KR20230094607A - Method and apparatus for protecting device - Google Patents

Abstract

A device protection method according to an embodiment of the present invention includes the steps of receiving threat information based on standard specifications (STIX) from an external domain, extracting IoT infection information based on the threat information, and infecting the IoT robot. The method may include determining an isolation device group to be isolated within the management domain based on the information, and distributing a blocking policy for blocking network access to the isolation device group.

Description

Device protection method and apparatus {METHOD AND APPARATUS FOR PROTECTING DEVICE}

The present invention relates to a device protection method, and more particularly, to a device protection method and apparatus for protecting a device from being infected with a malicious code.

With the recent development of IoT-based services and the increase in the size of IoT devices, Distributed Denial of Service (DDoS) attacks that cause service failures are increasing in the IoT environment.

IoT devices with ultra-light/low-power/low-performance features are not equipped with security functions or security threats are generated due to unmanaged mass devices such as firmware updates to improve vulnerabilities.

In particular, since a large number of devices are composed of various networks, the IoT malware that causes DDoS attacks can spread rapidly, and the damage can be serious.

Technologies for defending against DDoS attacks include technologies for defending against DDoS attacks themselves and technologies for defending robots that cause DDoS attacks. In particular, the technology for defending IoT is effective in that it can reduce the possibility of an attack by responding to the cause of a DDoS attack.

However, in the related art, the proliferation of security threats is prevented by relying on security threats occurring in the management domain. However, if the security threats do not occur in the management domain, it is impossible to respond to the security threats.

Korean Patent Publication No. 10-2020-0108742 (published on September 21, 2020) Korean Patent Publication No. 10-2020-0113836 (published on October 7, 2020)

An object of the present invention is to provide a device protection method and apparatus for preventing the proliferation of IoT security threats that cause DDoS attacks in advance.

To achieve the above object, a device protection method according to an embodiment of the present invention includes receiving threat information based on standard specifications (STIX) from an external domain, and extracting IoT infection information based on the threat information. The method may include determining an isolation device group to be isolated within a management domain based on the IoT infection information, and distributing a blocking policy for blocking network access to the isolation device group.

The extracting of the IoT infection information may include identifying IoT threat information based on the threat information, and extracting attribute information of an infected device based on the IoT threat information.

The identifying of the IoT threat information may include checking whether the object type of the threat information is 'infrastructure', and if the object type of the threat information is 'infrastructure', the type of threat information represented by the 'infrastructure' object. It may include checking whether the 'botnet' is a 'botnet', and setting a threat information check flag if the type of threat information represented by the 'infrastructure' object is 'botnet'.

The identifying the object robot threat information may include checking whether the object type of the threat information is 'relationship', and if the object type of the threat information is 'relationship', the type of threat information represented by the 'relationship' object. It may include checking whether the 'relationship' object is 'consist-of', and if the type of threat information expressed by the 'relationship' object is 'consist-of', setting a device infection check flag.

The identifying the IoT threat information may include checking whether an object to be checked subsequently is an 'ipv4-addr' object type when the threat information check flag and the device infection check flag are set.

In the step of extracting the attribute information of the infected device, if the two flags are set and the object to be checked subsequently is an 'ipv4-addr' object type, the attribute information of the infected device may be extracted.

The infected device attribute information may include at least one of a device type, a device manufacturer, a device product name, and a device operating system version.

Determining an isolated device group to be isolated in the management domain based on the IoT infection information may include calculating a cosine similarity between the attribute information of the infected device and the attribute information of the device in the management domain; It may include determining an isolation device group to be isolated within the management domain in consideration of.

In addition, the device protection apparatus according to the embodiment includes a threat information receiving unit receiving standard specification (STIX)-based threat information from an external domain, an infection information extracting unit extracting IoT infection information based on the threat information, and the It may include an isolation device group determination unit that determines an isolation device group to be isolated within the management domain based on the IoT infection information, and a policy distribution unit that distributes a blocking policy for blocking network access of the isolation device group.

The infection information extraction unit may include a threat information identification unit that identifies IoT threat information based on the threat information, and an attribute information extraction unit that extracts attribute information of an infected device based on the IoT threat information.

The threat information identification unit checks whether the object type of the threat information is 'infrastructure', and if the object type of the threat information is 'infrastructure', checks whether the type of threat information represented by the 'infrastructure' object is 'botnet' , If the type of threat information represented by the 'infrastructure' object is 'botnet', a threat information check flag can be set.

The threat information identification unit checks whether the object type of the threat information is 'relationship', and if the object type of the threat information is 'relationship', whether the threat information type represented by the 'relationship' object is 'consist-of'. If the type of threat information expressed by the 'relationship' object is 'consist-of', a flag for checking whether the device is infected can be set.

The threat information identification unit may determine whether an object to be checked subsequently is an 'ipv4-addr' object type when the threat information check flag and the device infection check flag are set.

The attribute information extraction unit may extract attribute information of the infected device if the two flags are set and the object to be checked subsequently is an 'ipv4-addr' object type.

The infected device attribute information may include at least one of a device type, a device manufacturer, a device product name, and a device operating system version.

The isolation device group determiner may calculate a cosine similarity between attribute information of the infected device and attribute information of a device in the management domain, and determine an isolation device group to be isolated in the management domain in consideration of the cosine similarity.

The present invention can prevent the spread of IoT threat information by sharing IoT infection information detected from the outside.

In addition, the present invention has an effect capable of responding in advance to a device group having a high risk of infection.

1 is an operational flowchart illustrating a device protection method according to an embodiment of the present invention.
2 is a diagram in which one of the SCO objects is expanded to explain the threat information structure in the present invention.
3 is an operation flowchart illustrating a step of extracting IoT infection information according to an embodiment of the present invention.
4 and 5 are views for explaining a method of extracting IoT threat information from arbitrary threat information and information for device protection.
6 is an operation flowchart illustrating detailed steps of extracting IoT infection information according to an embodiment of the present invention.
7 is a block diagram illustrating a device protection apparatus according to an embodiment of the present invention.
8 is a block diagram showing the configuration of a computer system according to an embodiment of the present invention.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Although "first" or "second" is used to describe various elements, these elements are not limited by the above terms. Such terms may only be used to distinguish one component from another. Therefore, the first component mentioned below may also be the second component within the technical spirit of the present invention.

Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used herein, "comprises" or "comprising" implies that a stated component or step does not preclude the presence or addition of one or more other components or steps.

Unless otherwise defined, all terms used herein may be interpreted as meanings commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when describing with reference to the drawings, the same or corresponding components are given the same reference numerals, and overlapping descriptions thereof will be omitted. .

1 is an operational flowchart illustrating a device protection method according to an embodiment of the present invention.

Referring to FIG. 1 , a device protection method according to an embodiment of the present invention includes receiving threat information (S100), extracting IoT infection information based on the threat information (S200), and IoT infection information. It may include determining an isolation device group based on the information (S300) and distributing a blocking policy for blocking network access of the isolation device group (S400). Here, the device protection method may be performed in the device protection apparatus 100 of FIG. 7 to be described later.

In step S100, the device protection apparatus 100 may receive threat information from an external domain. Threat information may be shared between domains equipped with a sharing system, and the device protection apparatus 100 may receive all detected threat information. Threat information can be based on the threat information sharing system defined in STIX v2.1, a standard specification. In STIX 2.1, threat information is composed of objects defined as STIX Domain Objects (SDO), STIX Relationship Objects (SRO), and STIX Cyber-observable Objects (SCO). SDO is an object that expresses threat information such as attack patterns, malicious actions and activities, observation information, malicious code information, and threat subjects related to threat behavior to understand threats. It is an object for expressing related host and network-based observed information, and SRO is an object for expressing SDOs, SCOs, or the relationship between SDOs and SCOs.

2 is a diagram in which one of the SCO objects is expanded to explain the threat information structure in the present invention.

To share IoT threat information proposed in the present invention, 'IPv4 Address' and 'IPv6 Address' objects (10) are extended among SCO objects defined as 18 objects such as Directory, Domain Name, Email Address, and File. 'IPv4 Address' and 'IPv6 Address' objects (10) consist of 'type' (11), 'id' (11), 'value' (12) and 'extension' (14) attribute fields, and 'extension' (14) The attribute field can be extended by adding a 'dev_pops' field (F1) expressing device attribute information. The device attribute information 15 may include, but is not limited to, a device type (dev_type), a device manufacturer (vendor), a device product name (product), and a device operating system version (os_ver).

In the embodiment, device attribute information is defined in the threat information, so that potentially infected devices within the management domain can be effectively found with respect to the IoT infection information.

In step S200, the device protection apparatus 100 may extract IoT infection information based on the threat information.

FIG. 3 is an operation flowchart illustrating a step of extracting IoT infection information according to an embodiment of the present invention, and FIGS. 4 and 5 are methods of extracting IoT threat information and device protection information from arbitrary threat information. It is a drawing for explaining.

Referring to FIG. 3 , first, the device protection apparatus 100 may perform step S210 of identifying IoT threat information based on the threat information. The device protection apparatus 100 may identify IoT threat information by using the object type of the threat information (S210).

4 shows an example of IoT threat information composed of malicious code identification information and infected host information, and FIG. 5 shows an example of IoT threat information composed of an infected host, a control and command server, and an attack target.

As shown in FIGS. 4 and 5 , hosts H that have become IoT robots have common characteristics. That is, the 'infrastructure' SDO is connected to the 'IPv4 Address' type SCO using the 'consist-of' type SRO. Here, when the 'infrastructure' SDO expresses IoT threat information, it has 'botnet' as a type value. In addition, the 'IPv4 Address' SCO can be composed of the 'IPv6 Address' SCO, and the 'IPv4 Address' SCO and the 'IPv6 Address' SCO differ only in the address type.

Accordingly, the device protection apparatus 100 may identify the IoT threat information by using the object types that are characteristics of the IoT threat information.

The device protection apparatus 100 may extract attribute information of an infected device based on the identified IoT threat information (S220).

The step of extracting IoT infection information based on the threat information (S200) will be described in more detail below.

6 is an operation flowchart illustrating detailed steps of extracting IoT infection information according to an embodiment of the present invention.

First, the device protection apparatus 100 may check whether the object type of the threat information is 'infrastructure' (S211). If the object type of the threat information is 'infrastructure', it can be checked whether the threat information type represented by the 'infrastructure' object is 'botnet', which means an IoT robot (S212).

If the threat information type represented by the 'infrastructure' object is 'botnet', the object may set a threat information check flag to mean information related to the IoT (S213). After setting the threat information check flag, the next object can be checked (S240).

Subsequently, since the infected device is connected to the 'infrastructure' object and the 'consist-of' type 'relationship' object, it can be confirmed whether the object type is 'relationship' (S214).

If the object type is 'relationship', it can be checked whether the threat information type represented by the 'relationship' object is 'consist-of' (S215). If the threat information type expressed by the 'relationship' object is 'consist-of', a device-infected check flag may be set to mean information related to the device (S216). After setting the device infection check flag, the next object can be checked (S240).

When the setting of the threat information check flag and the device infection check flag is completed, the device protection apparatus 100 checks the infected device (S217) and can check whether it is an 'ipv4-addr' object meaning infected device information (S217). S218).

Subsequently, if the identified object type is an 'ipv4-addr' object, a process of extracting attribute information of the infected device may be performed (S220). Attribute information of an infected device may include device type, device manufacturer, device product name, and device operating system version, but the type is not limited.

When the above process is completed, sharing of the attribute information of the infected device can be completed.

Returning to FIG. 1 , in step S300, the device protection apparatus 100 may determine an isolation device group to be isolated within the management domain based on the attribute information of the infected device (S300).

The device protection apparatus 100 may calculate a cosine similarity between attribute information of an infected device and attribute information of a device in the management domain. The device protection apparatus 100 may determine an isolation device group to be isolated within the management domain by considering the cosine similarity.

The device protection apparatus 100 calculates a feature vector of each attribute information of the infected device groups and a feature vector of each attribute information of the isolated device groups, and calculates a feature vector of each attribute information of the infected device groups and the isolated device group. A cosine similarity may be calculated using a cosine value of an angle between feature vectors of each attribute information of .

Characteristics of device attribute information are mostly text information, so it must be converted into a number format and processed. Therefore, word tokens are extracted from features using the TF-IDF (Term Frequency-Inverse Document Frequency) algorithm, which is mainly used when obtaining similarity between documents or extracting key words from documents, and finding the relative frequency of occurrence of words to find the characteristics Vectors can be created.

The cosine similarity may be expressed as a value of 0 or more and 1 or less, and the higher the value, the more similar it is. For example, when the angle between the two vectors is 0 degrees, the cosine value is 1, and the cosine values of all other angles may be less than 1. Therefore, if the cosine similarity value is 1, it can be determined that the direction of the feature vector of the infected device and the feature vector of the isolated device are the same.

The device protection apparatus 100 may set a reference value in consideration of the cosine similarity, and select an isolation device depending on whether the reference value is greater than or less than the reference value.

In operation S400 , the device protection apparatus 100 may distribute a blocking policy for blocking network access to an isolation device group or an isolation device requiring isolation.

7 is a block diagram illustrating a device protection apparatus according to an embodiment of the present invention.

Referring to FIG. 7 , the device protection apparatus 100 performing a device protection operation according to an embodiment of the present invention includes a threat information receiver 110, an infection information extractor 120, and an isolation device group determiner ( 130) and a policy distribution unit 140.

The threat information receiving unit 110 may receive standard specification (STIX)-based threat information from an external domain.

The infection information extraction unit 120 may extract IoT infection information based on the threat information. The infection information extraction unit 120 may include a threat information identification unit 121 and an attribute information extraction unit 123 .

The threat information identification unit 121 may identify IoT threat information based on the threat information. The attribute information extractor 123 may extract attribute information of an infected device based on IoT threat information.

In more detail, the threat information identification unit 121 checks whether the object type of the threat information is 'infrastructure', and if the object type of the threat information is 'infrastructure', the threat information type represented by the 'infrastructure' object is 'botnet'. ', and if the type of threat information represented by the 'infrastructure' object is 'botnet', the threat information check flag can be set.

The threat information identification unit 121 checks whether the object type of the threat information is 'relationship', and if the object type of the threat information is 'relationship', whether the threat information type represented by the 'relationship' object is 'consist-of'. If the type of threat information expressed by the 'relationship' object is 'consist-of', the device infection check flag can be set.

When the threat information identification unit 121 sets the threat information check flag and the device infection check flag, it may check whether the object to be checked is of the 'ipv4-addr' object type.

The attribute information extraction unit 123 may extract attribute information of the infected device if the object to be checked after the two flags are set is the 'ipv4-addr' object type. Here, the infected device attribute information may include at least one of device type, device manufacturer, device product name, and device operating system version.

The isolation device group determining unit 130 may determine an isolation device group to be isolated within the management domain based on the IoT infection information.

The isolation device group determining unit 130 may calculate a cosine similarity between attribute information of an infected device and attribute information of a device in the management domain, and determine an isolation device group to be isolated in the management domain by considering the cosine similarity.

The policy distribution unit 140 may distribute a blocking policy for blocking network access of the isolated device group.

8 is a block diagram showing the configuration of a computer system according to an embodiment of the present invention.

The device protection apparatus according to the embodiment may be implemented in the computer system 1000 such as a computer readable recording medium.

Referring to FIG. 9, a computer system 1000 according to an embodiment includes one or more processors 1010, a memory 1030, a user interface input device 1040, and a user interface output device communicating with each other through a bus 1020 ( 1050) and storage 1060. In addition, the computer system 1000 may further include a network interface 1070 connected to a network.

The processor 1010 may be a central processing unit or a semiconductor device that executes programs or processing instructions stored in memory or storage. The memory 1030 and the storage 1060 may be storage media including at least one of volatile media, nonvolatile media, removable media, non-removable media, communication media, and information delivery media. For example, memory 1030 may include ROM 1031 or RAM 1032 .

According to an embodiment, as a computer-readable recording medium storing a computer program, an operation of receiving standard specification (STIX)-based threat information from an external domain and an operation of extracting IoT infection information based on the threat information , determining an isolation device group to be isolated in the management domain based on the IoT infection information, and distributing a blocking policy for blocking network access to the isolation device group Can contain commands.

According to an embodiment, as a computer program stored on a computer-readable recording medium, an operation of receiving standard specification (STIX)-based threat information from an external domain and an operation of extracting IoT infection information based on the threat information , determining an isolation device group to be isolated in the management domain based on the IoT infection information, and distributing a blocking policy for blocking network access to the isolation device group Can contain commands.

The specific implementations described herein are examples and do not limit the scope of the present invention in any way. For brevity of the specification, description of conventional electronic components, control systems, software, and other functional aspects of the systems may be omitted. In addition, the connection of lines or connecting members between the components shown in the drawings are examples of functional connections and / or physical or circuit connections, which can be replaced in actual devices or additional various functional connections, physical connection, or circuit connections. In addition, if there is no specific reference such as "essential" or "important", it may not be a necessary component for the application of the present invention.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments and should not be determined, and all scopes equivalent to or equivalently changed from the claims as well as the claims to be described later are within the scope of the spirit of the present invention. will be said to belong to

100: device protection device
110: threat information receiver
120: infection information extraction unit
130: isolation device group determining unit
140: policy distribution unit

Claims (16)

Receiving standard specification (STIX) based threat information from an external domain;
extracting IoT infection information based on the threat information;
determining an isolation device group to be isolated within a management domain based on the IoT infection information; and
distributing a blocking policy for blocking network access to the isolated device group;
Device protection method comprising a. The method of claim 1,
In the step of extracting the IoT infection information,
identifying IoT threat information based on the threat information; and
extracting attribute information of an infected device based on the IoT threat information;
Device protection method comprising a. The method of claim 2,
In the step of identifying the IoT threat information,
checking whether the object type of the threat information is 'infrastructure';
If the object type of the threat information is 'infrastructure', checking whether the type of threat information represented by the 'infrastructure' object is 'botnet'; and
setting a threat information check flag if the type of threat information represented by the 'infrastructure' object is 'botnet';
Device protection method comprising a. The method of claim 3,
In the step of identifying the IoT threat information,
checking whether the object type of the threat information is 'relationship';
if the object type of the threat information is 'relationship', checking whether the type of threat information represented by the 'relationship' object is 'consist-of'; and
setting a device infection check flag if the type of threat information represented by the 'relationship' object is 'consist-of';
Device protection method comprising a. The method of claim 4,
In the step of identifying the IoT threat information,
if the threat information check flag and the device infection check flag are set, checking whether an object to be checked subsequently is an 'ipv4-addr' object type;
Device protection method comprising a. According to claim 5,
The step of extracting the attribute information of the infected device,
If the two flags are set and the object to be checked subsequently is an 'ipv4-addr' object type, extracting attribute information of the infected device. The method of claim 2,
The infected device attribute information includes at least one or more of a device type, a device manufacturer, a device product name, and a device operating system version. The method of claim 2,
Determining an isolation device group to be isolated within a management domain based on the IoT infection information includes:
calculating a cosine similarity between attribute information of the infected device and attribute information of devices in the management domain; and
determining an isolation device group to be isolated within a management domain by considering the cosine similarity;
Device protection method comprising a. a threat information receiving unit that receives threat information based on standard specifications (STIX) from an external domain;
an infection information extraction unit extracting IoT infection information based on the threat information;
an isolation device group determination unit determining an isolation device group to be isolated within a management domain based on the IoT infection information; and
a policy distribution unit distributing a blocking policy for blocking network access of the isolation device group;
Device protection device comprising a. According to claim 9,
The infection information extraction unit,
a threat information identification unit that identifies IoT threat information based on the threat information; and
an attribute information extraction unit extracting attribute information of an infected device based on the IoT threat information;
Device protection device comprising a. The method of claim 10,
The threat information identification unit,
It is checked whether the object type of the threat information is 'infrastructure', and if the object type of the threat information is 'infrastructure', it is checked whether the type of threat information represented by the 'infrastructure' object is 'botnet', and the 'infrastructure' object If the type of threat information expressed by 'botnet' is 'botnet', a device protection device that sets a threat information check flag. The method of claim 11,
The threat information identification unit,
It is checked whether the object type of the threat information is 'relationship', and if the object type of the threat information is 'relationship', it is checked whether the type of threat information represented by the 'relationship' object is 'consist-of', and the 'relationship'' If the type of threat information expressed by the object is 'consist-of', a device protection device that sets a flag to check if the device is infected. The method of claim 12,
The threat information identification unit,
If the threat information check flag and the device infection check flag are set, the device protection device checks whether an object to be checked subsequently is an 'ipv4-addr' object type. According to claim 13,
The attribute information extraction unit,
If the two flags are set and the object to be checked subsequently is an 'ipv4-addr' object type, the device protection device extracts attribute information of the infected device. The method of claim 10,
The device protection apparatus of claim 1, wherein the infected device attribute information includes at least one of a device type, a device manufacturer, a device product name, and a device operating system version. The method of claim 10,
The isolation device group determination unit,
The device protection device for calculating a cosine similarity between the attribute information of the infected device and the attribute information of a device in the management domain, and determining an isolation device group to be isolated in the management domain in consideration of the cosine similarity.

Images