KR20230009307A - Method for identification iot devices, and network management apparatus implementing the method - Google Patents

Abstract

The present invention relates to an operation method of a network management device which comprises the steps of: extracting source IP addresses communicating with a specific destination IP address of an IoT management server from session data over a certain period of time as IoT device candidates; calculating a statistical value of a first IoT identification index for each IoT device candidate from the session data; and comparing the statistical value of the first IoT identification index for each IoT device candidate with a reference value to identify a candidate for a specific source IP address as an IoT device. The first IoT identification index comprises the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of uniform resource identifiers (URI) used in a request transmitted by the corresponding IoT device candidate. According to an embodiment, in a network in which large traffic of tens of Gbps occurs, the IoT device communicating with an IoT management server can be identified even without basic information on the session data.

Description

IoT device identification method and network management device implementing the same

This disclosure relates to IoT device identification.

A server platform such as an Internet Data Center (IDC) provides hosting services and has various internal servers. However, it is difficult to prevent accidents related to network threats because it is difficult to manage all servers. In addition, in the case of a server platform such as IDC, it is impossible to analyze all packets or session logs because billions of sessions occur every day.

Recently, as IoT services increase, various types of IoT devices are connected to servers, but IoT devices are not recognized as devices requiring security, and there are few resources available for security functions, so they are very vulnerable to hacking. IoT devices such as CCTVs and artificial intelligence speakers can contain personal information, but they are vulnerable to DDoS attacks, so there is a risk of personal information being leaked. In addition, since there is a possibility of attacking the network through the IoT device, it is necessary to prevent accidents related to network threats by identifying IoT devices connected to the server and monitoring their normal operation.

On the other hand, in order to detect the IoT equipment connected to the network, the signature of the IoT device is used. However, as IoT devices diversify and types of services diversify, there is a limit to identifying and managing the characteristics of various IoT devices individually through a feature-based detection method. Also, if network personnel do not know about the new IoT device, they cannot characterize the new device.

The present disclosure provides an IoT device identification method and a network management device implementing the same.

A method of operating a network management device according to an embodiment, comprising extracting source IP addresses communicated with a specific destination IP address of an IoT management server as IoT device candidates from session data for a certain period of time, in the session data, IoT Calculating a statistical value of a first IoT identification indicator for each device candidate, and identifying a candidate of a specific source IP address as an IoT device by comparing the statistical value of the first IoT identification indicator for each IoT device candidate with a reference value include The first IoT identification index includes the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of Uniform Resource Identifiers (URIs) used in requests transmitted by the corresponding IoT device candidate.

The first IoT identification index may further include at least one of a transaction depth average and the number of time intervals in which sessions occur.

The operation method includes calculating a statistical value of a second IoT identification indicator for each destination IP address in the session data, and comparing the statistical value of the IoT identification indicator for each destination IP address with a reference value to obtain the specific destination IP address. The step of determining the address of the IoT management server may be further included. The second IoT identification indicator may include a coefficient of variation of the number of source IP addresses connected to the corresponding destination IP address.

The second IoT identification index may further include at least one of a transaction depth average and the number of time intervals in which sessions occur.

The step of calculating the statistical value of the second IoT identification indicator classifies the session data collected for each predetermined time unit by destination IP address, and uses the session data of each destination IP address to determine the number of source IP addresses for each predetermined time unit. and calculating a transaction depth average, and a statistical value of the second IoT identification indicator for each destination IP address by aggregating the number of source IP addresses and the transaction depth average calculated for each destination IP address at each predetermined time unit for a predetermined period of time. It may include a step of calculating .

The session data may include a session occurrence timestamp extracted from an HTTP log of each session, a connection identifier, a source IP address, a destination IP address, a transaction depth, and a Uniform Resource Identifier (URI).

A method of operating a network management device according to another embodiment, comprising: calculating a statistical value of an IoT identification indicator for each destination IP address for identification of an IoT management server in session data for a predetermined period of time, and IoT identification for each destination IP address. Determining a destination IP address corresponding to the IoT management server based on statistical values of indicators, extracting source IP addresses communicated with the IoT management server from the session data as IoT device candidates, the session data In, calculating a statistical value of an IoT identification index for each IoT device candidate for identification of the IoT device, and identifying the IoT device among the IoT device candidates based on the statistical value of the IoT identification index for each IoT device candidate contains steps

The IoT identification indicator for each destination IP address may include a coefficient of variation of the number of source IP addresses connected to the corresponding destination IP address.

The IoT identification index for each destination IP address may further include at least one of a transaction depth average and the number of time intervals in which sessions occur.

Determining the destination IP address corresponding to the IoT management server may include: among statistical values of each IoT identification index calculated for a destination IP address, the coefficient of variation is equal to or less than a first reference value, and the transaction depth average is a second reference value or less, and when the number of time intervals is greater than or equal to the third reference value, the arbitrary destination IP address may be determined as the address of the IoT management server.

The IoT identification indicator for each IoT device candidate may include the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of Uniform Resource Identifiers (URIs) used in requests transmitted by the corresponding IoT device candidate.

The IoT identification index for each IoT device candidate may further include at least one of a transaction depth average and the number of time intervals in which sessions occur.

In the step of identifying the IoT device, the number of destination IP addresses and/or the URI are less than or equal to a first reference value, and the average transaction depth is a second reference value, among statistical values of each IoT identification indicator calculated for an arbitrary IoT device candidate. or less, and when the number of time intervals is greater than or equal to the third reference value, the arbitrary IoT device candidate may be identified as the IoT device.

The step of calculating the statistical value of the IoT identification indicator for each destination IP address is to classify the session data collected for each predetermined time unit by destination IP address, and use the session data of each destination IP address to determine the source IP address for each predetermined time unit. Calculating the number of addresses and the average of the transaction depth, and a statistical value of the IoT identification index for each destination IP address by aggregating the number of source IP addresses and the average of the transaction depth calculated for each destination IP address at each predetermined time unit for the predetermined period of time It may include a step of calculating .

The session data may include a session occurrence timestamp extracted from an HTTP log of each session, a connection identifier, a source IP address, a destination IP address, a transaction depth, and a Uniform Resource Identifier (URI).

According to the embodiment, it is possible to identify an IoT device communicating with an IoT management server even if basic information on session data is not given in a network where a large amount of traffic of several tens of Gbps occurs.

According to the embodiment, since IoT devices connected to the network can be identified, abnormal operations of the identified IoT devices can be detected, and infection prevention measures can be taken to provide a basis for maintaining a stable network.

1 is a diagram conceptually illustrating an IoT network environment according to an embodiment.
2 is a diagram for explaining a step-by-step identification method of an IoT management server and an IoT device according to an embodiment.
3 is a flowchart of a method for identifying an IoT device according to an embodiment.

Hereinafter, with reference to the accompanying drawings, embodiments of the present disclosure will be described in detail so that those skilled in the art can easily carry out the present disclosure. However, the present disclosure may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly describe the present disclosure in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

In the description, reference numerals and names are attached for convenience of explanation, and devices are not necessarily limited to reference numerals or names.

In the description, when a part is said to "include" a certain component, it means that it may further include other components without excluding other components unless otherwise stated. In addition, terms such as “… unit”, “… unit”, and “module” described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. there is.

In the description, a computing device may include one or more processors, memory for loading programs executed by the processors, and storage for storing computer programs and various data. In addition, the computing device may further include various components. A computer program may include instructions that, when loaded into memory, cause a processor to perform methods/operations in accordance with various embodiments of the present disclosure. That is, the processor may perform methods/operations according to various embodiments of the present disclosure by executing instructions. An instruction refers to a set of computer readable instructions grouped on a functional basis that are the building blocks of a computer program and are executed by a processor.

The processor controls the overall operation of each component of the computing device. The processor includes at least one of a Central Processing Unit (CPU), a Micro Processor Unit (MPU), a Micro Controller Unit (MCU), a Graphic Processing Unit (GPU), or any type of processor well known in the art of the present disclosure. It can be. Also, the processor may perform an operation for at least one application or program for executing a method/operation according to various embodiments of the present disclosure.

The memory stores various data, commands and/or information. The memory may load one or more computer programs from storage to execute methods/actions according to various embodiments of the present disclosure. The memory may be implemented as a volatile memory such as RAM, but the technical scope of the present disclosure is not limited thereto.

The storage may non-temporarily store the computer program. The storage may include non-volatile memory such as read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, etc., a hard disk, a removable disk, or any well known in the art to which the present disclosure pertains. It may be configured to include a computer-readable recording medium in the form of.

1 is a diagram conceptually illustrating an IoT network environment according to an embodiment, and FIG. 2 is a diagram illustrating a step-by-step identification method of an IoT management server and an IoT device according to an embodiment.

Referring to FIG. 1 , the network management device 100 extracts session data between a connected server and a client from traffic transmitted from a managed network, and uses the session data to extract a plurality of connected IoT management servers 200. The IoT devices 300 of can be identified. Here, the IoT management server 200 may be designed to receive data from a certain number of IoT devices and manage them. The IoT device 300 refers to a device that is periodically connected to a server and transmits data. The type of IoT device 300 may vary according to the IoT service. For example, the IoT device 300 may be a terminal used in services such as solar power generation, bus route inquiry, printer copier rental management system, CCTV, smart home service, and the like.

The network management device 100 may be implemented as a computing device operated by at least one processor, and may manage, for example, a network of server platforms such as an Internet Data Center (IDC) in which a plurality of servers are built. .

The network management device 100 may identify the IoT management server 200 from the session data and identify the IoT device 300 connected to the identified IoT management server 200 step by step. The network management device 100 may extract statistical values of indicators for IoT identification from session data of a certain period of time and first identify the IoT management server 200 based on the statistical values of the IoT identification indicators. And, the network management device 100 may identify the IoT device 300 based on the statistical value of the IoT identification indicator among devices communicating with the server identified as the IoT management server 200 .

The network management device 100 may identify an IoT device using the HTTP protocol from session data, and the session data may be obtained using a network traffic analysis tool. Session data may be obtained by combining network packets generated during a connection process established based on a source and a destination. Here, the session data may be obtained from an HTTP log recording a connection of a request/response transaction transmitted according to the HTTP protocol. As shown in Table 1, the session data may include items obtained from the HTTP log.

Item Described Session Occurrence Timestamp (ts) Timestamp for when the request happened connection identifier (uid) unique identifier of the connection Source IP address (id.orig_h) source IP address Origin port (id.orig_p) port of departure Destination IP address (id.resp_h) destination IP address destination port (id.resp_p) destination port Transaction depth (trans_depth) Represents the pipelined depth into the connection of this request/response transaction URI Uniform Resource Identifier (URI) used in the request

The IoT device operates 24 hours a day and regularly transmits data such as status information to the IoT management server. The network management device 100 statistically processes session data of the server and the client to identify the IoT management server and IoT devices having these IoT characteristics. At this time, the network management device 100 groups the session data based on the destination IP address (IP address of the IoT management server candidate) every predetermined time unit, and if the number of source IP addresses included in the grouped session data is similar, The server of the destination IP address can be identified as the IoT management server. The network management device 100 may identify a terminal mainly connected to the identified IoT management server as an IoT device.

Referring to FIG. 2 , the network management device 100 collects session data from HTTP logs. Session data may include a session occurrence timestamp (ts), connection identifier (uid), source IP address, source port, destination IP address, destination port, transaction depth, URI, and the like.

The network management device 100 classifies the session data collected every predetermined time unit (eg, 1 hour) based on the destination IP address, and determines the number of unique source IP addresses in the classified session data and the transaction depth. Calculate the average.

The network management device 100 aggregates the number of source IP addresses calculated for each destination IP address and the average of the transaction depth for a certain period of time (for example, one day) per certain time unit (for example, one hour), so that the destination IP address Calculate the statistical value of each IoT identification index. The IoT identification index for identification of the IoT management server may include a coefficient of variation (CV) of the number of source IP addresses, an average transaction depth, and the number of session time intervals (number of BINs).

The coefficient of variation of the number of source IP addresses is a value obtained by dividing the standard deviation by the average, and the coefficient of variation decreases as the number of similar source IP addresses is collected in a unit of time. The smaller the coefficient of variation of the number of source IP addresses is, the higher the possibility of being an IoT management server.

The transaction depth average used as an IoT identification index is a value calculated by averaging transaction depth averages per hour for a day. The closer to 1, the more likely it is the IoT management server. In the case of web communication, multiple requests (script, img, css, XHR, etc.) are generated internally for one web page load. Here, when one web page load is referred to as one transaction, depth is internally assigned to each request in order. Therefore, the depth increases as the number of internal requests increases. Since IoT devices usually make a single request, the transaction depth is mostly 1. The closer the transaction depth average is to 1, the more likely it is the IoT management server.

The number of session occurrence time intervals (number of BINs) is a value obtained by calculating the number of time intervals in which sessions occur among time intervals divided by a certain period (eg, one day) based on the session occurrence timestamp (ts), The larger the number of time intervals in which sessions occur, the more likely it is the IoT management server, since it means regular connection every hour. The number of time intervals (number of BINs) in which sessions occur is, for example, a value obtained by dividing 24 hours by 1-hour time intervals (BINs) and counting the number of intervals in which sessions occur among the 24 intervals.

The network management device 100 may determine the destination IP address as the address of the IoT management server by comparing the IoT identification index for each destination IP address with a reference value. The reference value may be set in various ways depending on the characteristics of the IoT device and IoT service. For example, the coefficient of variation of the number of source IP addresses is 0.2, the average transaction depth is 1.2 or less, and the number of time intervals in which sessions occur (number of BINs) A destination IP address A having an IoT identification index of 20 or more may be determined as an address of an IoT management server.

When the destination IP address A is identified as the IoT management server, the network management device 100 extracts source IP addresses communicated with the destination IP address A. At this time, the network management device 100 is the starting point communicating with the destination IP address A in the session data for a period (eg, one day) for calculating the statistical value of the IoT identification index for each destination IP address, not a unit of a certain time. IP addresses can be extracted as IoT device candidates.

In order to determine whether the IoT device candidate has IoT characteristics, the network management device 100 uses statistics of IoT identification indicators for each source IP address corresponding to the IoT device candidate in session data for a certain period of time (eg, one day). Calculate the value. The IoT identification index for IoT device identification may include the number of destination IP addresses, the number of URIs, the average transaction depth, and the number of session time intervals (number of BINs).

Since an IoT device communicates with a designated server, the lower the number of destination IP addresses or URIs, the higher the probability of being an IoT device. Since an IoT device usually makes a single request, the closer the transaction depth average is to 1, the more likely it is an IoT device. The larger the number of time intervals in which sessions occur, the more likely it is an IoT device, since it means regular connection every hour.

The network management device 100 may compare the IoT identification index for each source IP address with a reference value to determine the source IP address B, which is an IoT device candidate, as the address of the IoT terminal. The reference value may be set in various ways depending on the characteristics of the IoT device and IoT service. For example, the number of destination IP addresses/URIs is 5 or less, the average transaction depth is 1.2 or less, and the number of session time intervals (number of BINs) is A source IP address B having an IoT identification index of 20 or more may be determined as an address of an IoT management server. Some of the IoT device candidates may be terminals used by general users.

Meanwhile, the network management device 100 may already know the IP address of the IoT management server it manages. Therefore, the network management device 100 skips the step of identifying the IoT management server, extracts source IP addresses that have communicated with the known IoT management server from the session data, and calculates statistical values of IoT identification indicators for each source IP address. can

3 is a flowchart of a method for identifying an IoT device according to an embodiment.

Referring to FIG. 3 , the network management apparatus 100 collects session data of a server and a terminal connected through a network (S110). The network management device 100 includes, from the HTTP log of each session, a session occurrence timestamp (ts), a connection identifier (uid), a source IP address, a source port, a destination IP address, a destination port, a transaction depth, a URI, and the like. Session data can be collected.

The network management device 100 classifies the session data collected per predetermined time unit by destination IP address, and calculates the average number of source IP addresses and transaction depth for each predetermined time unit using the session data of each destination IP address. (S120).

The network management device 100 aggregates the number of source IP addresses calculated for each destination IP address and the average transaction depth for a predetermined period of time for each destination IP address, and the statistical value of the IoT identification index for identification of the IoT management server for each destination IP address. Calculate (S130). The IoT identification index for identification of the IoT management server may include a coefficient of variation of the number of source IP addresses. The IoT identification index for identification of the IoT management server may further include an average transaction depth and the number of session time intervals (number of BINs).

The network management device 100 compares the statistical value of the IoT identification index for each destination IP address with the reference value, and determines a specific destination IP address as the address of the IoT management server (S140).

The network management device 100 extracts source IP addresses communicated with a specific destination IP address as IoT device candidates from session data for a certain period of time (S150).

The network management device 100 calculates statistical values of IoT identification indicators for IoT device identification for each IoT device candidate in session data for a certain period of time (S160). IoT identification indicators for identification of IoT devices may include the number of destination IP addresses or the number of URIs. The IoT identification index for identification of the IoT device may further include a transaction depth average and the number of session time intervals (number of BINs).

The network management device 100 identifies a candidate for a specific source IP address as an IoT device by comparing the statistical value of the IoT identification indicator for each IoT device candidate with the reference value (S170).

In this way, according to the embodiment, it is possible to identify an IoT device communicating with the IoT management server even if basic information on session data is not given in a network where a large amount of traffic of tens of Gbps occurs.

According to the embodiment, since IoT devices connected to the network can be identified, abnormal operations of the identified IoT devices can be detected, and infection prevention measures can be taken to provide a basis for maintaining a stable network.

The embodiments of the present disclosure described above are not implemented only through devices and methods, and may be implemented through a program that realizes functions corresponding to the configuration of the embodiments of the present disclosure or a recording medium on which the program is recorded.

Although the embodiments of the present disclosure have been described in detail above, the scope of the present disclosure is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present disclosure defined in the following claims are also included in the present disclosure. that fall within the scope of the right.

Claims (15)

As a method of operating a network management device,
Extracting source IP addresses that have communicated with a specific destination IP address of the IoT management server as IoT device candidates from session data for a certain period of time;
Calculating a statistical value of a first IoT identification indicator for each IoT device candidate in the session data; and
Identifying a candidate of a specific source IP address as an IoT device by comparing a statistical value and a reference value of a first IoT identification index for each IoT device candidate,
The first IoT identification indicator is
An operation method comprising the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of Uniform Resource Identifiers (URIs) used in requests transmitted by the corresponding IoT device candidate. In paragraph 1,
The first IoT identification indicator is
Further comprising at least one of a transaction depth average and the number of time intervals in which a session occurred. In paragraph 1,
Calculating a statistical value of a second IoT identification indicator for each destination IP address in the session data; and
Further comprising determining the specific destination IP address as the address of the IoT management server by comparing a statistical value and a reference value of IoT identification indicators for each destination IP address,
The second IoT identification index includes a coefficient of variation of the number of source IP addresses connected to the corresponding destination IP address. In paragraph 3,
The second IoT identification indicator is
Further comprising at least one of a transaction depth average and the number of time intervals in which a session occurred. In paragraph 3,
Calculating the statistical value of the second IoT identification indicator
Classifying the session data collected per predetermined time unit by destination IP address, and calculating the number of source IP addresses and the average transaction depth for each predetermined time unit using the session data of each destination IP address; and
Calculating a statistical value of the second IoT identification index for each destination IP address by aggregating the number of source IP addresses and the average transaction depth calculated for each destination IP address at each predetermined time unit for the predetermined period of time
Including, operating method. In paragraph 1,
The session data includes a session occurrence timestamp, a connection identifier, a source IP address, a destination IP address, a transaction depth, and a Uniform Resource Identifier (URI) extracted from an HTTP log of each session. As a method of operating a network management device,
Calculating a statistical value of an IoT identification indicator for each destination IP address for identification of an IoT management server in session data for a period of time;
Determining a destination IP address corresponding to the IoT management server based on the statistical value of the IoT identification index for each destination IP address;
Extracting source IP addresses communicated with the IoT management server as IoT device candidates from the session data;
In the session data, calculating a statistical value of an IoT identification indicator for each IoT device candidate for IoT device identification, and
Identifying the IoT device among the IoT device candidates based on the statistical value of the IoT identification indicator for each IoT device candidate.
Operation method including. In paragraph 7,
The IoT identification index for each destination IP address is
An operation method comprising a coefficient of variation of the number of source IP addresses connected to a corresponding destination IP address. In paragraph 8,
The IoT identification index for each destination IP address is
Further comprising at least one of a transaction depth average and the number of time intervals in which a session occurred. In paragraph 8,
Determining the destination IP address corresponding to the IoT management server
Among the statistical values of each IoT identification index calculated for an arbitrary destination IP address, when the coefficient of variation is less than or equal to a first reference value, the average transaction depth is less than or equal to a second reference value, and the number of time intervals is greater than or equal to a third reference value, the random An operation method of determining a destination IP address as an address of the IoT management server. In paragraph 7,
The IoT identification index for each IoT device candidate is
An operation method comprising the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of Uniform Resource Identifiers (URIs) used in requests transmitted by the corresponding IoT device candidate. In paragraph 11,
The IoT identification index for each IoT device candidate is
Further comprising at least one of a transaction depth average and the number of time intervals in which a session occurred. In paragraph 12,
Identifying the IoT device
Among the statistical values of each IoT identification index calculated for an arbitrary IoT device candidate, the number of destination IP addresses and/or the URI is less than or equal to a first reference value, the average transaction depth is less than or equal to a second reference value, and the number of time intervals is less than or equal to a first reference value. If it is equal to or greater than the reference value of 3, identifying the random IoT device candidate as the IoT device. In paragraph 7,
Calculating the statistical value of the IoT identification index for each destination IP address
Classifying the session data collected per predetermined time unit by destination IP address, and calculating the number of source IP addresses and the average transaction depth for each predetermined time unit using the session data of each destination IP address; and
Calculating a statistical value of the IoT identification indicator for each destination IP address by aggregating the number of source IP addresses and the average transaction depth calculated for each destination IP address at each predetermined time unit for the predetermined period of time
Including, operating method. In paragraph 7,
The session data includes a session occurrence timestamp, a connection identifier, a source IP address, a destination IP address, a transaction depth, and a Uniform Resource Identifier (URI) extracted from an HTTP log of each session.

Images