KR20200122054A - Harmful ip determining method - Google Patents

Abstract

The present invention relates to a harmful Internet protocol (IP) determination method for determining a source IP suspected of being harmful by analyzing a login-related packet. According to an embodiment of the present invention, a harmful IP determination method may comprise the steps of: collecting login packets; analyzing the login packets and classifying each source IP into a single attack IP or multiple attack IP according to the number of destination IPs attempted to access from the source IP; analyzing a login packet corresponding to the classified source IP to increase a harmful score for the source IP; and detecting a harmful IP from the increased harmful score for each source IP.

Description

How to determine harmful IP {HARMFUL IP DETERMINING METHOD}

The present invention relates to a method for determining a harmful IP, and more particularly, to a method for determining a harmful IP to determine a source IP suspected of being harmful by analyzing a login-related packet.

With the development of communication technology, various devices are connected online, and a large amount of data is transmitted at high speed. However, in IT devices including PCs, security holes are increasing due to various equipment and applications, and it is very difficult to accurately detect attacks due to various types of attacks.

As a method to verify their account created by a user online and to enhance security, an account login method through an ID and password is commonly used. However, in many cases, users simply set a password for convenience of login or use the same password for a plurality of accounts. Attackers targeting the security vulnerabilities of the user's ID and set password can use a method such as brute force, which indiscriminately substitutes the ID and password to neutralize the user's account security.

To protect users from such attackers, various network security devices and network monitoring methods attempt to detect harmful IP (Internet Protocol) addresses, but the brute force policy of existing security devices is based on the amount of traffic based on the destination port. Since the IP is detected, the accuracy of detection is deteriorated and the false detection rate is high.

In addition, in order to increase security, the method of using the security equipment distributed in the existing overseas gateway section does not collect/store data in a single server, but analyzes the data in each security equipment, thereby having an asymmetric traffic flow. In a large-scale network, there is a problem that the accuracy of determining a harmful IP is low.

A method for determining a harmful IP according to an embodiment of the present invention aims to detect an address of a harmful IP with a higher probability than before by combining several conditions and increasing a score according to each condition.

Another object of the method for determining a harmful IP according to an embodiment of the present invention is to increase the accuracy of detection of a harmful IP address by increasing a different score for each condition for finding a harmful IP address, and adding new conditions.

Another object of the method for determining harmful IP according to an embodiment of the present invention is to generate TI (Treat Intelligence) information by using the detected harmful IP, and to provide high-quality information security services to users by using the TI information. have.

The harmful IP determination method according to the embodiment of the present invention collects and analyzes data of distributed security equipment in one storage space, so that the environment in which only one direction analysis was possible in an asymmetrical network structure for data transmission and data reception is analyzed in both directions. There is another purpose in improving the data to be analyzed.

In order to solve the above problems, a method for determining a harmful IP according to an embodiment of the present invention includes: collecting a login packet; Analyzing the login packet and classifying each source IP into a single attack IP or multiple attack IPs according to the number of destination IPs attempted to access from the source IP (Internet Protocol); Analyzing a login packet corresponding to the classified source IP to increase a harmful score for the source IP; And detecting a harmful IP from the increased harmful score for each source IP. It may include.

The login packet is transmitted from a security device that collects packets on a communication path, and may be a packet including a phrase corresponding to a login failure.

Increasing the score may be a step of increasing the score based on a different criterion according to the attack type in which the source IP is classified.

Increasing the harmful score may include: if the source IP is classified as a plurality of attack IPs, increasing the harmful score based on the number of countries that have responded to the source IP for a login failure; Increasing a harmful score according to whether the source IP attempts to log in with a predetermined ID; Increasing the harmful score according to the length of the login attempt duration of the source IP; Increasing a harmful score according to the number of source ports used by the source IP; Increasing a harmful score according to the number of access attempts of the source IP within a predetermined time; Increasing a harmful score according to the number of IDs and passwords used by the source IP for login attempts; And increasing a harmful score according to whether a destination IP to which the source IP wants to log in is assigned a Dynamic Host Configuration Protocol (DHCP) IP. The harmful score for the source IP may be increased according to at least one of steps.

Increasing the harmful score may include: if the source IP is classified as a single attack IP, increasing the harmful score according to the number of IDs and passwords used by the source IP for login attempts; Increasing a harmful score according to whether the length of the single login attempt time of the source IP is less than a predetermined time; Increasing a score according to the number of source ports used by the source IP; Increasing a harmful score according to the number of access attempts of the source IP within a predetermined time; Increasing the harmful score according to the length of the login attempt duration of the source IP; And increasing the harmful score according to the country of the source IP attempting to log in. The harmful score for the source IP may be increased according to at least one of steps.

Increasing the harmful score may include increasing the harmful score according to the number of failed logins from the source IP to a specific destination IP; It may further include.

In the step of increasing the harmful score according to the number of failed logins from the source IP to a specific destination IP, the number of IDs and passwords used for the login attempt is increased in the step of increasing the harmful score according to the number of IDs and passwords used for the login attempt. In the step of increasing the harmful score according to whether the number is less than a predetermined value or the length of the single login attempt time is less than a predetermined time, it may be performed when it is determined that the single login attempt time is greater than the predetermined time.

The method for determining harmful IP according to an embodiment of the present invention can supplement the brute force policy of the existing security equipment with a high false positive rate, and can further improve the accuracy of the determination of the harmful IP address by changing the variable of each condition. . This makes it possible to block access to harmful IPs, thereby preventing damage from attackers.

In addition, according to the present invention, it is possible to solve a structural problem that was difficult to analyze by collecting and analyzing logs from security equipment distributed in an overseas gateway section of a network structure having an asymmetric traffic flow.

In addition, the present invention collects and analyzes distributed security equipment data in one storage space, so that data transmission and data reception can be analyzed in both directions in an environment where only one direction can be analyzed in an asymmetric network structure. can do.

In addition, the present invention generates TI (Treat Intelligence) information by using harmful IP, and by using the TI information, it is possible to provide a high-quality information security service to a user.

1 is a diagram for explaining a harmful IP determination system according to an embodiment of the present invention.
2 is a flowchart illustrating a method for determining a harmful IP according to another embodiment of the present invention.
3A and 3B are flow charts for explaining in more detail the step of increasing the harmful score in the embodiment of FIG. 2.
4A and 4B are other flow charts for explaining in more detail the step of increasing the harmful score in the embodiment of FIG. 2.
5 is a diagram for illustrating classifying a grade for harmful IP with an increased score according to an embodiment of the present invention.

In the present invention, various modifications may be made and various embodiments may be provided, and specific embodiments are illustrated in the drawings and will be described in detail through detailed description. However, this is not intended to limit the present invention to specific embodiments, and the present invention should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, in the present specification, when one component is referred to as "connected" or "connected" to another component, the one component may be directly connected or directly connected to the other component, but specially It should be understood that as long as there is no opposing substrate, it may be connected or may be connected via another component in the middle.

1 is a view for explaining a harmful IP determination system 10 according to an embodiment of the present invention.

Referring to FIG. 1, the harmful IP determination system 10 may include a security device 100 and a log analysis server 200.

The security equipment 100 is located on a communication path through which communication between the domestic terminal 20 and the foreign terminal 30 is performed, and may receive packets transmitted between each terminal. This communication path may be formed between the domestic network 21 and the overseas network 21. That is, a packet between terminals may be transmitted through a plurality of security devices 100 located in each communication path. FIG. 1 illustrates communication between the domestic terminal 20 and the foreign terminal 30 and the path thereof, but in the embodiment of the present invention, the security equipment 100 includes communication between the domestic terminal 20 or the foreign terminal 30. ) Can be located on the communication path.

The security equipment 100 may include equipment such as an Intrusion Prevention System (IPS), an Intrusion Detect System (IDS), a Unified Threat Management (UTM), and a firewall device.

The security equipment 100 may be configured in plural, and may be constructed corresponding to each communication line. Each of the security devices 100 is time-synchronized with each other, and packets collected by the security device 100 may be sequentially stored in a database. The security device 100 may filter a login packet related to a login failure among the collected packets.

In more detail, the login packet may be a packet including a phrase corresponding to a login failure among packets collected by the security device 100. To this end, the login packet must be a packet in which the text contained therein is not encrypted, and must include, for example, a phrase such as "Log-in fail". The login failure phrase is exemplary, and the operator of the harmful IP determination system 10 can filter more various types of login packets by designating various login failure phrases.

In addition to this, the login packet may include information on the IP address of the terminal transmitting and receiving the packet. Through this, it is possible to know the source IP, which is the IP address of the terminal attempting to log in, and the destination IP, which is the IP address of the terminal to be logged in.

The log-in packet may be transmitted from the security equipment 100 to the log analysis server 200. In more detail, the log analysis server 200 may receive various login packets transmitted through the domestic terminal 20 and the overseas terminal 30 from the security equipment 100 located in each communication path. Accordingly, when a packet is transmitted internationally, the log analysis server 200 can analyze the login packet even in an asymmetric network structure in which the communication path for transmitting the packet and the communication path for receiving the packet are different from each other.

The log analysis server 200 may analyze the transmitted login packet. In more detail, the log analysis server 200 classifies an attack type to analyze a login packet, increases a harmful score for the source IP according to a predetermined condition, and detects a harmful IP according to the increased score. .

A more detailed description of a process in which the log analysis server 200 analyzes a login packet will be described later.

2 is a flowchart illustrating a method for determining a harmful IP according to another embodiment of the present invention. Referring to FIG. 2, the method of determining a harmful IP may include a login packet collection step (S100 ), an attack type classification step (S200 ), a harmful score increase step (S300 ), and a harmful IP detection step (S400 ).

The login packet collection step S100 may be a step in which the log analysis server collects login packets from security devices located in each communication path.

The attack type classification step S200 may be a step in which the log analysis server analyzes the login packet and classifies each source IP into a single attack IP or multiple attack IPs according to the number of destination IPs attempted to access from the source IP.

The log analysis server may detect a source IP that attempts to log in, and a destination IP that receives a login attempt by the source IP through analysis of the login packet. In addition, information on a source port used by the source IP for a login attempt and information on a destination port used by the destination IP to receive a login attempt may be detected. Here, a source IP, a source port, a destination IP, and a destination port may be defined as a 4-tuple of a login packet.

The log analysis server can classify login packets by source IP through analysis of multiple login packets, and determine the attack type of the source IP according to the number of destination IPs that the classified source IP attempts to log in to, single attack IP or multiple attacks. It can be classified by IP. In this case, the number of destination IPs, which is a criterion for the log analysis server to classify the attack type of the source IP, may vary depending on the setting of the operator of the harmful IP determination system.

The harmful score increasing step S300 may be a step in which the log analysis server analyzes a log-in packet corresponding to the classified source IP to increase a harmful score for the source IP. In this case, the log analysis server may increase the score based on different criteria according to the attack type in which the source IP is classified. A more detailed description of the process of increasing the harmful score in the step S300 of increasing the harmful score will be described later.

The harmful IP detection step S400 may refer to a step of detecting a harmful IP from an increased harmful score for each source IP.

3A and 3B are flow charts for explaining in more detail the step of increasing the harmful score in the embodiment of FIG. 2. 4A and 4B are other flow charts for explaining in more detail the step of increasing the harmful score in the embodiment of FIG. 2.

3A and 3B are for explaining a case in which an arbitrary source IP is classified as a plurality of attack IPs through the attack type classification step S200. On the other hand, FIGS. 4A and 4B are for explaining a case in which an arbitrary source IP is classified as a single attack IP through the attack type classification step S200.

The case classified as multiple attack IPs through FIGS. 3A and 3B will be described in more detail as follows.

When the attack type of the source IP is classified as multiple attack IPs through the previous step (S301), the log analysis server may increase a predetermined harmful score for the corresponding source IP (S302). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, the number of destination IPs attempted to access from one source IP is often one or two. Therefore, when an attempt is made to access a plurality of destination IPs, it is possible to increase the harmful score by classifying it as an unusual login attempt.

Thereafter, the log analysis server may determine the number of countries to which login failure has responded (S303). Here, the number of countries as a criterion for determination may be set by the operator of the harmful IP determination system. In more detail, the log analysis server classifies the destination IP by country, and when the number of countries of the destination IP to which a random source IP attempts to log in is greater than or equal to a predetermined value, it may increase the harmful score for the corresponding source IP (S304). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In a normal case, since there is only one country to which a user who attempts to log in accesses, an act of attempting to log in to more than one country may be classified as an uncommon log in attempt, thereby increasing the harmful score.

Thereafter, the log analysis server may determine whether a login attempt is made with a predetermined ID (S305). Here, a predetermined ID as a criterion for determination may be set by an operator of the harmful IP determination system. For example, a harmful score may be increased for a source IP attempting to log in with an ID such as "Guest" (S306). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. An ID such as "Guest" is used as a default account in most systems, and is an ID set to be inaccessible in most operating systems. The log analysis server can increase the harmful score by classifying it as an unusual login attempt when accessing using such an ID.

Thereafter, the log analysis server may determine the length of the login attempt duration (S307). Here, the login attempt duration, which is the criterion for determination, may be set by the operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the duration of attempting to log in is greater than or equal to a predetermined time based on one source IP. If the source IP continuously repeats the login attempt for a predetermined time or longer, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S308). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In a typical case, if the login fails, the time for continuing the login attempt through retry is temporarily ended, and thus, if the login attempt is repeated for a predetermined time or longer, it is classified as an unusual login attempt and the harmful score can be increased.

Thereafter, the log analysis server may determine the number of source ports used by the source IP (S309). Here, the number of source ports serving as a criterion for determination may be set by an operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the number of source ports used when the source IP attempts to log in to the destination IP is greater than or equal to a predetermined value. If the number of source ports used by the source IP for login attempts is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S310). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, since the number of source ports used for login attempts is only one, communicating with a specific destination port from multiple source ports creates multiple sessions, which can be classified as unusual login attempts, which will increase the harmful score. I can.

Thereafter, the log analysis server may determine the number of attempts to access the source IP within a predetermined time (S311). Here, the time and the number of access attempts as the determination criteria may be set by the operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the number of times the source IP repeats log-in for log-in success is equal to or greater than a predetermined value. If the number of attempts to access the source IP within a predetermined time is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S312). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In a normal case, when accessing the destination IP, the session is terminated if the attempt to log in by input of the ID and password continues. In order to create a new session, it is necessary to retry with a different source port than the first time, and such attempts can be classified as unusual login attempts and may increase the harmful score.

Thereafter, the log analysis server may determine the number of IDs and passwords that the source IP uses for login attempts (S313). Here, the number of IDs and passwords that are criteria for determination may be set by an operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the type of ID/password used by the source IP to log in attempt is greater than or equal to a predetermined value. If the type of the ID/password used for the log-in attempt of the source IP is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S314). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, a login attempt is made with a unique ID/password, but when a login attempt using a widely used ID/password indiscriminately is classified as an unusual login attempt, a harmful score can be increased.

Thereafter, the log analysis server may determine whether the destination IP to which the source IP wants to log in is assigned a Dynamic Host Configuration Protocol (DHCP) IP (S315). In more detail, the log analysis server may determine whether the destination IP to which the source IP is to log in is a destination IP classified as a dynamic IP such as DHCP. If the destination IP has been assigned a DHCP IP, it is possible to increase the harmful score by classifying the source IP to access the corresponding destination IP as a harmful IP (S316). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, it is rare to access a terminal using a domestic DHCP IP from overseas, and if the number is more than two, it is classified as an unusual login attempt and the harmful score can be increased.

Thereafter, the analysis step for the login packet is terminated (S317), so that harmful scores may be synthesized for each source IP classified as multiple attack IPs. Through the steps (S302, S304, S306, S308, S310, S312, S314, S316) of increasing the harmful score, the harmful score that is increased for the source IP may be accumulated. In addition, the harmful score that is increased through the steps (S302, S304, S306, S308, S310, S312, S314, S316) in which the harmful score is increased is how effective the condition corresponding to each step is to determine the harmful IP. It can be set the same or differently depending on the location.

The case classified as a single attack IP through FIGS. 4A and 4B will be described in more detail as follows.

When the attack type of the source IP is classified as a single attack IP through the previous step (S320), the log analysis server may increase the harmful score in the following manner.

The log analysis server may determine the number of IDs and passwords that the source IP uses for login attempts (S321). Here, the number of IDs and passwords that are criteria for determination may be set by an operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the type of ID/password used by the source IP to log in attempt is greater than or equal to a predetermined value. If the type of the ID/password used for the log-in attempt of the source IP is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S322). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, a login attempt is made with a unique ID/password, but when a login attempt using a widely used ID/password indiscriminately is classified as an unusual login attempt, a harmful score can be increased.

When the harmful score for the source IP is increased through the harmful score increasing step (S322), the log analysis server may determine the length of a single login attempt time of the source IP (S323). Here, the length of the single login attempt time that is the criterion for determination may be set by the operator of the harmful IP determination system. In more detail, the log analysis server determines the length of time that the source IP attempts to log in once to the destination IP, and if the time exceeds a predetermined value, it may increase the harmful score for the source IP ( S324). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. The step of determining the length of the single login attempt (S323) may be performed to increase the spying rate of determining a harmful IP by combining a condition for detecting a general brute force attack with other conditions.

When the harmful score for the source IP is increased through the harmful score increasing step (S324), the log analysis server may determine the number of source ports used by the source IP (S325). Here, the number of source ports serving as a criterion for determination may be set by an operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the number of source ports used when the source IP attempts to log in to the destination IP is greater than or equal to a predetermined value. If the number of source ports used by the source IP for login attempts is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S326). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In general, since the number of source ports used for login attempts is only one, communicating with a specific destination port from multiple source ports creates multiple sessions, which can be classified as unusual login attempts, which will increase the harmful score. I can.

Thereafter, the log analysis server may determine the number of attempts to access the source IP within a predetermined time (S327). Here, the time and the number of access attempts as the determination criteria may be set by the operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the number of times the source IP repeats log-in for log-in success is equal to or greater than a predetermined value. If the number of attempts to access the source IP within a predetermined time is greater than or equal to a predetermined value, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S328). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In a normal case, when accessing the destination IP, the session is terminated if the attempt to log in by input of the ID and password continues. In order to create a new session, it is necessary to try again with a different source port than the first time, and these attempts can be classified as unusual login attempts and may increase the harmful score.

Thereafter, the log analysis server may determine the length of the login attempt duration (S329). Here, the login attempt duration, which is the criterion for determination, may be set by the operator of the harmful IP determination system. In more detail, the log analysis server may determine whether the duration of attempting to log in based on one source IP is greater than or equal to a predetermined time. If the source IP continuously repeats login attempts for a predetermined time or longer, the corresponding source IP may be classified as a harmful IP and a harmful score may be increased (S330). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. In a typical case, if the login fails, the time for continuing the login attempt through retry is temporarily ended, and thus, if the login attempt is repeated for a predetermined time or longer, it is classified as an unusual login attempt and the harmful score can be increased.

Thereafter, the log analysis server may determine the country to which the source IP belongs (S331). In more detail, the log analysis server may determine whether the IP address is a domestic IP address by checking which country the address of the source IP is assigned to. If the source IP is an overseas IP, the harmful score may be increased by classifying the source IP as a harmful IP (S332). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system. If an attempt is made to log in from overseas, it can be classified as an unusual login attempt and thus increase the harmful score.

Thereafter, the analysis step for the login packet may be terminated (S335).

Among the above steps, in the step (S321) of determining the number of IDs and passwords used by the source IP for login attempts, the number of IDs and passwords used for the login attempts is less than a predetermined value, or the time of a single login time of the source IP If it is determined that the single login attempt time is greater than or equal to the predetermined time in the determining step (S323), the log analysis server may determine the number of login failures from the source IP to a specific destination IP (S333).

Here, the number of failures as a reference may be set by an operator of the harmful IP determination system. In more detail, the log analysis server may determine whether a login failure from one source IP to a specific destination IP is greater than or equal to a predetermined value. If the log-in failure from one source IP to a specific destination IP exceeds a predetermined value, the corresponding source IP may be classified as a harmful IP, and a harmful score may be increased (S334). In this case, the increased harmful score may vary according to the setting of the operator of the harmful IP determination system.

If the harmful score of the source IP is increased through the harmful score increasing step (S334), determining the number of source ports used by the source IP (S325) may be performed. On the other hand, when the number of login failures is less than a predetermined value, the corresponding source IP is deemed to be harmless and analysis of the login packet may be terminated (S335).

When the log-in packet analysis is finished, harmful scores can be aggregated for each source IP classified as a single attack IP. Through the steps (S322, S324, S326, S328, S330, S332, S334) of increasing the harmful score, the increased harmful score for the source IP may be accumulated. In addition, the harmful score increased through the steps (S322, S324, S326, S328, S330, S332, S334) in which the harmful score is increased depends on how effective the condition corresponding to each step is to determine the harmful IP. They can be set the same or different.

5 is a diagram for illustrating classification of a grade for harmful IP with an increased score according to an embodiment of the present invention.

Referring to FIG. 5, it can be seen that a criterion for dividing a harmful grade of a corresponding source IP according to an accumulated harmful score for an arbitrary source IP is illustrated. A harmful score may be assigned to each source IP by performing the harmful score increasing step S300 performed through FIGS. 2 to 4.

As a result, if the adverse score of the source IP is 0, the grade is "normal", if the negative score is 1 to 3, the grade is "low", if the grade is 4 to 6, the grade is "slightly low", If it is, it can be classified into a "a little high" grade, and if it is 14-15, it can be classified into a "high" grade. FIG. 5 is an exemplary description, and the level of harmfulness may be changed according to an environment for determining a harmful IP or an operator setting a system for determining a harmful IP.

The log analysis server may classify source IPs of a predetermined level or higher as harmful IPs through a harmful class assigned to each source IP. For source IPs classified as harmful IPs, the log analysis server can store related information or notify the operator or user of the harmful IP system.

In the above, embodiments of the present invention have been described with reference to the accompanying drawings, but those of ordinary skill in the art to which the present invention pertains can be implemented in other specific forms without changing the technical spirit or essential features. You can understand that there is. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not limiting.

10: harmful IP determination system 20: domestic terminal
30: overseas terminal 100: security equipment
200: log analysis server

Claims (7)

Collecting login packets;
Analyzing the login packet and classifying each source IP into a single attack IP or multiple attack IPs according to the number of destination IPs attempted to access from the source IP (Internet Protocol);
Analyzing a login packet corresponding to the classified source IP to increase a harmful score for the source IP; And
Detecting a harmful IP from the increased harmful score for each source IP; Harmful IP determination method comprising a. The method of claim 1, wherein the login packet
A method for determining harmful IP, characterized in that the packet is transmitted from a security device collecting packets on a communication path and includes a phrase corresponding to a login failure. The method of claim 1, wherein increasing the score comprises:
And increasing a score based on a different criterion according to an attack type in which the source IP is classified. The method of claim 3, wherein increasing the adverse score
If the source IP is classified as multiple attack IPs,
Increasing a harmful score based on the number of countries that have responded to a login failure for the source IP;
Increasing a harmful score according to whether the source IP attempts to log in with a predetermined ID;
Increasing the harmful score according to the length of the login attempt duration of the source IP;
Increasing a harmful score according to the number of source ports used by the source IP;
Increasing a harmful score according to the number of access attempts of the source IP within a predetermined time;
Increasing a harmful score according to the number of IDs and passwords used by the source IP for login attempts; And
Increasing a harmful score according to whether a destination IP to which the source IP wants to log in is assigned a Dynamic Host Configuration Protocol (DHCP) IP; The harmful IP determination method, characterized in that increasing the harmful score for the source IP according to at least one step of. The method of claim 3, wherein increasing the adverse score
If the source IP is classified as a single attack IP,
Increasing a harmful score according to the number of IDs and passwords used by the source IP for login attempts;
Increasing a harmful score according to whether the length of a single login attempt time of the source IP is less than a predetermined time;
Increasing the score according to the number of source ports used by the source IP;
Increasing a harmful score according to the number of access attempts of the source IP within a predetermined time;
Increasing the harmful score according to the length of the login attempt duration of the source IP; And
Increasing the harmful score according to the country of the source IP attempting to log in; The harmful IP determination method, characterized in that increasing the harmful score for the source IP according to at least one step of. The method of claim 5, wherein increasing the adverse score
Increasing a harmful score according to the number of failed logins from the source IP to a specific destination IP; Harmful IP determination method, characterized in that it further comprises. The method of claim 6, wherein the step of increasing the harmful score according to the number of failed logins from the source IP to a specific destination IP
In the step of increasing the harmful score according to the number of IDs and passwords used for the login attempt, the number of IDs and passwords used for the login attempt is less than or equal to a predetermined value.
And in the step of increasing the harmful score according to whether the length of the single login attempt time is less than a predetermined time, and is performed when it is determined that the single login attempt time is greater than the predetermined time.

Images