KR100578503B1 - Intrusion Detection System for Inferring Risk Level - Google Patents

Abstract

The present invention provides a packet collector for collecting network packets, a destination system use use DB storing information on the use of the destination system including the IP of the destination system, and an intrusion type DB storing information on various intrusion types. And, analyzing the packets collected by the packet collector, separating IP and packet data of a destination system, and comparing the packet data with the intrusion type DB to determine whether a predetermined intrusion type is applicable and corresponding to a predetermined intrusion type. The present invention relates to a risk inference intrusion detection system including a packet analyzer that detects and compares the IP of the destination system with the destination system usage DB.

Intrusion Detection System, Packet, Hack

Description

Inference Detection System for Inferring Risk Level

1 is a block diagram showing a conventional intrusion detection system.

Figure 2 is a block diagram showing a risk inference intrusion detection system according to the present invention.

3 is a flowchart illustrating a process of analyzing and informing a detected packet by an intrusion detection system according to the present invention;

4 is a structural diagram showing a hierarchical structure of a database mounted on a hacking pattern DB of an intrusion detection system according to the present invention;

The present invention relates to an intrusion detection system, and more particularly, to a risk inference intrusion detection system that analyzes a network packet and infers a risk to inform an administrator.

 The Internet, a combination of the word International and the word Network, can be found in the ARPANET, which was established in 1969 with the support of the US Department of Defense to link four universities in the United States. It was initially introduced for military purposes, but recently, thanks to the wave of commercialization, millions of people around the world are using the Internet, based on e-mail, remote computer connections, file transfers (FTP), Usenet News, Internet Information Search (Gopher), Internet Conversation and Discussion (IRC), Bulletin Board (BBS), Hypertext Information View (WWW: World Wide Web), Online Games, Movies, or Voice Data in Real Time New services, such as broadcasting services and video conferencing, were developed and available in turn. As the commercialization of the Internet spreads rapidly, the whole world is connected to one Internet network, and the convenience of modern people's life by the Internet is increasing day by day. However, there are risk factors such as information leakage other than the convenience of modern people on the other side of the Internet, which can be easily disrupted and destroyed by criminals called hackers, information leakage, and illegal intrusion. Problems have arisen. In order to prevent such hacking, an intrusion detection system that detects and informs users in advance of unauthorized intrusion by insiders or outsiders is used.

Intrusion detection system is a system that detects intrusion or suspicious behavior in network environment and classifies risk according to detected pattern and informs user of detected result.

As shown in FIG. 1, the conventional intrusion detection system includes a packet collector 22 for collecting network packets, a packet analyzer 24 for analyzing the packets collected by the packet collector 22, and the packet analyzer ( Intrusion type DB that stores information about various intrusion types in order to determine which intrusion type is analyzed by 24) and the packet contents analyzed by the packet analyzer 24 and the intrusion type DB. It consists of a user interface that compares the stored intrusion types and informs the administrator.

However, such a conventional intrusion detection system only uses the destination system which attempts to intrude in the process of comparing the analyzed packet contents with the intrusion type DB (eg, whether the system is a file server, a web server, a mail server, or a DB server). It does not compare whether there are any vulnerabilities, but simply compares the intrusion type DB, and if the collected packet matches the intrusion type of the DB, it generates a risk alarm regardless of the actual risk. And the risk is low, or on the contrary, even though it is not a dangerous packet, it has a problem of high risk. In addition, this problem becomes more serious when it is common to generate thousands of packets in a short time.

The present invention has been made to solve the problems of the conventional detection system, the object of the present invention is to infer the risk inference detection that can be informed after analyzing the packet and infer the risk in consideration of the purpose of the destination system of the detected packet To provide a system.

Another object of the present invention is to make a hacking pattern for each hacking pattern by DB, and if the analyzed packet has a high actual risk, the hacking that is to be generated later will be reported by indicating whether the packet corresponds to which stage of the hacking. It is to provide a risk inference detection system that can be prevented.

The present invention has the following configuration to achieve the above object.

The risk inference intrusion detection system according to the present invention includes a packet collector for collecting network packets, a destination system use DB storing information on the use of the destination system including the IP of the destination system, and information on various intrusion types. Intrusion type DB that stores the data and the packet collected by the packet collector to analyze the IP of the destination system and packet data (packet data collectively the information that can know the ultimate purpose hackers try to separate) And comparing and searching the packet data and the intrusion type DB to determine whether or not a predetermined intrusion type is applicable, and if it corresponds to a predetermined intrusion type, information on a destination system obtained from the IP of the destination system and the intrusion type DB (eg, System OS, system purpose (whether it is Web server, Mail server, FTP server), server program name used And the like, hereinafter referred to as 'characteristic information of the destination system') and the destination system usage DB, the packet analyzer may be inferred and informed of the risk level.

In addition, the risk inference detection system according to the present invention further includes a hacking pattern DB that is loaded with a hierarchical pattern patterning the step of hacking, the packet analyzer if the packet analysis determines that the risk of the analyzed packet is high Comparing the hierarchical structure of the data and the hacking pattern DB is characterized in that the hacking level is informed.

Intrusion detection system according to the present invention is a packet collector collects packets generated on the Internet, the packet analyzer separates the packet data and the IP of the destination system, DB by comparing the separated packet data and the intrusion type DB It is determined whether or not it is an intrusion type on the network, and if it is an intrusion type, it compares the IP of the separated destination system and the characteristic information of the destination system identified from the intrusion type DB with the destination system use DB, and whether it is a real dangerous intrusion attempt. This will alert or inform the administrator.

Furthermore, the intrusion detection system according to the present invention may include a hacking pattern DB equipped with a hierarchical structure patterning the process of hacking, and if the packet analyzer determines that the packet corresponds to an actual dangerous intrusion attempt, By comparing the data with the hacking pattern DB, it is possible to block hacking in advance by alerting or notifying which stage of the hacking step the hacking step and the hacking to occur in the future.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

2, the intrusion detection system of the present invention includes a packet collector 42, a packet analyzer 44, a destination system use DB 45 and an intrusion type DB 48 interoperable with the packet analyzer 44; The hacking pattern DB 47 and a user interface 46 for alerting and notifying the analyzed content are configured.

The packet collector 42 intercepts and collects all packets transmitted / received through an internet network or a network, and thus a description thereof will be omitted.

Since the intrusion type DB 48 classifies intrusion types by category and stores information on the intrusion types, new intrusion types as well as existing intrusion types may be added at any time. For example, the DB for the intrusion type mounted on the server 48 may have a structure defined conceptually on the basis of large classification and medium classification as shown in the following table. Of course, the structure is not limited to this. As described above, since all intrusion types mounted on the intrusion type DB 48 are loaded by analyzing intrusion cases that have already occurred, the packet analyzer 44 of the destination system vulnerable to the intrusion type in the process of analyzing the intrusion type. Characteristic information can be grasped automatically.

    Table 1: Major Category

Major Category Explanation Information gathering attack It is an attack that collects network or system vulnerabilities before hacking is performed. Through this attack, you can see the version of the application used by the OS of the system or open ports. This is the type of attack that can lead to hacking. Intrusion attack In fact, the type of attack is underway. These types include buffer overflows when leaking or illegal operation of information inside the system such as backdoors, attempting to gain unauthorized access, attempting to interpret the protocol to view mail or user IDs / passwords, and so on. This type of attack requires immediate action, such as attempting an intrusion using a vulnerability. Denial of Service Attack A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a particular server. It does not leak internal information, but it can be fatal to business due to a malfunction. Etc Although not a pattern of hacking, this is a classification type that requires attention or is necessary for administrative statistics, and is used for applications (e.g. ICQ, IRC, etc.) It includes.

Table 2: Mid Category

Main Category Category Explanation Information gathering attack Aggression probe It is a type of attack that collects proactive information for attempting unauthorized access (attack), and this type includes scans using Satan, ports, and IP scans. Suspicious behavior In general, the action is performed after the pre-attack probe, which requires more attention than the pre-attack probe, and an attempt is made to check open ports at the previous stage and to obtain more detailed information through the port. Intrusion attack Backdoor It exists in the form of a virus, and there are various types from leaking various information to the outside to be able to illegally take control of the system from outside and monitor the communication port connected to the outside. The backdoor used must be deleted. Buffer overflow It is an attack that exploits a vulnerability that occurs when the buffer used by the system and application internal code overflows, and it must be implemented considering such risks when all programs are written, but it can be a major target if it does not. In the case of system programs, a patch program that fixes known vulnerabilities should be installed. IP spoofing It is an attack type to deceive a firewall that controls access based on an IP address. It is an attack that uses the passive protection method of a firewall to infiltrate the IP address of a computer attempting hacking as accessible. Even after analyzing the log, it may be misleading. Protocol analysis attempt It is an attempt to analyze a protocol by intercepting a network packet, and if each packet is not encrypted, it is a type of attack that may expose sensitive information such as a user ID and a password, and leak the contents of an exchanged mail. . Unauthorized access attempt It is a serious type of attack that attempts to intrude into the internal network or system without authorization or the information inside can be leaked to the outside. In this case, immediate action must be taken to minimize the damage. Denial of Service Attack DOS A denial of service attack is a type of attack that generates a huge amount of network traffic for the purpose of shutting down a server. There are patterns of attacks from one location or from several distributed locations simultaneously. Etc application Information about the application patterns used, and may be vulnerable to known hacking attacks against these applications. In particular, attention should be paid to the messenger program. Misuse Detects information about misuse that is connected regardless of work, and may be necessary for internal management purposes but is not related to hacking. These types include pornography, gambling, sports, and securities. Web information This is a type of information used to connect to internal web server from outside, and some of them may require attention depending on the type and version of web server. Other information Although it cannot be classified as an attack pattern, it shows various other information detected by intrusion detection.

The destination system use DB 45 is the IP of the destination system, the OS (window NT, Solaris, Linux, etc.) used for the system, the purpose of the system (FTP server, Web server, Mail server, DB server, etc.), Server program name used in the system (e.g., Web server uses lls or Aparch, FTP server uses wu-ftpd or proftpd, Mail server uses Msexchange or Lotusnotes, DB server uses Oracle, MsSQL SERVER, etc.) (Hereinafter referred to as 'purpose system usage information').

As illustrated in FIG. 4, the hacking pattern DB 47 stores the hacking pattern structure DB hierarchically structured by subdividing the hacking step by hacking type.

Referring to FIG. 3, the packet analyzer 44 separates the collected packets from IP of the destination system and packet data (52, 54), and compares the analyzed packet data with the DB of the intrusion type DB 48. It is determined whether or not it corresponds to the predetermined intrusion type (56), and if it does not correspond to the predetermined intrusion type, the analysis is terminated (66). Furthermore, if the collected packet corresponds to a predetermined intrusion type, the packet analyzer 44 has destination system usage information that is the same as the IP of the separated destination system and destination system characteristic information identified from the intrusion type DB 47. Search the destination system usage DB 45 to determine whether the destination system exists (58), and if it is present, determine that the packet is dangerous to affect the destination system to alert the user or (64) otherwise end the analysis (66). In addition, the packet analyzer 44 determines that the packet is an intrusion to harm the system (60), and then searches for the hacking pattern structure DB mounted on the DB 47 in association with the hacking pattern DB 47 (62). The packet may be further alerted or notified at which stage of the hack and in which direction it will develop (64).

  The operation of the intrusion detection system according to the embodiment of the present invention as described above will be described as follows.

  "Code Red" is a type of worm that enters through windowNT's IIS web server and infects windowNT's IIS web server by making packets in very short cycles. As soon as IIS receives the packet created by "Code Red", it becomes infected with Code Red. However, "Code Red" does not affect mail server or FTP server other than web server because it only infects web server whose window system is windowNT and IIS is IIS. It has no effect on web servers that do not use.

Thus, although "Code Red" only infects the IIS web server of windowNT, the conventional intrusion detection system only detects packets made by "Code Red" and examines whether the destination system is a web server or a mail server. If the destination system is a mail server, the alarm is triggered, and the user may be insensitive to the warning message about the danger and cannot respond quickly.

However, according to the intrusion detection system according to the present invention, the packet collector 42 collects packets made by "Code Red". The packet analyzer 54 then separates the packet into IP and packet data of the destination system (52, 54), and determines whether the packet corresponds to a predetermined intrusion type mounted in the intrusion type DB 48. 56, if the packet corresponds to a predetermined intrusion type, search for the destination system use DB 45, and as a result, IP of the destination system separated from the packet and the intrusion type DB 47 If there exists a destination system with the destination system usage information (OS is windowNT, the server program is IIS) and the destination system characteristic information (OS is windowNT, the server program is IIS). , Warns or notifies you that the risk is high (60, 64), and otherwise (for example, if the OS is Aparch, even if the OS is Solaris, Linux, FTP server, Mail server, or web server). No warning light Be carried out nor end the analysis (66).

In addition, when it is determined that the risk is high, the packet analyzer 44 determines which stage of the hierarchical structure of the hacking pattern DB 47 in which the packet is loaded with a hacking pattern having a hierarchical structure as shown in FIG. It may determine whether or not to further inform or warn the user of the steps (62, 64). As shown in Fig. 4, the attack by “code red” is a kind of denial of service attack by a virus, and thus the attack phase may be classified into an initial denial of service, an intermediate denial of service, and a denial of service attack step. Each stage is distinguished by the number of denial of service attack packets generated per unit time. The hierarchical structure of the hacking pattern DB 47 is classified based on the number of packets generated by " code red " per unit time. For example, the number of packets is less than 10 for 30 seconds. Less than 100 are structured as intermediate denial of service, and less than 200 are denial-of-service attacks during 10 seconds and are mounted on the DB 47. Accordingly, the packet analyzer 44, in conjunction with the hacking pattern DB 47, notifies the user of the initial stage of denial of service if the number of packets generated by "code red" is less than 10 per 30 seconds. Alerts that there is a possibility to proceed to the stage and service attack phase, alerts that the service is intermediate if it is within 100 per 10 seconds, alerts that it is likely to proceed to the service attack phase later, and alerts to the service attack phase if it is within 200 per 10 seconds. .

The above embodiments are merely examples of the present invention, and the present invention may be changed and modified without exceeding its technical scope.

By the above configuration, the present invention can achieve the following effects.

Since the present invention can infer and inform the risk by analyzing the packet in consideration of the purpose of the destination system of the detected packet, it is possible to prevent the intrusion detection system from being ineffective due to the false alarm. We can plan.

According to the present invention, if a hacking pattern is processed by DB, the hacking process is made into a DB, and if the analyzed packet has a high risk, the step of hacking is notified. The effect can be aimed at.

Claims (2)

A packet collector for collecting network packets, a destination system use DB storing information on the use of the destination system including the IP of the destination system, an intrusion type DB storing information on various intrusion types, and Analyzes the packets collected by the packet collector to separate the IP of the destination system and the packet data, and compares the packet data and the intrusion type DB to determine whether a predetermined intrusion type is applicable. Inferring the risk by judging the existence of the destination system with usage information that matches the IP and the characteristic information by searching and comparing the characteristic information of the destination system identified from the system IP and the intrusion type DB and the destination system usage DB. Risk inference intrusion detection system including a packet analyzer to inform. The method of claim 1, wherein the intrusion detection system further comprises a hacking pattern DB that loads a hierarchical structure patterning the process of hacking, the packet analyzer when the packet analyzer determines that the risk of the analyzed packet is high Inference detection intrusion detection system, characterized in that the comparison of the hierarchical structure of the data and the hacking pattern DB to inform the step of belonging to the packet.

Images