KR20190010225A - Method for detecting malicious traffic and Apparatus thereof - Google Patents

Abstract

Provided is an apparatus for detecting a malicious traffic and a malicious code causing the malicious traffic through a traffic analysis result for a target system without predefined malignant pattern information. According to an embodiment of the present invention, the apparatus for detecting a malicious traffic comprises: a traffic collection unit for collecting a traffic for a target system on a network; and a first malicious traffic detection unit for detecting a malicious traffic from the collected traffic. The first malicious traffic detection unit may include: a periodic traffic detecting unit for detecting a periodic traffic indicating a traffic continuously appearing for each time slot from the collected traffic; and a first malicious traffic determining unit for determining whether the detected periodic traffic is a malicious traffic on the basis of a distribution of a traffic generation frequency for each time slot.

Description

TECHNICAL FIELD The present invention relates to a malicious traffic detection method and apparatus,

The present invention relates to a malicious traffic detection method and apparatus. More particularly, the present invention relates to a method for detecting malicious traffic caused by malicious code without previously defined malicious pattern information, and an apparatus for performing the method.

Malicious code is a generic term that refers to all the code that causes harm to the user in such a way as to cause an abnormal operation in the system by exploiting security weakness of a specific application or system, or to seize the user's personal information. The types of malicious codes vary from malicious code such as worms and viruses to executable files and script-type malicious code executed through web browsers.

A variety of malicious code detection methods have been proposed so far to prevent damage caused by malicious code. For example, a static analysis method for detecting malicious code through signature matching, a dynamic analysis method for detecting malicious code through dynamic behavior analysis performed in a blocked space such as a sandbox .

However, since the above-described static analysis and dynamic analysis methods are methods for detecting malicious code based on similarity with previously defined malicious pattern information, malicious pattern information is vulnerable to detection of new or variant malicious code that is not defined in advance there is a problem.

In addition, static analysis and dynamic analysis methods can detect malicious code based on static analysis and dynamic analysis, because there are many elements that can be avoided (eg, malicious codes that do not perform malicious actions in the sandbox). Even if the device is built in the target system, it is difficult to guarantee the security of the target system from malicious code.

In addition, since conventional devices for detecting malicious codes concentrate only on the inspection of inbound traffic flowing into the internal network in order to prevent the infiltration of malicious code, it is impossible to cope with a cyber attack carried out using already infiltrated malicious code Lt; / RTI >

Therefore, there is a need for a method and apparatus capable of detecting new and variant malicious codes without previously defined malicious pattern information, and preventing cyber attacks performed using infiltrated malicious codes.

Korean Patent Laid-Open No. 10-2011-0035336 (published April 26, 2011)

The present invention is directed to a malicious traffic detection method capable of detecting malicious traffic generated by malicious code based on a heuristic without any predefined malicious pattern information and further detecting the malicious code, And to provide a device for performing the method.

The technical objects of the present invention are not limited to the above-mentioned technical problems, and other technical subjects not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided an apparatus for detecting malicious traffic according to an exemplary embodiment of the present invention. The apparatus includes a traffic collecting unit for collecting traffic for a target system on a network, Wherein the first malicious traffic detection unit comprises a periodic traffic detection unit for detecting periodic traffic indicative of traffic continuously appearing in the time period among the collected traffic, and a second malicious traffic detection unit for detecting, based on the time- And a first malicious traffic determiner for determining whether the detected periodic traffic is malicious traffic.

In one embodiment, the collected traffic may be outbound traffic transmitted from the target system to an external host.

In one embodiment, the first malicious traffic detection unit may further include a traffic extracting unit that extracts, from among the collected traffic, traffic for which a referer field value does not exist, And may detect the periodic traffic among the traffic.

In one embodiment, the first malicious traffic determination unit may determine the detected periodic traffic as malicious traffic when the standard deviation or the variance value for the number of times of traffic generation for each time period is less than or equal to a preset threshold value.

In one embodiment, a second malicious traffic detection unit detects multiple access traffic indicating traffic requesting connection to a plurality of external hosts among the collected traffic, and detects malicious traffic based on the detected multiple access traffic .

Detecting a fake traffic that indicates a traffic for which the IP and the URL for the destination do not match using the comparison result of the number of IPs matched with the number of URLs for the destination among the collected traffic; And a second malicious traffic detection unit for detecting malicious traffic based on the traffic.

According to another aspect of the present invention, there is provided an apparatus for detecting malicious traffic according to another embodiment of the present invention. The apparatus includes a traffic collector for collecting traffic for a target system on a network, Wherein the malicious traffic detection unit includes a multiple access traffic detection unit for detecting multiple access traffic indicating request traffic requesting connection to a plurality of external hosts from the collected traffic, Access traffic is malicious traffic based on the degree of deviation of the size of data included in the response traffic corresponding to the malicious traffic.

According to another aspect of the present invention, there is provided a malicious traffic detection method for a malicious traffic detection device, the malicious traffic detection method comprising the steps of: Detecting periodic traffic indicative of traffic continuously appearing in each time period among the collected traffic and detecting whether or not the detected periodic traffic corresponds to malicious traffic based on the distribution of the number of times of traffic occurrence by time slot, Based on the result of the determination.

According to another aspect of the present invention, there is provided a computer program product for collecting traffic for a target system on a network, the method comprising the steps of: And determining whether the detected periodic traffic corresponds to malicious traffic, based on the time-based distribution of the number of times of occurrence of the traffic .

According to the present invention, malicious traffic is detected based on a heuristic without previously defined malicious pattern information, and malicious code causing the malicious traffic can also be detected. Therefore, according to the present invention, it is possible to detect new and / or variant malicious codes which have been difficult to detect by the conventional malicious code detection method, and accordingly, to detect social and economic damages caused by the new and / Can be prevented.

Also, periodic traffic, multiple access traffic and / or fake traffic are detected as malicious suspicious traffic, and traffic satisfying a predetermined criterion among the malicious suspicious traffic is determined as malicious traffic. Thus, the accuracy of malicious traffic detection can be improved.

In addition, outbound traffic analysis can detect malicious traffic caused by malicious code infiltrating the target system. Accordingly, there is an effect that a cyber attack performed using malicious code infiltrating into the target system is prevented.

In addition, malicious pattern information for new and / or variant malicious codes detected based on the heuristic can be provided to a conventional malicious code detection apparatus. Thus, the security of the target system can be further improved.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood to those of ordinary skill in the art from the following description.

1 is a block diagram of a malicious traffic detection system according to a first embodiment of the present invention.
2 is a configuration diagram of a malicious traffic detection system according to a second embodiment of the present invention.
3 is a block diagram illustrating a malicious traffic detection apparatus according to another embodiment of the present invention.
4A to 4C are views for explaining a malicious traffic detection unit according to some embodiments of the present invention.
5 is a block diagram illustrating a first malicious traffic detection unit, which is a component of the malicious traffic detection unit.
Fig. 6 is a diagram for explaining the format and constituent elements of the URL.
7 is a block diagram illustrating a second malicious traffic detection unit, which is a component of the malicious traffic detection unit.
8 is a block diagram illustrating a third malicious traffic detection unit, which is a component of the malicious traffic detection unit.
9 is a hardware block diagram of a malicious traffic detection apparatus according to another embodiment of the present invention.
10 and 11 are flowcharts for explaining a malicious traffic detection method according to the first embodiment of the present invention.
12 to 14 are flowcharts for explaining a malicious traffic detection method according to a second embodiment of the present invention.
15 is a flowchart illustrating a malicious traffic detection method according to a third embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. To fully disclose the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise. The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification.

It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions.

Hereinafter, some embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a malicious traffic detection system according to a first embodiment of the present invention. 1 shows an example where a target system is an intra-company intra-net and a terminal 10 infected with a malicious code distributed by a malicious code distribution server 20 communicates with an external C & C server 30, .

Referring to FIG. 1, the malicious traffic detection system according to the first embodiment of the present invention may include a traffic collection apparatus 200 and a malicious traffic detection apparatus 100. However, it should be understood that the present invention is not limited to the above-described embodiments, and that various changes and modifications may be made without departing from the scope of the present invention. It should be noted that each component of the malicious traffic detection system shown in FIG. 1 represents functionally functioning functional elements, and that at least one component may be implemented in a form that they are integrated with each other in an actual physical environment. Hereinafter, each component of the malicious traffic detection system according to the first embodiment will be described.

In the first embodiment, the traffic collecting apparatus 200 collects traffic for a target system on a network and provides the collected traffic to the malicious traffic detecting apparatus 100. The traffic collecting apparatus 200 may collect traffic for the target system through, for example, port mirroring, but is not limited thereto.

In one embodiment, the traffic collection device 200 may collect outbound traffic from the target system to an external host and provide it to the malicious traffic detection device 100. Since the malicious code-infected terminal 10 has a high probability of attempting to connect to an external malicious server 30 in order to achieve a predetermined purpose (eg, leakage of private information, leakage of classified documents, etc.) It is effective to detect malicious traffic. That is, in this embodiment, the malicious traffic detection device 100 can detect malicious traffic through outbound traffic analysis, assuming that the malicious code is infiltrated into the target system.

However, according to another embodiment, the traffic collecting apparatus 200 may collect both the outbound traffic and the inbound traffic and provide the same to the malicious traffic detecting apparatus 100.

The malicious traffic can be used as a comprehensive concept to collectively refer to all traffic that may have a detrimental effect on a target system or a user of the target system, such as traffic including malicious code and traffic generated by malicious code. It should be noted that the malicious traffic may be used in combination with terminology such as abnormal traffic, abnormal traffic, and harmful traffic in the related art, but may refer to the same concept.

In the first embodiment, the malicious traffic detection device 100 is a computing device that detects malicious traffic based on the traffic provided by the traffic collection device 100. [ Here, the computing device may be a notebook computer, a desktop computer, a laptop computer, or the like. However, the present invention is not limited thereto and may include all kinds of devices having a computing function and a communication function. However, if the malicious traffic detection apparatus 100 is implemented for the purpose of inspecting traffic on the intranet as in the first embodiment, it is preferable that the computing apparatus is implemented as a high-performance server apparatus.

In addition, the malicious traffic detection device 100 may detect a malicious code related to the detected malicious traffic when malicious traffic is detected. For example, the malicious traffic detection device 100 may track the detected malicious traffic to detect a malicious code that caused the malicious traffic.

According to some embodiments of the present invention, the malicious traffic detection device 100 can detect malicious traffic based on heuristics without predefined malicious pattern information on malicious traffic or malicious code. Here, the detection of malicious traffic based on the heuristic may include inspecting collected traffic using a defined condition based on a reasonable assumption even if there is no malicious pattern information defined in advance, and detecting traffic satisfying the condition as malicious traffic .

The rational assumption may include, for example, the following assumptions.

(Assumption 1) A terminal infected with malicious code will continuously try to connect to an external malicious server to achieve its final goal.

(Assumption 2) A terminal infected with malicious code will try to connect to a number of malicious servers existing outside the terminal to achieve the final purpose.

(Assumption 3) A terminal infected with malicious code will use a forged destination address to conceal an attempt to connect to an external malicious server (eg, forge the URL of the HTTP header to the URL of a normal site, Is trying to connect to the malicious server's IP, etc.).

In summary, the malicious traffic detection device 100 can detect malicious traffic and / or malicious code using the above-described reasonable assumptions without previously defined malicious pattern information. Accordingly, new malicious codes and / or malicious codes that could not be detected by conventional methods of detecting malicious codes using previously defined malicious pattern information can be detected. A detailed description of a method of detecting malicious traffic based on a heuristic based on the malicious traffic detection apparatus 100 will be described later with reference to FIG. 3 and subsequent drawings.

In a malicious code detection system according to some embodiments of the present invention, the traffic collection device 200 and the malicious traffic detection device 100 may communicate over a network. Generally, the network will be implemented as a wired network such as a local area network (LAN), but may be a wide area network (WAN), a mobile radio communication network, a Wibro (Wireless Broadband Internet) It may be implemented as any kind of wired / wireless network.

1, the malicious traffic detection device 100 and the traffic collection device 200 are physically independent devices, but they may be implemented in different logic in the same device according to an embodiment .

The malicious traffic detection system according to the first embodiment of the present invention has been described with reference to FIG. Next, a malicious traffic detection system according to a second embodiment of the present invention will be described with reference to FIG.

2 is a configuration diagram of a malicious traffic detection system according to a second embodiment of the present invention. 2 shows an example in which the target system is an intranet in the enterprise and the specific terminal 40 is infected with the new malicious code distributed by the malicious code distribution server 50 and communicates with the external C & C server 60 .

Referring to FIG. 2, the malicious traffic detection system according to the second embodiment may further include a malicious code detection apparatus 300.

In the second embodiment, the malicious code detection apparatus 300 performs a static analysis and / or a dynamic analysis on the traffic provided by the traffic collection apparatus 200 using previously defined malicious pattern information, Lt; / RTI > computing device. In particular, the malicious code detection device 300 may be, but is not limited to, a computing device that detects malicious code through full inspection of inbound traffic.

In the second embodiment, the malicious traffic detection device 100 and the malicious code detection device 300 can complement each other to further improve the stability and security of the target system. For example, after the malicious traffic detection device 100 detects a new malicious code that can not be detected by the malicious code detection device 300, the detection information for the new malicious code is provided to the malicious code detection device 300 So that the two devices 100 and 300 can complement each other.

Describing the above example in detail, the malicious code detection apparatus 300 can not detect a new malicious code for which a malicious code pattern does not exist, so that a case where a specific terminal 40 is infected with a new malicious code occurs . In this case, the infected terminal 40 will try to access the external C & C server 60 to achieve a predetermined purpose. Then, the heuristic-based malicious traffic detection device 100 detects malicious traffic that attempts to access the external C & C server 60 and new malicious code that caused the malicious traffic, and detects detection information of the new malicious code To the malicious code detection apparatus 300. The malicious code detection device 300 provided with the detection information may generate malicious pattern information on the new malicious code based on the detection information to detect the penetration of the new malicious code in advance .

The malicious traffic detection system according to the second embodiment of the present invention has been described with reference to FIG. Hereinafter, the configuration and operation of the malicious traffic detection apparatus 100 according to another embodiment of the present invention will be described with reference to FIG. 3 to FIG.

3 is a block diagram illustrating a malicious traffic detection apparatus 100 according to an embodiment of the present invention.

Referring to FIG. 3, the malicious traffic detection apparatus 100 may include a traffic collection unit 110 and a malicious traffic detection unit 130. 3, only the components related to the embodiment of the present invention are shown. Accordingly, those skilled in the art will recognize that other general-purpose components may be included in addition to those shown in FIG. In addition, each component of the malicious traffic detection device 100 shown in FIG. 3 represents functionally functioning functional elements, and at least one component may be implemented in a form that they are integrated with each other in an actual physical environment Please note. Hereinafter, each component of the malicious traffic detection device 100 will be described.

The traffic collecting unit 110 collects traffic for the target system on the network for a predetermined collection period. Here, the collected traffic may be outbound traffic, but is not limited thereto. In addition, the collection period may be variously set, for example, by day, week, or month.

In some embodiments, the traffic collecting unit 110 does not collect the direct traffic, but may receive the collected traffic from a separate traffic collecting device such as the traffic collecting device 200 shown in FIGS. 1 and 2 have.

The malicious traffic detection unit 130 detects malicious traffic in the collected traffic based on the heuristic.

According to the embodiment of the present invention, the malicious traffic detection unit 130 is configured to include the first malicious traffic detection unit 131, the second malicious traffic detection unit 133, and the third malicious traffic detection unit 135 .

The first malicious traffic detection unit 131 detects malicious traffic based on traffic (hereinafter referred to as "periodic traffic") that continuously attempts to access the same external host. More specifically, the first malicious traffic detection unit 131 detects the periodic traffic as malicious suspicious traffic based on the above-described " Assumption 1 ", and judges that the traffic satisfying the predetermined criterion among the malicious suspicious traffic is malicious traffic . This will be described in detail with reference to FIGS. 5, 10, and 11. FIG.

The second malicious traffic detection unit 133 detects malicious traffic based on traffic that attempts to access a plurality of external hosts (hereinafter referred to as "multiple access traffic"). Specifically, the second malicious traffic detection unit 133 detects the multiple access traffic as malicious suspicious traffic based on the above-described " Assumption 2 ", and judges that traffic satisfying a predetermined criterion among the multiple access traffic is malicious traffic do. This will be described in detail with reference to FIG. 7 and FIG. 12 to FIG.

The third malicious traffic detection unit 135 detects malicious traffic based on the URL of the destination and the traffic whose IP does not match (hereinafter referred to as "fake traffic"). In detail, the third malicious traffic detection unit 135 detects the fake traffic as malicious suspicious traffic based on the above-described " Assumption 3 ", and judges that the traffic satisfying the predetermined criterion among the malicious suspicious traffic is malicious traffic . This will be described in detail with reference to FIGS. 8 and 15. FIG.

According to an embodiment of the present invention, the first to third malicious traffic detection units 131 to 135 may be configured to operate in various ways.

In one embodiment, as shown in FIG. 4A, the first malicious traffic detecting unit to the third malicious traffic detecting unit 131 to 135 may be configured to operate independently of each other and in parallel. In the present embodiment, the first to third malicious traffic detection units 131 to 135 duplicate the whole collected traffic to perform malicious traffic detection. According to the present embodiment, since malicious traffic detection is performed in parallel, the average detection rate can be improved.

In one embodiment, as shown in FIG. 4B, the first to third malicious traffic detection units 131 to 135 may be configured to operate stepwise or sequentially. In the present embodiment, the first malicious traffic detection unit 131 checks whether or not malicious traffic exists for each of the collected traffic first, and the traffic that has not been determined to be malicious traffic is again detected by the second malicious traffic detection unit 133 And is inspected. In addition, the traffic that has not been determined to be malicious traffic by the second malicious traffic detection unit 1330 is finally checked by the third malicious traffic detection unit 135. According to the present exemplary embodiment, since the exhaustive inspection is performed on the sequentially collected traffic, the average detection rate can be lowered, but the amount of the inspection target traffic decreases as the step progresses, so that it can be efficient in terms of the computing cost.

In FIG. 4B, the first malicious traffic detection unit 131 first detects malicious traffic, but the detection order of the malicious traffic detection units 131 through 135 may vary. However, in order to detect malicious traffic more efficiently, the detection order is determined based on the detection performance (eg, detection accuracy, false rate, number of traffic inspections per reference time, etc.) of each of the malicious traffic detection units 131 to 135 May be preferred. According to the embodiment, the detection performance of each of the malicious traffic detecting units 131 to 135 is calculated at predetermined time intervals, and the detection order of each of the malicious traffic detecting units 131 to 135 is dynamically determined based on the calculated detection performance And may be implemented to be determined.

In one embodiment, as shown in FIG. 4C, the first to third malicious traffic detectors 131 to 135 calculate malicious suspect indices in parallel to each other in the collected traffic, The separate malicious traffic determining unit 137 may determine whether or not the malicious traffic is finally detected. In the present embodiment, each of the malicious traffic detecting units to malicious traffic detecting units 131 to 135 calculates the first to third malicious suspicious indices indicating the probability or score that the corresponding traffic corresponds to the malicious traffic, The server 137 determines whether the traffic is malicious traffic based on the first to third malignancy suspect indices.

For example, the malicious traffic determining unit 137 may determine whether the corresponding traffic is malicious traffic based on whether the weighted sum of the first to third malicious suspicious indices or the weighted average is greater than a threshold value. Here, the weight used for the weighted sum or the weighted average may be a predetermined fixed value or a variation value that varies depending on the situation. For example, the weight may be a dynamically determined fluctuation value based on the detection performance of each malicious traffic detection unit 131 to 135. [ According to the present embodiment, since malicious traffic is judged based on comprehensive consideration of various malicious patterns appearing in the traffic, the accuracy of malicious traffic detection can be improved and the false positives can be reduced.

Up to now, several embodiments according to the operation modes of the malicious traffic detection units 131 to 135 have been described with reference to FIGS. 4A to 4C. Hereinafter, the malicious traffic detection units 131 to 135 will be described in detail with reference to FIGS. 5 to 8. FIG.

5 is a block diagram showing the first malicious traffic detection unit 131. As shown in FIG.

5, the first malicious traffic detecting unit 131 may include a traffic grouping unit 131a, a traffic extracting unit 131b, a periodic traffic detecting unit 131c, and a malicious traffic determining unit 131d. have.

Referring to the respective components, the traffic grouping unit 131a groups the collected traffic by time zone. For example, the traffic grouping unit 131a groups the collected traffic in units of time intervals of 30 minutes, 1 hour, 3 hours, or the like.

The traffic extracting unit 131b performs a first extracting step of extracting a traffic for which there is no referer field value in the grouped traffic. This is because traffic with a specific URL in the referrer field is less likely to be malicious traffic because it is traffic generated as a user clicks a link on a particular web page. This technical idea may be similarly applied to the second malicious traffic detection unit 133 and the third malicious traffic detection unit 135. [

In addition, the traffic extracting unit 131b performs a second extracting step of extracting traffic matching a uniform resource locator (URL) of the extracted traffic. In the first example, the traffic extracting unit 131b may extract traffic matching the host address included in the URL in order to extract traffic accessing the same external host. In the second example, the traffic extracting unit 131b may extract traffic having the same host address and file path included in the URL.

For convenience of understanding, the format of the URL will be briefly described with reference to FIG. 6, and an example URL (" http://aaa.com:8080/bbb/ccc.jsp?i= 1 ")," http "indicates the protocol," aaa.com "indicates the host address to connect to, and" 8080 "indicates the port number of the host to be connected. Also, "bbb" indicates the path of the request file, "ccc.jsp" indicates the request file name, and "i = 1" indicates the query string. Further, in the URL shown in Fig. 6, the file path can be understood as a string including " bbb / ccc.jsp " including the path and name of the file.

For reference, in the above-described traffic extracting unit 131b, it is explained that the first extracting step based on the referer field and the second extracting step based on the URL are performed in order. However, those skilled in the art will appreciate that, It will be appreciated that no dependencies exist. That is, the first extraction step and the second extraction step may be carried out in any order. In FIG. 5, operations of the traffic grouping unit 131a and the traffic extracting unit 131b are sequentially performed. However, it should be noted that the present invention can also be performed in a different order. It should also be noted that, although there is no mention otherwise, the operation of components or steps that do not have dependencies herein may be performed in any order.

Referring again to FIG. 5, the periodic traffic detection unit 131c detects periodic traffic that continuously appears in a plurality of traffic groups among traffic groups grouped by time zone. For example, the periodic traffic detection unit 131c may detect the traffic as periodic traffic when the same traffic or the same source and destination traffic appear in a predetermined number of traffic groups or more.

According to the embodiment of the present invention, the periodic traffic detection unit 131c not only detects periodic traffic generated precisely at specific time intervals, but also periodic traffic that continuously appears over various time periods even if there is no precise period. For example, if traffic is grouped at 1 hour intervals, the URL of the destination will consistently appear in the traffic group that indicates the same traffic between 1:00 and 2:00, between 2:00 and 3:00, and between 3:00 and 4:00. , The corresponding traffic can be detected as periodic traffic.

The malicious traffic determination section 131d determines whether or not the detected periodic traffic is malicious traffic, based on the distribution of the number of traffic occurrences over time. For example, the malicious traffic determining unit 131d may calculate a standard deviation or a variance value of the number of traffic generation times for each of the detected periodic traffic, and if the calculated standard deviation or variance value is equal to or less than a predetermined threshold value, The detected periodic traffic can be determined as malicious traffic. This is because the traffic that occurs intensively only in a specific time zone (eg, business hours) and less frequently generated in other time zones (eg, out-of-hours) (eg, traffic having a large standard deviation or a large variance value)

According to the embodiment of the present invention, the malicious traffic determining unit 131d can determine whether or not the malicious traffic is based on the number of source terminals for each of the detected periodic traffic. For example, when the detected periodic traffic is traffic generated at a source terminal that is higher than a threshold, the malicious traffic determining unit 131d may determine the periodic traffic as normal traffic. It is unlikely that multiple source terminals will be infected with malicious code at the same time. The technical idea according to the present embodiment can be similarly applied to the second and third malicious traffic detection units 133 and 135.

When the malicious traffic detection unit 130 is configured as shown in FIG. 4C according to the embodiment of the present invention, the malicious traffic determination unit 131d may be replaced with a malicious suspiciousness determining unit (not shown) . In this embodiment, the malignant suspect index determiner (not shown) may determine the malignant suspect index based on the variance and / or standard deviation of the number of traffic occurrences and / or the number of source terminals. For example, the malignant suspiciousness index determiner (not shown) may determine the malicious suspect index for detected periodic traffic to be a higher value as the standard deviation or variance value is smaller or the number of source terminals is smaller. The technical idea according to the present embodiment can be similarly applied to the second and third malicious traffic detection units 133 and 135.

Up to now, the first malicious traffic detection unit 131 has been described with reference to FIG. Additional details of the first malicious traffic detection unit 131 will be described with reference to FIGS. 10 and 11.

Next, the second malicious traffic detection unit 133 will be described with reference to FIG.

7, the second malicious traffic detecting unit 133 includes a traffic grouping unit 133a, a traffic extracting unit 133b, a multiple access traffic detecting unit 133c, and a malicious traffic determining unit 133d .

Referring to each component, the traffic grouping unit 133a forms at least one trapping group by grouping request traffic requesting connection to an external host based on a destination URL. In the first example, the traffic grouping unit 133a may group the collected traffic based on the file path included in the destination URL. According to the first example, the request traffic for the first URL (" aaa.com/main.jsp?i=3 ") and the second URL ("bbb.com/main.jsp?i=5"Lt; / RTI > In the second example, the traffic grouping unit 133a can group the collected traffic based on the file path and the query string included in the destination URL. According to the second example, the request traffic for the first URL ("aaa.com/main.jsp?i=3") and the second URL ("bbb.com/main.jsp?i=5") are different Can be grouped into groups.

The traffic extracting unit 133b extracts traffic based on the size of data included in the corresponding response traffic among the request traffic included in the traffic group. For example, the traffic extracting unit 133b may extract the traffic having the size of the data included in the corresponding response traffic among the request traffic included in the traffic group equal to or larger than the first threshold value or the size of the data smaller than or equal to the second threshold value do. At this time, the second threshold value may be set to a value larger than the first threshold value. That is, the traffic extracting unit 133b may exclude request traffic that is too large or small in the data size of the corresponding response traffic. This is because when the size of the response data is too large, it usually corresponds to the image data and is not related to the malicious traffic. If the size of the response data is too small, the probability of the traffic is meaningless as in the case of ACK.

According to the embodiment of the present invention, the traffic extracting unit 133b may extract traffic based on the number of request traffic destined to a specific external host. For example, the traffic extracting unit 133b may extract the traffic having the number of request traffic whose destination is a specific external host is equal to or greater than the first threshold value or equal to or less than the second threshold value. At this time, the second threshold value may be set to a value larger than the first threshold value. That is, the traffic extracting unit 133b may exclude traffic that is too large or small in number of request traffic destined to a specific external host. This is because, when the number of requested traffic is too large, the probability of normal traffic connecting to the portal site is high, and when the number of traffic is too small, there is a high probability of meaningless traffic. For example, in the present embodiment, the traffic grouping unit 133a may group the collected traffic on the basis of a specific external host and provide the grouped traffic to the traffic extracting unit 133b. And the third malicious traffic detection unit 131, 135 as well.

The multiple access traffic detector 133c detects a traffic group in which the destination URL including different host addresses is included among the traffic groups included in the extracted traffic as multiple access traffic. In other words, since the traffic group is a set of traffic including the same file path in the destination URL, the multiple access traffic detector 133c can detect a traffic group including a plurality of host addresses in the destination URL as multiple access traffic It is.

The malicious traffic determining section 133d determines whether or not the detected multiple access traffic is malicious traffic based on the degree of deviation of the size of the data included in the corresponding response traffic. For example, the malicious traffic determining unit 133d calculates a standard deviation and / or a variance value of the size of data included in the corresponding response traffic, and when the standard deviation and / or the variance value is equal to or less than a predetermined threshold value, Multiple access traffic is judged to be malicious traffic. This is because it is difficult to accidentally occur when the size of the response data is similar to that of the traffic whose destination is the same as the file path and which is different from the external host.

Up to now, the second malicious traffic detection unit 133 has been described with reference to FIG. Additional details of the second malicious traffic detection unit 133 will be described with reference to the description of FIGS. 12 to 14. FIG.

Next, the third malicious traffic detection unit 135 will be described with reference to FIG.

Referring to FIG. 8, the third malicious traffic detection unit 135 may include a traffic grouping unit 135a, a fake traffic detection unit 135b, and a malicious traffic determination unit 135c.

Referring to each component, the traffic grouping unit 135a groups the collected traffic based on any one of a host address and an IP included in a destination URL of the collected traffic. That is, the traffic grouping unit 135a may form the first traffic group based on the host address of the destination URL, and may form the second traffic group by grouping the collected traffic based on the IP have.

The forged traffic detection unit 135b detects at least one traffic group in which a URL for a destination and an IP do not match among traffic groups as fake traffic.

According to the embodiment of the present invention, the forged traffic detecting unit 135b does not check whether the inquired IP matches with the URL, inquiring the IP corresponding to the URL of each traffic individually, The forged traffic is detected by comparing the number of matched IPs based on the URL or the number of matched URLs based on the IP. By doing so, the forged traffic detection unit 135b can detect forged traffic at high speed without needing to inquire IP information corresponding to each URL.

In other words, when the first traffic group is formed based on the host address, the fake traffic detector 135b can detect a traffic group in which a plurality of IPs appear in the first traffic group as the first fake traffic. If the second traffic group is formed based on the IP, the falsification traffic detector 135b may detect the traffic group in which the plurality of URLs appear in the second traffic group as the second falsification traffic.

On the other hand, in the case of a portal site, a plurality of IPs may be held to provide a plurality of services. In such a case, since there are a plurality of IPs in the traffic to the portal site, falsified traffic that is erroneously detected in the first forged traffic may exist. Also, when using a hosting company, there may be cases where different services are provided with the same IP. In such a case, since a plurality of URLs may appear in one IP, falsified traffic that is erroneously detected even in the second falsified traffic may exist.

In order to solve such a problem, the forged traffic detection unit 135b may detect a traffic group in which a plurality of IPs appear among the first traffic group, The second traffic group is detected as a first forged traffic and the second traffic group for which a plurality of host addresses are indicated is detected as a second forged traffic and the second and the third forged traffic are simultaneously included in the first forged traffic and the second forged traffic, Traffic can be detected as fake traffic. According to the present embodiment, the detection accuracy for the fake traffic can be improved, and thus the accuracy of malicious traffic detection can also be improved.

The malicious traffic determining unit 135c determines that the fake traffic whose destination is an external host whose number of access traffic is equal to or less than a preset threshold value among the detected fake traffic as malicious traffic. That is, the malicious traffic determining unit 135c determines whether or not the detected fake traffic is malicious traffic based on the number of traffic requests for connection. It can be understood that the external host having a high connection traffic reflects a high probability that the host is a normal host providing a site visited by a large number of users.

Up to now, the third malicious traffic detection unit 135 has been described with reference to FIG. Additional details of the third malicious traffic detection unit 135 will be further described with reference to FIG.

Each of the components of FIGS. 3 and 4A to 8 described above may mean software or hardware such as an FPGA (Field Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit). However, the components are not limited to software or hardware, and may be configured to be addressable storage media, and configured to execute one or more processors. The functions provided in the components may be implemented by a more detailed component, or may be implemented by a single component that performs a specific function by combining a plurality of components.

9 is a hardware configuration diagram of a malicious traffic detection apparatus 100 according to another embodiment of the present invention.

9, the malicious traffic detection apparatus 100 includes one or more processors 101, a bus 105, a network interface 107, a memory (not shown) for loading a computer program executed by the processor 101 103), and storage 109 for storing malicious traffic detection software 109a. However, only components that are related to the embodiment of the present invention are shown in Fig. Therefore, it will be understood by those skilled in the art that other general-purpose components other than the components shown in FIG. 9 may be further included.

The processor 101 controls the overall operation of each configuration of the malicious traffic detection device 100. The processor 101 includes a central processing unit (CPU), a microprocessor unit (MPU), a microcontroller unit (MCU), a graphics processing unit (GPU), or any type of processor well known in the art . The processor 101 may also perform operations on at least one application or program to perform the method according to embodiments of the present invention. The malicious traffic detection device 100 may include one or more processors.

The memory 103 stores various data, commands and / or information. The memory 103 may load one or more programs 109a from the storage 109 to execute a malicious traffic detection method according to embodiments of the present invention. RAM is shown as an example of the memory 103 in Fig.

The bus 105 provides communication between components of the malicious traffic detection device 100. The bus 105 may be implemented as various types of buses such as an address bus, a data bus, and a control bus.

The network interface 107 supports wired / wireless Internet communication of the malicious traffic detection device 100. In addition, the network interface 107 may support various communication methods other than Internet communication. To this end, the network interface 107 may comprise a communication module well known in the art.

The storage 109 may non-temporarily store the one or more programs 109a. In FIG. 9, malicious traffic detection software 109a is shown as an example of the one or more programs 109a.

The storage 109 may be a nonvolatile memory such as ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), flash memory, etc., hard disk, removable disk, And any form of computer-readable recording medium known in the art.

The malicious traffic detection software 109a may perform a malicious traffic detection method according to an embodiment of the present invention.

Specifically, the malicious traffic detection software 109a is loaded into the memory 103 and is operated by one or more processors 101 to collect traffic on the network, on the network, among the collected traffic, It is possible to perform an operation for determining whether or not the detected periodic traffic corresponds to malicious traffic based on the operation of detecting the periodic traffic indicating the continuously appearing traffic and the distribution of the number of times of occurrence of the traffic by the time period.

Up to now, the configuration and operation of the malicious traffic detection apparatus 100 according to the embodiment of the present invention have been described with reference to FIG. 3 to FIG. Next, a malicious traffic detection method according to another embodiment of the present invention will be described with reference to FIGS. 10 to 15. FIG.

Each step of the malicious traffic detection method according to an embodiment of the present invention to be described below may be performed by a computing device. For example, the computing device may be malicious traffic detection device 100. However, for the sake of convenience of description, description of the operation subject of each step included in the malicious traffic detection method may be omitted. Each step of the malicious traffic detection method may be an operation performed by the malicious traffic detection device 100 by the malicious traffic detection software 109a being executed by the processor 101. [

In order to exclude redundant description, description of components substantially the same as those described with reference to FIGS. 3 to 9 among the components of the malicious traffic detection method to be described below will be omitted.

10 and 11 are flowcharts of a malicious traffic detection method according to the first embodiment of the present invention. However, it should be understood that the present invention is not limited thereto and that some steps may be added or deleted as needed.

The malicious traffic detection method according to the first exemplary embodiment detects malicious traffic based on periodic traffic. Referring to FIGS. 10 and 11, each step of the malicious traffic detection method according to the first embodiment will be described in detail. When traffic for a target system is collected on the network (S110), the malicious traffic detection apparatus 100 The collected traffic is grouped by time zone (S130). Next, the malicious traffic detection device 100 extracts traffic having a matching host address included in the URL (S150), and detects periodic traffic that continuously appears in the extracted traffic (S170). Next, the malicious traffic detection device 100 determines whether or not the periodic traffic is malicious traffic based on the distribution of the number of traffic occurrences by time slot (S190).

11, the malicious traffic detection device 100 calculates a standard deviation or variance of the number of times of traffic generation by time slot (S191), and the calculated standard deviation or variance is compared with the threshold value , It is determined that the periodic traffic is malicious traffic (S193, S195).

The malicious traffic detection method according to the first embodiment of the present invention has been described with reference to FIGS. 10 and 11. FIG. The contents of the first embodiment will be described with reference to FIG.

Next, FIGS. 12 to 14 illustrate a malicious traffic detection method according to a second embodiment of the present invention.

The malicious traffic detection method according to the second embodiment detects malicious traffic based on multiple access traffic. 12 to 14, each step of the malicious traffic detection method according to the second embodiment will be described in detail. When the traffic for the target system is collected on the network (S210), the malicious traffic detection apparatus 100 The collected traffic is grouped based on the file path included in the URL (S230). Here, the collected traffic may be a request traffic requesting connection to an external host.

Next, the malicious traffic detection device 100 extracts the requested traffic based on the size of the data included in the corresponding response traffic (S250). 13, the malicious traffic detection device 100 determines whether the amount of data included in the corresponding response traffic is greater than or equal to the first threshold value and less than or equal to the second threshold value (S251, S252, S254, and S255).

Next, the malicious traffic detection device 100 detects a traffic group in which the destination URL including a plurality of host addresses is included among the traffic groups included in the extracted request traffic, as multiple access traffic (S270). Next, the malicious traffic detection device 100 determines whether the detected multiple access traffic is malicious traffic based on the degree of deviation of the data size included in the response traffic (S290).

14, the malicious traffic detection device 100 calculates a standard deviation or variance of the data size of the response traffic corresponding to the detected multiple access traffic (S291) If the calculated standard deviation or variance is less than or equal to the threshold value, it is determined that the detected multiple access traffic is malicious traffic (S293, 295).

Up to now, a malicious traffic detection method according to the second embodiment of the present invention has been described with reference to FIG. 12 to FIG. The contents of the second embodiment will be described with reference to FIG.

Next, a malicious traffic detection method according to the third embodiment of the present invention will be described with reference to FIG.

The malicious traffic detection method according to the third embodiment detects malicious traffic based on the forged traffic. Referring to FIG. 15, each step of the malicious traffic detection method according to the third embodiment will be described in detail. When the traffic for the target system is collected on the network (S310), the malicious traffic detection apparatus 100 (320) the collected traffic based on any one of the included host address and IP.

Next, the malicious traffic detection device 100 detects the forged traffic using the comparison result of the number of URLs matched with the number of URLs of the destination (S330). In addition, the malicious traffic detection device 100 determines that the fake traffic destined for the host whose number of access traffic is less than or equal to the threshold value among the detected fake traffic is malicious traffic (S340, S350).

The malicious traffic detection method according to the third embodiment of the present invention has been described with reference to FIG. The third embodiment will be described with reference to FIG.

Up to now, a malicious traffic detection method according to some embodiments of the present invention has been described with reference to FIGS. 10 to 15. FIG. According to the present invention, malicious traffic is detected based on a heuristic without previously defined malicious pattern information, and malicious code causing the malicious traffic can also be detected. Thus, according to the present invention, new and / or variant malicious codes can be detected, thereby preventing economic damage caused by the new and / or variant malicious code.

Also, periodic traffic, multiple access traffic and / or fake traffic are detected as malicious suspicious traffic, and traffic satisfying a predetermined criterion defined among the malicious suspicious traffic is determined as malicious traffic. Thus, the accuracy of malicious traffic detection can be improved.

The concepts of the present invention described above with reference to Figures 1-15 can be implemented in computer readable code on a computer readable medium. The computer readable recording medium may be, for example, a removable recording medium (CD, DVD, Blu-ray disk, USB storage device, removable hard disk) . The computer program recorded on the computer-readable recording medium may be transmitted to another computing device via a network such as the Internet and installed in the other computing device, thereby being used in the other computing device.

Although the operations are shown in the specific order in the figures, it should be understood that the operations need not necessarily be performed in the particular order shown or in a sequential order, or that all of the illustrated operations must be performed to achieve the desired result. In certain situations, multitasking and parallel processing may be advantageous. Moreover, the separation of the various configurations in the above-described embodiments should not be understood as such a separation being necessary, and the described program components and systems may generally be integrated together into a single software product or packaged into multiple software products .

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

Claims (20)

A traffic collecting unit for collecting traffic for a target system on a network;
And a first malicious traffic detection unit for detecting malicious traffic among the collected traffic,
Wherein the first malicious traffic detection unit comprises:
A periodic traffic detector for detecting periodic traffic indicating traffic continuously appearing in each time period among the collected traffic;
And a first malicious traffic determiner for determining whether the detected periodic traffic is malicious traffic based on the distribution of the number of traffic occurrences by time slot.
Malicious traffic detection device. The method according to claim 1,
The collected traffic,
Wherein the target system is an outbound traffic transmitted from the target system to an external host.
Malicious traffic detection device. The method according to claim 1,
Wherein the first malicious traffic detection unit comprises:
And a traffic extracting unit for extracting traffic that does not have a referer field value among the collected traffic,
Wherein the periodic traffic detection unit comprises:
And detects the periodic traffic among the extracted traffic.
Malicious traffic detection device. The method according to claim 1,
Wherein the first malicious traffic detection unit comprises:
A traffic grouping unit for grouping the collected traffic by time zone,
Further comprising a traffic extracting unit for extracting, among the grouped traffic, traffic having a matching host address and file path included in a uniform resource locator (URL) of a destination,
Wherein the periodic traffic detection unit comprises:
And the periodic traffic is detected from among the extracted traffic.
Malicious traffic detection device. The method according to claim 1,
Wherein the first malicious traffic judging unit comprises:
And judges that the detected periodic traffic is malicious traffic when the standard deviation or variance with respect to the number of times of occurrence of traffic by time slot is equal to or less than a predetermined threshold value.
Malicious traffic detection device. The method according to claim 1,
And a second malicious traffic detection unit for detecting multiple access traffic indicating traffic requesting connection to a plurality of external hosts from the collected traffic and detecting malicious traffic based on the detected multiple access traffic As a result,
Malicious traffic detection device. The method according to claim 6,
Wherein the collected traffic includes request traffic for requesting connection to an external host and response traffic according to the request,
Wherein the second malicious traffic detection unit comprises:
And a traffic extracting unit for extracting a request traffic having a size of the data included in the response traffic corresponding to the request traffic or a size of the data included in the response traffic is equal to or larger than a first threshold value,
Wherein the second threshold value is greater than the first threshold value,
The detected multiple access traffic may include:
Wherein the request traffic is detected from the extracted request traffic.
Malicious traffic detection device. The method according to claim 6,
Wherein the second malicious traffic detection unit comprises:
A traffic grouping unit for grouping the collected traffic based on a file path included in the URL to form at least one traffic group,
And a multiple access traffic detector for detecting a traffic group in which at least one traffic group includes destination addresses including different host addresses as multiple access traffic.
Malicious traffic detection device. The method according to claim 6,
Wherein the detected multiple access traffic includes request traffic for a plurality of hosts,
Wherein the second malicious traffic detection unit comprises:
And a second malicious traffic determiner for determining whether the detected multiple-access traffic is malicious traffic based on a degree of deviation of the size of data included in the response traffic corresponding to the request traffic.
Malicious traffic detection device. 10. The method of claim 9,
The second malicious traffic judging section judges,
And a second malicious traffic determiner for determining that the detected multiple access traffic is malicious traffic when the standard deviation or variance of the size of the data is less than or equal to a preset threshold value.
Malicious traffic detection device. The method according to claim 1,
Detecting, from among the collected traffic, a fake traffic indicating a traffic in which IP is inconsistent with a URL of the destination using a comparison result of the number of IPs matched with the number of URLs of the destination; Further comprising a second malicious traffic detection unit for detecting traffic,
Malicious traffic detection device. 12. The method of claim 11,
Wherein the second malicious traffic detection unit comprises:
A traffic grouping unit for grouping the collected traffic based on any one of a host address and an IP included in a destination URL to form at least one traffic group,
And a forged traffic detector for detecting a traffic group in which the number of IP addresses matched with the number of host addresses is mismatched among the at least one traffic group as fake traffic.
Malicious traffic detection device. 13. The method of claim 12,
The traffic-
Grouping the collected traffic based on the host address to form at least one first traffic group, forming at least one second traffic group by grouping the collected traffic based on the IP,
Wherein the forged traffic detection unit comprises:
Detecting, from among the at least one first traffic group, a traffic group in which a plurality of IPs appear, as a first forged traffic suspicious traffic, and for detecting a traffic group in which a plurality of host addresses appear among the at least one second traffic group, Traffic is detected as traffic, and traffic included in both the first forgery suspect traffic and the second forgery suspect traffic is detected as fake traffic.
Malicious traffic detection device. 12. The method of claim 11,
Wherein the second malicious traffic detection unit comprises:
And a second malicious traffic judging unit for judging, as malicious traffic, falsified traffic destined for an external host whose number of access traffic is less than or equal to a predetermined threshold value, among the detected falsified traffic.
Malicious traffic detection device. A traffic collecting unit for collecting traffic for a target system on a network;
And a first malicious traffic detection unit for detecting malicious traffic among the collected traffic,
Wherein the first malicious traffic detection unit comprises:
A multiple access traffic detector for detecting a multiple access traffic pointing to a request traffic requesting connection to a plurality of external hosts from among the collected traffic;
And a malicious traffic determiner for determining whether the detected multiple access traffic is malicious traffic based on a degree of deviation of data size included in response traffic corresponding to the plurality of request traffic.
Malicious traffic detection device. 16. The method of claim 15,
Wherein the first malicious traffic detection unit comprises:
Further comprising a traffic grouping unit for grouping the collected traffic based on a file path included in the URL to form at least one traffic group,
Wherein the multiple access traffic detection unit comprises:
And detects a traffic group in which a destination URL including a different host address appears among the at least one traffic group as multiple access traffic.
Malicious traffic detection device. 16. The method of claim 15,
Wherein the collected traffic includes request traffic for requesting connection to an external host and response traffic according to the request,
Wherein the first malicious traffic detection unit comprises:
Further comprising a traffic extracting unit for extracting request traffic having a size of the data included in the corresponding response traffic from the request traffic being greater than or equal to a first threshold value or a size of the data being less than or equal to a second threshold value,
Wherein the second threshold value is greater than the first threshold value,
Wherein the multiple access traffic detection unit comprises:
And detects the multiple access traffic from among the extracted request traffic.
Malicious traffic detection device. 16. The method of claim 15,
The malicious traffic judging unit judges,
And determines that the detected multiple access traffic is malicious traffic when the standard deviation or variance of the size of data included in the corresponding response traffic is less than or equal to a preset threshold value.
Malicious traffic detection device. 16. The method of claim 15,
And a second malicious traffic detection unit for detecting periodic traffic indicating traffic continuously appearing in the time period among the collected traffic and detecting malicious traffic among the detected periodic traffic based on distribution of the number of times of traffic generation by time period ≪ / RTI >
Malicious traffic detection device. 16. The method of claim 15,
Detecting fake traffic indicating a traffic having an IP mismatch between a URL for the destination and a number of IPs matched with the number of URLs for the destination among the collected traffic; And a second malicious traffic detection unit for detecting malicious traffic among the detected fake traffic based on the detected malicious traffic.
Malicious traffic detection device.

Images