WO2018194282A1 - Server access control system for detecting abnormal user on basis of learning of inputted commands for security enhancement - Google Patents

Abstract

The present invention relates to a server access control system for detecting an abnormal user on the basis of learning of inputted commands, the system: learning commands used by a user when the user remotely accesses a server; extracting behavior patterns of the user through learning; and comparing an inputted command with a learned behavior pattern when a command input event of the user occurs, thereby determining whether abnormality occurs and controlling the same, and the system comprises: a relay module for extracting session information and a command statement from a packet transmitted from a user terminal, and relaying the command statement inputted between the user terminal and the server, or the results of the server; an abnormality detection unit, which extracts commands by receiving the session information and the command statement from the relay module, learns and generates a behavior model that exhibits command input patterns of the user, and applies a current command of the user to the behavior model so as to calculate the probability of an abnormal user; and an abnormality determination unit, which receives the probability of the abnormal user from the abnormality detection unit, and determines to warn a manager or disconnect a session or a user by using the probability of the abnormal user according to a policy determined in advance. According to the server access control system, whether a user is an authorized user is estimated by comparing whether behaviors of an accessing person are similar to the authorized user's command use patterns having been extracted in advance, such that attack behaviors by a hacker or a malicious user who seizes an account and proceeds through normal authentication can be defended against.

Description

Server access control system that detects abnormal user input based on command learning for enhanced security

The present invention for the security management of the main server managed by the institution, the user remotely access the server to learn the commands used, extract the behavior pattern of the user through the learning, the input command when the user's command input event occurs The present invention relates to a server access control system that detects an input instruction learning based abnormal user that determines and controls an abnormality by comparing with a learned behavior pattern.

In addition, the present invention focuses on performing an operation different from a conventional user's legitimate user's work pattern when performing infringement by a hacker or a malicious intention user who is not a normal user. A server access control system for detecting abnormal user.

In general, the server access control system analyzes the packet passing through the access control gateway server to extract a command input by the user, and checks and controls whether the extracted command is allowed. For example, if it is in the list, the command is destroyed without being sent to the server, compared to the list of prohibited commands that may threaten the security applied to the user. This can enhance the security of the server.

In addition, the server access control system according to the prior art provides a security function to perform the user authentication for the first user to access, and to access and perform the equipment within the authority granted after the user authentication.

However, as shown in FIG. 1, if a hacker or a malicious user steals the administrator account information and performs user authentication with the corresponding account information, normal authentication may be performed. In this case, the malicious user can access the server under the authority of the administrator, and can perform malicious actions (eg, information leakage, destruction, etc.) within the assigned authority. That is, due to leakage of administrator account information, a security problem that cannot be controlled may occur.

Therefore, it is necessary to go beyond the existing primary authentication method and to determine and control whether the user's normal behavior is based on the user's work behavior.

An object of the present invention is to solve the problems as described above, for the security management of the main server managed by the institution, to learn the commands used by the user remote access to the server, and extract the behavior pattern of the user through the learning In addition, when a command input event of a user is generated, a server access control system for detecting an input user based on an input command learning that determines an abnormality by comparing the input command with a learned behavior pattern and controls the abnormality.

In particular, an object of the present invention is to connect to the server access control system that the user controls access to the main server of the institution, the user accesses the server, collects the command data used at this time, and utilizes the machine learning (Machine Learning) technique By providing a server access control system for detecting an abnormal user input based on input instruction learning, extracting a work behavior pattern for each user.

In addition, an object of the present invention is to determine whether the user is an abnormal user based on the work behavior pattern information extracted when the user is connected to the server via the actual access control system, the command input, and if the user is determined to be an abnormal user It is to provide a server access control system that detects abnormal user input based on input instruction learning which automatically executes the user control based on it.

In addition, an object of the present invention is to create a learning model based on the user's server access and command input values in the access control system, in order to defend against infringement by hackers and intrusion by malicious users, It is to provide a server access control system that detects abnormal user based on inputted instruction learning that can check whether the currently connected user is the user using the model.

In order to achieve the above object, the present invention provides a server access control system for detecting an input instruction learning-based abnormal user, in which a user terminal and a server are connected to a network and installed as a gateway on a network between the user terminal and the server. A relay module, comprising: a relay module for extracting session information and a statement from a packet transmitted from the user terminal and relaying a result of a statement or a server input between the user terminal and the server; Receiving session information and statements from the relay module, extracting a command, learning and generating a behavior model indicating a user's command input pattern, and calculating a probability of the abnormal user by applying a user's current command to the behavior model. Detection unit; And an abnormality determination unit configured to receive a probability of an abnormal user from the abnormality detection unit, and determine an alert, a session block, or a user block to an administrator by using the probability of the abnormal user according to a predetermined policy. .

The present invention also provides a server access control system for detecting an input instruction learning based abnormal user, wherein the abnormality detecting unit comprises: an event channel for receiving a statement from the relay module; A state channel for providing probability information of an abnormal user to the abnormal determination unit; An action coordinator for extracting instructions from the statement; A behavior model engine for generating a behavior model for each user through learning; Receiving a command from the behavior coordinator, calculates the probability for each user with respect to the received command, characterized in that it comprises a calculation unit for calculating using the behavior model.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, wherein the behavior coordinator writes the command in the behavior log storage and accumulates the behavior model engine, the behavior model engine is stored in the instruction of the behavior log storage It is characterized by continuously learning and updating the behavior model using data.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, the behavior model is composed of a Bayesian model and a deep learning model, the operation unit calculates a first probability from the Bayesian model, The second probability is calculated from the deep learning model, and the final probability is extracted by adjusting a ratio between the first probability and the second probability by using weights.

The present invention provides a server access control system for detecting an input instruction learning-based abnormal user, wherein the relay module receives a statement character from the user terminal, accumulates the statement character if the statement character is not an enter character. Generate a statement cumulative string, extract the final statement to be actually executed from the cumulative string if the statement character is an enter character, and if the statement character is a control character, transmit the accumulated statement cumulative string and the control character to the server, The character string reflecting the control character is received, and the accumulated character string is generated by accumulating the reflected character string.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, wherein the relay module is any one of an echo command, a linked command extraction (realpath) command, a command name extraction (basename) command And transmitting the cumulative string to the server as one or more commands and as an argument of the command, extracting the final command using the result of the command received from the server, and the echo command being variable-processed. A command that converts a command, a command including a wild char, and a command including a history to a command that is actually executed, is returned. The linked command extract (realpath) command is a linked command extract (realpath). ) Command is a command that returns an actual command linked by a symbolic link, and extracts the command name. e) The command is characterized in that the command to return the name of the actual execution command excluding the path if the command includes a path (path).

In addition, the present invention is characterized in that in the server access control system that detects the input instruction learning-based abnormal user, the command is extracted by consisting of only the command name and command options in the statement.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, the behavior model engine is similar to the input order of options and option string of each command, similarity of usage frequency for each command, command Reflecting the similarity of the usage pattern according to the order of use, characterized in that to learn the behavior model.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, the behavior model engine is characterized by obtaining the behavior model using the following [Equation 1].

[Equation 1]

Where P _{c and u} represent the probability of the instruction c with respect to the user u, Training Count is the number of training data, Training Data Length is the length of the training instruction, and α is a predetermined constant. pseudocount), and A is the number of distinct commands.

In addition, the present invention is a server access control system for detecting an input instruction learning-based abnormal user, the behavior model is built by learning N number in advance by the number of users, the operation unit is a user input commands of a specific user Probability of N users is obtained by applying to all N behavior models, and the ranking of probability of each user is given by sorting the probability of N users in descending order. It is determined whether the user is an abnormal user according to the rank of the probability, and when the probability of the corresponding user is below a predetermined rank with respect to a command input by a specific user, the user is determined to be an abnormal user.

As described above, according to the server access control system for detecting an input instruction learning-based abnormal user according to the present invention, by comparing whether the behavior of the accessor is similar to the command usage pattern of the legitimate user extracted in advance to estimate whether the legitimate user For example, a hacker or a malicious user can take over an account and defend against an attack through normal authentication.

1 is a view showing a security vulnerability when the authentication information is stolen from the access control system according to the prior art.

2 is a block diagram of an overall system for practicing the present invention.

3 is a block diagram of a configuration of a server access control system for detecting an input instruction learning-based abnormal user for enhanced security according to an embodiment of the present invention.

Figure 4 is a block diagram for a detailed configuration of the abnormality detection unit for real-time abnormal user detection according to an embodiment of the present invention.

5 is a block diagram of an action model for detecting an abnormal user by machine learning according to an embodiment of the present invention.

6 is a schematic flowchart illustrating a process of extracting a statement according to an embodiment of the present invention.

7 is a flowchart illustrating a process of extracting a statement according to an embodiment of the present invention.

8 is an exemplary view of a statement checking process according to an embodiment of the present invention.

9 is an exemplary view of a result of deriving an instruction from a statement according to an embodiment of the present invention.

10 is an exemplary diagram of input data of an action model engine according to an embodiment of the present invention.

11 is an exemplary diagram of output data of an action model engine according to an embodiment of the present invention.

12 is a flowchart illustrating a method of determining an abnormal user according to an embodiment of the present invention.

Figure 13 is a block diagram for learning the behavior model according to an embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, specific contents for carrying out the present invention will be described with reference to the drawings.

In addition, in describing this invention, the same code | symbol is attached | subjected and the repeated description is abbreviate | omitted.

First, examples of the configuration of the entire system for implementing the present invention will be described with reference to FIG.

As shown in FIG. 2, the entire system for implementing the present invention includes an access control system 30 that serves as a gateway between the user terminal 10, the server 40, and the user terminal 10 and the server 40. It is composed of In addition, the user terminal 10 and the server 40 are connected through a network (not shown).

The user terminal 10 is a computing terminal used by a user, such as a PC, a notebook, a smartphone, a tablet PC, and the like. In addition, the user terminal 10 connects to the server 40 through a remote access protocol Telnet (TELNET) or SSH (secure shell), and performs the operation through a shell (Shell) installed in the server 40.

A shell is a command interpreter that translates user input into machine language and passes it to the server's kernel. In other words, a shell is an interactive command interprinter that interprets commands entered by a user and processes them with the server kernel. The shell uses a character user interface (CLI). In particular, the shell uses a command line interface (CLI) to interact with the user terminal 10 and the server 40 through a text terminal. As the shell, various shells such as a Bourne shell, a Korn shell, a bash shell, a C shell, and a Tcsh shell may be applied.

Accordingly, the user uses the service of the server 40 through the user terminal 10, and for this purpose, a series of characters, that is, a command string (or string), is input on a shell, and an enter is entered. Thus, the server 40 transmits the input statement or string. In addition, a shell installed in the user terminal 10 receives a result of a command input from the server 40 and displays the result on a screen in a text form or a string form. At this time, the input command string (string) is called a statement.

Next, the server 40 receives a statement from the user terminal 10 through a network (not shown), performs a command of the corresponding statement, and transmits the result to the user terminal 10. In this case, the statement consists of a series of characters, ie strings. These characters, or strings, are transmitted over the network. That is, a session is formed between the user terminal 10 or the shell and the server 40, and a character or a string is transmitted through the data packet within the session.

The server 40 recognizes a string of characters entered by the user, preferably, a string of characters or strings entered up to the previous character as one statement (or command string). The enter character means a character indicating that statement input is completed. Hereinafter, the enter character (or enter key character, enter key) or statement input completion character will be referred to.

Preferably, the server 40 may accumulate input characters until an enter is input, generate a string (or a statement), parse the generated string up to the middle, and return the result. In this case, the returned result may be displayed on the shell of the user terminal 10. That is, whenever one character is input, the server 40 returns a command string (or statement) corresponding to the input in the form of a text to be displayed on the user terminal 10 or the shell. When the input character is a character that cannot be displayed on the shell such as a control character, the server 40 causes the character string of the result corresponding thereto to be returned.

More preferably, the server 40 receives a control key (or control character) such as a combination of a tab, a direction key, and a control (ctrl, alt) key in addition to a general character key input such as a letter, number, or symbol. In this case, the control character is interpreted and converted into a character string (or a text string) of the corresponding general character. Here, the general character refers to characters that can be displayed as text such as letters, numbers, and symbols, and the control character refers to characters for control such as tabs, direction keys, control keys, and combination characters.

On the other hand, preferably, the server 40 is operated by a Linux or Unix-based operating system (OS), remote access using a CLI (Command-Line Interface) type remote access protocol (TELNET, SSH) Provide services for In addition, the access control system 30 controls the statements entered in the service for such remote access.

Next, the access control system 30 is a gateway installed on a network (not shown) between the user terminal 10 and the server 40, and relays or blocks the user terminal 10 and the server 40. .

That is, the access control system 30 receives the command character or string (or statement) received from the user terminal 10 and transmits it to the server 40, and receives the result from the server 40 to receive the user terminal 10. To pass.

At this time, the access control system 30 analyzes the command character or string received from the user terminal 10, and determines whether to block the command contained in the command string (or statement). That is, according to the determination of blocking or not, the command string (or statement) is transmitted to the server 40 or blocked.

Next, a server access control system that detects an input instruction learning-based abnormal user to enhance security according to an embodiment of the present invention will be described with reference to FIG. 3.

The present invention collects and learns the history of working on the server through the access control system, that is, command information, and extracts the work behavior pattern for each user. When a user accesses a server and performs a task, the access control system compares the statements input by the user with the patterns in real time based on the extracted pattern to determine whether there is an abnormal user. That is, the authentication function for the user is continuously performed through the pattern. If it is determined that the abnormal user, the session of the user can be blocked to prevent potential threats.

As shown in FIG. 3, the server access control system 30 according to the present invention includes an input / response transmitter 31, a statement extractor 32, a packet relay 33, an equipment transmitter 34, and a policy. The determination unit 35 and the abnormality detection unit 36 are configured.

It is assumed that a user accesses a specific server 40 and performs a task via the server access control system 30 of the statement extracting unit.

First, the input response transmitter 31 receives an input from the user or the user terminal 10 and transmits it to the relay module 38 or transmits a response received from the relay module 38 to the user or the user terminal 10. .

The relay module 38 is a module that connects the input response transmitter 31 and the equipment transmitter 34 to relay packets or data. The relay module 38 includes a statement extractor 32 for extracting a statement from a packet, and a packet relay 33 for relaying a packet or data.

In particular, the statement extracting unit 32 analyzes the packet received from the user terminal 10, extracts a statement, or extracts session information of the user.

The session refers to a session of the TCP / IP protocol established by the user terminal 10 to remotely access the server 40. The user makes a remote connection to the server 40 by using Telnet, Secure Shell (SSH) protocol, or the like. During a session, a user enters a number of commands to do what he wants.

The session information includes device connection session information of the user. That is, session information includes user identification information (user ID, etc.), access equipment identification number (access equipment ID, etc.), access protocol, access account, access start time, access end time, and the like.

If the statement extracting unit 32 extracts the user's session information and statements from the packet, the statement extracting unit 32 transmits the session information and the information about the statement to the abnormality detecting unit 36. When an abnormality is not detected from the abnormality detecting unit 36 or the abnormality determining unit 35, the packet is relayed through the packet relaying unit 33.

Next, the abnormality detection unit 36 extracts a command from a statement, collects a series of commands corresponding to one session, and analyzes a pattern for the series of commands. And it compares with the behavior pattern (or command pattern) of the previously learned user. At this time, the analysis result is derived from the learned user's behavior pattern and the difference or abnormal user probability (probability value of abnormal user).

Preferably, the abnormality detection unit 36 collects a series of commands in the session, learns and generates a behavior model with the corresponding commands, and derives an abnormal user probability using the learned behavior model.

The abnormality detection unit 36 transmits the derived abnormal user probability to the abnormality determination unit 35.

The abnormality determination unit 35 receives the abnormal user probability and determines whether the abnormal user is based on a predefined policy. That is, when the abnormal user probability is out of a predetermined threshold (for example, when the probability exceeds a predetermined threshold), the abnormal user is determined as an abnormal user.

The abnormality determination unit 35 judges the abnormal user, and sanctions on the use of the user based on the defined policy. For example, send notifications to administrators or block sessions. This can enhance security.

That is, in order to check whether the user is an abnormal user in real time when the user inputs a statement, the access control system suspends the command transmission to the management server actually connected. And the user authentication is continuously performed by the abnormality detection unit 36 and the abnormality determination unit 25 for authentication.

In particular, the abnormality determination unit 35 or the abnormality detection unit 36 derives a result based on the probability that the corresponding user is not True / False or not, and “Decision Support System”. If the probability that a user is hit by a policy exceeds a certain threshold, then an automatic action is taken based on the defined policy.

Next, the detailed configuration of the abnormality detection unit 36 for real-time abnormal user detection according to an embodiment of the present invention will be described in more detail with reference to FIG. 4. 4 shows a detailed configuration of the abnormality detecting unit 36 and a series of processes for detecting an abnormal user based on a usage pattern based on the user's real-time work behavior in the access control system.

As shown in Figure 4, the configuration of the abnormality detection unit 36 according to an embodiment of the present invention is largely divided into a data pipe and an action engine.

First, the data pipe part will be described. It is composed of an event channel 51 for delivering a work event of a user and a state channel 52 for delivering an abnormal user probability.

The event channel 51 receives information about a user's work event (User, Device Session, Command). That is, the gateway relay module 38 of the access control system transmits the corresponding event information to the event channel 51 when a user's work event (User, Device Session, Command) occurs. When the event is delivered, the event channel 51 calls the behavior coordinator 61 to deliver the corresponding information.

At this time, the job event refers to a user's statement input. That is, the user enters a series of strings, and finally enters an enter character (enter key) that completes a statement. In other words, when a statement is completed and entered, a job event is generated for that statement.

In addition, the state channel 52 receives the calculated probability user information from the operation unit 64 of the behavior engine. That is, the calculator 64 of the behavior engine transfers the calculated probability user to the status channel 52. When the abnormality probability (abnormal user probability) is transmitted, the state channel 52 calls the abnormality determination unit 35 to transmit corresponding information.

Next, the action engine includes an action coordinator 61, a data storage unit 62, an action model engine 63, and an operation unit 64. In addition, for storing data, the behavior log storage 71, the behavior model 72, the model cache 73 is configured.

First, the behavior coordinator 61 receives a user's work event (User, Device Session, Command) from the event channel 51, instructs to store a log for model construction, and detects an abnormal user. The operation unit 64 is called to perform analysis on the work event. That is, the behavior coordinator 61 transmits the information to the data saver 62 to store the received event information, and calls the calculator 64 to determine the abnormal user.

In particular, the behavior coordinator 61 gets the statement from the event channel 51. The command is extracted from the imported statement, and the extracted command is stored in the behavior log storage 71.

Next, the data storage unit 62 stores the user's job event information received from the behavior coordinator 61 in the behavior log storage 71. That is, the data saver 62 stores the event information in the behavior log storage 71 for learning the user's work behavior.

Preferably, the activity log storage 71 records and accumulates session information and commands in the session. Also, more preferably, the entire statement is recorded in a log together with session information and commands.

Next, the calculator 64 compares the learned behavior pattern model for each user with a probability and calculates a probability that the received behavior information differs from the stored behavior pattern (or behaviors) of the user. .

In addition, the behavior model engine 63 is an engine for generating the behavior model 72 to build a behavior-based behavior model of the user. That is, the behavior model engine 63 uses the user behavior information stored in the behavior log storage 71 to reconstruct the behavior model (work behavior based behavior model of the user). That is, the behavior model engine 63 is called to reconstruct the user's work behavior based behavior model.

Preferably, as shown in Figure 5, the behavior model uses a Bayesian model and a cyclic neural network (RNN) model. That is, the behavior model engine 63 extracts variables of the Bayesian model by using user behavior information, that is, inputted commands. In addition, the recursive neural network model is trained using the inputted commands.

In addition, the behavior model engine 63 is periodically called to periodically reconstruct the user's work behavior based behavior model.

Next, the calculator 64 calculates probability information of a calculated abnormal user and transfers the calculated probability information to a status channel. That is, the calculator 64 calculates the probability of the abnormal user by comparing the behavior model 72 and the behavior patterns of the user.

Preferably, the calculation unit 64 calculates first probability information of the abnormal user by the Bayesian model, and calculates second probability information of the abnormal user by the cyclic neural network model (or deep learning model). The calculating unit 64 extracts final probability information (or probability information of an abnormal user) by weighting and adjusting the first probability information and the second probability information.

In this case, preferably, the weight is determined according to the learning data or the number of events or instructions of each user. That is, when the size and number of the training data are relatively small numbers (100 to 1000) of input data, the weight of the first probability information is greater than the weight of the second probability information, and when the number is relatively large, The weight of the first probability information is made smaller than the weight of the second probability information.

In order to use the deep learning model, each user's data must be accumulated sufficiently. Using tip learning models until they accumulate enough may not produce the correct results. That is, a cold start problem occurs. The Bayesian model, on the other hand, can discern abnormal users even with relatively small input data. Therefore, when the initial data is insufficient, the weight is added to the Bayesian model, and as the data is accumulated, the weight of the deep learning model is increased. In other words, if the data is sufficiently accumulated, the ratio of the deep learning model and the Bayesian decision model may be adjusted to make an optimal decision.

In addition, the model cache 73 is a medium (or cache) that temporarily stores these data in order to prepare for the behavior model and the behavior pattern of the user. In particular, record the behavior model to be prepared in the model cache and contrast it with the user behavior pattern. The model cache allocates and uses a certain amount of cache space for abnormal user detection in real time. This speeds up searches for commonly used models.

On the other hand, the abnormality determination unit 35 is a decision support system (Decision Support System), and determines whether or not the abnormal user based on the defined policy. At this time, the probability information of the abnormal user is received from the status channel 52, and it is determined whether the abnormal user is using the received probability information.

In particular, the abnormality determination unit 35 requests an appropriate sanction (warning, administrator notification, session blocking) when the applied threshold is exceeded.

If it is determined that the user has exceeded the threshold applied, the abnormality determination unit 35 requests the gateway server or the relay module 38 to block the session based on the defined policy.

For example, the threshold of the probability unit of the abnormal user may be set as follows.

If the probability of the abnormal user is 70% or more, the administrator sends a notification signal informing the administrator of the abnormal user. If the error rate is 80% or more, the session currently connected to the user to block a task is blocked. In addition, if the probability of the abnormal user is more than 90%, access to the user is blocked. As described above, each threshold is set in advance, and the abnormality determination unit 35 automatically performs a predetermined series of tasks (security tasks) when the probability of the abnormal user exceeds each threshold.

Next, a method of extracting a statement from the relay module 38 (or the statement extracting unit) according to an embodiment of the present invention will be described with reference to FIGS. 6 and 7.

As shown in FIG. 6, the relay module 38 or the statement extracting unit 32 performs a work in an environment in which communication data is relayed between the user terminal 10 and the management target server 40. In an embodiment, an environment in which a user or a user terminal 10 performs a remote access operation using a CLI protocol to a management target server 40 authorized through an access control system 30 will be described as an embodiment. .

The user or user terminal 10 inputs a statement to work on the server 40. At this time, the relay module 38 or the statement extracting unit 32 transmits the received statement to the server 40 and transmits the response of the server 40 to the user terminal 10 again. At this time, the statement extracting unit 32 extracts the inputted characters and accumulates them in the internal memory until the Enter key input indicating execution of the command is received. When the user enters the Enter key, the statement extractor 32 or the relay module 38 suspends the transmission of the corresponding key input to the server 40, and the permission policy in which the instructions accumulated in the memory are assigned to the user is assigned. It is determined whether or not according to the execution, and whether or not to transmit to the server (40).

That is, when the user's enter key is input, the relay module 38 does not determine whether the terminal is immediately authorized, but instead executes a final command or statement through communication with the server 40 and analysis of response data through a command confirmation process. Extract. For example, when the accumulated user command string is a string of “/ usr / bin / rm”, the relay module 38 extracts “rm”, which is the final command string to be actually executed from the command string. Then extract the actual statement with the extracted final commands, options, and arguments.

As a result, when determining whether to execute the statement, analysis of the statement input by the user is required, and for this, a statement checking operation (or command checking operation) through defined communication and analysis with the server 40 is performed. Extract the final statement that will actually be executed. By filtering the final statement string that will actually be executed, we can learn more about the instruction.

Specifically, it receives a command character from the user terminal 10 (S10), it is determined whether the enter key (Enter), which means the execution of the statement is input (S20).

If it is not the Enter key, it checks whether it is a control character (S30). The control character is a character for control, such as a tab, a direction key, a combination character with a control (ctrl, alt) key, a function key, etc. and means a character that is not a text type character.

If not the control character, the input statement character is accumulated in the input statement cumulative string (S40). A statement cumulative string is a string created by accumulating the input statement characters. The cumulative statement string is accumulated before the enter key character (or command completion character) is input. The relay module 38 returns the cumulative statement string to the user terminal 10 and outputs the corresponding character string on the shell of the user terminal 10. That is, the user can see that the statement string he entered is displayed in the shell.

When the input statement character is a control character, the accumulated character string and the corresponding input control character are transmitted to the server 40 (S31), and the statement string reflecting the control character is received from the server 40 (S32). The reflected statement string is reflected in the input statement cumulative string (S40). For example, the accumulated string is "ren", in which the user enters a tab character. In this case, when the character string "ren [Tab]" is transmitted to the server 40, the character string "rename" is received from the server 40. That is, "rename" is a string in which "ren" reflects the control character [Tab].

The reflected cumulative string is returned to the user terminal 10, and the reflected cumulative string is displayed on the shell. Thus, when the user enters the ren + tab, the user sees "rename" displayed on the screen (in a shell).

When the enter character or the statement input completion character is input in step S20, the statement checking process is performed (S50). The statement checking process S50 is a process of extracting a statement in which an input cumulative string or a statement string is actually executed. That is, the relay module 38 checks the final statement intended by the user by executing the statement on the real server 40.

The statement checking process S50 requests the server 40 and returns a result by using system commands such as an echo command, a linked command extract (realpath) command, and a command name extract (basename) command. In addition, to improve performance, an executable checking (which) instruction may be additionally used. A detailed process of the statement checking process S50 is illustrated in FIG. 7.

First, an echo command is applied (S51). The echo command converts a command that has been processed into a variable, a command including a wild char, and a command including a history to convert the command to be executed. In addition, the echo command replaces newlines, spaces, and so on.

In other words, when the user presses the Enter key to execute a statement, the command outputs newline characters on the standard output and includes a space between the strings and the end of a line to check the accumulated statement characters in memory. "Echo" + [input command] is sent to the server, and the server 40 receives the response. The relay module 38 analyzes the received message to replace the variable processed statement character and replaces wild char and history statements with actual statements.

Next, although not shown, an executable checking (which) command may be performed. The executable check (which) command is used to check whether a corresponding cumulative statement string is executable.

In other words, to improve the performance of the access control system, the command “which [command]” is sent to the server to check whether the replaced command is a command that can be executed on the server.

Next, the linked command extraction (realpath) command is applied (S52). The linked command realpath command returns the actual command or statement linked by the symbolic link.

In other words, in case of an executable statement by analyzing the response message for “which [command]”, the “realpath” command, which returns the actual executable path, is sent to the server to determine whether to execute the symbolic link statement. Get the executable file path.

Next, the command name extraction (basename) command is applied (S53). The command command basename returns the name of the actual execution command except the path if the command contains a path.

The final intended command can be extracted by sending the command “basename” to the server to get the command character except the path from the string including the full path of the executable file.

Finally, the final statement or the actual statement is extracted by the above process (S60). In particular, replace the command name in the statement with the command name obtained by "basename" to obtain the final statement.

Next, an example of a statement extracting method according to an embodiment of the present invention will be described with reference to FIG. 8.

First, the case where the user enters the command “ren” + [TAB key] is explained.

At this time, the output is displayed as "rename" on the screen of the user terminal.

The cumulative statement string according to the prior art is "ren [TAB]", but the cumulative statement string according to the present invention is "rename". In addition, when a user inputs a statement using a control character (Control Key) rather than a general character, the relay module 38 does not accumulate the character and transmits the character to the server to analyze the response value and accumulate the statement.

The following is an example of checking the final statement by using the echo command. It is a case where a newline character is input like FIG. 8A. Replace or remove the newline character, returning the original command string rm -rf.

Next, FIG. 8B is an example of using a history command. Check the execution by looking at the statement number used previously. That is, in the example of FIG. 8B, the number "546" represents the statement of "/ usr / bin / ssh". The command string "/ usr / bin / ssh" is returned from the server 40.

 Next, FIG. 8C is an example of using a statement using wild chars (*,?). Instead of typing the entire statement, you can use wild chars to run similar executables that exist in that directory.

For example, you can run “ssh” by typing “ss *”. As in Fig. 8C, even in this case, the echo statement returns "./ssh".

Next, FIG. 8D shows an example of using a variable processed statement. In the case of using the variable a, it is defined that a has the statement "rm". Using an echo statement, the server returns "rm -rf".

The next step is to check using the linked command's realpath statement. In bold in Fig. 8E, "ssf" is a command linked to a command of "/ usr / bin / ssh". So when you run "ssf", the linked statement "/ usr / bin / ssh" is executed. When passed to the server using a linked command command (realpath), the "ssf" statement string returns the linked command "/ usr / bin / ssh". At this time, reply with the location of the actual executable and the name of the executable.

Next, an example of confirming a final command using a command name extraction (basename) is shown in FIG. 8F. When the command string "usr / bin / ssh" is requested to the server with the command command basename, the command name "ssh" is returned.

Next, a method of extracting an instruction from a statement in the behavior coordinator 61 according to an embodiment of the present invention will be described with reference to FIG. 9.

First, in order to create a learning model for detecting anomalous users, only commands are extracted from work statements that a user connects to the server. The command includes an optional part of the command. That is, a statement consists of a command and its arguments (or arguments). At this time, only the command is extracted without the argument value.

In addition, when a command includes a path, only the pure command is extracted except the path. That is, when entering a statement, the path (directory or folder) in which the command is located may be described together with the name of the command. Exclude the path from the command or statement.

The final command therefore consists only of the command (or command name) and command options. In this way, the learning noise can be reduced by reducing the statement to instructions.

An example of deriving an instruction from a statement is shown in FIG. 9.

Next, a method of constructing a behavior model in the behavior model engine 63 according to an embodiment of the present invention will be described in detail.

According to the behavior model, whether a user is an abnormal user with respect to a series of commands input by a user in one session is determined based on the following criteria.

First, it is determined whether or not the options of each command and the input order of option strings are similar. That is, it determines whether or not each command is similar to which option is used. In general, each user enters a command and its option string in a certain order according to their own habits. For example, users who use the command "ls -al" do not change the order of the options "ls -la".

Next, it is determined whether the frequency of use of each user command is similar. In general, each user performs routine tasks. Therefore, users often use certain commands. That is, frequently used commands are defined. Therefore, similarity of user usage patterns may be determined based on similarity of usage frequency of each user's command.

In addition, next, in order to use sequences of a dictionary instruction for using a specific instruction, it is determined whether or not the usage pattern is similar. In general, each user has a series of instructions that he or she performs regularly to perform a particular task. The task may be performed according to the execution of another series of commands, but in general, the user performs the task through a command task that is familiar to the user. Thus, by analyzing a series of commands required to perform a specific task, it may be determined whether the user is similar.

Specifically, the behavior model engine 63 inputs session information and command data to build a behavior model through learning. At this time, the input data of the behavior model includes session information and command data, and includes user identification information (user ID, etc.) and session identification information (ID of a device access session). Preferably, the command input time may be further added.

An example of the input data of the behavior model is shown in FIG. In FIG. 10, "_id" represents an object unique value in a DB, and "user_id" represents a user ID connected to equipment. In addition, "command" represents a command input after the device is connected, and "connection_id" represents the ID of the device connection session. The equipment connection session eye can connect and find data such as equipment information and connection protocol information. And "datetime" represents the input time of the statement.

Also, an example of output data of the behavior model is shown in FIG. As the output data (or result data) of the behavior model, a usage pattern of a command for each user is extracted.

In FIG. 11, "_id" is an object unique value in the DB, and "num_distinct_commands" represents the number of unique_commands (non-duplicated) commands. "user_id" is a user ID and indicates which user's command learning model. And "unique_commands" represents the weight for each command modeled through the training data. The command weight is a weight value for determining whether there is an abnormal user.

Specifically, the instruction is trained by the following [Equation 1] to build a model (or pattern) for each user. The following equation shows which options are used with each command, and how often each command is used.

[Equation 1]

That is, the probability at each command line c for a specific user u is calculated by the above equation. Here, α is a predetermined constant and is a pseudocount, and A is the number of distinct commands.

The pseudocount α does not mathematically make the molecule zero. Conceptually, if a new command is entered that is not in the training data, it can be regarded as sensitivity.

In the case of the Naive Bayesian model, all commands are assumed to be independent trials, and the probability at the nth command input can be calculated as the product of all the probabilities up to the nth.

Next, a method of calculating the abnormal user probability by the calculating unit 64 and the abnormal determining unit 35 according to an embodiment of the present invention will be described with reference to FIG. 12.

As shown in FIG. 12, first, the behavioral model for each user is referred to (S11).

The behavior model is previously generated by the behavior model engine 63. That is, the behavior model engine 63 learns about N users. When a specific command is entered, it can find out which user the command is most likely to be.

Specifically, first, N behavior models M are learned in advance as many as the number of users, and operation unit 64 is brought from a database or the like so as to refer to behavior model M (S11).

Next, the command received from the current user is received (S12). The input command is the actual command extracted by the command extractor 32 or the behavior adjuster 61. That is, the entered command consists of the command name and options.

Next, the calculation unit 64 applies the input command to the behavior model for each user, and obtains the probability P for each user (S13). That is, the form of the result consists of a combination of (user ID, probability).

The probability per user is calculated by the number of users (eg N). Here, the probability is not an absolute value but a relative probability that the current user is each user.

In addition, the user-specific probability is calculated by the calculation unit 64.

Next, ranks are assigned according to sizes of N user-specific probabilities (S14). Preferably, the probability of each user is ranked by sorting the probability of each user in descending order. That is, the probability for each user represents the probability that the current user is the corresponding user.

For example, the calculated probability for each user is as follows.

[Example result]

-User: zz_user

-Input command: ls? F? L -l

Result data

  1. [a_user, 90.43]

  2. [b_user, 88.34]

  3. [c_user, 85.32]

  4. [d_user, 82.12]

  5. [e_user, 79.14]

  6. [f_user, 77.23]

  ....

  100. [zz_user, 10.23]

As shown in the result example above, the command “ls? F? L? L” used by the current user “zz_user” is evaluated based on the learning model of the entire user. Examples of the results are as described above.

The resultant value as described above is transmitted to the abnormality determination unit 35.

Next, it is determined whether the user is an abnormal user according to the ranking of the probability of the corresponding user with respect to the input command (S15). Preferably, the judgment work is performed by the abnormal decision unit 35.

The order of users sorted in descending order indicates the predicted value of the probability that the user is correct for the input command string.

Therefore, the abnormality determination unit 35 determines that the user is an abnormal user when the probability of being the corresponding user is below a predetermined rank with respect to a command input by a specific user.

In general, the abnormality determination unit 35 assumes that the user who used the command is correct when the user (or user ID) that inputs the command is included in the applied top N names according to the policy.

Meanwhile, a method of learning a deep learning model or a cyclic neural network model is shown in FIG. 13. 13 is when a command is input. This is a conceptual diagram of how to calculate the probability that a user who enters a command is correct.

In addition, the input command is calculated based on the trained model of the entire user and Equation 1, and the probability that the corresponding user is corrected is calculated as a result value.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the said Example, this invention is not limited to the said Example and can be variously changed in the range which does not deviate from the summary.

Claims (10)

1. In the server access control system for detecting an input instruction learning-based abnormal user is installed in the network between the user terminal and the server, the gateway between the user terminal and the server,

   A relay module for extracting session information and a statement from a packet transmitted from the user terminal and relaying a result of a statement or a server input between the user terminal and the server;

   Receiving session information and statements from the relay module, extracting a command, learning and generating a behavior model indicating a user's command input pattern, and calculating a probability of the abnormal user by applying a user's current command to the behavior model. Detection unit; And,

   Receiving the probability of the abnormal user from the abnormality detection unit, and using the probability of the abnormal user according to a predetermined policy comprises an abnormality determination unit for determining the warning, session blocking, user blocking Server access control system that detects abnormal user learning based instruction.
2. The method of claim 1, wherein the abnormality detection unit,

   An event channel for receiving a statement from the relay module;

   A state channel for providing probability information of an abnormal user to the abnormal determination unit;

   An action coordinator for extracting instructions from the statement;

   A behavior model engine for generating a behavior model for each user through learning;

   Receiving a command from the behavior coordinator, calculates the probability for each user with respect to the received command, the server for detecting the input instruction learning-based abnormal user, characterized in that it comprises a calculation unit using the behavior model Access control system.
3. The method of claim 2,

   The behavior coordinator records and accumulates the command in the behavior log storage, and the behavior model engine continuously learns and updates the behavior model using the accumulated instruction data in the behavior log storage. Server access control system to detect users over infrastructure.
4. The method of claim 2,

   The behavior model is composed of a Bayesian model and a deep learning model,

   The calculating unit calculates a first probability from the Bayesian model, calculates a second probability from the deep learning model, and extracts a final probability by adjusting a ratio between the first probability and the second probability through weights. Server access control system that detects abnormal user input based instruction learning features.
5. The method of claim 2,

   The relay module receives a statement character from the user terminal, and if the statement character is not an enter character, accumulates the statement character to generate a statement cumulative string. Extracting the control character, and if the statement character is a control character, transmitting the accumulated statement cumulative string and the control character to the server, receiving a character string reflecting the control character, and accumulating the reflected character string to generate the cumulative character string. Server access control system for detecting the input command learning based abnormal user, characterized in that.
6. The method of claim 5,

   The relay module transmits any one or more of an echo command, a linked command extract (realpath) command, a command name extract (basename) command, and the accumulated string as an argument of the command to the server, and the server Extract the last statement using the result of the command received from

   The echo command is a command for converting a command that has been processed into a variable, a command including a wild char, and a command including a history to be converted into a command to be actually executed.

   The linked command extract (realpath) command is a linked command extract (realpath) command is a command to return the actual command linked by the symbolic link (Symbolic Link),

   The command name extraction (basename) command is a command for returning the name of the actual execution command except for the path when the command includes a path, wherein the server access control for detecting an abnormal instruction input based instruction system.
7. The method of claim 2,

   The server access control system for detecting an input command learning-based abnormal user, characterized in that the command is extracted with only the command name and command options in the statement.
8. The method of claim 2,

   The behavior model engine learns the behavior model by reflecting the similarity of the input order of options and option strings of each command, the similarity of usage frequency for each instruction, and the similarity of usage patterns according to the usage order of instructions. Server access control system to detect abnormal user input based instruction learning.
9. The method of claim 8,

   The behavior model engine is a server access control system for detecting an input instruction learning-based abnormal user, characterized in that to obtain the behavior model using the following [Equation 1].

   [Equation 1]

   

   Where P _{c and u} represent the probability of the instruction c with respect to the user u, Training Count is the number of training data, Training Data Length is the length of the training instruction, and α is a predetermined constant. pseudocount), and A is the number of distinct commands.
10. The method of claim 2,

    The behavior model is constructed by learning N number of users in advance,

    The operation unit applies all the input commands of a specific user to N behavior models for each user, obtains N user probabilities, ranks the N user probabilities in descending order, and ranks the probabilities for each user.

    The abnormal determination unit determines whether the user is an abnormal user according to the rank of the probability of the corresponding user with respect to the input command, and if the probability that the user is under a certain rank for the command input by a specific user is determined as the abnormal user. Server access control system for detecting an abnormal instruction input based user, characterized in that the.

Images