KR20230097350A - Security system and method through network traffic analysis - Google Patents

Abstract

A security system and method through network traffic analysis are disclosed. A security method through network traffic analysis according to an embodiment of the present invention includes the steps of detecting an information leakage attempt in a security inspection engine by a security system through network traffic analysis, and the security system through network traffic analysis detecting false positives of an information leakage attempt. Alternatively, the method may include selecting metadata for determining whether there is excessive detection, and determining whether the detected content is false positive or excessive positive through the selected metadata by the security system through the network traffic analysis.

Description

Security system and method through network traffic analysis

The present invention relates to a security system and method through network traffic analysis, and more particularly, in order to reduce false positives and/or excessive positives in a security inspection that identifies threats according to a specific pattern (signature) in network traffic, accumulated It is about a technical idea that makes it possible to utilize the results of correlation analysis of protocol metadata.

Protocol metadata refers to identifiable field values such as protocol headers used by network packets, and values are extracted from all network traffic to perform DB storage and correlation analysis.

Meanwhile, a security inspection is performed to identify whether or not there is a threat according to a specific pattern (signature) in network traffic. This security inspection inspects all network traffic based on a signature.

These security checks basically use a pattern-based detection method, but special attention is required because false positives and/or excessive positives can always exist.

Therefore, in order to reduce such false positives and/or over-positives in security inspection, a technical idea that can utilize the result of correlation analysis of accumulated protocol metadata is required.

Patent Document 1. Korea Registered Patent (Registration No. 10-1502490, "Subscriber terminal and security monitoring node monitoring network traffic")

The problem to be solved by the present invention is to reduce false positives and / or excessive positives in a security inspection that identifies threats according to specific patterns (signatures) in network traffic, to utilize the results of correlation analysis of accumulated protocol metadata It is to provide a technical idea to

A security method through network traffic analysis according to an embodiment of the present invention for solving the above technical problem includes the step of detecting an information leakage attempt in a security inspection engine by a security system through network traffic analysis, security through network traffic analysis The system selects metadata for determining whether an information leakage attempt is false positive or excessive positive, and the security system through the network traffic analysis determines whether the detected content is false positive or excessive positive through the selected metadata. .

According to an embodiment of the present invention, by utilizing the correlation analysis result of the accumulated protocol metadata, there is an effect of reducing false positives and/or excessive positives in a security check.

In order to more fully understand the drawings cited in the detailed description of the present invention, a brief description of each drawing is provided.
1 shows detection of an information leakage attempt by a security system through network traffic analysis according to an embodiment of the present invention.
2 shows network scanning attempt detection by a security system through network traffic analysis according to an embodiment of the present invention.

Since the present invention can apply various transformations and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, it should be understood that this is not intended to limit the present invention to specific embodiments, and includes all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the present invention, if it is determined that a detailed description of related known technologies may obscure the gist of the present invention, the detailed description will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are only used for the purpose of distinguishing one component from another.

Terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, terms such as "include" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other It should be understood that the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof is not precluded.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings, focusing on embodiments of the present invention. Like reference numerals in each figure indicate like members.

A security system and method through network traffic analysis according to the technical idea of the present invention are as shown in FIGS. 1 and 2 .

1 shows detection of an information leakage attempt by a security system through network traffic analysis according to an embodiment of the present invention.

Referring to FIG. 1, there may be cases where the information leakage attempt of the security inspection engine is suspected. (Attempted Information Leak, IP A (internal IP) → IP X (external IP, attacker))

In order to determine whether an information leakage attempt is false positive and/or excessive positive, the security system through network traffic analysis may select metadata.

If outbound traffic from an internal IP to an external IP or the external IP needs to continuously access information located on the internal network from the outside due to telecommuting, etc., the message may occur, but it may not be a real threat.

If a new external IP that has no connection with an internal IP accesses information located on the internal network, it can be determined as a real threat.

Accordingly, metadata may be utilized to check the frequency of an external IP communicating with IP A and to check the appearance frequency of the detected IP (IP X).

A security system through network traffic analysis can determine false positives and/or excessive positives through metadata.

For example, IP X, which is an IP detected from an external IP that communicated with IP A, may have attempted to leak the information only once as a result of frequency check, and may not be the external IP that was previously communicated. In this case, the security system through the network traffic analysis may determine the information leakage attempt as a real threat.

2 shows network scanning attempt detection by a security system through network traffic analysis according to an embodiment of the present invention.

Referring to FIG. 2 , the security system through network traffic analysis according to an embodiment of the present invention can detect a case in which a network scanning attempt by a security scan engine is suspected. (Attempted Network Scan, IP B (internal IP, attack) suspect) → IP Y (internal IP, attacker))

The security system through the network traffic analysis may select metadata for determining false positives and/or excessive positives of such a network scanning attempt.

Even if it is a scanning attempt with an internal IP as the destination, there is a possibility that the scanning process is regularly performed by internal security personnel to identify vulnerabilities in the network.

However, if the scanning execution IP is an external IP and an intermittent scanning attempt to the inside is detected, it can be determined as a real threat.

Accordingly, metadata may be utilized to identify whether IP B is an external IP and to check temporal regularity of traffic between IP B and IP Y.

The security system through the network traffic analysis can determine false positives and/or excessive false positives through metadata.

For example, IP B is an internal IP, and as a result of checking the traffic of IP B and IP Y, a scanning operation may be continuously performed only on the first day of every month.

This is a scanning performed on the internal IP at a specific period, and it can be determined that it is not a real threat.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts thereof should be construed as being included in the scope of the present invention. .

Claims (1)

Detecting an information leakage attempt in a security inspection engine by a security system through network traffic analysis;
selecting, by the security system through the network traffic analysis, metadata for determining false positives or excessive negatives in an information leakage attempt; and
A security method through network traffic analysis comprising the step of determining, by the security system through network traffic analysis, whether false positives or excessive positives are detected through selected metadata.

Images