KR20110068308A - System and method for network attack detection and analysis - Google Patents

Abstract

PURPOSE: A network attack detection and analysis system is provided to detect a new malicious cyber attack which is hard to deal with a signature based technique by analyzing the correlation of traffic property through real-time and post monitoring of inside and external traffic. CONSTITUTION: A firewall(110) determines to block the traffic coming into a private network from outside and coming out from the inside of the private network. A virtual honey pot(120) includes a virtual machine and collects network attack data. The VM emulates the operation of the OS. A honey pot manager(130) controls the installation, operation, and setting change of the VM, and monitors the operation of the virtual honey pot. A packet collector(140) collects the packet data coming into the virtual honey pot or coming out from the virtual honey pot.

Description

Network attack detection and analysis system and method thereof {SYSTEM AND METHOD FOR NETWORK ATTACK DETECTION AND ANALYSIS}

The present invention relates to network security, and more particularly, to a network attack detection and analysis system and method thereof.

Distributed denial-of-service attack (DDoS) allows a large number of computers distributed in multiple networks to send packets to a specific server all at once, overflowing communication lines or processing capacity. It is an attack that stops. In fact, the administrator or user of the computer sending the packet has no intention of attacking, but the computer is manipulated by an external malicious third party (attacker, cracker) so that the user cooperates with the server attack without the user's knowledge.

An attacker exploits a vulnerability in one computer system to make it a DDoS master system, and then uses that master system to search for other systems that will be mobilized together in a DDoS attack. Load into the system. The attacker instructs the systems he can control to launch an attack against a particular target system, resulting in a denial of service (DoS) attack on the target system by flooding more packets than the target system can accommodate. ) Is caused.

Recently, large-scale distributed denial-of-service attacks by botnets have become a social or national problem. A botnet is a form in which many computers infected by malicious software bots are connected by a network. Thousands to hundreds of thousands of computers infected by bots, which are malicious programs that can perform various malicious actions, are connected to the network, and DDoS attacks, spam ( It launches various attacks, such as sending spam and key logging.

In particular, botnets cause a major damage by exploiting known vulnerabilities in computer systems, causing a zero day attack that runs a network attack for a period before a security patch is released. Traditional network security technologies, such as programs, intrusion detection systems (IDS), and intrusion prevention systems (IPS), often determine whether an attack is based on a database of attack patterns called signatures. There are technical limitations in defending new malicious programs such as bots, which are not known in the art, dynamically varying, and even using hidden techniques.

Accordingly, a first object of the present invention is to provide a network attack detection and analysis system that can detect the operation of malicious programs such as botnets and block network attacks such as distributed denial of service attacks.

Accordingly, a second object of the present invention is to provide a network attack detection and analysis method that can detect the operation of malicious programs such as botnets and block network attacks such as distributed denial of service attacks.

 The technical objects to be achieved by the present invention are not limited to the above-mentioned technical problems, and other technical subjects which are not mentioned can be clearly understood by those skilled in the art from the description of the present invention .

Network attack detection and analysis system according to an embodiment of the present invention for achieving the first object of the present invention described above, at least one of traffic flowing into the private network from the outside and traffic flowing out of the private network from the outside A firewall configured to determine whether to block the network; and at least one virtual machine located behind the firewall and emulating the operation of an operating system, and a virtual honeypot unit configured to collect data about a network attack, and located behind the firewall. Controls the installation, operation start, operation stop and change of settings, and located behind the firewall and the honeypot management unit for monitoring the operation of the virtual honeypot unit in real time, the packet flowing into or out of the virtual honeypot unit Including a packet collector to collect data All.

The honeypot management unit may determine whether an attack on the virtual honeypot unit based on at least a portion of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector.

When the honeypot management unit determines that there is an attack on the virtual honeypot unit based on at least one of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collecting unit, the firewall causes the firewall to cause the private network. It can block traffic from inside to outside.

When the firewall determines that there is an attack on the virtual honeypot unit based on at least one of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector, the firewall is leaked from the inside of the private network to the outside. You can block traffic.

The honeypot management unit or the firewall may be an external network IP address, an internal network IP address, or a port of the internal network IP based on at least a portion of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector. At least one of an address and a packet size may be determined, and it may be determined whether there is an attack on the virtual honeypot unit based on the determined result.

The honeypot management unit or the firewall determines the inflow traffic and the outflow traffic of the virtual honeypot unit based on at least a portion of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector. Based on the correlation analysis result of the inflow traffic and the outflow traffic of the virtual honeypot unit, it may be determined whether there is an attack on the virtual honeypot unit.

The correlation analysis calculates a ratio of incoming TCP SYN traffic to outgoing TCP FIN traffic, and determining whether there is an attack on the virtual honeypot unit may determine whether there is a TCP distributed denial of service attack.

The correlation analysis calculates a ratio of inflow traffic to outflow traffic, and determining whether there is an attack on the virtual honeypot unit may determine whether there is a UDP distributed denial of service attack.

The correlation analysis calculates a ratio of outflow traffic to inflow traffic, and determining whether there is an attack on the virtual honeypot unit may determine whether there is an ICM distributed denial of service attack.

Network attack detection and analysis method according to an embodiment of the present invention for achieving the second object of the present invention, at least one virtual machine emulating the operation of the operating system in the honeypot host, the at least one Collecting the data for the network attack, entering or exiting the at least one virtual machine from the at least one virtual machine, and collecting the data; Detecting a network attack that occurred on at least one of the virtual machines based on the detection.

The network attack detection and analysis method may further include performing at least one of starting, stopping, changing, and removing an operation of the at least one virtual machine.

The network attack detection and analysis method may include at least one of traffic flowing into the at least one virtual machine from outside and traffic flowing out from the at least one virtual machine when a network attack is detected in at least one of the virtual machines. It may further comprise the step of blocking.

According to the network attack detection and analysis system and the method as described above, real-time monitoring and post-monitoring of internal and external traffic and correlation of network traffic characteristics to cope with conventional signature-based technologies such as distributed denial of service attacks by botnets. It can detect difficult new malicious cyber attacks.

The firewall allows traffic from the outside to the honeypot and blocks traffic from the outside to the honeypot, and applies behavior-based algorithms based on the collected data to attack botnets and target systems. New cyber attacks, such as communications, can be detected and blocked by firewalls.

Furthermore, by configuring the honeypot as a virtual machine and having a management server for it, it is easy to integrate management and maintenance of the honeypot such as installation, start-up, stoppage, and configuration change.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings, it will be described in detail a preferred embodiment of the present invention. Hereinafter, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

Prior to describing an embodiment of the present invention, terms used in the present invention will first be described.

Private network

Unlike public networks, private networks are networks that can be used by organizations built on specific networks. In other words, by blocking access from unauthorized users, the security of the network can be maintained and the network can be directly controlled to provide flexibility and independence in network operations, while interworking with other private networks and supporting mobile users is difficult. . There is a big cost burden when establishing a network or leased line between remote locations, and a virtual private network (VPN) is used to solve this problem. It means a private network used for the purpose of communicating without revealing the contents to outsiders.

Virtual machine

Typically, a virtual machine is a completely separate software container that can run its own operating system and applications as if it were a computer with a physical entity. A virtual machine behaves like a physical computer and has its own virtual processing unit (CPU), random access memory (RAM), hard disk and network interface card (NIC). Include. The operating system can't distinguish between virtual and physical machines, and neither can applications or other computers on the network. Typically, a virtual machine consists only of software and does not contain any hardware components.

Virtual machines are compatible with standard physical computers, and virtual machines are separated from each other as if they were physically separate. Virtual machines encapsulate the entire computing environment and run independently of the underlying hardware. These features allow for the execution of multiple different operating system and application mix configurations on a single physical computer.

Firewall

The primary role of the firewall is to place malicious traffic between networks with different levels of trust so that harmful traffic from a low-trust network does not reach the high-trust network. Generally, a section having a high reliability from the position of a network administrator is called an internal network section, and a section having a low reliability is called an internet section or an external network section. For example, you can set up a small network (DMZ) of servers that provide services to the outside, and enforce network policies such as firewalls preventing intrusion from the Internet to the internal network and allowing communication from the internal network to the Internet. have.

Honeypot

Honeypots are conceptually a security resource whose value lies in being invaded or attacked. Honeypots do not have a separate function to attract attackers or hackers, but simply exist on the Internet and are used to analyze attacker or hacker behaviors and attack techniques by being intruded or attacked. In other words, honeypots aim at improving the overall security structure rather than solving specific security problems such as firewalls and intrusion detection systems.

In the field of intrusion prevention, honeypots can be used to trick or stop an attacker. And in the field of intrusion detection, honeypots are very efficient in detecting attacker's actions. In addition, in the area of intrusion response, honeypots can provide detailed information about how an intruder intruded into the system and what it did.

The degree to which a honeypot interacts with an attacker, that is, the extent to which an attacker can infiltrate the system and do what they want, affects the quality and amount of data that the honeypot collects. Low level honeypots emulate some specific services, such as telnet or file transfer protocol (FTP), and their security vulnerabilities. Attackers can only log in and try very limited interaction. Therefore, the quality and quantity of information that can be obtained through this is low and small. High level honeypots, on the other hand, emulate the actual operating system itself. An attacker can perform various actions, such as sending files such as backdoor programs or compiling hacking code. The advantage is that you get a lot of information, such as keystrokes, the use of attack tools, an attacker's conversation, or an image to be sent.

Honeynet

A honeynet is a network structure consisting of general computer systems, security solutions, and honeypots. Alternatively, a honeynet generally refers to a network system that requires a plurality of simultaneous sessions, unlike a honeypot, which requires only one session. There is a high level of interaction with the attacker, and the attacker can freely access and act on the network as well as the system.

A honeynet is not a system but a network of several systems. Honeynet is controlled by access control system to control all inflow and outflow traffic and collect data through it. The collected information can be analyzed to learn about attack tools, attack techniques, and attack motives. The collected information can also be used to forecast and alert on attacks.

1 is a block diagram showing the configuration of a network attack detection and analysis system according to an embodiment of the present invention.

1, a network attack detection and analysis system according to an embodiment of the present invention includes a firewall 110, a virtual honeypot unit 120, a honeypot manager 130, and a packet collector 140.

The firewall 110 blocks or passes the traffic flowing into the private network from outside and the traffic flowing out from the inside of the private network at the boundary of the external network, the Internet, the public network, and the internal network, the private network, the intranet, and the like.

The criteria for the firewall 110 to block or pass the traffic may be based on a network security policy determined by a network attack detection and analysis system user or a private network administrator, or may be applied to the firewall 110. The signature-based detection and analysis module or the action-based detection and analysis module may be based on predetermined criteria.

The signature-based detection and analysis module uses a technique for searching for signatures of malicious codes mainly used in antivirus software and antivirus software, that is, patterns of malicious codes to determine whether they are malicious codes. In contrast, the behavior-based detection and analysis module uses a technique for determining whether the malicious code is malicious by analyzing the behavior of the malicious code in the host or the characteristics of the network traffic.

The firewall 110 may block traffic flowing out from the inside of the private network without blocking traffic flowing into the private network from the outside. For example, the operation or policy of the firewall 110 may block a target system attack of the botnet, communication with a bot master or a command & control server (C & C server).

The firewall 110 may include key stroke information, network traffic information, and suspected malicious code behavior pattern information generated in each of the virtual machine honeypots 121 and 123 included in the virtual honeypot unit 120 to be described later. Intrusion detection system (IDS) pattern information can be stored. In this case, the firewall 110 or the honeypot management unit 130 may change the traffic management policy of the firewall 110 based on the result of analyzing the information.

The virtual honeypot unit 120 is located behind the firewall 110, that is, inside the private network isolated from the external network by the firewall 110. The virtual honeypot unit 120 includes at least one virtual machine that emulates the operation of an operating system and becomes a potential target of a network attack to collect data about the network attack.

The virtual honeypot unit 120 includes n virtual machine honeypots 121 and 123 generated by installing virtual operating systems on m physical servers (hosts). At least one virtual machine honeypot installed in a specific physical server (host) may share a physical network card (network interface card) with the physical server (host).

The process of creating the virtual machine honeypots 121 and 123 may include system setting including installation of an operating system for each virtual machine, network setting or virtual session setting, logging setting of a virtual session, and the like. It may include a test operation of a pod, a backup of a virtual machine or a virtual session, and the like.

2 is a conceptual diagram illustrating a virtual machine honeypot in a network attack detection and analysis system according to an embodiment of the present invention.

The virtual machine honeypots 121 and 123 may correspond to individual guest systems that are created and controlled by a virtual machine manager (VM manager). The virtual machine honeypots 121 and 123 may be viewed as one system in which a virtual network session is established in the virtual operating system.

The virtual machine manager runs on a host operating system (OS) that controls hardware, which is a physical entity constituting a physical server (host), and executes software on the hardware.

Referring back to FIG. 1, the virtual honeypot unit 120 may be a high level honeypot that provides high level interaction with an attacker. By emulating the full set of features, services, and applications of the operating system, you can collect and analyze more detailed information about attacker behavior.

The honeypot management unit 130 is located behind the firewall 110, that is, inside the private network isolated from the external network by the firewall 110. The honeypot management unit 130 may start and control the installation, operation start, operation stop, setting change and removal of the virtual machine, and may monitor the operation of the virtual honeypot unit 123 in real time. As described above, the virtual machine corresponds to each of the virtual machine honeypots 121 and 123 included in the virtual honeypot unit 120.

The honeypot management unit 130 monitors the information about the operation of the virtual honeypot unit 120, that is, the virtual machine honeypots 121 and 123, or data collected from the virtual honeypot unit 120, and generates a report about the system. Can be provided to the administrator.

As described above, the honeypot management unit 130 may initiate and control the creation, reinstallation, removal, operation start, operation stop, and setting change of each virtual machine honeypot 121 and 123 of the virtual honeypot unit 120. have. The virtual honeypot unit 120 may include a plurality of virtual machine honeypots 121 and 123, and the honeypot manager 130 may control each of the virtual machine honeypots 121 and 123. The trouble of installing an operating system and installing applications on a plurality of physical servers (hosts) can be avoided, and as a result, the honeynet can be easily controlled.

The honeypot management unit 130 identifies whether a network attack has occurred or an attacker's attack technique based on data stored in the firewall 110, the virtual honeypot unit 120, the packet collecting unit 140, or itself 130 to be described later. The network security policy can be determined. The honey pot manager 130 may detect a network attack, and may use an attack intention confirmation technique, a network behavior based technique, or a signature based technique.

For example, the honeypot management unit 130 may monitor all ports providing a TCP / UDP service as an attack intention checking technique, or detect a service request that attempts to access the same port multiple times as a potential network attack. have.

Alternatively, the honeypot manager 130 may detect an unknown attack through analysis of a source IP address, a source port, a destination IP address, a destination port, and a packet length as a network behavior based technique. For example, if the relationship between the number of source IP addresses, the number of destination IP addresses, and the number of destination ports is 1: 1: m, then the destination port scan; if 1: 1: 1, the worm or host scan port fixed source modulation DDoS for m: 1: 1, distributed host scan for m: m: 1, port variable source modulation DDoS for m: 1: m, back for 1: m: m This can be detected by an attack that corresponds to a scatter.

Alternatively, the honeypot manager 130 may detect malicious code having a pattern known as a signature-based technique.

Hereinafter, an attack detection method according to a network behavior based method will be described with a specific example. The network attack detection may be performed by any one of the firewall 110, the honeypot management unit 130, and the packet collecting unit 140, but hereinafter, it is assumed that the honeypot management unit 130 performs the network attack detection. I will explain.

The honeypot management unit 130 may include all or a portion of data collected by the virtual honeypot unit 120, all or a portion of packet data collected by the packet collecting unit 140, or a virtual honeypot unit 120 and a packet. The inflow traffic and the outflow traffic of the virtual honeypot unit 120 may be determined based on all or a part of the packet data collected by the collection unit 140. The honeypot management unit 130 may determine whether there is an attack on the virtual honeypot unit 120 based on the determined correlation analysis result of the inflow traffic and the outflow traffic of the virtual honeypot unit 120. NetFlow statistical information may be used to calculate the ratio of the inflow traffic and the outflow traffic.

The honeypot management unit 130 performs a correlation analysis that calculates the ratio of the incoming TCP SYN traffic to the outgoing TCP FIN traffic, and based on the correlation analysis result, the TCP distributed denial of service attack on the virtual honeypot unit 120 is performed. Can be determined. The honeypot manager 130 may determine the location (IP information) of the master bot (C & C server) by searching the TCP flow record using the IP of the host that caused the traffic.

Alternatively, the honeypot management unit 130 performs a correlation analysis for calculating a ratio of inflow traffic to outflow traffic, and based on the correlation analysis result, whether or not there is a UDP distributed denial of service attack on the virtual honeypot unit 120. You can judge. The honeypot manager 130 may determine the location (IP information) of the master bot (C & C server) by searching the UDP flow record using the IP of the host that caused the traffic.

Alternatively, the honeypot management unit 130 performs a correlation analysis for calculating the ratio of outflow traffic to the inflow traffic, and based on the correlation analysis result, whether there is an ICM distributed denial of service attack on the virtual honeypot unit 120. You can judge. The honeypot manager 130 may determine the location (IP information) of the master bot (C & C server) by searching the ICM flow record using the IP of the host that caused the traffic.

The honeypot management unit 130 may include all or a portion of data collected by the virtual honeypot unit 120, all or a portion of packet data collected by the packet collector 140 to be described later, or a virtual honeypot unit 120 and a packet collection. On the basis of all or part of the packet data collected by the unit 140, it is determined whether there is a network attack on the virtual honeypot unit 120, and when it is determined that the firewall 110 causes the traffic to flow into the private network from the outside, the firewall 110. For example, it can block outgoing traffic from inside or outside the private network, or all incoming or outgoing traffic.

As another embodiment of the present invention, the firewall 110 is all or part of the data collected by the virtual honeypot unit 120, all or part of the packet data collected by the packet collection unit 140 to be described later, or virtual honey Based on all or part of the packet data collected by the pod 120 and the packet collecting unit 140, it is determined whether there is an attack on the virtual honey pot unit 120, and when the attack is determined, traffic flowing into the private network from the outside is determined. For example, it can block outgoing traffic from inside or outside the private network, or any incoming or outgoing traffic.

As another embodiment of the present invention, the packet collecting unit 140 to be described later includes all or part of the data collected by the virtual honeypot unit 120, all or part of the packet data collected by the packet collecting unit 140, Alternatively, the virtual honeypot 120 and the packet collecting unit 140 determine whether there is an attack on the virtual honeypot unit 120 based on all or a part of the packet data collected, and if the attack is determined, the firewall 110. You can block traffic from outside into the private network, from outside the private network to outside, or from all outgoing or outgoing traffic.

The packet collector 140 is located behind the firewall 110, that is, inside the private network isolated from the external network by the firewall 110. The packet collecting unit 140 collects packet data flowing into or out of the virtual honeypot unit 120. The packet collection unit 140 stores communication packets transmitted between the virtual honeypot unit 120 and the external network, and provides the data as data used for network attack detection analysis in the firewall 110 or the honeypot management unit 130, Forensic data of network attacks or forensic evidence of network attacks can be provided.

The packet collecting unit 140 includes a packet capture device that collects packets that flow into or out of the virtual honeypot unit 120 and inquires packet data or tracks the packet. You can also generate a report on the collected packets and provide them to the system administrator.

At least two or more components of the firewall 110, the virtual honeypot unit 120, the honeypot management unit 130, and the packet collecting unit 140 may be implemented as one block or one device. For example, the virtual honeypot unit 120 and the honeypot manager 130 may be implemented as one block or one device, such as a honeypot host (not shown). Alternatively, the virtual honeypot unit 120, the honeypot manager 130, and the packet collector 140 may be implemented as one block or one device, such as a honeypot host (not shown). Alternatively, the firewall 110, the virtual honeypot unit 120, and the honeypot management unit 130 may be implemented as one block or one device, such as a honeypot host (not shown). Alternatively, the firewall 110, the virtual honeypot unit 120, the honeypot manager 130, and the packet collector 140 may be implemented as one block or one device, such as a honeypot host (not shown).

Hereinafter, an example of a method of detecting or determining a network attack based on a network event occurring in the virtual honeypot unit 120 will be described with reference to a separate drawing.

3 is a flowchart illustrating a network attack detection method in a network attack detection and analysis system according to an embodiment of the present invention. The network attack detection may be performed by any one of the firewall 110, the honeypot management unit 130, and the packet collecting unit 140, but hereinafter, it is assumed that the honeypot management unit 130 performs the network attack detection. I will explain.

Referring to FIG. 3, the honeypot management unit 130 collects network events for a unit time (S210). A network event refers to an event on the network caused by at least one communication packet.

The honeypot management unit 130 may include all or a portion of data collected by the virtual honeypot unit 120, all or a portion of packet data collected by the packet collecting unit 140, or a virtual honeypot 120 and a packet collecting unit ( At least one of an external network IP address, an internal network IP address, a port address of the internal network IP, a packet size, and a code signature for at least one packet based on all or part of the packet data collected by 140 Can be determined. The honeypot management unit 130 may determine whether there is an attack on the virtual honeypot unit 120 based on the determined result. Here, the code signature refers to a known code pattern of malicious code that is composed of payloads of at least one packet.

When the same network event more than a predetermined number has occurred, it may be determined that the abbreviated event has occurred (S220, S271).

If the same network event or more than a predetermined number does not occur as follows (S220). When an event for the same port address of the same external network IP address and different internal network IP addresses occurs, it may be determined as a scanning suspicious event (S230, S240, S273). When an event occurs for the same port address of different external network IP addresses and different internal network IP addresses, it may be determined as a worm propagation event (S230, S250, S275). If the same code signature is identified, it may be determined as a suspicious bot propagation event (S220, S230, S240, S250, S260, S277).

4 is a flowchart illustrating a network attack detection method in a network attack detection and analysis system according to another embodiment of the present invention. The network attack detection may be performed by any one of the firewall 110, the honeypot management unit 130, and the packet collecting unit 140, but hereinafter, it is assumed that the honeypot management unit 130 performs the network attack detection. I will explain.

Referring to FIG. 4, the honeypot manager 130 analyzes network traffic for a unit time (S310). When traffic from an external network occurs and traffic to the same port may be determined as a suspicious master bot C & C event (S320, S330, S351). When traffic leaked from the internal network occurs and traffic to the same external IP address may be determined as a suspected DDoS event (S320, S340, and S353). If the traffic leaked from the internal network is generated and is not traffic to the same external IP address, it may be determined as a worm propagation event (S320, S340, and S355).

5 is a block diagram showing the configuration of a network attack detection and analysis system according to another embodiment of the present invention.

The firewall 110, the virtual honeypot unit 120, the honeypot management unit 130, and the packet collecting unit 140 use the same reference numerals as those of FIGS. 1 to 4, and the network attack according to the embodiment of the present invention. Since the detection and analysis system can be understood in the same manner as described with reference to FIGS. 1 to 4, a description thereof will be omitted.

Actual traffic is transmitted between the L3 switch 150 and the firewall 110, the virtual honeypot 120, and the packet collector 140. The packet collecting unit 140 may collect a packet flowing in or out of the traffic line 151 between the L3 switch 150 and the virtual honeypot unit 120, and a mirroring port (SPAN port) of the L3 switch 150. It may be connected to (S153).

Management traffic or control traffic is transmitted between the L2 switch 160 and the firewall 110, the virtual honeypot unit 120, the honeypot management unit 130, and the packet collection unit 140.

6 is a flowchart illustrating a network attack detection and analysis method according to an embodiment of the present invention.

Referring to FIG. 6, in the network attack detection and analysis method according to an embodiment of the present invention, at least one virtual machine is installed in a honeypot host that emulates an operation of an operating system, and the at least one virtual machine provides a honeypot function. Setting to perform (S410), collecting data about network attacks that flow into or out of the at least one virtual machine (S430) and at least one based on the collected data Detecting a network attack occurred in the virtual machine (S440).

The network attack detection and analysis method according to an embodiment of the present invention may further include performing at least one of starting, stopping, changing, and removing an operation of at least one virtual machine (S420).

Network attack detection and analysis method according to an embodiment of the present invention, when the network attack is detected in at least one of the virtual machine traffic from the outside to the at least one virtual machine and at least one virtual machine to the outside Blocking at least one of the outgoing traffic may be further included (S450).

In the virtual machine honeypot setting step (S410), virtual machine honeypot setting change step (S420), inflow and outflow data collection step (S430), network attack detection step (S440) and inflow and outflow traffic blocking step (S450) 1 to 5 with respect to the firewall 110, the virtual honeypot unit 120, the honeypot management unit 130 and the packet collector 140 in the network attack detection and analysis system according to an embodiment of the present invention. As it may be understood similarly to what has been described with reference, the following description is omitted.

Although described with reference to the above embodiments, those skilled in the art will understand that various modifications and changes can be made without departing from the spirit and scope of the invention as set forth in the claims below. Could be.

1 is a block diagram showing the configuration of a network attack detection and analysis system according to an embodiment of the present invention.

2 is a conceptual diagram illustrating a virtual machine honeypot in a network attack detection and analysis system according to an embodiment of the present invention.

3 is a flowchart illustrating a network attack detection method in a network attack detection and analysis system according to an embodiment of the present invention.

4 is a flowchart illustrating a network attack detection method in a network attack detection and analysis system according to another embodiment of the present invention.

5 is a block diagram showing the configuration of a network attack detection and analysis system according to another embodiment of the present invention.

6 is a flowchart illustrating a network attack detection and analysis method according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

110: firewall 120: virtual honey pot

130: honey pot management unit 140: packet collection unit

150: L3 switch 160: L2 switch

Claims (12)

A firewall for determining whether to block at least one of traffic flowing into the private network from the outside and traffic flowing out from the inside of the private network; A virtual honeypot unit located behind the firewall and including at least one virtual machine that emulates an operation of an operating system, and collects data about a network attack; A honeypot manager located behind the firewall and controlling installation, operation start, operation stop, and configuration change of the virtual machine, and monitoring the operation of the virtual honeypot unit in real time; And And a packet collecting unit located behind the firewall and collecting packet data flowing into or out of the virtual honeypot unit. The method of claim 1, The honeypot management unit determines whether or not an attack on the virtual honeypot unit based on at least a portion of at least one of the data collected by the virtual honeypot unit and the packet data collected by the packet collector. Analysis system. The method of claim 1, When the honeypot management unit determines that there is an attack on the virtual honeypot unit based on at least one of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collecting unit, the firewall causes the firewall to cause the private network. Network attack detection and analysis system, characterized in that to block traffic flowing out from the inside. The method of claim 1, When the firewall determines that there is an attack on the virtual honeypot unit based on at least one of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector, the firewall is leaked from the inside of the private network to the outside. Network attack detection and analysis system, characterized in that blocking traffic. The method according to any one of claims 2 to 4, An external network IP address, an internal network IP address, a port address of the internal network IP, and a packet size based on at least one of at least one of data collected by the virtual honeypot unit and packet data collected by the packet collector. And determining whether there is an attack on the virtual honeypot unit based on the determined result. The method according to any one of claims 2 to 4, Determine the inflow traffic and the outflow traffic of the virtual honeypot unit based on at least a portion of at least one of the data collected by the virtual honeypot unit and the packet data collected by the packet collector unit; And determining whether there is an attack on the virtual honeypot unit based on a correlation analysis result for the leaked traffic. The method of claim 6, The correlation analysis calculates the ratio of the incoming TCP SYN traffic to the outgoing TCP FIN traffic, and determining whether there is an attack on the virtual honeypot unit, determining whether there is a TCP distributed denial of service attack. Network attack detection and analysis system. The method of claim 6, The correlation analysis calculates a ratio of inflow traffic to outflow traffic, and determining whether there is an attack on the virtual honeypot unit determines whether there is a UDP distributed denial-of-service attack, and Analysis system. The method of claim 6, The correlation analysis calculates a ratio of outflow traffic to inflow traffic, and determining whether there is an attack on the virtual honeypot unit determines whether there is an ICM distributed denial-of-service attack, and Analysis system. Installing at least one virtual machine on a honeypot host that emulates the operation of an operating system and setting the at least one virtual machine to perform a honeypot function; Collecting data, for network attacks, flowing into or out of the at least one virtual machine; and Detecting network attacks occurring in at least one of the virtual machines based on the collected data. The method of claim 10, And performing at least one of starting, stopping, changing, and removing an operation of the at least one virtual machine. The method of claim 10, Blocking at least one of traffic flowing into the at least one virtual machine from outside and traffic flowing out from the at least one virtual machine when a network attack is detected in at least one of the virtual machines; How to detect and analyze network attacks.

Images