WO2013089395A1

WO2013089395A1 - Signature-based wireless intrusion prevention system

Info

Publication number: WO2013089395A1
Application number: PCT/KR2012/010682
Authority: WO
Inventors: 류동주
Original assignee: 주식회사 코닉글로리
Priority date: 2011-12-16
Filing date: 2012-12-10
Publication date: 2013-06-20
Also published as: KR101186873B1

Abstract

The present invention provides a signature-based wireless intrusion prevention system capable of effectively detecting a wireless intrusion signal and blocking the signal. The present invention provides a method for operating a signature-based wireless intrusion prevention system, comprising the steps of: collecting wireless data packets; analyzing the collected wireless data packets; and providing a file corresponding to the analyzed result, wherein the step of analyzing the wireless data packets comprises a preprocessing step for analyzing a wireless threat to verify the packets and analyzing a protocol attack, and a step for allowing an intrusion detection engine to search for provided policies to select one policy and to execute an intrusion prevention operation according to the selected policy.

Description

Signature based wireless intrusion prevention system

The present invention relates to a wireless intrusion blocking system in a method, and relates to a signature-based wireless intrusion blocking system.

In general, due to the rapid development and dissemination of the Internet, the network environment is getting bigger and larger, and its shape is complicated by the simple and convenient network access of the Internet and various services provided. However, due to various types of network attacks, such as viruses, hacking, system intrusions, gaining system administrator rights, concealing intrusions, denial of service attacks, etc., the Internet is always exposed to the risk of hacking. Public institutions, infrastructure and financial institutions are increasingly affected and influential. In order to solve such Internet security problems, network security technologies such as antivirus, firewall, integrated security management, and intrusion detection system are needed.

A wireless LAN system for wireless Internet communication includes a wireless LAN access point (AP) and a wireless LAN terminal. An access point (AP) installs and uses equipment called an access point apparatus. The WLAN terminal functions to receive information provided from the access point and provide the information to the next stage. Currently, the access point device which is mainly used does not filter hacking information that is wirelessly intruded because it provides only a transmission and network support function for wireless traffic.

Recently, integrated network systems using wired and wireless devices have been widely developed and applied. It is difficult to reliably block harmful traffic that is accessed by wire, but it is more difficult to reliably block harmful traffic that is accessed by wireless. To solve this problem, an intrusion prevention system has been developed, but no intrusion prevention system has yet been developed to block hacking packets that invade wirelessly reliably.

The present invention provides a signature-based wireless intrusion blocking system that can effectively detect and block a signal that invades wirelessly.

The present invention provides a method of operating a signature-based wireless intrusion blocking system, the method comprising: collecting a wireless data packet; Analyzing the collected wireless data packets; And providing a file corresponding to the analyzed result, wherein the analyzing of the wireless data packet includes a preprocessing step of performing a wireless threat analysis for packet verification, a protocol attack analysis, and an intrusion detection engine. Searches for a policy provided, selects one policy, and performs an intrusion blocking operation according to the selected policy, and provides a method of operating a signature-based wireless intrusion blocking system.

In addition, the wireless threat analysis is characterized by including the ARP spoofing, Mac spoofing, unauthorized access point and anti-stumbler method.

In addition, the protocol attack analysis is characterized by including the analysis using analysis and segmentation using the analysis port scan using the flooding situation.

In addition, the intrusion detection engine is characterized in that using a black list, white list and gray list.

According to the present invention, the wireless intrusion blocking system has a policy search function, so that the policy can be more effectively applied to the operation of blocking the wireless intrusion, thereby detecting and blocking the hacking signal more reliably.

1 is a block diagram illustrating an intrusion prevention system for explaining the present invention.

2 is an operation flowchart of a wireless intrusion prevention system according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, the most preferred embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art may easily implement the technical idea of the present invention. do.

Referring to FIG. 1, the intrusion prevention system includes a plurality of sensors 12 and a manager 13. A plurality of sensors 12 may be provided, and the number of the sensors 12 may be determined according to regional characteristics in which the wired / wireless network system is disposed. In addition, the position where the sensor 12 is disposed may also vary according to the regional characteristics of the wired / wireless network.

The sensor 12 senses data transmitted from the wireless terminal 10 to the AP 11 or data transmitted by the request to the wireless terminal 10. The manager 13 controls the sensor to check whether the data packet provided through the sensor 12 is malicious or not, and accordingly, controls whether the wireless terminal 10 is allowed to continue to be connected to the wired or wireless network. do. As shown in Fig. 1, each manager has a sensor corresponding thereto according to a zone where a network is installed, and each grouped sensor is controlled by each manager.

2 is an operation flowchart of a wireless intrusion prevention system according to an embodiment of the present invention. In particular, Figure 2 illustrates the wireless snort internal processing.

Referring to Figure 2, the wireless intrusion blocking system according to the present embodiment first collects a wireless data packet (S1). The wireless data packet collected here may be a wireless data packet requested by the wireless terminal 10 and provided to the wireless terminal 10 from the AP 12. The wireless data packet may be provided from the wireless terminal 10 and received by the AP 11. It may also be a data packet transmitted to a network system.

Subsequently, analysis of the collected wireless data packet is started (S2).

Subsequently, the wireless data packet collected by the preprocessor is verified (S3). Radio threat analysis and protocol attack analysis are performed using the collected wireless data packets.

Radio threat analysis includes ARP spoofing, Mac spoofing, rogue access point (rogue AP), and anti-stumbler.

ARP (Address Resolution Protocol) is a protocol that obtains an MAC address, which is an Ethernet address, with an IP address (Internet Protocol address) on a local area network (LAN). By broadcasting ARP packets within a network, you can see the IP and MAC address of the computer that responded to the ARP packets connected to that network.

ARP spoofing is a kind of hacking technique that sends packets of a forged ARP response packet to a specific computer so that packets from that specific computer can be sent to its own computer. When ARP spoofing is performed between a host and a host computer, the other host sends a packet to the host that sent ARP spoofing. However, if the device receiving ARP spoofing is a router or an L3 switch, the router or L3 switch may send a packet to the wrong destination, which may cause a host connected to the router or L3 switch to have no access to the Internet.

ARP spoofing detection technology can be divided into two types depending on the method. The first is using Dynamic Host Configuration Protocol (DHCP) packets, and the second is using IP and Reverse ARP (RAP).

The second method is to use IP and Reverse ARP. The method using a DHCP packet uses a system consisting of a device for collecting DHCP packets, a DHCP packet analysis device, and an ARP spoofing detection device. The ARP spoofing detection technique using DHCP packets manages the MAC address associated with the IP address in a database when the DHCP server assigns an IP. If it detects an ARP that does not correspond to a Mac address stored in this database, it is considered as ARP spoofing.

On the other hand, the method using IP and ARP / RARP uses a system consisting of an IP packet collection device, an IP packet analysis device, a RARP transmission device, and an ARP spoofing detection device. The ARP spoofing detection technology using IP and ARP / RARP detects whether the IP packet received from the system is the same as the IP (or MAC) address of the local network. If it is not the same, it sends a RARP and determines that it is ARP spoofing if there is no response.

Mac spoofing is a type of DDoS attack that deceives a MAC or IP address. If such a DDoS attack occurs, it becomes very difficult to find a host computer that performs a DDoS attack in a short time. Because mostly Spoofed DDoS Packets do not have a true MAC or IP address, it is impossible to determine where a packet came from by observing the packet itself.

A rogue access point (rogue AP) is a personally installed access point (AP) that does not comply with security policies within the company. In particular, in the wireless LAN environment of a company, an external or illegal intruder enters through a wireless AP frame personally installed by a user and accesses all resources with the same qualification as an internal employee. May become obsolete. rogue AP has a method to prevent illegal AP installation in the enterprise or authenticate the AP by providing 802.1x authentication on the switch. However, for accurate rogue AP prevention, direct and physical surveillance is the best way for administrators to detect and navigate the AP range with an analyzer.

The Network Stumbler is one of the tools for discovering APs, and it can tell you if an AP is unauthorized.

As we continue, we perform a protocol attack analysis. Protocol attack analysis uses a flooding situation, a port scan method, and a fragmentation method.

Flooding attacks have been frequently used in recent years to target servers on the Internet and to disable them. Flooding attacks occur when a user sends a number of requests to a server in a relatively short time with the intention of overloading the server and thereby disabling the server. Flooding a packet from a malicious user can overload the server in the same way that flooding a packet from a misconfigured system can overload the server.

A port scan is a continuous access to a server over a network, looking for security holes (security holes). Server computers published on the Internet operate according to a communication protocol (protocol) called TCP / IP. Usually, several connection windows called ports are prepared to wait for a connection from a user. Port scan is an act of accessing these ports sequentially to examine the types of application software and operating systems running on the server, and to determine if there are any vulnerable ports that could be an intrusion. If a security hole is found as a result of a port scan, intrusion is often done using an intrusion program. Network administrators can do port scans to investigate the weakness of their systems. Servers that receive port scans retain suspicious records in the communication history (access log), which are considered as port scans, and sometimes cover up port scans by performing scans at intervals.

Fragmentation is a method used to shorten the size of the IP packet in the short-range wireless communication device to reduce the size to transmit and receive data in the short-range wireless network supporting a packet of a relatively small size.

Continuing to look at it, we turn on the intrusion detection engine. Intrusion detection engine detects what policy is provided (S4), and determines the policy to use.

Searching for a policy (rule) refers to a process of searching for a policy such as a filtering policy, an intrusion detection policy, and an access control policy necessary for intrusion detection and blocking, and selecting a currently required policy (rule).

Once a policy is set, it operates in accordance with the policy. For example, refer to an access control policy to prevent unauthorized users from using the system, and make sure that all subjects can access only if they have access to the object. The result is stored in a log file.

Subsequently, an intrusion blocking operation for determining whether the wireless data packet is intrusion data for hacking is performed (S5). In this case, a black list, a white list, and a gray list are used.

The black list is a list of mobile terminals that are in poor or stolen state, the white list is a list of all mobile terminals in good condition, and the gray list is an unclear list of mobile terminals.

When the intrusion prevention engine completes its operation, it generates a log file and informs the user (S6).

The wireless intrusion blocking system performs the blocking method with its own stored policy base. That is, the wireless intrusion blocking operation is performed using only one stored policy internally.

However, the wireless intrusion blocking system according to the present invention has been developed to enable a function of making and distributing a signature (detection policy or rule). In addition, it is designed to perform functions such as blacklist, whitelist, graylist, and the like, blocking, temporary blocking and temporary allow. Therefore, the wireless intrusion blocking operation can be easily performed by effectively reflecting the necessary policy.

Although the present invention has been described in detail with reference to exemplary embodiments above, those skilled in the art to which the present invention pertains can make various modifications to the above-described embodiments without departing from the scope of the present invention. Will understand. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims below and equivalents thereof.

Claims

In the operation method of the signature-based wireless intrusion blocking system,

Collecting a wireless data packet;

Analyzing the collected wireless data packets; And

Providing a file corresponding to the analyzed result;

Analyzing the wireless data packet

A preprocessing step of performing a wireless threat analysis for packet verification, a protocol attack analysis,

The intrusion detection engine searches for a policy to be provided, selects one policy, and performs an intrusion blocking operation according to the selected policy.
The method of claim 1

The wireless threat analysis

ARP spoofing, MAC spoofing, unauthorized access point and anti-stumbler method comprising a method for operating a signature-based wireless intrusion prevention system.
The method of claim 1,

The protocol attack analysis is a method of operating a signature-based wireless intrusion blocking system comprising an analysis using a flooding situation, an analysis using a port scan and analysis using segmentation.
The method of claim 1,

The intrusion detection engine

A method of operating a signature-based wireless intrusion prevention system using blacklist, whitelist and graylist.