KR102616603B1 - Supporting Method of Network Security and device using the same - Google Patents

Abstract

The present invention includes collecting a packet list containing at least some packets transmitted to a network server device, and determining whether the packets included in the packet list are attack packets that violate NIDPS (Network Intrusion Detection and Prevention System) security rules. A step of inspecting, when the attack packet is detected, a step of applying a kill chain rule that evaluates threat elements on a process basis to the detected attack packet, and at least including information about the attack stage according to the application of the kill chain rule. Disclosed is a network security support method and a network security support device using the same, comprising the steps of generating a packet security message and transmitting the generated packet security message to a designated administrator device.

Description

{Supporting Method of Network Security and device using the same}

The present invention relates to network security, and more specifically, to a network security support method that can define, identify, and report packets with attack patterns by process, and a security support device using the same.

An environment in which various information can be exchanged is provided through the Internet network. However, there is a problem of maliciously attacking other people's computing devices through such Internet networks. For example, zero-day attacks that attack vulnerabilities in specific computing systems are becoming a problem. To solve this problem, attack packets could previously be stored using Packet Capture Appliance (PCA) equipment. The PCA equipment uses a Network Intrusion Detection and Prevention System (NIDPS) engine, and the NIDPS engine can perform Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) functions. Packets passed from the NIDPS engine are stored in the PCA device, and when rules for new attack patterns are updated, they can be applied to the stored packets.

Since the security support method using the conventional PCA and NIDPS engine described above only provides the function of passing the collected packets through the NIDPS engine and then simply storing and outputting the test results to the DB, the administrator must individually check the stored test results. There were difficulties in doing so, and as a result, there was a problem that defense against vulnerability attacks was very delayed.

The present invention is intended to solve the above-described conventional problems. The present invention is a network security support method that allows the characteristics of an attack packet to be quickly determined by defining and analyzing each threat element on the inspection results of the attack packet. and providing security support devices that support this.

A network security support device according to an embodiment of the present invention has a communication interface connected to a network to form a communication channel, a storage unit for storing at least some packets received through the communication interface, and a functional combination of the communication interface and the storage unit. and a connected improved security support device, wherein the improved security support device collects a packet list including at least a portion of packets received by the communication interface, and determines whether a security rule is violated for packets included in the packet list. It includes a packet inspection engine that inspects, an analysis module that evaluates threat elements on a per-process basis for attack packets that violate security rules among the packets, and an analysis result processing module that generates and reports a packet security message according to the evaluation results. It is characterized by

Meanwhile, the packet inspection engine determines whether the packets are attack packets based on whether they violate Network Intrusion Detection and Prevention System (NIDPS) security rules.

In addition, the analysis module is characterized in that it determines the attack stage for the attack packet according to the kill chain rule.

Here, the analysis module is characterized in that it analyzes the attack stage of the currently collected attack packet in time series with reference to the attack stage of the previous attack packet stored in the storage unit.

Additionally, the analysis result processing module generates the packet security message including information on when the attack packet was received, source and destination information of the attack packet, and a predefined response plan corresponding to the attack stage. Do it as

In particular, the analysis result processing module performs attack response processing according to the response method and includes the result of the attack response processing in the packet security message.

A network security support method according to an embodiment of the present invention includes collecting a packet list containing at least some packets transmitted to a network server device, and packets included in the packet list are NIDPS (Network Intrusion Detection and Prevention System) security. Checking whether an attack packet violates a rule; If the attack packet is detected, applying a kill chain rule that evaluates threat elements on a process basis to the detected attack packet; Following application of the kill chain rule The method includes generating a packet security message containing at least information about the attack stage and transmitting the generated packet security message to a designated administrator device.

In the above method, the step of applying the kill chain rule includes the step of analyzing the attack stage of the currently collected attack packet in time series with reference to the attack stage of the previous attack packet stored in the storage unit.

In addition, the step of generating the packet security message includes generating the packet security message including information on when the attack packet was received, source and destination information of the attack packet, and a predefined response plan corresponding to the attack step. It is characterized by including steps.

In this case, the step of generating the packet security message may further include performing attack response processing according to the response method and including a result of the attack response processing in the packet security message.

According to the network security support method and the security support device using the same according to the present invention, the present invention supports faster determination of the threat elements of attack packets, thereby securing time to establish an appropriate response strategy. do.

Figure 1 is a diagram showing an example of an environment to which a network security support device according to an embodiment of the present invention is applied.
Figure 2 is a diagram showing an example of the configuration of a network security support device according to an embodiment of the present invention.
Figure 3 is a diagram showing an example of a time series analysis method within a period of a network security support device according to an embodiment of the present invention.

It should be noted that in the following description, only the parts necessary to understand the embodiments of the present invention will be described, and descriptions of other parts will be omitted to the extent that they do not distract from the gist of the present invention.

The terms or words used in the specification and claims described below should not be construed as limited to their usual or dictionary meanings, and the inventor should use the concept of terminology appropriately to explain his/her invention in the best way. It must be interpreted as meaning and concept consistent with the technical idea of the present invention based on the principle that it can be defined clearly. Therefore, the embodiments described in this specification and the configurations shown in the drawings are only preferred embodiments of the present invention and do not represent the entire technical idea of the present invention, and therefore various equivalents can be substituted for them at the time of filing the present application. It should be understood that there may be variations.

Hereinafter, embodiments of the present invention will be described in more detail with reference to the attached drawings.

Figure 1 is a diagram showing an example of an environment to which a network security support device according to an embodiment of the present invention is applied.

Referring to FIG. 1, the network security support environment 10 includes a network 50 composed of various network elements or equipment or devices, an attacker device 51 and a computing device 53 connected to the network 50, It may include a network security support device 100 that inspects packets transmitted to the computing device 53.

The network 50 may form a communication channel between edge terminals (eg, the attacker device 51 and the computing device 53) of the network security support environment 10. This network 50 may include not only cables, routers, and address converters that support various wired or wireless environments, but also base stations and wireless access points. The network 50 is a configuration that passively transmits packets, for example, and may transmit attack packets output from the attacker device 51 to the computing device 53.

The attacker device 51 may be communicatively connected to the network 50 and may include a configuration that transmits an attack packet to the computing device 53 . The above-described attacker device 51 uses the vulnerability of the computing device 53 to hack the data stored in the computing device 53 without the consent of the user of the computing device 53, change the data stored in the computing device 53, or , cyber attacks such as deletion can be carried out.

The computing device 53 is connected to the network 50 and can provide information to various network 50 user terminals or receive and store information from various network 50 user terminals. In this process, attack packets provided by the attacker device 51 may be received.

The network security support device 100 is placed at the front of the computing device 53, inspects packets transmitted to the computing device 53, performs attack packet inspection, determines threats based on the inspection results, and reports them. can do. This network security support device 100 may be included and disposed as a part of the computing device 53.

Figure 2 is a diagram showing an example of the configuration of a network security support device according to an embodiment of the present invention.

Referring to FIG. 2, the network security support device 100 of the present invention may include a communication interface 110, an improved security support device 120, and a storage unit 130.

The communication interface 110 may form a communication channel with the network 50 and receive at least a portion of packets transmitted from the network 50 to the computing device 53. The communication interface 110 may transfer the received packet to the improved security support device 120.

The storage unit 130 may store data, programs, algorithms, etc. necessary for operating the network security support device 100. Additionally, the storage unit 130 may store data according to the operation of the improved security support device 120 or provide the stored data to the improved security support device 120. This storage unit 130 includes a storage module that stores programs related to the operation of the network security support device 100, and a database that stores data generated according to the operation of the improved security support device 120 or provides the stored data. may include.

The improved security support device 120 may include a packet inspection engine 121 (eg, NIDPS engine), a result storage processor 123, an analysis module 125, and an analysis result processing module 127.

The packet inspection engine 121 may include at least one engine capable of inspecting packets delivered to the computing device 53 through the network 50. In this process, the packet inspection engine 121 may apply attack pattern defense rules to packets captured through an improved security support device (e.g., Advanced PCA equipment). The attack pattern defense rule is stored in the storage unit 130, and can be loaded and operated when the packet inspection engine 121 is operated. As an example, the packet inspection engine 121 may include the previously mentioned NIDPS engine. The packet inspection engine 121 may transmit the packet inspection result and the corresponding packet to the result storage processor 123. At this time, the packet inspection engine 121 may also store packet inspection time information. The packet inspection engine 121 may perform packet list collection for packet inspection for a specified period of time according to settings, at the request of the computing device 53, or according to the policy of the improved security support device 120. there is. Alternatively, the packet inspection engine 121 may collect a packet list for real-time packet security inspection. Alternatively, the packet inspection engine 121 may collect the packet list when the amount of packets transmitted to the computing device 53 is more than a certain amount, and may stop collecting the packet list when the amount of packets is less than a specified amount. The packet inspection engine 121 can store and manage predefined algorithms to inspect packets for security rule violations. The packet inspection engine 121 performs inspection of the packet, and if it is determined that the packet violates a security rule, it may guide the result to the analysis module 125. In addition, the packet inspection engine 121 may transmit packets that violate security rules to the analysis module 125.

The result storage processing unit 123 may store the packets delivered by the packet inspection engine 121 in the storage unit 130. The result storage processing unit 123 may store the packet delivered by the packet inspection engine 121, security rule violation inspection results for the packet, packet collection and inspection time, etc., in the database of the storage unit 130.

The analysis module 125 may perform attack stage analysis on security rule violation packets delivered by the packet inspection engine 121. For example, the analysis module 125 may perform process-level analysis of cyber attacks and operate an analysis model (e.g., cyber kill chain) to define and identify threat elements at each process step. In this regard, the analysis module 125 may determine the attack stage according to the characteristics of the packet or the attack method of the packet. Additionally, the analysis module 125 can determine a response plan for each attack stage. The improved security support device 120 can store and manage policy or setting values that define attack stages mapped to attack methods and response measures mapped to attack stages. As an example, the cyber kill chain stages can be divided into seven stages and may include reconnaissance, weaponization, delivery, exploitation, installation, C&C, and action initiation stages. When applying the cyber kill chain analysis model, which is the analysis module 125, the attack method and response plan at each stage can be defined as shown in Table 1 below.

step Attack method Countermeasures reconnaissance email, crawling Firewall Filtering weaponization Malicious code generation IDS/IPS relay Drive by download Proxy Filter exploit cyber weapon operation antivirus installation Trojan installation Secure OS C&C Acquire system permissions Firewall ACLs take action data breach Sending false data

Referring to Table 1, when an attack packet related to email or crawling is detected, the analysis module 125 determines the corresponding stage to be a reconnaissance stage, and as a response plan mapped to the reconnaissance stage, firewall filtering is used by the network security support device (100). ) or suggested to the computing device 53, or firewall filtering can be performed automatically. When an attack packet for malicious code creation is detected, the analysis module 125 determines the corresponding step to be a weaponization step, and as a response plan mapped to the weaponization step, IDS/IPS filtering is performed by the network security support device 100 or a computing device. As suggested in (53), firewall filtering can be performed automatically. When an attack packet corresponding to Drive by download is detected, the analysis module 125 determines the corresponding stage as a delivery stage, and as a response plan mapped to the delivery stage, proxy filtering is performed by the network security support device 100 or the computing device ( 53), or firewall filtering can be performed automatically. When an attack packet related to the operation of a cyber weapon is detected, the analysis module 125 determines the corresponding stage as an exploit stage, and as a response plan mapped to the exploit stage, anti-virus application is applied to the network security support device 100 or the computing device ( 53), or firewall filtering can be performed automatically. When an attack packet related to Trojan installation is detected, the analysis module 125 determines that the step is an installation step, and as a response plan mapped to the installation step, Secure OS operation is performed by the network security support device 100 or the computing device 53. ), or firewall filtering can be performed automatically. When an attack packet for obtaining system permissions is detected, the analysis module 125 determines that the step is a C&C step, and as a response plan mapped to the C&C step, firewall ACL operation is performed by the network security support device 100 or computing device ( 53), or firewall filtering can be performed automatically. When a data leak is detected, the analysis module 125 determines the corresponding stage as an action initiation stage and, as a response plan mapped to the action initiation stage, transmits false data to the network security support device 100 or the computing device 53. You can make suggestions or automatically perform firewall filtering.

Meanwhile, the step analysis and response plan for the attack method presented above is an example, and according to the policy change of the improved security support device 120 manager or designer or the request of the computing device 53, new attack method, steps, and response Methods may be added, or previously registered attack methods, steps, and response plans may be changed or deleted.

The analysis module 125 may perform cyber kill chain analysis on the inspection results of the packet inspection engine 121 in relation to the attack stage analysis according to the above-described attack method. At this time, the analysis module 125 can retrieve past data stored in the database of the storage unit 130 and analyze past attack attempts by applying the currently updated NIDPS security rules and kill chain rules.

The analysis result processing module 127 may process the generation of a packet security message for reporting according to the results of the analysis module 125 and delivery of the generated packet security message. In this regard, the analysis result processing module 127 may include a security message generation module and a report module. The packet security message may have various types of information, but may include information as shown in Table 2 below.

Timestamp Origin IP Destination IP attack message How to respond ...

Referring to Table 2, the packet security message includes a Timestamp corresponding to the reception time of the packet considered to be an attack packet, the source IP and destination IP of the packet, an attack message corresponding to the purpose of the attack packet, and a response method according to the attack method. It can include at least. Additionally, entry items in the packet security message may be added, deleted, or changed.

Meanwhile, when the analysis result processing module 127 generates a packet security message, it can report the packet security message to a designated manager device. The manager device is, for example, the electronic device of the manager who manages the network security support device 100, the electronic device of the manager of the computing device 53 targeted by the attack packet, or reports on detection and response methods of the attack packet. It can be transmitted to the electronic device of the administrator who requested it. In this regard, the analysis result processing module 127 may store and manage connection information of the manager device that received the packet security message.

Meanwhile, the analysis result processing module 127 may perform adaptive response processing (e.g., perform a report on at least some attack steps among all attack steps) in relation to packet security message generation. For example, the analysis result processing module 127 may generate and report a packet security message only for a specific attack stage or higher (e.g., installation stage or higher) according to settings or policies. The analysis result processing module 127 can automatically perform an attack response to attack stages below the installation stage and report only the attack stage and corresponding response processing results to the manager device.

Figure 3 is a diagram showing an example of a time series analysis method within a period of a network security support device according to an embodiment of the present invention.

Referring to FIG. 3, in the network security support method according to an embodiment of the present invention, the network security support device 100 may collect a list of packets to be inspected in step 301. In this regard, the network security support device 100 may connect to a specific network 50 and monitor packets transmitted through the network 50. In this process, the network security support device 100 may perform packet monitoring and packet list collection for the network 50 during a specified period or when a specific event occurs, according to the administrator's settings.

In step 303, the network security support device 100 may collect kill chain rule data. The kill chain root data is used to process attack stage analysis of packet inspection results on a process-by-process basis, and may be replaced with another analysis model.

In step 305, the packet inspection engine 121 of the network security support device 100 may check whether the packet being inspected violates the NIDPS security rule. The packet inspection engine 121 stores the results of violations of the NIDPS security rules and packet-related information in the database of the storage unit 130, while transmitting the packet inspection results and the corresponding packet to the analysis module 125. .

In step 305, if the packet being inspected is a packet that violates the NIDPS security rule, the analysis module 125 of the network security support device 100 may perform attack stage analysis in step 307. In this process, the analysis module 125 may use a kill chain analysis model.

In step 309, the network security support device 100 may check which attack pattern among the attack patterns registered in the kill chain rule corresponds to the attack stage analysis result. As explained earlier, the kill chain rule is a rule that applies data on attack methods and response measures in each step. The attack method can be matched with the result inspection of the NIDPS engine.

If the attack stage analysis result corresponds to a specific attack pattern registered in the kill chain rule, in step 311, the network security support device 100 may search for a response plan mapped to the attack pattern registered in the kill chain rule.

In step 309, the network security support device 100 may determine error processing in step 313 if the attack stage analysis result is an attack pattern that is not registered in the kill chain rule. The error processing content may include information indicating that the attack stage analysis result is an item not included in the analysis model. Meanwhile, in step 305, if the collected packet is not a packet that violates the NIDPS security rule, for example, if it is a normal packet, the network security support device 100 may skip the following steps, for example, steps 307 to 313.

Next, the network security support device 100 may generate a packet security message in step 315. The packet security message may include a result of attack stage analysis, a response plan (or method) according to the attack stage, time information (Timestamp), packet source and destination address information (IP address), etc. Alternatively, when the packet security message is set to automatically perform response processing to attacks, it may include the result of attack response processing performed by the network security support device 100 according to attack stage analysis.

In step 317, the network security support device 100 may check whether the currently inspected packet is the last packet. If it is the last packet, the network security support device 100 may terminate the network security support function. If the currently inspected packet is not the last packet, the network security support device 100 may branch to step 305 and re-perform the following process.

As described above, according to the network security support method according to an embodiment of the present invention, the present invention defines threat elements on a process basis for the inspection results of attack packets attacking a specific computing device 53, and simply Beyond checking whether an attack packet exists, it can support recognition of the threat stage and adaptive processing accordingly. In addition, the network security support method refers to the analysis result of the attack packet stored in the database of the previous storage unit 130 in the process of analyzing the attack packet currently being inspected, thereby providing the result of the attack packet analysis at the current time. Time series analysis can be performed. In other words, the present invention supports the ability to determine the progress of an attack, thereby securing time to perform a dynamic response to a cyber attack through more active progress confirmation and estimation.

Meanwhile, the embodiments disclosed in the specification and drawings are merely provided as specific examples to aid understanding, and are not intended to limit the scope of the present invention. It is obvious to those skilled in the art that in addition to the embodiments disclosed herein, other modifications based on the technical idea of the present invention can be implemented.

10: Network security support environment
50: network
51: Attacker device
53: computing device
100: Network security support device
110: communication interface
120: Improved security support device
130: storage unit

Claims (10)

a communication interface connected to a network to form a communication channel;
a storage unit that stores at least some packets received through the communication interface;
Comprising an improved security support device functionally connected to the communication interface and the storage unit,
The improved security support device is
A packet that collects a packet list containing at least part of the packets received by the communication interface and determines whether the packet is an attack packet based on whether the packets included in the packet list violate NIDPS (Network Intrusion Detection and Prevention System) security rules. inspection engine;
An analysis module that evaluates threat elements on a process-by-process basis for attack packets that violate security rules among the packets, and determines an attack stage for the attack packets according to kill chain rules;
It includes an analysis result processing module that generates and reports a packet security message according to the evaluation result,
The analysis result processing module is,
It is set to generate the packet security message for a specific attack level or higher according to the settings or policy and transmit it to the administrator device,
It is set to automatically perform attack response to attack stages below the installation stage according to the kill chain rule and report only the result of the attack response processing to the manager device,
The packet inspection engine,
A network security support device, characterized in that the communication interface is set to collect the packet list when the amount of packets received is more than a certain amount, and to stop collecting the packet list when the amount of packets received is less than a specified amount.
delete delete According to paragraph 1,
The analysis module is
A network security support device characterized in that the attack stage of the currently collected attack packet is analyzed in time series with reference to the attack stage of the previous attack packet stored in the storage unit.
According to paragraph 1,
The analysis result processing module is
A network security support device, characterized in that generating the packet security message including information on when the attack packet was received, source and destination information of the attack packet, and a predefined response plan corresponding to the attack stage.
According to clause 5,
The analysis result processing module is
A network security support device that performs attack response processing according to the response method and includes a result of the attack response processing in the packet security message.
collecting a packet list containing at least some packets transmitted over the network to a server device;
examining whether a packet included in the packet list is an attack packet that violates NIDPS (Network Intrusion Detection and Prevention System) security rules;
When the attack packet is detected, applying a kill chain rule that evaluates threat elements on a process-by-process basis to the detected attack packet;
generating a packet security message containing at least information about an attack stage according to application of the kill chain rule;
A step of transmitting the generated packet security message to a designated administrator device,
The step of generating the packet security message is
Generating the packet security message for a specific attack level or higher according to settings or policies;
Automatically performing an attack response to attack stages below the installation stage according to the kill chain rule, and reporting only the result of the attack response processing to the manager device,
The collecting step is,
A network security support method comprising: collecting the packet list when the amount of packets received by the communication interface is greater than a certain amount, and stopping collection of the packet list when the amount of packets received is less than a specified amount.
In clause 7,
The step of applying the kill chain rule is
A network security support method comprising: analyzing the attack stages of the currently collected attack packet in time series with reference to the attack stages of previous attack packets stored in the storage unit.
In clause 7,
The step of generating the packet security message is
Network security support, comprising the step of generating the packet security message including information on when the attack packet was received, source and destination information of the attack packet, and a predefined response plan corresponding to the attack stage. method.
According to clause 9,
The step of generating the packet security message is
A network security support method further comprising: performing attack response processing according to the response method and including a result of the attack response processing in the packet security message.

Images