KR20120000942A - Bot-infected host detection apparatus and method based on blacklist access statistics - Google Patents

Abstract

PURPOSE: A bot-infected host detection device and method based on blacklist access statistics is provided to conveniently detect host which are infected to the bot from an inner network by using a new method without being changed by communication encoding and communication pattern reading. CONSTITUTION: A blacklist access statistic unit(223) calculates an access statistic about a blacklist per an inner IP address by using the access information and predetermine backlist information. A host state monitoring unit(225) monitors the state of the internal hosts which are connected to inside network by using access statistics. The host state monitoring unit detects an infected host. A database stores the access information, the blacklist information, and the status information for internal hosts and access statistics.

Description

Bot-infected host detection apparatus and method based on blacklist access statistics}

The present invention relates to a network security system, and more particularly, to a detection apparatus for detecting hosts infected by a bot by calculating access statistics on a blacklist for each internal host included in an internal network, and a detection method thereof.

Due to the rapid development of many infrastructures that make up the Internet due to the development of Internet technology and the increase in the number of users, many vulnerabilities of the Internet are exposed due to the incomplete preparation of security factors. Cyber terrorism that attacks people is frequently occurring. These cyber attacks are increasingly intelligent and organized, and are forming professional and organized networks to gain economic benefits. As such, cyber attackers have come up with technology to control their existence and location, to control numerous computers under their control in order to obtain financial gains for illegal activities, and botnets have emerged for this purpose. .

A bot is a kind of malicious code that commands commands from a remote location to control a bot-infected host. A botnet is a network of bot-infected hosts. Hosts infected by bots are controlled and controlled by C & C (Command & Control) servers. Recently, botnets have been exploited by criminals to become the main cause of crimes using the network, including distributed denial of service (DDoS) attacks, spamming, personal information leakage, and online financial fraud.

In order to prevent malicious behavior caused by botnets, a method of detecting a bot infected host is needed.

Conventionally, a method for detecting a bot infected host includes a host based detection method for executing a malware detection program directly on the host and a network based detection method for detecting a bot infected host by collecting / analyzing network traffic. However, a method of executing a malware detection program directly on a host requires a network-based detection method because it is difficult to force users to execute a malware detection program directly on each host.

Network-based detection methods include signature-based detection and network behavior-based detection. Signature-based detection is a method of detecting malicious packet patterns through a string comparison method. Network behavior-based detection is a method of detecting bots by statistically analyzing communication patterns such as packet volume, time zone distribution, and group behavior.

Recently, however, bots have applied communication encryption and communication pattern obfuscation to avoid network-based detection. Bot communication encryption avoids signature-based detection by encrypting the payload. The bot communication pattern obfuscation avoids network behavior based detection by arbitrarily adjusting the communication amount, communication period, and time interval between packets. Therefore, in order to detect such a bot infected host, a new bot host detection method using a feature that is not changed by encryption and obfuscation is required.

The present invention is to provide a method that can more easily detect the host infected by the bot in the internal network using a new method that is not changed by communication encryption and communication pattern obfuscation.

An apparatus for detecting a bot infected host according to an embodiment of the present invention may include a packet collecting unit configured to collect packets transferred between an internal network and an external network, and interpret the packets collected by the packet collecting unit to the external network for each internal IP address. A packet decode unit for extracting access information for the server, a blacklist access statistics unit for calculating access statistics for the blacklist for each IP address by using the access information and pre-registered blacklist information, and the internal using the access statistics And a host status monitoring unit for monitoring the status of internal hosts connected to the network and detecting an infected host, and a database storing the access information, the blacklist information, the access statistics, and status information about the internal hosts.

The bot infection host detection device of the present invention is further provided with a blacklist management unit that receives information on a web site from which an botnet's C & C (Command & Control) server or malicious code can be downloaded from an external system and updates the blacklist information. It may include.

In the bot infected host detection apparatus of the present invention, the packet collector may receive and collect packets in real time through a network tap installed between the internal network and the external network.

In the bot infected host detection apparatus of the present invention, the packet decode unit extracts an external IP address, an external URL, and an access time of the external network accessed by each internal IP address, and for this purpose, the source IP address, The destination IP address and access time are extracted, and in the L7 layer HTTP packet, the destination URL is extracted by parsing the URL part of the HTTP request.

In the bot infected host detection device of the present invention, the blacklist access statistics unit is the access statistics, and whether the internal host is operated and the number of times that the internal IP address accesses the pre-registered blacklist for a predetermined period, Calculate the frequency of access. For example, the daily operation of the internal host, the number of daily accesses to the blacklist by the internal IP address, the number of weekly access days, the inaccess period, and the frequency of weekly accesses are calculated. In this case, the number of weekly access days indicates the number of days each internal IP address accesses the blacklist one or more times during the week, and the weekly access frequency is a value obtained by dividing the number of weekly access days by the number of operating days during the week. In addition, the non-access period represents the difference between the date and the current date after each internal IP address obtains the date when the internal IP address is most recently accessed using the stored number of daily accesses.

In the bot infected host detection device of the present invention, the host status monitoring unit converts an internal host corresponding to the internal IP address that has accessed the blacklist at least once into a 'suspected infection' state, and among the internal hosts that are in 'suspected infection' state. The internal host whose weekly access frequency exceeds the first predetermined threshold value is converted into an 'infection' state. The host state monitoring unit converts the internal host treated in the 'infected' state into the 'suspected infection' state, and sets a second reference value for which the inaccessibility period for the blacklist among the internal hosts in the 'suspected infection' state is set. Transition excess internal hosts into a 'normal' state.

In one embodiment, a method for detecting a bot infected host according to an embodiment of the present invention collects packets transmitted between an external network and an internal network, and analyzes the collected packets to obtain access information for the external network for each internal IP address. A second step of extracting, a third step of calculating access statistics for the blacklist for each internal IP address using the access information and the pre-registered blacklist information, and an internal host connected to the internal network using the access statistics. Monitoring the status and detecting an infected host.

The present invention makes it easier and more efficient to detect infected hosts by bots that have communication encryption and communication pattern obfuscation applied.

1 is a view showing the overall configuration of a network to which the bot infection host detection device based on the blacklist access statistics according to an embodiment of the present invention.
Figure 2 is a system configuration diagram showing in more detail the structure of the bot infected host detection device in FIG.
Figure 3 is a flow chart for explaining a bot infection host detection method through the operation of the bot infection host detection device having the above configuration.
4 is a state flow diagram illustrating a change in infection state of internal hosts.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

1 is a diagram illustrating the overall configuration of a network to which a bot infection host detection apparatus based on blacklist access statistics according to an embodiment of the present invention is applied.

The network of FIG. 1 includes an external network 110, an internal network 120, internal hosts 130 connected to an internal network, a network tap 210, and a bot infected host detection device 220.

The external network 110 is an Internet network, and servers that distribute malicious codes such as bots are connected, and the internal network 120 is a network to which internal hosts 130 loaded with a program providing a specific service are connected. In this case, it is assumed that the internal hosts 130 to be monitored are terminals having IP addresses, and the internal hosts 130 may include a general computer, a network device such as a printer or a scanner, an IP router, and the like.

The network tap 210 mirrors and transmits network traffic between the external network 110 and the internal network 120 to the bot infection host detection device 220. The network tap 210 may transfer the up / down traffic to the bot infection host detection device 220 or transmit the up / down traffic to the bot infection host detection device 220 in a state where the up / down traffic is separated.

The bot infection host detection device 220 monitors the traffic between the external network 110 and the internal network 120 transmitted through the network tap 210, and internal hosts 130 connected to the internal network 120. Detect internal hosts infected by this bot. To this end, the bot infection host detection device 220 collects network packets transmitted and received by the internal hosts 130 to and from the external network 110, and then each IP address belonging to the internal network 120 (hereinafter, referred to as an 'internal IP address'). Access statistics on the pre-registered blacklist IP address or blacklist URL are monitored to monitor the infection of internal hosts 130, and the frequency of access to the blacklist IP address or blacklist URL is determined in advance. The internal host 130 that exceeds the predetermined threshold is detected and notified to the network security manager. At this time, information about blacklists (IP address, URL) is used to induce IP addresses and clicks on host servers that recently spread malicious code such as bots from security companies and ISPs (Internet Service Providers). By managing information on URLs that infect malicious code, the information can be used.

2 is a system configuration diagram illustrating the structure of the bot infection host detection device 220 in FIG. 1 in more detail.

The bot infection host detection device 220 includes a packet collecting unit 221, a packet decoding unit 222, a blacklist access statistics unit 223, a blacklist managing unit 224, a host status monitoring unit 225, and a blacklist IP. Address DB 226, blacklist URL DB 227, traffic DB 228, and host state DB 229.

The packet collector 221 collects network packets transmitted between the internal hosts 130 connected to the internal network 120 and the external network 110 in real time through the network tap 210, and decodes the packet decoder 222. To pass on.

The packet decode unit 222 interprets the packets received from the packet collector 221 in real time, and for each internal IP address, an IP address of an external network accessed by the corresponding internal IP address (hereinafter, referred to as an “external IP address”). , URL (hereinafter referred to as 'external URL') and its access time are extracted and stored in the traffic DB 228. That is, the packet decode unit 222 analyzes the network packet, extracts the source IP address, the destination IP address and the access time from the IP packet of the L3 (LAYER 3) layer, and the HTTP request from the HTTP packet of the L7 (LAYER 7) layer. After analyzing the URL part from the contents, extract the destination URL and classify it by the internal IP address, and store the external IP address, the external URL, and the access time of the corresponding internal IP address in the traffic DB 228 for each internal IP.

The blacklist access statistics unit 223 blacks the traffic information (access information for each internal IP address) stored in the traffic DB 228 and the blacklist IP address DB 226 and the black data for a predetermined period of time (for example, daily, weekly). Using the blacklist information stored in the list URL DB 227, access statistics for the blacklist for each internal IP address are calculated. That is, the blacklist access statistics unit 223 uses the traffic information stored in the traffic DB 228 and the blacklist information stored in the blacklist IP address DB 226 and the blacklist URL DB 227 to internal host 130. , The number, days, and frequency of each internal IP address's access to a blacklisted IP address (hereinafter referred to as "blacklist IP address") and URL (hereinafter referred to as "blacklist URL"). The calculated state is stored in the host state DB 229 and the information is transmitted to the host state monitoring unit 225. For example, the blacklist access statistics unit 223 calculates the daily operation status, the daily access count, the weekly access days, the inaccessible days, and the weekly access frequency for each internal IP address, and stores them in the host state DB 229.

The blacklist management unit 224 is provided with information on a web site from which a botnet's C & C server or malicious code can be downloaded from an external system such as a security company or an ISP that has blacklist information. 226 or in the blacklist URL DB 227 (update). The function of the blacklist management unit 224 may be automatically performed online, but in some cases, it may be manually performed offline by the security system administrator.

The host status monitoring unit 225 monitors the status (normal / suspicious / infection) of each of the internal hosts 130 in real time by using the information stored in the host status DB 229, and detects the bot infected host for security. Notify the administrator.

The blacklist IP address DB 226 and the blacklist URL DB 227 respectively store the botnet's C & C server IP address and a website URL from which malicious code can be downloaded.

The traffic DB 228 stores information about an external IP, an external URL, and an access time accessed by the corresponding internal IP address for each internal IP address.

The host status DB 229 provides information on whether each internal host 130 has been operated for a period of time, the number of accesses to the blacklist IP address or blacklist URL for each internal IP address, the number of days of access, the frequency of access, and the inaccessibility. It stores the number of days and status information for the internal hosts (130).

3 is a flowchart illustrating a bot infected host detection method through the operation of the bot infected host detection device having the above-described configuration.

The network tap 210 is installed between the external network 110 and the internal network 120 to mirror the bot by mirroring network traffic transmitted between the external hosts 110 and the internal hosts 130 connected to the internal network 120. It delivers to the packet collection unit 221 of the infection host detection device 220.

The packet collector 221 collects the network packets received from the network tap 210 in real time and delivers them to the packet decode unit 222 (step 310).

The packet decode unit 222 analyzes the received packets in real time, extracts information on an external IP address, an external URL, and an access time accessed by the corresponding internal IP address for each internal IP address, and extracts the extracted information from the traffic DB 228. (Step 320).

That is, the packet decode unit 22 first checks whether the received packet is an IP packet, and if the packet is an IP packet, extracts a source IP address, a destination IP address, and an access time, and then extracts an external IP and an access time corresponding to each internal IP. Store in the traffic DB (228). Further, the packet decode unit 22 additionally checks whether the corresponding packet is an HTTP packet, and in the case of the HTTP packet, extracts a destination URL by interpreting the URL part from the contents of the HTTP request and responds it to an external URL for the corresponding internal IP address. Store it in the traffic DB 228.

That is, in the traffic DB 228, an external IP address, an external URL, and an access time are matched with each internal IP address and stored in real time.

Then, the blacklist access statistics unit 223 uses the traffic information (access information for each internal IP) stored in the traffic DB 228 and the blacklist for each internal IP address using the blacklist information stored in the blacklist DBs 226 and 227. Compute access statistics for (step 330).

That is, the blacklist access statistics unit 223 periodically determines the operation of each internal host by using the traffic information stored in the traffic DB 228, and uses the blacklist IP address DB 226 and the blacklist URL to determine the traffic information. The access statistics for the blacklist IP address or the blacklist URL are calculated for each internal IP address by comparing with the blacklist information (IP address and URL) stored in the DB 227. These access statistics calculate daily access counts, weekly access days, inaccessibility periods, and access frequency.

To this end, the blacklist access statistics unit 223 first checks whether or not each internal IP address is generated from the traffic information stored in the traffic DB 228 on a daily basis, so that internal hosts corresponding to the internal IP address are assigned to the corresponding day. It is determined whether the operation has been performed. The reason for judging whether the internal host is operating is because the hosts in the corporate network, unlike personal computers, operate on working days and do not work on holidays, so malicious activity appears on working days and malicious activity does not appear on holidays. have. Therefore, it is possible to increase the reliability of access statistics by distinguishing whether the malicious code is inactive because the internal host is not running or whether the malicious code is inactive although the internal host is running. The operation determination information is stored in the host state DB 229 and used to calculate the weekly access frequency.

In addition, the blacklist access statistics unit 223 stores the traffic information stored in the traffic DB 228 in the blacklist IP address DB 226 and the blacklist URL DB 227 on a daily basis, for example. In comparison with the URL, each internal IP address calculates the number of times of accessing the blacklisted IP address or the blacklisted URL (the number of daily accesses) and stores the number in the host state DB 229. The information on the blacklist IP address and blacklist URL is updated by the blacklist manager 224 from time to time or regularly.

Next, the blacklist access statistics unit 223 uses the number of daily accesses stored in the host state DB 229, for example, the number of days each internal IP address accesses the blacklist IP address or the blacklist URL at least once in a week ( Weekly access days) are calculated and stored in the host state DB 229. In addition, the blacklist access statistics unit 223 calculates the date when each internal IP address most recently accessed the blacklist IP address or the blacklist URL using the daily access count stored in the host state DB 229. The non-access period is calculated by calculating the difference with the current date and stored in the host state DB 229.

Next, the blacklist access statistics unit 223 divides the number of weekly access days for each internal IP address by the number of days of operation of the corresponding internal host for the week, and thus the frequency of weekly access to the blacklist IP address or blacklist URL for each internal IP address. Calculate In this case, if the number of operating days during the week is 0, it is excluded from the frequency calculation.

When the access statistics for the blacklist IP address or the blacklist URL for each internal IP address are calculated, the host status monitoring unit 225 detects the infected host by determining the state of each internal IP address, that is, the internal host. (Step 340).

FIG. 4 is a flowchart illustrating a change in the infection status of internal hosts. Referring to FIG. 4, the operation of the host status monitoring unit 225 will be described below.

When the bot infected host detection device of the present invention is first applied, the internal hosts 130 are considered to be 'normal'.

The host status monitoring unit 225 “infects the internal host corresponding to the internal IP address if there is an internal IP address that accesses the blacklist IP address or the blacklist URL more than once using the information stored in the host status DB 229. 'Suspect' state. However, when the number of access increases and the access frequency of the blacklist IP address or the blacklist URL of the corresponding internal IP address exceeds the preset first threshold value, the host status monitoring unit 225 converts the internal host into an 'infected' state. Then inform the network security administrator.

Internal hosts notified of an 'infection' status are subject to actions such as IP blocking or infection treatment by the network security administrator. When the IP of the internal host is blocked, the internal host is removed from the managed host 130 connected to the internal network 120. When the infection treatment is received, the host status monitoring unit 225 converts the corresponding internal host from the 'infection' state to the 'suspect infection' state. In this case, the reason for not immediately converting to a 'normal' state is that the malware repair program generally does not have a high possibility of completely treating the malicious code, so that additional verification is required. That is, the host status monitoring unit 225 converts internal hosts whose inaccessibility period for the blacklisted IP address or the blacklist URL among the internal hosts converted to the 'suspect susceptibility' state to the 'normal' state. Let's do it.

The operations of steps 310 to 340 described above are repeated until an abnormality occurs in the bot infected host detection device or a separate instruction from the security manager is given.

The above-described embodiment is for the purpose of illustrating the invention, and those skilled in the art will be able to make various modifications, changes, substitutions and additions through the spirit and scope of the appended claims, and such modifications may be made by the following claims. It should be seen as belonging to a range.

110: external network 120: internal network
130: internal host 210: network tab
220: bot infection host detection device 221: packet collection unit
222: packet decode unit 223: blacklist access statistics unit
224: black list management unit 225: host status monitoring unit
226: blacklist IP address DB 227: blacklist URL DB
228: traffic DB 229: host status DB

Claims (19)

A packet collecting unit collecting packets transmitted between the internal network and the external network;
A packet decoder configured to interpret packets collected by the packet collector and extract access information of the external network for each internal IP address;
A blacklist access statistics unit configured to calculate access statistics for the blacklist for each internal IP address using the access information and the registered blacklist information;
A host status monitoring unit for monitoring a status of internal hosts connected to the internal network using the access statistics and detecting an infected host; And
And a database for storing the access information, the blacklist information, the access statistics, and state information about the internal hosts. The method of claim 1,
Bot infected host detection, characterized in that it further comprises a blacklist management unit for receiving information about the botnet's C & C (Command & Control) server or a website that can download malicious code to update the blacklist information Device. The method of claim 1, wherein the packet collecting unit
Bot infection host detection device, characterized in that the packets received and collected in real time through a network tap installed between the internal network and the external network. The method of claim 1, wherein the packet decode unit
And extracting the external IP address, external URL, and access time of the external network accessed by each internal IP address. The method of claim 4, wherein the packet decode unit
Source IP address, destination IP address, and access time are extracted from L3 (LAYER 3) layer IP packet, and destination URL is extracted from the HTTP request contents in L7 (LAYER 7) layer HTTP packet. Bot infection host detection device. The method of claim 1, wherein the blacklist access statistics unit
The access statistics, the bot infected host detection device, characterized in that it calculates the operation of the internal host and the number of times, the number of days and the frequency of access to the blacklist registered by the internal IP address in a predetermined period unit. The method of claim 6, wherein the blacklist access statistics unit
The apparatus for detecting a bot infected host, characterized in that the daily operation of the internal host, the number of daily accesses to the blacklist by the internal IP address, the number of weekly access days, the inaccessible period and the frequency of weekly accesses are calculated. The method of claim 7, wherein the blacklist access statistics unit
Bot infection host detection device, characterized in that for calculating the weekly access frequency by dividing the weekly access days by the number of operating days for the week. The method of claim 8, wherein the host status monitoring unit
The internal host corresponding to the internal IP address that has accessed the blacklist at least once is converted into a 'suspected infection' state, and among the internal hosts that are in 'suspected infection' state, the weekly access frequency exceeds a preset first threshold. A bot infected host detection device, which translates the host into an 'infected' state. The method of claim 7, wherein the blacklist access statistics unit
Bot infection characterized by calculating the date of each internal IP address most recently accessed the blacklist using the stored daily access number and calculating the inaccessibility period by calculating the difference between the date and the current date. Host Beacon. The method of claim 10, wherein the host status monitoring unit
Converts an internal host treated in the 'infected' state into a 'suspected infection' state, and among the internal hosts in the 'suspected infection' state, an internal host whose inaccessibility period for the blacklist exceeds the second predetermined threshold, Bot infected host detection device, characterized in that the conversion to the normal state. A first step of collecting packets transmitted between the external network and the internal network;
A second step of extracting access information about the external network for each internal IP address by analyzing the collected packets;
A third step of calculating access statistics for the blacklist for each internal IP address by using the access information and the registered blacklist information; And
And monitoring the status of internal hosts connected to the internal network using the access statistics, and detecting an infected host. 13. The method of claim 12, wherein the second step is
A method for detecting a bot infected host, comprising extracting an external IP address, an external URL, and an access time of the external network accessed by each internal IP address. The method of claim 13, wherein the second step
The source IP address, the destination IP address, and the access time are extracted from the IP packet of the L3 layer, and the destination URL is extracted from the HTTP packet of the L7 layer by extracting the destination URL. The method of claim 12, wherein the third step
As the access statistics, the bot infection, which calculates whether the internal host is operated and the number of times the internal IP address accesses a pre-registered blacklist, the number of days accessed, the inaccess period, and the frequency of access, as the access statistics. Host detection method. The method of claim 15, wherein the access frequency is
The bot infection host detection method, characterized in that the week access days divided by the number of days of operation for the week. The method of claim 16, wherein the fourth step
The internal host corresponding to the internal IP address that has accessed the blacklist at least once is converted into a 'suspected infection' state, and among the internal hosts that are 'suspected infection' state, the access frequency exceeds a preset first threshold value. Bot infected host detection method, characterized in that the conversion to the 'infected' state. 16. The method of claim 15, wherein the inaccessibility period is
A method for detecting a bot infected host, wherein each internal IP address obtains a date when the blacklist is most recently accessed, and indicates a difference between the date and the current date. 19. The method of claim 18, wherein the fourth step is
Converts an internal host treated in the 'infected' state into a 'suspected infection' state, and among the internal hosts in the 'suspected infection' state, the inaccessible period for the blacklist exceeds the preset second threshold; Bot infected host detection method, characterized in that the transition to the 'normal' state.

Images