KR20200073772A - Separating network system with honeypot - Google Patents

Abstract

The present invention relates to a network separation system to which a honeypot is applied, which comprises: a control means; a photographing means; a first review means; a first conversion means; a first detection means; a second conversion means; and a monitoring means. Accordingly, the network separation system may reliably protect the system even if components used to build a video security system contain malware, increase the utilization of public services since it is possible to safely utilize video data of the video security system established in public institutions or public enterprises, and can not only increase the efficiency of integrated control of the video security system in the surrounding area, but also can collect new cyberattack information since infringement can be checked and responded in real time in the event of the infringement on the video security system, thereby improving the security of the system by performing feedback on the same.

Description

Network separation system with honeypot{SEPARATING NETWORK SYSTEM WITH HONEYPOT}

The present invention relates to a network separation system to which a honeypot is applied, and more specifically, it can stably protect a system even if malicious components or the like are included in a component used to construct a video security system, and is built in a public institution or a public corporation. It is possible to securely utilize the video data of the video security system to increase the utilization of public services, increase the efficiency of integrated control of the video security system in the nearby area, and to check the infringement in real time in the event of an infringement of the video security system. Since it can cope, it is possible to collect new cyber attack information, and it is about a network separation system to which honeypot is applied to improve the security of the system by feedback.

In recent years, rapidly increasing public sector terrorism, kidnapping, fire prevention of major facilities, and children's safety accidents have emerged as social problems, and as a result, installation of real-time video security systems based on surveillance cameras has rapidly increased. Doing.

However, as components required for building a video security system, for example, a network camera (IP camera) and a network video recorder (Network Video Recorder, NVR), have been developed in the form of network products, malicious software (Malicious Software, Malware), etc. are built into the components in advance. Through this, hacking is possible, and the threat of security breaches caused by components used in building a video security system is increasing.

In particular, the issue of security breaches of network cameras disclosed in the public and private internet networks has been issued through media several times.In April 2016, a distributed bot of a distributed denial of service (DDoS) attack could be created. Malicious code was found in Chinese network cameras sold at Amazon, and in November 2016, a large-scale DDoS attack occurred to US DNS companies using botnets included in Chinese network video security products.

As a result, the US Congress passed the National Defense Authorization Act (NDAA) to prohibit the use of Chinese-made network video security products in major facilities.

On the other hand, a number of Chinese network video security products have already been supplied to and installed and operated in the network video security system operated by domestic public institutions and public enterprises.

In addition, although there is a need for external sharing and utilization of public purposes for shooting data of video security systems operated by public institutions and public corporations, it is difficult to secure the stability of the system against external threats such as hacking, and sharing it externally Avoiding things.

Therefore, even if the components used to build the video security system contain malicious software, the system is physically segregated to protect the system from infringement (hacking) through an external network, and the technology is rapidly being upgraded. There is a growing need to collect data on active network infringement methods in order to recognize system administrators' infringement methods and to quickly develop countermeasures.

Republic of Korea Patent Registration No. 10-0926456

Accordingly, an object of the present invention is to solve such a conventional problem and to provide a network separation system with a honeypot capable of stably protecting a system even if malicious components or the like are included in a component used to construct a video security system. have.

In addition, it provides a network separation system with a honeypot that can safely utilize the video data of a video security system built in a public institution or a public enterprise to increase the utilization of public services and increase the efficiency of integrated control of a video security system in a nearby area. Is in

In addition, when an infringement action occurs on the video security system, it is possible to check and respond to the infringement in real time, so it is possible to collect new cyber attack information, and feed it back to the network separation system with a honeypot that can improve the security of the system. In the offer.

The object, according to the present invention, the control means; Photographing means operating under the control of the control means; First review means for receiving first control data for controlling the photographing means from the control means, and examining whether the first control data is normal or abnormal; As a result of the review of the first review means, first conversion means for receiving normal first control data and converting it into first unidirectional data that is unilaterally transmitted toward one direction and transmits it to the photographing means; First detection means for receiving abnormal first control data as a result of the review of the first review means, and detecting first cracker data included in the abnormal first control data; Second conversion means for receiving the abnormal first control data from the first detection means and converting it into second unidirectional data unilaterally transmitted toward one direction; And monitoring means for receiving and storing the first cracker data and the second unidirectional data, and transmitting the second unidirectional data to the cracker server when the first cracker data includes cracker server information. It is achieved by a network separation system to which the honeypot containing is applied.

Here, the image separating means for separating the image data from the photographing data photographed by the photographing means; Third conversion means for receiving the image data from the image separation means and converting it into third unidirectional data that is unilaterally transmitted toward one direction and transmitting it to the control means; Second review means for receiving the photographing data from the photographing means or the image separating means, and examining whether the second control data included in the photographing data is normal or abnormal; As a result of the review of the second review means, fourth conversion means that receives normal second control data and converts it into fourth unidirectional data that is unilaterally transmitted toward one direction and transmits the result to the control means; Second detection means for receiving abnormal second control data as a result of review of the second review means, and detecting second cracker data included in the abnormal second control data; And fifth conversion means for receiving the abnormal second control data from the second detection means and converting it into fifth unidirectional data unilaterally transmitted toward one direction. Further comprising, the monitoring means, receiving and storing the second cracker data and the fifth unidirectional data, and when the second cracker data includes the information of the cracker server, the fifth to the cracker server It is desirable to transmit unidirectional data.

Here, it is preferable that the information of the cracker server is address information of the cracker server or data stored in the cracker server.

Here, the monitoring means is connected to the second conversion means to receive and store the first cracker data and the second unidirectional data, and when the first cracker data includes the cracker server information, the cracker A first monitoring unit transmitting the second unidirectional data to a server; And connected to the fifth conversion means to receive and store the second cracker data and the fifth one-way data, and when the second cracker data includes information of the cracker server, the fifth one-way to the cracker server. A second monitoring unit transmitting data; It is preferred to include.

Here, the first review means, if the protocol of the first control data is different from the preset protocol, determines the first control data as abnormal, and the second review means is configured to determine whether the second control data is When the protocols are different from the preset protocols, it is preferable to judge the second control data as abnormal.

According to the present invention, even if malicious components or the like are included in the components used to construct the video security system, the system can be stably protected.

In addition, it is possible to securely utilize the video data of a video security system built in a public institution or a public corporation to increase the utilization of public services and increase the efficiency of integrated control of a video security system in a nearby area.

In addition, as an infringement action for the video security system can be identified and countered in real time, new cyber attack information can be collected, and the security of the system can be improved by feedback.

1 is a configuration diagram briefly showing the configuration of a honeypot-applied network separation system according to a first embodiment of the present invention,
Figure 2 is a schematic diagram showing the configuration of a honeycomb network separation system is applied according to a second embodiment of the present invention,
3 is a schematic view showing the configuration of a honeypot-applied network separation system according to a third embodiment of the present invention,
FIG. 4 is a flow chart showing a state in which the network separation system to which the honeypot is applied according to the first embodiment of the present invention is operated to identify and respond to whether components included in the system construction include malicious software,
5 is a flowchart illustrating a state in which the network separation system to which the honeypot is applied according to the second and third embodiments of the present invention is operated to identify and respond to whether components included in the system construction include malicious software or the like.

Hereinafter, a network separation system to which the honeypot according to the present invention is applied will be described in detail with reference to the accompanying drawings.

Here, Honeypot (Honeypot) refers to a system that is intentionally installed to detect abnormal access through an external network, that is, intrusion such as hacking, and detects and tracks spam, computer viruses, and cracker servers that have invaded the system. And it is widely used to prevent cyber terrorism.

The present invention applies the concept of a honeypot to a physical network separation system to stably protect a system even if malware (Malware, malicious software, etc.) is included in a component used to construct a video security system.

1 is a configuration diagram briefly showing a configuration of a network separation system to which a honeypot is applied according to a first embodiment of the present invention.

First, referring to FIG. 1, the network separation system 10 to which the honeypot is applied according to the first embodiment of the present invention is largely controlled means 100, photographing means 200, first review means 110, and first conversion It comprises a means 120, the first detection means 130, the second conversion means 140, the monitoring means 300.

The control means 100 is the operation of the shooting means 200, for example, lifting or pan (Pan), tilt (Tilt), zoom (Zoom) or the power on/off (On/Off), the start or completion of the shooting As a component that controls the back, for this purpose, control data, that is, first control data is transmitted to the photographing means 200. In the present specification, the control means 100 is described as controlling the photographing means 200, but may be configured to control the entire network separation system 10 to which the honeypot according to the present invention is applied. In addition, it is preferable that the control means 100 can store an image captured through the shooting means 200, and for this purpose, a network video recorder (NVR) or the like can be used as the controlling means 100.

The photographing means 200 operates under the control of the control means 100 and is a component such as a camera installed in a place for surveillance or security, and may use one or more network cameras. ) Image is taken as shooting data.

The first review means 110 is a component that receives first control data for controlling the photographing means 200 from the control means 100 and examines whether the first control data is normal or abnormal.

As a result of the review of the first review means 110, the first conversion means 120 receives normal first control data and is unilaterally transmitted in one direction (One-way, Simplex) data, that is, the first one-way data It is a component that is converted to and transmitted to the imaging means 200. As a method of converting normal first control data into first unidirectional data, various known methods, such as using an encoder, can be used.

The first detection means 130 is a component that receives the first abnormal control data as a result of the review by the first review means 110 and detects the first cracker data included in the abnormal first control data.

The second conversion means 140 is a component that receives the abnormal first control data from the first detection means 130 and converts it into second unidirectional data that is unilaterally transmitted toward one direction. As such, the abnormal first control data converted into the second unidirectional data becomes impossible to access to the transmitting side through the second unidirectional data, like the first unidirectional data converted through the first converting means 120.

The monitoring means 300 receives and stores the first cracker data and the second unidirectional data, and when the first cracker data includes information of the cracker server 20, the second unidirectional data is transmitted to the corresponding cracker server 20. It is a transmitting component.

Here, the information of the cracker server 20 may include address information of the cracker server 20, for example, an IP address, a domain name, and a uniform resource locator (URL). In addition, address information of data stored in the cracker server 20, for example, a data location address (Uniform Resource Locator) or the like may be used.

2 is a configuration diagram briefly showing a configuration of a network separation system to which a honeypot is applied according to a second embodiment of the present invention.

As shown in FIG. 2, the second embodiment of the present invention is similar to the first embodiment described above, but in the case of the first embodiment, the control means 100 among the components used in the construction of the honeypot applied network separation system 10 Is a system for reviewing and processing whether malware is included in the second embodiment, and in the second embodiment, there is a difference in reviewing and processing whether malware is included in the photographing means 200 in addition to the control means 100.

Accordingly, the network separation system 10 to which the honeypot is applied according to the second embodiment of the present invention, in addition to the components used in the first embodiment, the image separation means 210, the third conversion means 220, and the second review means (230), the fourth conversion means 240, the second detection means 250 and the fifth conversion means 260 is further configured.

First, the image separating means 210 is a component that separates image data from the photographing data photographed by the photographing means 200, and a so-called parsing engine may be used.

The third conversion means 220 is a component that receives image data from the image separation means 210 and converts it into third unidirectional data that is unilaterally transmitted toward one direction and transmits it to the control means 100. Accordingly, access to the third conversion means 220 which is the transmitting side is blocked from the control means 100 that is the receiving side of the third unidirectional data through the third unidirectional data.

The second review means 230 is a component that receives the photographing data from the photographing means 200 or the image separation means 210 and examines whether the second control data included in the photographing data is normal or abnormal. Here, in the illustrated drawing, the second review means 230 is disposed after the image separation means 210, but the second review means 230 is disposed between the imaging means 200 and the image separation means 210. As a result, after reviewing whether the second control data included in the photographing data is normal or abnormal, the image separating means 210 may be configured to separate the image data.

As a result of the review of the second review means 230, the fourth conversion means 240 receives normal second control data and converts it into fourth one-way data that is unilaterally transmitted toward one direction and transmits it to the control means 100 It is a component, and access to the fourth conversion means 240 from the control means 100, which is the receiving side, becomes impossible through the fourth unidirectional data.

The second detection means 250 is a component that receives abnormal second control data as a result of the review by the second review means 230 and detects second cracker data included in the abnormal second control data. The second detection means 250 may extract the second cracker data through the same method as the first detection means 130 detects the first cracker data, or may extract the second cracker data by another method. have. In the case of the first detection means 130, the second detection means 250 similarly extracts data related to the malware included in the control means 100, and the second detection means 250 extracts data related to the malware included in the imaging means 200. Will be extracted.

The fifth conversion means 260 is a component that receives abnormal second control data from the second detection means 250 and converts it into fifth unidirectional data that is unilaterally transmitted toward one direction.

In addition, in the first embodiment, the monitoring means 300 for receiving and storing the first cracker data and the second unidirectional data receives and stores the second cracker data and the fifth unidirectional data in the second embodiment.

When the second unidirectional data is transmitted to the monitoring means 300 and the first cracker data includes information of the cracker server 20 such as an IP address, domain, URL, etc., the second unidirectional data is transferred to the corresponding cracker server 20 ).

In addition, the fifth unidirectional data is transmitted to the monitoring means 300, and when the second cracker data includes information of the cracker server 20, the fifth unidirectional data is transmitted to the corresponding cracker server 20.

That is, if the information of the cracker server 20 is present in the first cracker data and the information of the cracker server 20 is not present in the second cracker data, only the second unidirectional data is transmitted to the corresponding cracker server 20, If information of the cracker server 20 exists only in the second cracker data, only the fifth unidirectional data is transmitted to the cracker server 20.

At this time, if the information of the cracker server 20 is included in both the first cracker data and the second cracker data, the second unidirectional data and the fifth unidirectional data are transmitted to the corresponding cracker server 20, but different IP addresses are provided. It is configured to transmit.

3 is a configuration diagram briefly showing a configuration of a network separation system to which a honeypot is applied according to a third embodiment of the present invention.

The network separation system 10 to which the honeypot is applied according to the third embodiment of the present invention is almost the same as the second embodiment described above, but is separated from each other in that the monitoring means 300 is physically divided and configured.

That is, in the case of the third embodiment, the monitoring means 300 is divided into two to be composed of the first monitoring unit 310 and the second monitoring unit 320, and the first monitoring unit 310 is configured as shown in the configuration of the first embodiment. The first cracker data and the second unidirectional data are transmitted and stored, and the second cracker data and the fifth unidirectional data are transmitted and stored in the second monitoring unit 320.

In this case, when the control means 100 includes malware and the first cracker data includes information of the cracker server 20, the first monitoring unit 310 sends the second one-way data to the cracker server 20. Will send.

In addition, when the photographing means 200 includes malware, and the second cracker data includes information of a cracker server 20 different from the first cracker data, the second monitoring unit 320 may have a different cracker server ( 20), the fifth unidirectional data is transmitted.

If the control means 100 and the photographing means 200 contain malware, and the first cracker data and the second cracker data contain information of different cracker servers 20, the first and second The monitoring unit 320 transmits the second unidirectional data and the fifth unidirectional data to the corresponding cracker server 20 separately.

Meanwhile, if both the control means 100 and the imaging means 200 contain malware, and the same cracker includes such malware, that is, second unidirectional data is transmitted to the first monitoring unit 310, and 2 If the fifth unidirectional data is transmitted to the monitoring unit 320, and the information of the same cracker server 20 is included in both the first cracker data and the second cracker data, the second unidirectional data is transmitted to the corresponding cracker server 20. And the fifth unidirectional data. The first monitoring unit 310 transmitting the second unidirectional data and the second monitoring unit 320 transmitting the fifth unidirectional data are physically divided into different IP addresses. It is transmitted to the cracker server 20.

Hereinafter, a description will be given of a state in which a honeypot according to the present invention is used.

4 is a flowchart illustrating a state in which the network separation system to which the honeypot is applied according to the first embodiment of the present invention is operated to identify and respond to whether components included in the system construction include malicious software or the like.

First, data for controlling the photographing means 200 from the control means 100, that is, first control data is generated and transmitted to the photographing means 200 side.

In the present invention, the first control data is configured to be transmitted (S100) to the first review means 110 first, rather than directly to the photographing means 200, and the first control data transmitted from the control means 100 is normally controlled. Review whether it is data or abnormal control data (S110), that is, go through a process of examining whether or not malware is included in the control means 100 used in the construction of the network separation system 10 to which the honeypot according to the present invention is applied. do.

At this time, whether the first control data is normal or abnormal is determined by comparing the protocol of the first control data with a protocol set in the first review means 110. That is, if the protocols match each other, it is determined to be normal, and if they are different, it is determined to be abnormal.

This is a protocol that is pre-set by an operation such as including the malware in the control means 100 and the malware including the contents not instructed or instructed by the system administrator in the first control data. When it is judged that it is different from that, the first control data may be determined as abnormal control data. In particular, when the first control data includes important protocols such as addition, deletion, and change of shooting data that are not directed by the system administrator, it is possible to be sure of the existence of malware.

As the first control data transmitted from the control means 100 passes through the first review means 110 before being transferred to the imaging means 200, the control means 100 includes malware, and the corresponding malware is a honeypot. It is possible to always check whether the first control data is normal or abnormal even if it is operated as soon as the applied network separation system 10 is constructed or is operated after a certain period of time. That is, the first review means 110 serves to check whether a cracker exists in the component, that is, malware that may have been stored in the storage means in advance.

When the first control data reviewed through the first review means 110 is normal (S120), that is, when it is determined that the control means 100 does not contain malware, it is transferred to the first conversion means 120 (S122) Then, the normal first control data is converted to the first unidirectional data (S124) and transmitted to the photographing means 200 (S126), and the photographing means 200 is driven according to the contents of the first unidirectional data.

Unidirectional data refers to data in which the flow direction of data flows in only one direction, and a communication method such as TV broadcasting or radio broadcasting, for example, is divided between a transmitting side and a receiving side, such as a relationship between a microphone and a speaker. In other words, such a situation is the same as watching TV through the video data unilaterally transmitted from the broadcast station and unilaterally transmitted from the broadcast station at home. That is, the broadcasting station unilaterally transmits data toward the home, and the home can watch TV with the data received from the broadcasting station and cannot transmit it to return to the broadcasting station.

That is, in the present invention, the normal first control data is converted into the first unidirectional data and transferred to the photographing means 200 so that the photographing means 200 which is the receiving side of the first unidirectional data operates according to the first unidirectional data. , Access to the control means 100, which is the transmitting side through the first unidirectional data, is blocked by nature.

Next, as a result of the review through the first review means 110, if the first control data is determined to be abnormal (S120), that is, the control means 100 includes malware or the malware operates, the protocol of the first control data If it is determined that this is different from the predetermined protocol, the abnormal first control data is transmitted to the first detection means 130 (S130).

The first detection means 130 detects the first cracker data from the abnormal first control data (S140), and various methods known in the art for detecting the first cracker data may be used. Here, the first cracker data may be log data generated by logging abnormal first control data, or may be extracted data obtained by directly extracting information about malware included in the control means 100.

Then, the second conversion means 140 receives the abnormal first control data from the first detection means 130 (S150), and converts it into second unidirectional data sent unilaterally (S160) and monitors the means. It is transmitted to (300) (S170). As such, the abnormal first control data is converted into the second unidirectional data, making it impossible to access the transmitting side through the second unidirectional data.

In the monitoring means 300, the first cracker data detected through the first detection means 130 and the second unidirectional data converted by the second conversion means 140 are transmitted (S170) and stored. The monitoring means 300 may perform analysis on the transmitted first cracker data to determine what purpose the malware included in the control means 100 has, and how to operate the malware, in most cases It is difficult to understand the contents of malware except for the existence of.

Accordingly, in the present invention, it is determined whether the information of the cracker server 20 exists in the first cracker data, for example, the IP address, domain, URL, etc. of the cracker server 20 (S180), and if the cracker server 20 If information exists, the second one-way data is transmitted to the cracker server 20 through this (S190).

When the information of the cracker server 20 is known as described above, the cracker server 20 can be monitored by allowing the monitoring means 300 to record the cracker server 20 information in a blacklist.

In addition, by transmitting the second unidirectional data to the cracker server 20, it is possible to prevent the cracker from accessing the monitoring means 300, which is the transmitting side, through the second unidirectional data.

Meanwhile, even if the cracker server 20 receiving the second unidirectional data performs a system command to check the IP address of the control means 100 including malware, such as ifconfig, inconfig, ipconfig, netstat, etc., the control means 100 ) Not the IP address of the monitoring means 300 is checked.

That is, the cracker may think that the system intrusion attempt was successful without realizing that he or she is being detected and monitored, but the system administrator is aware of the existence of the malware included in the control means 100 and is preparing for external intrusion. Therefore, it is possible to detect and track cracker information and collect information such as cracker attack timing and patterns to improve the security of the system.

5 is a flowchart illustrating a state in which the network separation system to which the honeypot is applied according to the second and third embodiments of the present invention operates to identify and respond to whether components included in system construction include malicious software or the like.

First, the photographing means 200 is operated to generate photographing data (S200). The operation of the photographing means 200 may be in accordance with the contents of the first control data of the control means 100, in particular, the first unidirectional data in which normal first control data is converted. That is, it can be seen that the second and third embodiments of the present invention are connected and operated in the above-described first embodiment, and the step S200 in which photographing data is generated in FIG. 5 is the first unidirectional data in FIG. 4. It may be a step performed after the step S126 transmitted to the photographing means 200.

Next, in FIG. 5, the photographing data generated by the photographing means 200 is illustrated to be transmitted to the image separation means 210 and the second review means 230 (S210, S260), respectively. The second review means 230 ) May be transmitted from the image separation means 210.

The image separation means 210 separates the image data from the transmitted shooting data (S220), and the separated image data is transmitted to the third conversion means 220 (S230) and is unilaterally transmitted toward one direction. It is converted to unidirectional data (S240).

Here, the third conversion means 220 may use the same data conversion method as the first and second conversion means 140. In addition, it decodes video data in real time and converts it to an AVI file or an MP4 file, or security. To improve the performance, it is first decoded and converted into low data, then encoded into unidirectional data, for example, serial data or parallel data, and then decoded into secondary data to convert it into video data unidirectional data. It may be configured to.

And the third unidirectional data is transmitted to the control means 100 (S250), likewise, a video reproducing apparatus separately connected to the control means 100 together with the fourth unidirectional data transmitted to the control means 100, for example a monitor It can be configured to be delivered to the display or to be stored by placing a separate image storage device.

Meanwhile, when the photographing data is transmitted to the second review means 230 (S260 ), the second review means 230 examines whether the second control data included in the photographing data is normal or abnormal (S270 ). The second review means 230 compares the protocol of the first control data to the second control by comparing whether the protocols of the second control data are the same as or different from the preset protocol similar to the first review means 110 for comparing the protocol of the first control data. It determines whether the data is normal or abnormal. As described above, since the second control data undergoes a review step through the second review means 230, it is possible to check whether a cracker exists in a component, that is, malware that may have been stored in the photographing means 200 in advance.

If the second control data is normal (S280), that is, if it is determined that the photographing means 200 does not contain malware, the normal second control data is transferred to the fourth conversion means 240 (S282), and this is the fourth unidirectional It is converted to data (S284) and transmitted to the control means 100 (S286), and is transmitted to the display device together with the above-described third one-way data so that the third one-way data can be displayed.

In addition, if the second control data is abnormal (S280), that is, when it is determined that the malware is included in the photographing means 200, the abnormal second control data is transmitted to the second detection means 250 (S290), thereby causing the second cracker. Data is detected (S300).

Next, the fifth conversion means 260 receiving the abnormal second control data from the second detection means 250 (S310) converts it into the fifth unidirectional data (S320), and the monitoring means 300 has a second The cracker data and the fifth unidirectional data are transmitted (S330).

The monitoring means 300 determines whether information of the cracker server 20 such as the IP address, domain, URL, etc. of the cracker server 20 exists in the second cracker data (S340), and if so, uses the cracker server 20 ) To the fifth unidirectional data (S350), and even if the cracker server 20 performs a system command to check the IP address of the recording means 200, the monitoring means is not the IP address of the recording means 200 ( By checking the IP address of 300), it is possible to hide the fact that crackers are being detected and tracked.

If the second unidirectional data and the fifth unidirectional data are transmitted to the monitoring means 300, and the information of the cracker server 20 is included in both the first cracker data and the second cracker data, different IP addresses are provided. Thus, the second unidirectional data and the fifth unidirectional data are transmitted.

Therefore, even if the cracker server 20 performs a system command to check the IP address of the control means 100 and the photographing means 200, different IP addresses are checked, and the control means 100 and the photographing means are respectively used. It is recognized that it is the IP address of (200).

Meanwhile, in the network separation system 10 to which the honeypot according to the present invention is applied, the review result of the first control data through the first review means 110 or the review result of the second control data through the second review means 230 is abnormal Or, it is normal, and whether the first cracker data or the second cracker data is detected, the presence of information on the cracker server 20, etc. are inserted as subtitles such as text or images, such as a video playback device used by the system administrator. For example, it may be configured to include a separate caption insertion means (not shown) to be displayed through a monitor so that a system administrator can easily recognize it.

The scope of the present invention is not limited to the above-described embodiments, but can be implemented in various forms of embodiments within the scope of the appended claims. Any person skilled in the art to which the present invention pertains without departing from the gist of the present invention as claimed in the claims is deemed to be within the scope of the claims of the present invention to a wide range that can be modified.

10: honeypot applied network separation system 20, 20a, 20b: cracker server
100: control means 110: first review means
120: first conversion means 130: first detection means
140: second conversion means 200: shooting means
210: image separation means 220: third conversion means:
230: second review means 240: fourth conversion means
250: second detection means 260: fifth conversion means
300: monitoring means 310: first monitoring unit
320: second monitoring unit

Claims (5)

In the honeypot applied network separation system,
Control means;
Photographing means operating under the control of the control means;
First review means for receiving first control data for controlling the photographing means from the control means, and examining whether the first control data is normal or abnormal;
As a result of the review of the first review means, first conversion means for receiving normal first control data and converting it into first unidirectional data that is unilaterally transmitted toward one direction and transmits it to the photographing means;
First detection means for receiving abnormal first control data as a result of the review of the first review means, and detecting first cracker data included in the abnormal first control data;
Second conversion means for receiving the abnormal first control data from the first detection means and converting it into second unidirectional data unilaterally transmitted toward one direction; And
Monitoring means for receiving and storing the first cracker data and the second unidirectional data, and transmitting the second unidirectional data to the cracker server when the first cracker data includes cracker server information;
Network separation system to which the honeypot is applied. According to claim 1,
Image separating means for separating image data from the photographing data photographed by the photographing means;
Third conversion means for receiving the image data from the image separation means and converting it into third unidirectional data that is unilaterally transmitted toward one direction and transmitting it to the control means;
Second review means for receiving the photographing data from the photographing means or the image separating means, and examining whether the second control data included in the photographing data is normal or abnormal;
As a result of the review of the second review means, fourth conversion means that receives normal second control data and converts it into fourth unidirectional data that is unilaterally transmitted toward one direction and transmits the result to the control means;
Second detection means for receiving abnormal second control data as a result of review of the second review means, and detecting second cracker data included in the abnormal second control data; And
Fifth conversion means for receiving the abnormal second control data from the second detection means and converting it into fifth unidirectional data unilaterally transmitted toward one direction; Further comprising,
The monitoring means,
A honeypot characterized by receiving and storing the second cracker data and the fifth unidirectional data, and transmitting the fifth unidirectional data to the cracker server when the second cracker data includes information of the cracker server. Network separation system applied. According to claim 2,
The information of the cracker server,
A network separation system to which a honeypot is applied, characterized in that it is address information of data stored in the cracker server or the cracker server. According to claim 3,
The monitoring means,
It is connected to the second conversion means to receive and store the first cracker data and the second unidirectional data, and when the first cracker data includes information of the cracker server, the second unidirectional data to the cracker server A first monitoring unit for transmitting; And
It is connected to the fifth conversion means to receive and store the second cracker data and the fifth unidirectional data, and when the second cracker data includes information of the cracker server, the fifth unidirectional data to the cracker server A second monitoring unit for transmitting;
Network separation system is applied to the honeypot, characterized in that it comprises a. The method according to any one of claims 1 to 4,
The first review means,
When the protocol of the first control data is different from the preset protocol, the first control data is determined as abnormal,
The second review means,
When the protocol of the second control data is different from the preset protocol, the honeypot applied network separation system is characterized in that the second control data is judged as abnormal.

Images