KR20180085155A - Apparatus and method for detecting harmful packet - Google Patents

Abstract

A device for inspecting a harmful packet comprises: a division unit which divides a signature including information on a harmful packet into a plurality of partial signatures; an information analysis unit which analyzes relationship information on the plurality of partial signatures; a storage unit which stores the analyzed relationship information; a receiving unit which receives packet data from an external device; and a detection unit which analyzes the received packet data based on the stored relationship information, and detects whether the signature is included. The relationship information may be a correlation between data constituting each of the plurality of partial signatures. According to the present invention, it is possible to remarkably improve the processing speed of a security gateway.

Description

[0001] APPARATUS AND METHOD FOR DETECTING HARMFUL PACKET [0002]

The present invention relates to a harmful packet inspection apparatus and a harmful packet inspection method.

Deep Packet Inspection (DPI) is a technology implemented in a security device that configures firewall technology between an external network and an internal network over the Internet. It can analyze the in-depth portion of data transmitted over the Internet. In-depth packet analysis complements the limitations of the Transmission Control Protocol (TCP), the basic protocol of the Internet, in that it can examine and analyze up to the actual contents of packets, which are data transmitted over the Internet. , Hacking, and DDoS attacks.

In connection with this in-depth packet analysis technique, the prior art Korean Patent No. 10-1172889 discloses a harmful traffic detection / response method and system.

In recent industrial IoT control networks, cyber security threats are increasing. As a countermeasure against this cyber security threat, the industrial IoT control network can perform packet filtering through a security gateway. However, as the amount of data increases, security gateways can not handle packet filtering quickly and can not provide a solution for large traffic attacks. Therefore, there is a need for a security gateway that can improve the speed of packet filtering and improve the performance of the industrial IoT control network.

We propose a harmful packet inspection device and a harmful packet inspection method applying a high-speed DPI (Deep Packet Inspection) algorithm based on a field programmable gate array (FPGA) of an industrial IoT control network. It is intended to provide a harmful packet inspection device and a harmful packet inspection method which can dramatically improve the processing speed degradation of a security gateway by mounting a DPI algorithm capable of filtering packets at a very high speed in an FPGA. And to provide a harmful packet inspection device and a harmful packet inspection method which can actively recognize the security situation globally in the industrial IoT control network. A harmful packet inspection apparatus and a harmful packet inspection method capable of detecting a signature at a high speed while optimally using a memory. It is to be understood, however, that the technical scope of the present invention is not limited to the above-described technical problems, and other technical problems may exist.

According to an aspect of the present invention, there is provided an information processing apparatus comprising: a division unit for dividing a signature including information about harmful packets into a plurality of partial signatures; an information analysis unit for analyzing relationship information on the plurality of partial signatures; And a detection unit for analyzing the received packet data based on the stored relationship information and detecting whether the signature is included or not, And the information is a correlation between data constituting each of the plurality of partial signatures.

According to an embodiment, the information analyzing unit may include a masking unit for masking predetermined-sized data included in each of the plurality of partial signatures as key bytes of each of the plurality of partial signatures, As the relationship information between the plurality of partial signatures. The information analyzer may further include an indicator selector for selecting an indicator from an area of a key byte masked to each of the plurality of partial signatures, and the storage unit may further store the indicator as relation information between the plurality of partial signatures.

According to one embodiment, the detection unit can access the storage unit using the indicator as an address of the storage unit.

According to one embodiment, the divider may divide the signatures into different data lengths, respectively.

According to one embodiment, the detection unit extracts data of predetermined size from the received packet data, loads the stored relationship information using the extracted data as the address of the storage unit, The packet data can be compared. The detecting unit detects whether or not the signature is included in the packet data received through the plurality of layers. The plurality of layers include a third layer, a fourth layer, and a third layer, And a seventh layer.

According to one embodiment, the harmful packet inspection apparatus may be a security gateway that performs packet filtering on packet data continuously inputted to an industrial IoT (Internet Of Things) apparatus to detect harmful packets.

According to an embodiment, the storage unit may include a plurality of filter blocks, and may store the relation information by allocating a memory space according to a predetermined number of the plurality of filter blocks.

Another embodiment of the present invention is a method for analyzing a computer program for causing a computer to perform the steps of: dividing a signature including information about a harmful packet into a plurality of partial signatures, analyzing relationship information on the plurality of partial signatures, Receiving packet data from an external device, and analyzing the received packet data based on the stored relationship information to detect whether the signature is included, wherein the relationship information comprises a plurality of partial signatures It is possible to provide a harmful packet inspection method which is a correlation between data constituting each of them.

The above-described task solution is merely exemplary and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and the detailed description of the invention.

According to one of the above-mentioned objects, there is provided a harmful packet inspection apparatus and a harmful packet inspection method applying a security gateway high speed DPI (Deep Packet Inspection) algorithm based on FPGA (Field Programmable Gate Array) of an industrial IoT control network . It is possible to provide a harmful packet inspection device and a harmful packet inspection method which can drastically improve the processing speed degradation of the security gateway by mounting a DPI algorithm capable of filtering packets at an ultra high speed in the FPGA. It is possible to provide a harmful packet inspection device and a harmful packet inspection method which can actively recognize the security situation globally in the industrial IoT control network. It is possible to provide a harmful packet inspection apparatus and a harmful packet inspection method capable of detecting a signature at a high speed while optimally using a memory.

1 is a configuration diagram of a harmful packet inspection apparatus according to an embodiment of the present invention.
2 is a flowchart of a method for inspecting a harmful packet in a harmful packet inspection apparatus according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a network attack using a preprocessing process of a harmful packet inspection apparatus in a network attack detection apparatus according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "including" an element, it is to be understood that the element may include other elements as well as other elements, And does not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

In this specification, the term " part " includes a unit realized by hardware, a unit realized by software, and a unit realized by using both. Further, one unit may be implemented using two or more hardware, or two or more units may be implemented by one hardware.

In this specification, some of the operations or functions described as being performed by the terminal or the device may be performed in the server connected to the terminal or the device instead. Similarly, some of the operations or functions described as being performed by the server may also be performed on a terminal or device connected to the server.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a harmful packet inspection apparatus according to an embodiment of the present invention. The harmful packet inspection apparatus 100 is a security gateway that performs packet filtering at a plurality of layers (or layers) on packet data continuously input to an industrial IoT (Internet of Things) apparatus (external apparatus) to detect harmful packets . The harmful packet inspection apparatus 100 may include a segmentation unit 110, an information analysis unit 120, a storage unit 130, a reception unit 140, and a detection unit 150.

The partitioning unit 110 may divide the signature including the information about the harmful packet into a plurality of partial signatures. The partitioning unit 110 may divide the signature of K bytes in length into a plurality of N partial signatures in order to formalize the signature. At this time, the division unit 110 can divide the signatures into different data lengths. For example, the division unit 110 may divide the length of the first (N-1) partial signatures into S bytes and the length of the last N partial signatures to be S bytes or less.

The information analysis unit 120 may analyze the relationship information for a plurality of partial signatures. Here, the relationship information may be a correlation between data constituting each of a plurality of partial signatures as information represented in the signature itself. In this case, the length of each key byte may be different depending on the length of each partial signature.

The information analyzer 120 may include a masking unit 121 and an indicator selector 122.

The masking unit 121 may mask predetermined-sized data included in each of the plurality of partial signatures as key bytes of each of the plurality of partial signatures. In this case, the masked key byte may be used as an address of a filter block composed of a plurality of memory groups, and the maximum number of times of application of the memory space of the filter block designated by the masked key byte may be set.

The indicator selector 122 can select an indicator from the area of the key byte masked in each of the plurality of partial signatures. For example, the indicator selector 122 may select an indicator from the area of the key byte masked to the M byte partial signature.

The storage unit 130 may store the analyzed relationship information in the information analysis unit 120. For example, the storage unit 130 may store each key byte as relation information between a plurality of partial signatures. As another example, the storage unit 130 may store an indicator as relation information between a plurality of partial signatures.

The storage unit 130 may include a plurality of filter blocks, and may store the relation information by allocating a memory space according to a predetermined number of the plurality of filter blocks. For example, the storage unit 130 may associate a plurality of filter blocks with an allocated memory space using a hashing structure. At this time, the storage unit 130 can use the indicator selected from the area of the key byte masked by the Q partial signatures as the address of the memory of the filter block, thereby confirming the location of the partial signature and the relation information stored in the memory.

The receiving unit 140 can receive packet data from an external device (not shown).

The detection unit 150 may analyze the received packet data based on the stored relationship information to detect whether or not the signature is included. For example, the detection unit 150 may detect whether or not a signature is included in packet data received through a plurality of layers. The plurality of layers may include at least one of a third layer, a fourth layer, and a seventh layer included in seven layers constituting the network. At this time, the detection unit 150 can use the indicator as the address of the storage unit 130 to access the storage unit 130 to perform signature matching in real time.

The detection unit 150 may compare the received packet data with the relationship information. For example, the detection unit 150 extracts data of predetermined size from the received packet data, loads the stored relationship information using the extracted data as the address of the storage unit, and compares the loaded relationship information with the packet data . The detection unit 150 may determine whether to block the received packet data according to the comparison result.

2 is a flowchart of a method for inspecting a harmful packet in a harmful packet inspection apparatus according to an embodiment of the present invention. The method for inspecting harmful packets performed by the harmful packet inspection apparatus 100 according to the embodiment shown in FIG. 2 is the same as that of the harmful packet inspection apparatus 100 according to the embodiment shown in FIG. . Therefore, even if omitted in the following description, the present invention is also applied to a method for inspecting harmful packets performed by the harmful packet inspection apparatus 100 according to the embodiment shown in FIG.

In step S210, the harmful packet inspection apparatus 100 may divide the signature including the information on the harmful packet into a plurality of partial signatures.

In step S220, the harmful packet inspection apparatus 100 may analyze the relationship information on a plurality of partial signatures.

In step S230, the harmful packet inspection apparatus 100 may store the analyzed relationship information.

In step S240, the harmful packet inspection apparatus 100 can receive packet data from the external apparatus.

In step S250, the harmful packet inspection apparatus 100 may analyze the received packet data based on the stored relationship information to detect whether or not the signature is included.

In the above description, steps S210 to S250 may be further divided into further steps or combined into fewer steps, according to an embodiment of the present invention. In addition, some of the steps may be omitted as necessary, and the order between the steps may be switched.

3 is a flowchart of a method of detecting a network attack using a preprocessing process of a harmful packet inspection apparatus in a network attack detection apparatus (not shown) according to an embodiment of the present invention. In this case, the harmful packet device 100 may be included as a module for the preprocessing process in the network attack detection device. A method for detecting a network attack using a preprocessing process of a harmful packet inspection apparatus performed by the network attack detection apparatus according to the embodiment shown in FIG. 3 is the same as that of the harmful packet inspection apparatus according to the embodiment shown in FIGS. 1 and 2, (100). ≪ / RTI > Therefore, even if omitted in the following description, the present invention is also applied to a method for inspecting harmful packets performed by the harmful packet inspection apparatus 100 according to the embodiment shown in FIG. 1 and FIG.

The network attack detection device may perform a preprocessing process (steps S310 to S330) to inspect harmful packets.

In step S310, the network attack detection device may extract data of a predetermined size from the packet data received from the external device.

In step S320, the network attack detection apparatus can load the stored relationship information using the extracted data as the address of the storage unit.

In step S330, the network attack detection device can compare the packet data with the relation information loaded.

Upon completion of the preprocessing process (steps S310 to S330), the network attack detection device checks packet data received through a plurality of layers to detect whether there is a network attack on each layer.

In step S340, the network attack detection device compares the relation information with the packet data received through the third layer, and detects whether there is a third layer attack. At this time, if the network attack detection device detects the third layer attack (S341), the network attack detection device may determine whether to block the packet data and store the third layer attack (S380). Alternatively, if the network attack detection device does not detect the third layer attack (S342), the network attack detection device may detect whether there is a fourth layer attack (S350).

In step S350, the network attack detecting apparatus compares the relation information with the packet data received through the fourth layer, and detects whether there is a fourth layer attack. For example, if the network attack detection device detects a fourth layer attack (S351), it may determine whether to block the packet data and store the packet data (S380). In another example, if the network attack detection device does not detect the fourth layer attack (S352), it may detect whether there is a seventh layer attack (S360).

In step S360, the network attack detection apparatus compares the relationship information with the packet data received through the seventh layer to detect whether there is a seventh layer attack. For example, if the network attack detection device detects a seventh layer attack (S361), the network attack detection device may determine whether to block the packet data and store the blocked data (S380). In another example, if the network attack detection device fails to detect the seventh layer attack (S362), the packet data may be forwarded to the external device (S370).

In the above description, steps S310 to S380 may be further divided into further steps, or combined in fewer steps, according to an embodiment of the present invention. In addition, some of the steps may be omitted as necessary, and the order between the steps may be switched.

The method for inspecting harmful packets in the harmful packet inspection apparatus described with reference to Figs. 1 to 3 can also be implemented in the form of a recording medium including a computer program stored in a medium executed by the computer or instructions executable by the computer have. In addition, the method for inspecting harmful packets in the harmful packet inspection apparatus described with reference to FIGS. 1 to 3 may also be implemented in the form of a computer program stored in a medium executed by a computer.

Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. The computer-readable medium may also include computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

110: minute installment
120: Information Analysis Department
121: masking portion
122: Indicator selection unit
130:
140: Receiver
150:

Claims (13)

An apparatus for inspecting harmful packets,
A division unit for dividing a signature including information about a harmful packet into a plurality of partial signatures;
An information analysis unit for analyzing relationship information on the plurality of partial signatures;
A storage unit for storing the analyzed relationship information;
A receiving unit for receiving packet data from an external device; And
And a detection unit for analyzing the received packet data based on the stored relationship information and detecting whether the signature is included or not
Lt; / RTI >
Wherein the relationship information is a correlation between data constituting each of the plurality of partial signatures.
The method according to claim 1,
The information analyzing unit,
A masking unit for masking data of a predetermined size included in each of the plurality of partial signatures as key bytes of each of the plurality of partial signatures,
Lt; / RTI >
And the storage unit stores the respective key bytes as relation information between the plurality of partial signatures.
3. The method of claim 2,
The information analyzing unit,
An indicator selection unit for selecting an indicator from an area of the key byte masked in each of the plurality of partial signatures,
Further comprising:
And the storage unit further stores the indicator as relation information between the plurality of partial signatures.
The method of claim 3,
Wherein the detection unit accesses the storage unit using the indicator as an address of the storage unit.
The method according to claim 1,
And the dividing unit divides the signature into different data lengths.
The method according to claim 1,
The detecting unit extracts data of a predetermined size from the received packet data, loads the stored relationship information using the extracted data as an address of the storage unit, and compares the loaded relation information with the packet data A harmful packet inspection device.
The method according to claim 1,
The detection unit detects whether or not the signature is included in the packet data received through the plurality of layers,
Wherein the plurality of layers include at least one of a third layer, a fourth layer and a seventh layer included in seven layers constituting a network.
The method according to claim 1,
Wherein the harmful packet inspection apparatus is a security gateway that performs packet filtering on packet data continuously inputted to an industrial IoT (Internet Of Things) apparatus in the plurality of layers to detect harmful packets.
The method according to claim 1,
Wherein the storage unit includes a plurality of filter blocks and allocates a memory space according to a predetermined number of the plurality of filter blocks to store the relationship information.
A method for inspecting harmful packets,
Dividing a signature including information about a harmful packet into a plurality of partial signatures;
Analyzing relationship information for the plurality of partial signatures;
Storing the analyzed relationship information;
Receiving packet data from an external device; And
And analyzing the received packet data based on the stored relationship information to detect whether the signature is included,
Wherein the relationship information is a correlation between data constituting each of the plurality of partial signatures.
11. The method of claim 10,
Wherein analyzing the relationship information further comprises masking data of a predetermined size included in each of the plurality of partial signatures as key bytes of each of the plurality of partial signatures,
Wherein the storing of the relationship information stores each of the key bytes as relationship information between the plurality of partial signatures.
12. The method of claim 11,
Wherein the detecting comprises:
Extracting a predetermined size of data from the received packet data;
Loading the stored relationship information using the extracted data as an address of the storage unit; And
Comparing the loaded relationship information with the packet data
Wherein the packet comprises a plurality of packets.
12. The method of claim 11,
Determining whether to block the received packet data according to a result of the comparison;
The method comprising the steps of:

Images