KR20190049322A - Forensic server and Method for identifying the cause of attack on software defined network - Google Patents

Abstract

Disclosed are a forensic server for identifying a cause of an attack performed on a software defined network and a method thereof. The forensic server comprises: a collection unit for collecting evidence data existing in the software defined network; an extracting unit for extracting pieces of information including execution event information of an application log, host profile information, link database information, event information of an API log, switch flow rule information, and switch runtime log information from the collected evidence data; and a search unit for inputting the extracted pieces of information into a machine learning algorithm to search for a host that has performed the network attack.

Description

[0002] Forensic server and method for identifying the cause of an attack performed on a software defined network and a method thereof [0002]

Embodiments of the present invention relate to a forensic server and method for identifying the cause of an attack performed on a software defined network.

The Internet plays an integral and important role in our daily lives, and we expect that this role will grow even more when the Internet of Things is applied to everyday life. However, the conventional network equipment operates in accordance with predetermined rules, which is difficult to manage, and when adding new functions, it is inconvenient to update or replace all related equipment. And it shows security vulnerabilities from various new malicious attacks.

Therefore, Software Defined Network (SDN) is emerging to solve this problem. A software defined network is separated from the control plane and the data plane unlike the existing network equipment.

At this time, a controller is located on a control plane, a plurality of switches are located on a data plane, a plurality of switches are controlled by a controller, and the switch periodically reports its state to the controller. That is, the controller manages the network as a whole by configuring a routing mechanism in the sub-switch. Thus, the network structure is simplified, and the network management is flexible.

However, there are numerous security attacks using features of this software-defined network, and there are also potential security attacks. The openness and flexibility of software-defined networks make a big difference, especially for cloud service and data center networks, but they can not control the security of the interface protocols adjacent to southbound and northbound due to problems such as single point of failure.

In order to solve the problems of the prior art as described above, the present invention proposes a forensic server and method for detecting the cause of an attack performed in a software defined network.

Other objects of the invention will be apparent to those skilled in the art from the following examples.

In order to accomplish the above object, according to a preferred embodiment of the present invention, there is provided a computer-readable recording medium having a collection unit for collecting evidence data existing in a software defined network; An extraction unit for extracting information including execution event information of the application log, host profile information, link database information, event information of the API log, switch flow rule information, and switch run time log information from the collected evidence data; And a search unit for inputting the extracted information into a machine learning algorithm to search for a host that has performed a network attack.

The collected evidence data may include the application log, the controller service log, the northbound API log, the southbound API log, the switch flow rules, and the switch runtime log.

Execution event information of the application log is extracted from the application log, the host profile information and the link database information are extracted from the controller service log, and event information of the API log is extracted from the northbound API log and the southbound API log The flow rule information of the switch is extracted from the switch flow rule, and the switch run time log information can be extracted from the switch run time log.

The machine learning algorithm is a SVM (Support Vector Machine) algorithm, and the extracted information can be input as features of the SVM algorithm.

The forensic server further includes a database for storing record data including abnormal operation data and normal operation data of the software defined network, wherein the search unit further performs the network attack using the record data stored in the database You can search for one host.

According to another embodiment of the present invention, there is provided a forensic method performed in an apparatus including a processor, the method comprising: collecting evidence data present in a software defined network; Extracting information including execution event information of the application log, host profile information, link database information, event information of the API log, switch flow rule information, and switch runtime log information from the collected evidence data; And inputting the extracted information to a machine learning algorithm to search for a host that has performed a network attack.

According to the present invention, there is an advantage of accurately grasping the cause of an attack performed on a software defined network.

It should be understood that the effects of the present invention are not limited to the above effects and include all effects that can be deduced from the detailed description of the present invention or the configuration of the invention described in the claims.

1 is a diagram showing a basic structure of a software defined network.
2 is a diagram showing a structure of OpenFlow used in a software defined network.
FIG. 3 is a diagram showing a schematic configuration of a forensic server according to an embodiment of the present invention.
4 is a flowchart illustrating a forensic method according to an embodiment of the present invention.
5 is a diagram for explaining the concept of the SVM algorithm.

As used herein, the singular forms "a", "an" and "the" include plural referents unless the context clearly dictates otherwise. In this specification, the terms " comprising ", or " comprising " and the like should not be construed as necessarily including the various elements or steps described in the specification, Or may be further comprised of additional components or steps. Also, the terms " part, " " module, " and the like described in the specification mean units for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software .

Hereinafter, a Software Defined Network (SDN) as an object of the present invention will be briefly described.

FIG. 1 is a diagram showing a basic structure of a software defined network, and FIG. 2 is a diagram showing a structure of OpenFlow used in a software defined network.

Referring to FIG. 1, a software defined network includes an infrastructure layer corresponding to a data plane, a control layer corresponding to a control plane, an application layer layer. The data layer is a layer that receives control through a specific interface of a software defined network and is responsible for the transmission of the data flow. The control layer is the layer that controls the flow of data and determines whether to route, forward, or reject the data flow through applications and network services. In addition, the operations of the data layer are summarized and transmitted to the application layer in the form of API (Application Programming Interface). Finally, the application layer enables various functions of the network to be performed using APIs provided by the control layer.

On the other hand, in traditional networks, network devices such as routers and switches are responsible for traffic control and rules. Therefore, the routing information of the network is stored in the switch and the router. Such a network structure has a problem in that administrators have to place related Internet facilities whenever the network changes, and data center or group network environment wastes resources due to frequent network changes.

OpenFlow is a technology used as an interface specification between a controller and a network device that complements the disadvantages of the conventional network. Referring to FIG. 2, OpenFlow separates a control plane and a data plane from each other to operate a network, thereby separating a function for controlling network traffic from a function for delivering and controlling the network by creating software . Using the OpenFlow protocol, control and data planes can be implemented in software rather than hardware, and the software can be installed on a general-purpose server to quickly implement new functionality.

OpenFlow can specify the operation of a packet (frame) by combining header information from protocol layers 1 to 4 into one. By modifying the program in the control plane, the user can freely create a new protocol in a range up to layer 4, and the user can implement a network optimized for a specific service or application. In other words, OpenFlow is a technology that controls the network by programming and separating the function of controlling packet and the function of delivering.

With reference to the above description, the forensic server and method according to an embodiment of the present invention will be described.

FIG. 3 is a diagram showing a schematic configuration of a forensic server according to an embodiment of the present invention.

Referring to FIG. 3, the forensic server 300 is a device that performs a function of searching for an attacker by analyzing or grasping the cause of an attack applied to a software defined network, and collects digital evidence or evidence data in a software defined network, Analyze the cause of the attack through. To this end, the forensic server 300 includes a collecting unit 310, an extracting unit 320, a searching unit 330, and a database 340.

4 is a flowchart illustrating a forensic method that is an operation of the forensic server 300 according to an embodiment of the present invention.

Hereinafter, the function of each component and the process performed for each step will be described in detail.

At step 410, the collection unit 310 collects evidence data residing in the software defined network.

According to one embodiment of the present invention, the evidence data includes application logs, controller service logs, northbound API logs, southbound API logs, switch flow rules, and switch runtime logs.

The application log contains information about the request sent from the application. That is, information of events to be performed when an application is executed is included. Here, an event refers to an operation occurring in a software defined network, such as when an application is executed or stopped, or when a host is connected to or disconnected from a software defined network.

As an example, the application log includes access logs and error logs. The access log contains information about who or where access has been provided, the success status of the request, and the response time of the request, and the error log contains information about the error that occurred in the application when processing the request.

The controller service log contains information about the services running on the controller. In one example, the information includes information of a host tracking service, information of a link search service, and topology manager information.

The northbound API log contains a call event for the northbound interface, and the southbound API log contains a call event for the southbound interface. In other words, the northbound interface and the southbound interface are the two underlying channels that are connected to the controller, and both interfaces can support the investigation process by maintaining a communication record with respect to the API log. The API log also includes call events such as access (e.g., insertion, deletion, editing, viewing), time and error.

A switch flow rule is an openflow flow entry of an openflow-based switch that contains match fields, priority, counters, instructions, and cookies. At this time, the match field is composed of ingress ports, packet header fields, metadata of a previous flow table, the priority is the matching priority of the entry, The counter is a statistic of the matching packet, the command corresponds to the processing of the set or pipeline, and the cookie contains the Opaque data transmitted by the controller.

The switch runtime log contains information about the set data path, configuration update, switch to controller connection state, and port information.

Next, in step 420, the extracting unit 320 extracts execution event information of the application log, host profile information, link database information, event information of the API log, switch flow rule information, and switch runtime log information And the like.

At this time, the execution event information of the application log is extracted from the application log, and may include an access log and an error log.

Further, the host profile information and the link database information can be extracted from the controller service log. In this case, the host profile information includes information of a host such as an IP address, a MAC address, a connected switch port, and a last active time stamp, and the link database information includes information on a host- ) Information and port-out information).

In addition, the event information of the API log is information extracted from the northbound API log and the southbound API log.

The switch flow rule information is information extracted from the switch flow rule, and the switch run time log information is information extracted from the switch run time log, and corresponds to the time at which the flow and flow rules in the table of the OpenFlow switch are set.

Next, in step 430, the search unit 330 inputs the extracted information to the machine learning algorithm to search for a host that has performed a network attack. That is, the search unit 330 analyzes the extracted evidence data, finds the root cause of the attack performed in the software defined network, and can detect an abnormal symptom.

At this time, the search unit 330 can search the host that has performed the network attack by further using the record data stored in the database 340. At this time, the recording data includes abnormal operation data and normal operation data.

Also, according to an embodiment of the present invention, the machine learning algorithm is a SVM (Support Vector Machine) algorithm, and the extracted information may be input as features of the SVM algorithm.

5 is a diagram for explaining the concept of the SVM algorithm.

Referring to FIG. 5, the SVM algorithm is a supervised learning technique and requires labeled data or historical data. At this time, the recording data is training data for constructing a prediction model.

Then, the database 340 provides the recording data for the SVM, and the recording data includes the network abnormal operation data and the normal operation data as mentioned above.

At this time, the database 340 is stored as vector-type data including features. Here, the features correspond to the extracted information. Based on the vector data set, the SVM defines a separation plane (or hyperplane) between the two cases, i.e., abnormal and normal behavior, to build the prediction model. When the vector reaches the predictive model, the SVM can determine whether the new data is abnormal.

In summary, the forensic server 300 and method according to the present invention grasps the root cause of an attack on a software defined network, and the forensic server 300 can be configured as a separate device separate from a software defined network.

In addition, embodiments of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Examples of program instructions, such as magneto-optical and ROM, RAM, flash memory and the like, can be executed by a computer using an interpreter or the like, as well as machine code, Includes a high-level language code. The hardware devices described above may be configured to operate as one or more software modules to perform operations of one embodiment of the present invention, and vice versa.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and limited embodiments and drawings. However, it should be understood that the present invention is not limited to the above- Various modifications and variations may be made thereto by those skilled in the art to which the present invention pertains. Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (6)

A collection unit for collecting evidence data existing in a software defined network;
An extraction unit for extracting information including execution event information of the application log, host profile information, link database information, event information of the API log, switch flow rule information, and switch run time log information from the collected evidence data; And
And a search unit for inputting the extracted information into a machine learning algorithm and searching for a host that has performed a network attack. The method according to claim 1,
Wherein the collected evidence data includes the application log, the controller service log, the northbound API log, the southbound API log, the switch flow rule, and the switch run time log. 3. The method of claim 2,
Execution event information of the application log is extracted from the application log, the host profile information and the link database information are extracted from the controller service log, and event information of the API log is extracted from the northbound API log and the southbound API log The flow rule information of the switch is extracted from the switch flow rule, and the switch run time log information is extracted from the switch run time log. The method according to claim 1,
Wherein the machine learning algorithm is a SVM (Support Vector Machine) algorithm, and the extracted information is input as features of the SVM algorithm. 5. The method of claim 4,
Wherein the forensic server further comprises a database for storing record data including abnormal operation data and normal operation data of the software defined network,
Wherein the search unit searches the host that has performed the network attack by further using the record data stored in the database. A forensic method performed on a device including a processor,
Collecting evidence data present in a software defined network;
Extracting information including execution event information of the application log, host profile information, link database information, event information of the API log, switch flow rule information, and switch runtime log information from the collected evidence data; And
And inputting the extracted information to a machine learning algorithm to search for a host that has performed a network attack.

Images