is information indicating how the network packets are transmitted between the two network devices. At least one of sourcehost, source port, destinationhost, destination port, packets, bytes, protocol, service, filetype, tcpflags, One can be included.

In addition, the network malicious behavior analysis apparatus 200 stores the extracted network flow meta information in the form of a table in a database. At this time, the network malicious behavior analysis apparatus 200 may store network flow meta information in an external database 300 or store network flow meta information in a database provided in the network malicious behavior analysis apparatus 200.

The network malicious behavior analysis apparatus 200 can store network flow meta information using a bitmap index to support fast loading and fast searching.

Here, the bitmap index refers to an index that stores a column value using a bit and automatically generates a rowid using the bit value. The apparatus 200 for analyzing network malicious behavior according to an embodiment of the present invention may use a bitmap index that manages an index in a bitmap form for searching large amounts of data.

The network malicious behavior analysis apparatus 200 queries the database 300 according to a predefined network malicious behavior analysis method, and receives a response value of the query. In this case, the database 300 may be an external database 300 storing network flow meta information or a database provided in the network malicious behavior analysis apparatus 200.

The network malicious behavior analysis apparatus 200 may perform a query corresponding to a persistent external connection or perform a query corresponding to TCP SYN flooding. And analyze network malicious behavior based on the response value of the query.

At this time, the network malicious behavior analysis apparatus 200 can perform a query corresponding to the persistent external connection based on the symptom when an internal system infected with a malicious code such as a bot approaches the external C & C system.

In addition, the network malicious code analysis apparatus 200 can perform a query corresponding to the TCP SYN flooding based on the symptom that a large amount of TCP SYN packet is transmitted to a specific destination IP and a specific destination port.

Hereinafter, a configuration of a network malicious behavior analysis apparatus according to an embodiment of the present invention will be described in detail with reference to FIG.

2 is a block diagram illustrating a configuration of an apparatus for analyzing network malicious behavior according to an exemplary embodiment of the present invention.

2, the network malicious behavior analysis apparatus 200 includes a flow extracting unit 210, a flow storing unit 220, and a malicious behavior analyzing unit 230. As shown in FIG.

First, the flow extracting unit 210 extracts flow meta information of the collected network traffic.

Here, the flow meta information is information indicating how network packets are transmitted between two network devices. The flow meta information includes at least one of a source IP address of a source corresponding to a flow of network traffic, a source port number, a destination IP address, a destination port number, a packet number, Includes at least any one of a number of bytes, a protocol, a service, a file type, an accumulated value of TCP flag information (tcpflags), a start time, and an end time .

Next, the flow storage unit 220 stores the extracted flow meta information in the form of a table in the database. At this time, the flow storage unit 220 may store flow meta information in an external database or store flow meta information in a database provided in the network malicious behavior analysis apparatus 200.

The flow storage unit 220 may store the network flow meta information using a bitmap index to support fast loading and fast searching.

Here, the loading means storing the network flow information in the form of a table in the database, and the flow storage unit 220 can manage the index of the flow meta information in the form of a bitmap for searching a large amount of data.

Finally, the malicious behavior analysis unit 230 transmits a query to the database according to a predefined network malicious behavior analysis method. Then, it receives the response value (result) corresponding to the query, and analyzes network malicious behavior based on the response value of the query.

At this time, the malicious behavior analysis unit 230 may transmit a query corresponding to at least one of a query corresponding to persistent external connection and a query corresponding to TCP SYN flooding to the database. The malicious behavior analysis unit 230 can analyze network malicious behavior based on the response value to the query.

Malicious behavior analysis unit 230 may analyze the RST packet corresponding to a plurality of SYN packets transmitted from the first network equipment to the second network equipment by performing persistent external connection query.

The malicious behavior analysis unit 230 may determine at least one of the host of the second network equipment corresponding to the source IP, the port of the second network equipment, the host of the first network equipment corresponding to the destination IP, Can be grouped. If the number of ports of the first network equipment is greater than or equal to the threshold value, the malicious behavior analysis unit 230 may detect malicious activity corresponding to the persistent external connection.

A persistent external connection means that the external system sends an RST packet to the internal system because the internal system continuously sends the SYN packet to connect to the external system but the corresponding port of the external system is not open.

Persistent external connectivity is a common symptom often seen when an internal system infected with malicious code tries to access an external C & C system. Accordingly, the malicious behavior analysis unit 230 can analyze the malicious behavior corresponding to the continuous external connection by transmitting the continuous external connection query to the database.

In addition, the malicious behavior analysis unit 230 may analyze the number of packets corresponding to the destination IP and the destination port by performing the TCP SYN flooding query. The malicious behavior analysis unit 230 may group at least one of the destination IP, the destination port, and the number of flows corresponding to the destination port of the destination IP. If the number of flows is equal to or greater than the threshold value, the malicious behavior analysis unit 230 may detect malicious activity corresponding to TCP SYN flooding.

TCP SYN flooding means sending a large number of TCP SYN packets to a specific destination IP and a specific destination port. TCP SYN flooding is mainly used for Denial of Service (DoS) attacks. Therefore, the malicious behavior analysis unit 230 may analyze the malicious behavior corresponding to the TCP SYN flooding by transmitting the TCP SYN flooding query to the database.

The malicious behavior analysis unit 230 can query the database using the 6-bit TCP flag information.

Here, the TCP flag information may be composed of 6 bits of URG, ACK, PSH, RST, SYN, and FIN. URG means Urgent Flag, it is used when urgent data processing is required, ACK means Acknowledgment Flag and it is used when responding to a connection. PSH stands for Push Flag and is used to send data quickly.

RST means Reset Flag and it is used to unblock the session unilaterally if communication can not be restored due to unexplained failure. SYN means a Synchronize Flag used when requesting a connection, and FIN means a Fin Flag used when a data transmission is completed or a session is requested to be terminated.

Hereinafter, a method for analyzing network malicious behavior performed by the apparatus for analyzing network malicious behavior according to an embodiment of the present invention will be described in detail with reference to FIG. 3 through FIG.

3 is a flowchart illustrating a method for analyzing network malicious behavior according to an exemplary embodiment of the present invention.

First, the network malicious behavior analysis apparatus 200 collects network traffic (S310).

The network malicious behavior analysis apparatus 200 may obtain a pcap file from a traffic collection device such as a tap or a mirroring device or may acquire a pcap file directly using traffic monitoring software. The network malicious behavior analysis apparatus 200 can collect network traffic using a known technology, and the method for collecting network traffic is not limited thereto.

Then, the network malicious behavior analysis apparatus 200 extracts flow meta information from the collected network traffic (S320) and stores the extracted flow meta information (S330).

Here, the network flow meta information means information indicating how network packets are transmitted between two network devices.

4 is a diagram illustrating network flow meta information according to an exemplary embodiment of the present invention.

As shown in FIG. 4, the network flow meta information may include sourcehost, source port, destinationhost, destination port, packets, bytes, protocol, service, filetype, tcpflags, starttime and endtime.

Sourcehost means the IP of the device that sent the network packet, and source port means the port number used in the device that sent the network packet. The destination host is the IP address of the device receiving the network packet, and the destination port is the port number of the device receiving the network packet.

In addition, packets indicate the number of packets sent from the flow, bytes indicate the number of bytes sent from the flow, protocol indicates a protocol used in the flow, and service indicates a service used in the flow . And the filetype detects the signature of the file when the file is transferred in the flow.

Tcpflags denotes an accumulated value of TCP flag information corresponding to a packet sent from the corresponding flow, starttime means the start time of the flow, and endtime means the end time of the flow.

Referring again to FIG. 3, the network malicious behavior analysis apparatus 200 transmits a query to the flow meta information database (S340) and analyzes network malicious behavior based on the response value of the query (S350).

At this time, the network malicious code analysis apparatus 200 may transmit a query corresponding to at least one of a query corresponding to persistent external connection and a query corresponding to TCP SYN flooding to the database.

The network malicious behavior analysis apparatus 200 can query the database using the 6-bit TCP flag information.

5 is a diagram illustrating a TCP flag according to an embodiment of the present invention.

As shown in FIG. 5, the TCP flag information may be composed of 6 bits of URG, ACK, PSH, RST, SYN, and FIN. URG means Urgent Flag, it is used when urgent data processing is required, ACK means Acknowledgment Flag and it is used when responding to a connection. PSH stands for Push Flag and is used to send data quickly.

RST means Reset Flag and it is used to unblock the session unilaterally if communication can not be restored due to unexplained failure. SYN means a Synchronize Flag used when requesting a connection, and FIN means a Fin Flag used when a data transmission is completed or a session is requested to be terminated.

The network malicious behavior analysis apparatus 200 may transmit a query corresponding to the persistent external connection to the database in step S340 of FIG.

A persistent external connection means that the external system sends an RST packet to the internal system because the internal system continuously sends the SYN packet to connect to the external system but the corresponding port of the external system is not open.

Persistent external connectivity is a common symptom often seen when an internal system infected with malicious code tries to access an external C & C system. Therefore, the network malicious behavior analysis apparatus 200 can analyze the malicious behavior corresponding to the persistent external connection by transmitting the persistent external connection query to the database.

6 is a diagram for explaining a persistent external connection query according to an embodiment of the present invention.

In the persistent external connection query shown in FIG. 6, the value of tcpflags is 20, meaning binary number 010100. Since the Tcp flag is composed of 6 bits of URG, ACK, PSH, RST, SYN and FIN as shown in FIG. 5, 010100 indicates that a packet with the ACK flag and the RST flag set to 1 is transmitted in the corresponding flow. That is, the device corresponding to the source IP transmits the RST packet to the device corresponding to the destination IP.

When the apparatus corresponding to the destination IP sends a SYN packet to the apparatus corresponding to the source IP through the persistent external connection query of FIG. 6, the network malicious behavior analysis apparatus 200 determines whether the apparatus corresponding to the source IP is a destination IP To determine whether the RST packet has been sent to the corresponding equipment.

The network malicious behavior analysis apparatus 200 groups (sourcehost, source port, destinationhost, destination port number) in order to process such a process for all the flows at once. If the number of destination ports is equal to or greater than a preset threshold value, the network malicious behavior analysis apparatus 200 determines that the malicious behavior corresponds to the persistent external connection.

For example, if the response value (result) of the persistent external connection query is (A, B, C, D), the infection system C means that the external connection is continuously made to the port B of the external system A . Since port B of external system A is not yet open, external system A has sent RST packet D to infected system C. Then, the network malicious behavior analysis apparatus 200 can compare malicious behavior corresponding to the persistent external connection by comparing D with a preset threshold.

In this manner, the network malicious behavior analysis apparatus 200 can perform a persistent external connection query to analyze RST packets corresponding to a plurality of SYN packets transmitted from the first network equipment to the second network equipment.

Then, the network malicious behavior analysis apparatus 200 determines at least one of the host of the second network equipment corresponding to the source IP, the port of the second network equipment, the host of the first network equipment corresponding to the destination IP, Any one can be grouped. In addition, the network malicious behavior analysis apparatus 200 can detect malicious behavior corresponding to a persistent external connection when the number of ports of the first network equipment is equal to or greater than a threshold value.

Meanwhile, the network malicious behavior analysis apparatus 200 may transmit a query corresponding to TCP SYN flooding to the database in step S340 of FIG.

TCP SYN flooding means sending a large number of TCP SYN packets to a specific destination IP and a specific destination port. TCP SYN flooding is mainly used for Denial of Service (DoS) attacks. Therefore, the network malicious behavior analysis apparatus 200 can analyze the malicious behavior corresponding to the TCP SYN flooding by transmitting the TCP SYN flooding query to the database.

7 is a view for explaining a TCP SYN flooding query according to an embodiment of the present invention.

In the TCP SYN flooding query shown in FIG. 7, when the value of tcpflags is 2, it means 000010 as a binary number. Since the Tcp flag is composed of 6 bits of URG, ACK, PSH, RST, SYN, and FIN as shown in FIG. 5, 000010 means that a packet having the SYN flag set to 1 is transmitted in the corresponding flow.

Since TCP SYN flooding targets specific destination IP and specific destination port, grouping is performed using destination IP and destination port, and when the number of flows corresponding to the destination IP and destination port is equal to or greater than a preset threshold value, The network malicious behavior analysis apparatus 200 can detect malicious activity corresponding to TCP SYN flooding.

For example, if the response value (result) of the TCP SYN flooding query is (A, B, C), it means that TCP SYN packet C is sent to port B of the destination IP of A. Then, the network malicious behavior analysis apparatus 200 can compare malicious behavior corresponding to the TCP SYN flooding by comparing C with a predetermined threshold.

For convenience of explanation, the predetermined threshold value in FIG. 6 and the predetermined threshold value in FIG. 7 are not displayed separately from each other. However, the predetermined threshold values shown in FIG. 6 and FIG. It can mean different values.

In this manner, the network malicious code analysis apparatus 200 can perform the TCP SYN flooding query to analyze the number of packets corresponding to the destination IP and the destination port. The network malicious behavior analysis apparatus 200 can group at least one of the destination IP, the destination port, and the number of flows corresponding to the destination port of the destination IP. Then, the network malicious behavior analysis apparatus 200 can detect malicious behavior corresponding to the TCP SYN flooding when the number of flows is equal to or greater than the threshold value.

8 is a block diagram illustrating a computer system in accordance with an embodiment of the present invention.

Referring to FIG. 8, embodiments of the present invention may be implemented in a computer system 800, such as a computer readable recording medium. 8, a computer system 800 includes one or more processors 810, a memory 830, a user input device 840, a user output device 850, and a storage 850, which communicate with one another via a bus 820. [ 860 < / RTI > In addition, the computer system 800 may further include a network interface 870 connected to the network 880. The processor 810 may be a central processing unit or a semiconductor device that executes the processing instructions stored in the memory 830 or the storage 860. [ Memory 830 and storage 860 may be various types of volatile or non-volatile storage media. For example, the memory may include ROM 831 or RAM 832.

Thus, embodiments of the invention may be embodied in a computer-implemented method or in a non-volatile computer readable medium having recorded thereon instructions executable by the computer. When computer readable instructions are executed by a processor, the instructions readable by the computer are capable of performing the method according to at least one aspect of the present invention.

As described above, the apparatus and method for analyzing network malicious behavior according to the present invention are not limited to the configuration and method of the embodiments described above, but the embodiments can be applied to various embodiments All or a part of the above-described elements may be selectively combined.

100: traffic collecting apparatus 200: network malicious behavior analyzing apparatus
210: Flow extraction unit 220: Flow storage unit
230: malicious behavior analysis unit 300: database
800: computer system 810: processor
820: bus 830: memory
831: ROM 832: RAM
840: user input device 850: user output device
860: Storage 870: Network Interface
880: Network

Claims (20)

A flow extracting unit for extracting flow meta information of the collected network traffic;
A flow storage unit for storing the extracted flow meta information in a table form of a database; And
A malicious behavior analysis unit for analyzing a network malicious behavior based on a response value of the query, a malicious behavior analysis unit for analyzing malicious behavior of the network based on a response value of the query, a query corresponding to at least one of a persistent external connection query and a TCP SYN flooding query,
The network malicious behavior analysis apparatus comprising: The method according to claim 1,
The malicious behavior analysis unit,
Wherein the persistent external connection query analyzing unit analyzes the RST packet corresponding to a plurality of SYN packets transmitted from the first network equipment to the second network equipment. The method of claim 2,
The malicious behavior analysis unit,
Grouping at least one of a host of the second network equipment corresponding to the source IP, a port of the second network equipment, a host of the first network equipment corresponding to the destination IP and a port number of the first network equipment, Malicious behavior analysis device. The method of claim 3,
The malicious behavior analysis unit,
Detecting malicious behavior corresponding to the persistent external connection when the number of ports of the first network equipment is equal to or greater than a threshold value. The method according to claim 1,
The malicious behavior analysis unit,
And analyzes the number of packets corresponding to the destination IP and the destination port, and performs the TCP SYN flooding query. The method of claim 5,
The malicious behavior analysis unit,
And grouping the number of flows corresponding to the destination IP, the destination port, and the destination port of the destination IP. The method of claim 6,
The malicious behavior analysis unit,
And detects a malicious action corresponding to the TCP SYN flooding if the number of flows is equal to or greater than a threshold value. The method according to claim 1,
Wherein the flow storage unit comprises:
And the index of the flow meta information is managed in a bitmap form. The method of claim 8,
The flowmeter information includes:
A source port number, a destination IP number, a destination port number, a packet number, a byte number, a protocol, a service, a file type, an accumulated value of TCP flag information, Time, and end time of the network malicious behavior. The method of claim 9,
The malicious behavior analysis unit,
And queries the flow storage unit using the 6-bit TCP flag information. A network malicious behavior analysis method performed by a network malicious behavior analysis apparatus,
Extracting flow meta information of the collected network traffic;
Storing the extracted flow meta information in a table form of a database; And
Transmitting a query corresponding to at least one of a persistent external connection query and a TCP SYN flooding query to a database of the stored flow meta information; And
Analyzing network malicious behavior based on a response value of the query;
Wherein the network malicious behavior analysis method comprises the steps of: The method of claim 11,
Wherein the step of transmitting the query comprises:
The persistent external connection query analyzing the RST packet corresponding to a plurality of SYN packets transmitted by the first network equipment to the second network equipment. The method of claim 12,
Wherein analyzing the network malicious behavior comprises:
Grouping at least one of a host of the second network equipment corresponding to the source IP, a port of the second network equipment, a host of the first network equipment corresponding to the destination IP and a port number of the first network equipment, Malicious behavior analysis method. . 14. The method of claim 13,
Wherein analyzing the network malicious behavior comprises:
Detecting a malicious action corresponding to the persistent external connection when the number of ports of the first network equipment is equal to or greater than a threshold value. The method of claim 11,
Wherein the step of transmitting the query comprises:
And transmits the TCP SYN flooding query, which analyzes the number of packets corresponding to the destination IP and the destination port. 16. The method of claim 15,
Wherein analyzing the network malicious behavior comprises:
And grouping the number of flows corresponding to the destination IP, the destination port, and the destination port of the destination IP. 18. The method of claim 16,
Wherein analyzing the network malicious behavior comprises:
And detecting malicious behavior corresponding to the TCP SYN flooding if the number of flows is equal to or greater than a threshold value. The method of claim 11,
Wherein the step of storing the flow meta information comprises:
Wherein the index of the flow meta information is managed in a bitmap form. 19. The method of claim 18,
The flowmeter information includes:
A source port number, a destination IP number, a destination port number, a packet number, a byte number, a protocol, a service, a file type, an accumulated value of TCP flag information, A time and an end time of the network malicious behavior. The method of claim 19,
Wherein analyzing the network malicious behavior comprises:
And querying the database of the flowmeter information using the 6-bit TCP flag information.

Images