KR20210141198A - Network security system that provides security optimization function of internal network - Google Patents

Abstract

The present invention relates to a network security system, and more specifically, to a network security system providing a security optimization function of an internal network, which classifies traffic suspected of being harmful to traffic generated in an external network and the internal network, establishes a virtual security policy by analyzing a signature of classified traffic and then calculates accuracy by simulating the virtual security policy using an entire generated traffic, and manages by automatically adding and modifying the security policy based on the same. Therefore, effective security policy can be implemented by automatically detecting and analyzing new harmful traffic generated in the internal network and the external network.

Description

Network security system that provides security optimization function of internal network}

The present invention relates to a network security system, and more particularly, classifies traffic suspected of being harmful to traffic generated in an external network and an internal network, analyzes a signature of the classified traffic, and establishes a virtual security policy. , calculates accuracy by simulating a virtual security policy using all generated traffic, and automatically detects new harmful traffic generated from internal and external networks by automatically adding and modifying security policies based on this and managing them And it relates to a network security system that provides an internal network security optimization function capable of performing an effective security policy by analyzing it.

Cyber attacks are organized and intelligent, and in particular, APT (Advanced Persistent Threat) attacks in which hacking organizations perform covert and continuous intelligent attacks targeting specific attack targets for economic purposes. It is growing rapidly and is becoming a major social problem. In particular, APT attacks infect the host of the person who has access to important information with malicious code through continuous malicious code updates after a hacker or hacking organization infiltrates the target organization with malicious code to illegally extort important information of the organization. , an attack method that leaks important information.

Accordingly, with the increase of information system assets, operating systems (OS) in various environments, application programs for mobile terminals, and security solutions have been developed and used.

Security events recorded in such various environments are also stored in various forms, and their capacity is increasing rapidly.

Events related to security breaches occurring in various types of local terminals are recorded as event logs by local terminals or monitoring devices on the network.

The administrator analyzes the generated event log to check the damage of the security breach and takes action to prevent further breaches.

In 'Citation 1' ("Kernel backdoor detection system and method through Windows network monitoring", hereinafter referred to as 'Citation 1'), TDI (Transport Driver Interface) layer and NDIS (Network Driver Interface Specification) among Windows network components ) by comparing and analyzing the information of network packets passing through the layer to detect a kernel backdoor by distinguishing between a network packet generated from a normal network behavior and a network packet generated from a malicious network behavior such as a kernel backdoor. Disclosed are a kernel backdoor detection system and method capable of preventing intrusion by a kernel backdoor by filtering generated network packets.

However, the 'cited document 1' is a technology limited to preventing intrusion through a kernel backdoor, and a technology capable of preventing document leakage or hacking through terminals connected to a system server or an internal network is not disclosed, and in sub-traffic A technology that can block the generated harmful traffic is not disclosed.

In addition, in the prior art, the level of risk is measured by analyzing the generated network-based security event log. In some cases, it is efficient to group and analyze various security events that are related to each other.

In addition, in the prior art of analyzing a network-based security event log, there is a problem in that it is difficult to effectively cope because it cannot provide a related analysis method even if there is such a need.

In other words, in the early days of security control services, the reality is that the basic service level is mainly limited to operating the network security system and monitoring various events occurring in the equipment.

Hacking techniques, such as homepage falsification and major information leakage, which have been widely used recently, are becoming more intelligent, specialized, and advanced as time goes by. is not reflected in the operation.

In order to solve the above problems, corporations and national institutions perform risk management to enable pre/post responses to various events (hereinafter referred to as security events) related to security breaches occurring in the network, thereby providing a wide range of networks. To ensure availability, integrity, and confidentiality of multiple security solutions, an integrated security management system (ESM), a risk management system (RMS), a threat management system (TMS), a firewall (Firewall), Intrusion Detection System (IDS), Intrusion Prevention System (IPS; Intrusion Protection System), such as to build a network security management system.

The risk management system (RMS) collects and analyzes security events for all IT (Information Technology) assets of the managed network, for example, various security equipment or network equipment (eg, servers, routers, etc.) to prevent vulnerabilities and threats in advance. By identifying and responding to security incidents, we prevent security incidents in advance and manage the security level stably at all times.

The threat management system (TMS) collects and analyzes security events that occur in the network to be managed, and in particular, detects and identifies cyber threats in network traffic and comprehensively analyzes them to provide early warning.

The firewall installs routers or application gateways so that all information flows only through them, so that information transmitted between a network and the Internet within a company or organization is selected and accepted, rejected, and modified.

The intrusion detection system (IDS) collects and analyzes security events occurring in the managed network, and when malicious network traffic is detected, it functions to alert the administrator of this fact.

The intrusion prevention system (IPS) collects and analyzes security events occurring in the managed network, and when malicious network traffic is detected, alerts the administrator of this fact and also performs a function to block immediately.

A typical network security management system operated as described above determines a threat level corresponding to a security event according to a network security policy.

However, the network security management system as described above does not consider the integrated and relevant analysis and unstructured data.

In addition, the rapid growth of the Internet provides various advantages, but at the same time, the Internet includes many problems.

Among them, the security area is emerging as the biggest problem area.

Currently, many systems are being attacked, and these intrusion behaviors are classified into misuse intrusion and abnormal intrusion, depending on the type of intrusion model.

Accordingly, many intrusion detection techniques have been introduced and intrusion detection systems (IDS) equipped with them have been commercialized, but most of them are pattern detection, and the false positive rate is very high.

As such, there is a problem in practical application due to a high false positive rate to perform actual control using only intrusion detection information.

That is, the control system using the intrusion detection log information up to now has a disadvantage in that it is difficult to check the actual intrusion information due to numerous false positives.

Meanwhile, as an attempt to detect an external intrusion using a statistical technique, methods using traffic statistics have been proposed.

In the case of the method using traffic statistics, anomaly detection is performed when the amount of traffic increases more rapidly than usual or when the amount of traffic on a specific port increases through time series analysis of traffic statistics information.

However, this method can also be judged as an attack for normal use that causes a lot of traffic, and there is a problem in that it cannot detect an intrusion attempt that causes a small amount of traffic.

That is, the control system using traffic statistics information provides a method for detecting abnormal traffic by not using a specific pattern unlike the intrusion detection system.

In general, a method of using traffic statistics information determines whether the traffic statistics are in a normal state or abnormal by comparing the amount of traffic in a normal state with the amount of currently collected traffic statistics.

Since this method also judges only using statistical information of traffic, there is a difficulty in detecting an attack in the case of an attack with a high false positive rate and a small amount of traffic.

In addition, the existing network firewall operates at the network layer level in the OSI7 layer.

Existing firewall devices control traffic according to the policies registered in the firewall, so it is inconvenient for administrators to directly manage the firewall policies, and communication between devices connected to the internal network is difficult to control. was difficult to detect and control, and the firewall program installed and running in the operating system had a serious problem in that it could not function normally when the operating system or firewall program was infected with a virus.

Republic of Korea Patent Publication No. 10-0635130 (October 10, 2006)

The present invention has been devised to solve the problems of the prior art,

Classify traffic that is suspected of being harmful to traffic generated from external and internal networks, analyze the signature of the classified traffic to establish a virtual security policy, and then simulate the virtual security policy using the entire generated traffic. A network security system that can perform effective security policies by automatically detecting and analyzing new harmful traffic that occurs in internal and external networks by calculating accuracy by calculating the accuracy and automatically adding and modifying security policies based on this. The purpose is to provide

The present invention for achieving the above object,

In a network security system for security of a network consisting of a server 100, a hub 200, and a plurality of clients 400,

Includes an upper traffic packet information collecting unit 111 that collects upper traffic files generated between the external network and the server 100 and the hub 200 together with packet data to generate traffic packet information and stores it in the memory module 150 The upper traffic processing module 110, which is configured by

Upper threshold reference information generation unit 122 for generating threshold reference information by receiving support, reliability, and improvement threshold standards from the manager;

An upper association rule information generating unit 123 that extracts association rules that match the threshold reference information from the traffic packet information based on the apriori algorithm, generates association rule information, and stores the association rule information in the memory module 150;

An upper level comprising an upper signature generator 124 that generates signature information by transforming the association rule information into a form suitable for the characteristics of a security method so as to be readable in a virtual or physical security method, and stores it in the memory module 150 A signature generation module 120, and

The signature information newly stored in the memory module 150 is set as the standard of the security simulation policy, or the signature information selected by the administrator among the signature information stored in the memory module 150 is set as the standard of the security simulation policy to secure Security simulation policy information generating unit 131 for generating simulation policy information,

A traffic generation processing unit 132 that generates traffic for simulating the security simulation policy information by utilizing the traffic packet information stored in the memory module 150;

a destination change processing unit 133 for changing the traffic destination so that the traffic generated by the traffic generation processing unit 132 is directed toward the pattern matching simulation unit 134;

By analyzing the pattern matching between the traffic packet information and the security simulation policy information flowing in by the traffic generation processing unit 132 and the destination change processing unit 133, the security policy is simulated while blocking the matching traffic packet information. , a pattern matching simulation unit 134 that generates the blocked traffic packet information as pattern matching information and stores it in the memory module 150;

A validity information generation unit 135 that generates validity information by analyzing the validity of the pattern matching information generated by the pattern matching simulation unit 134;

Signature information generated by the validity information generated by the validity information generating unit 135, traffic packet information flowing into the pattern matching simulation unit 134, security simulation policy information generated by the security simulation policy information generating unit 131, A security policy accuracy calculation unit 136 that comprehensively compares and analyzes the pattern matching information generated by the pattern matching simulation unit 134 to calculate the accuracy of the security simulation policy information to generate the accuracy calculation information and store it in the memory module 150 . A signature verification module 130 configured to include, and a category management unit 143 for adding, modifying and deleting category information of the upper category information generation unit 113 under the control of an administrator;

Controlling the traffic generation of the traffic generation processing unit 132 under the control of the administrator, and promoting the signature information verified through simulation or the signature information selected as the security policy by the administrator to the final security policy to generate the final security policy information, A signature management module configured to include a security policy management unit 145 that stores in the memory module 150 and applies the generated fixed security policy information to the security policy of the server 100 or transmits it to the micro security gateway device 300 . (140) and;

a server 100 configured to include a memory module 150;

a hub 200 for branching a network from the server 100 to a plurality of nodes;

A security policy receiving unit 331 that receives the fixed security policy information transmitted from the security policy management unit 145 of the signature management module 140 of the server 100;

A security policy application module 330 configured including a security policy application unit 332 for applying the determined security policy information received in the security policy receiving unit 331 to the security policy of the micro security gateway device 300;

a micro-security gateway device 300 configured to include a sub-memory 340 for storing fixed security policy information, and installed to connect the client 400 to a network connection to each node branched by the hub 200; is comprised of

Therefore, the present invention classifies traffic suspected of being harmful to traffic generated in the external network and the internal network, analyzes the signature of the classified traffic to establish a virtual security policy, and then uses the entire generated traffic to create a virtual It calculates the accuracy by simulating the security policy of provide possible effects.

1 is a structural diagram showing the overall configuration of the present invention.
2 is a block diagram showing the configuration of a server according to the present invention.
3 is a block diagram showing the configuration of the upper traffic processing module 110 of the present invention.
4 is a block diagram showing the configuration of the upper signature generating module 120 of the present invention.
5 is a block diagram showing the configuration of the signature verification module 130 of the present invention.
6 is a block diagram showing the configuration of the signature management module 140 of the present invention.
7 is a block diagram showing the configuration of the micro-security gateway device 300 of the present invention.
8 is a block diagram showing the configuration of the lower traffic processing module 310 of the present invention.
9 is a block diagram showing the configuration of the sub-signature generating module 320 of the present invention.
10 is a block diagram showing the configuration of the security policy application module 330 of the present invention.

Hereinafter, since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. These embodiments are provided to explain the present invention in more detail to those of ordinary skill in the art to which the present invention pertains. Therefore, the shape of each element shown in the drawings may be exaggerated to emphasize a clearer description, and in describing the present invention, if it is determined that a detailed description of a related known technology may obscure the gist of the present invention, the detailed description thereof omit

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

Terms used in the present invention are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise.

In the present invention, terms such as "comprises" or "have" are intended to designate that the features, numbers, steps, operations, components, parts, or combinations thereof described in the specification exist, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings.

1, the present invention according to an embodiment,

A hub 200 branching the server 100 and the network from the server 100 to a plurality of nodes, and a plurality of clients 400 to each node branched by the hub 200 are installed to connect the network It is configured to include a miniature security gateway device (300).

In this case, the client may be configured in plurality from the first client to the n-th client, and at least one of the clients may be configured to communicate with the hub and wireless network.

According to one embodiment, the present invention

Includes an upper traffic packet information collecting unit 111 that collects upper traffic files generated between the external network and the server 100 and the hub 200 together with packet data to generate traffic packet information and stores it in the memory module 150 The upper traffic processing module 110, which is configured by

Upper threshold reference information generation unit 122 for generating threshold reference information by receiving support, reliability, and improvement threshold standards from the manager;

An upper association rule information generating unit 123 that extracts association rules that match the threshold reference information from the traffic packet information based on the apriori algorithm, generates association rule information, and stores the association rule information in the memory module 150;

An upper level comprising an upper signature generator 124 that generates signature information by transforming the association rule information into a form suitable for the characteristics of a security method so as to be readable in a virtual or physical security method, and stores it in the memory module 150 A signature generation module 120, and

The signature information newly stored in the memory module 150 is set as the standard of the security simulation policy, or the signature information selected by the administrator among the signature information stored in the memory module 150 is set as the standard of the security simulation policy to secure Security simulation policy information generating unit 131 for generating simulation policy information,

A traffic generation processing unit 132 that generates traffic for simulating the security simulation policy information by utilizing the traffic packet information stored in the memory module 150;

a destination change processing unit 133 for changing the traffic destination so that the traffic generated by the traffic generation processing unit 132 is directed toward the pattern matching simulation unit 134;

By analyzing the pattern matching between the traffic packet information and the security simulation policy information flowing in by the traffic generation processing unit 132 and the destination change processing unit 133, the security policy is simulated while blocking the matching traffic packet information. , a pattern matching simulation unit 134 that generates the blocked traffic packet information as pattern matching information and stores it in the memory module 150;

A validity information generation unit 135 that generates validity information by analyzing the validity of the pattern matching information generated by the pattern matching simulation unit 134;

Signature information generated by the validity information generated by the validity information generating unit 135, traffic packet information flowing into the pattern matching simulation unit 134, security simulation policy information generated by the security simulation policy information generating unit 131, A security policy accuracy calculation unit 136 that comprehensively compares and analyzes the pattern matching information generated by the pattern matching simulation unit 134 to calculate the accuracy of the security simulation policy information to generate the accuracy calculation information and store it in the memory module 150 . A signature verification module 130 comprising a, and

Category management unit 143 for adding, modifying and deleting category information of the upper category information generation unit 113 under the control of the administrator;

Controlling the traffic generation of the traffic generation processing unit 132 under the control of the administrator, and promoting the signature information verified through simulation or the signature information selected as the security policy by the administrator to the final security policy to generate the final security policy information, A signature management module configured to include a security policy management unit 145 that stores in the memory module 150 and applies the generated fixed security policy information to the security policy of the server 100 or transmits it to the micro security gateway device 300 . (140) and;

A server 100 comprising a memory module 150 and

a hub 200 for branching a network from the server 100 to a plurality of nodes;

A security policy receiving unit 331 that receives the fixed security policy information transmitted from the security policy management unit 145 of the signature management module 140 of the server 100;

A security policy application module 330 configured including a security policy application unit 332 for applying the determined security policy information received in the security policy receiving unit 331 to the security policy of the micro security gateway device 300;

A micro security gateway device 300 configured to include a sub-memory 340 for storing the finalized security policy information, and installed to network the client 400 to each node branched by the hub 200 . consists of including

The upper-level traffic processing module 110 extracts a log source for optimizing security from the traffic packet information generated by the upper-level traffic packet information collection unit 111 , generates log file information, and stores it in the memory module 150 . It is configured to further include an upper log file information generating unit 112 that

The upper traffic processing module 110 classifies the log file information generated by the upper log file information generating unit 112 by characteristic type to generate category information according to the classification, and according to the category information classified by characteristic type It is configured to further include an upper category information generating unit 113 for storing log file information in the memory module 150 .

The upper-level traffic processing module 110 detects whether the log file information generated by the upper-level log file information generating unit 112 matches the category information generated by the upper-level category information generating unit 113, and the category When traffic containing log file information of a new characteristic that does not match the information is detected, it further includes an upper event log file generation detection unit 114 for designating log file information for the detected traffic as an analysis target.

The upper level traffic processing module 110 generates labeling information by labeling the log file information designated as an analysis target from the upper event log file generation detection unit 114 and stores the labeling information in the memory module 150 . (115) is configured to further include.

The higher-order signature generating module 120 encodes the labeling information into data in a form readable by the higher-order association rule information generating unit 123 to generate the encoding information and store the higher-order encoding information generating unit in the memory module 150 . (121) is further included.

The memory unit 150, traffic packet information, log file information, category information, labeling information, encoding information, threshold reference information, related rule information, signature information, security simulation policy information, traffic arrival destination, pattern matching information, validity It is configured to store at least any one or more of information, accuracy calculation information, and definite security policy information.

Hereinafter, the configuration of the present invention according to an embodiment will be described in more detail with reference to the drawings.

2 to 6, the server 100 of the present invention according to an embodiment,

It may be configured to include an upper traffic processing module 110 , an upper signature generating module 120 , a signature verification module 130 , a signature management module 140 , and a memory module 150 .

The upper level traffic processing module 110 collects upper traffic files generated between the external network and the server 100 and the hub 200 together with packet data, generates traffic packet information, and stores it in the memory module 150 . It may be configured to include a traffic packet information collection unit 111 .

The upper-level traffic processing module 110 extracts a log source for optimizing security from the traffic packet information generated by the upper-level traffic packet information collection unit 111 , generates log file information, and stores it in the memory module 150 . It may be configured to include an upper log file information generating unit 112 that is.

The upper traffic processing module 110 classifies the log file information generated by the upper log file information generating unit 112 by characteristic type to generate category information according to the classification, and according to the category information classified by characteristic type It may be configured to include an upper category information generating unit 113 that stores log file information in the memory module 150 .

The upper-level traffic processing module 110 detects whether the log file information generated by the upper-level log file information generating unit 112 matches the category information generated by the upper-level category information generating unit 113, and the category When traffic containing log file information of a new characteristic that does not match the information is detected, the upper event log file generation detection unit 114 for designating log file information for the detected traffic as an analysis target may be included. .

The upper level traffic processing module 110 generates labeling information by labeling the log file information designated as an analysis target from the upper event log file generation detection unit 114 and stores the labeling information in the memory module 150 . 115 may be included.

The higher-order signature generating module 120 encodes the labeling information into data in a form readable by the higher-order association rule information generating unit 123 to generate the encoding information and store the higher-order encoding information generating unit in the memory module 150 . (121) may be configured to include.

The upper signature generation module 120 may be configured to include an upper threshold reference information generation unit 122 that generates threshold reference information by receiving support, reliability, and improvement threshold values from an administrator.

The higher-order signature generating module 120 generates association rule information by extracting association rules that match the threshold reference information from the encoding information based on an apriori algorithm, and generates upper association rule information to be stored in the memory module 150 . It may be configured to include a unit 123 .

The upper signature generation module 120 generates the signature information by transforming the association rule information into a form suitable for the characteristics of the security method so as to be readable in a virtual or physical security method, and stores the upper signature information in the memory module 150 . It may be configured to include a portion 124 .

The signature verification module 130 sets the signature information newly stored in the memory module 150 as a standard of the security simulation policy, or selects the signature information selected by the administrator among the signature information stored in the memory module 150 It may be configured to include a security simulation policy information generating unit 131 that generates security simulation policy information by setting it as a standard of the security simulation policy.

The signature verification module 130 may include a traffic generation processing unit 132 that generates traffic for simulating the security simulation policy information by utilizing the traffic packet information stored in the memory module 150 .

The signature verification module 130 may include a destination change processing unit 133 for changing the traffic destination so that the traffic generated by the traffic generation processing unit 132 is directed toward the pattern matching simulation unit 134 .

Here, the traffic generation means that the traffic generation processing unit 132 transmits the traffic packet information stored in the memory module 150 toward the pattern matching simulation unit 134, which is the destination set by the destination change processing unit 133. It is desirable to be understood as traffic.

The signature verification module 130 analyzes whether the pattern matching between the traffic packet information flowing in by the traffic generation processing unit 132 and the destination change processing unit 133 and the security simulation policy information, and the pattern matching traffic packet It may be configured to include a pattern matching simulation unit 134 that simulates a security policy while blocking information, generates blocked traffic packet information as pattern matching information, and stores the information in the memory module 150 .

Here, the pattern matching information means "1. Among a plurality of packet data in a traffic file or a traffic file included in the traffic packet information that matches the signature information pattern with the security simulation policy information, 2. Signature information with the security simulation policy information It is desirable to be understood as "to simulate a security policy while performing blocking on a traffic file or packet data matching a pattern, and 3. designating a blocked traffic file or packet data as pattern matching information".

The signature verification module 130 may include a validity information generation unit 135 that generates validity information by analyzing the validity of the pattern matching information generated by the pattern matching simulation unit 134 .

Here, the validity analysis means that the traffic file or packet data included in the pattern matching information generated by the pattern matching simulation unit 134 is the signature information of the security simulation policy information generated by the security simulation policy information generation unit 131 . It is preferable to be understood as analyzing whether or not the matching signature information is included.

At this time, if the analysis result is found to include matching signature information, it is determined that the pattern matching information is valid, and validity information for the signature information of the corresponding security simulation policy information is generated, and the analysis result does not include the matching signature information. If it appears, it is preferable to understand that the pattern matching information is judged to be invalid and does not generate validity information.

At this time, the signature information for which the validity information is generated is promoted to the final security policy by the following security policy management unit 145 to generate the final security policy information, and it is preferable to be understood as verified signature information that can be applied to the security policy. .

The signature verification module 130 includes the signature information generated by the validity information generation unit 135, the traffic packet information flowing into the pattern matching simulation unit 134, and the security simulation policy information generation unit 131. ), the security simulation policy information generated by the pattern matching simulation unit 134 is comprehensively compared and analyzed to calculate the accuracy of the security simulation policy information, and the accuracy calculation information is generated and stored in the memory module 150 It may be configured to include a security policy accuracy calculation unit (136).

,

,

(%)" 의 방법에 의해 보안시뮬레이션정책정보의 정확도를 산출하는 것으로 이해될 수 있다.Accuracy calculation here means "A. Traffic packet information B. Using signature information extracted from traffic packet information C. Signature information is designated as security simulation policy information, and D. Security simulation is performed using security simulation policy information. In the process, E. The pattern matching information that was blocked by matching the pattern with the security simulation policy information F. How much traffic file or packet data related to the signature information G. How much does it contain” and calculate the probability As one thing, if "A=Traffic packet information, B=Signature information, C=Security simulation policy information, E=F=G=Pattern matching information, P=Accuracy, Q=Apriori algorithm analysis method", "

,

,

(%)" can be understood as calculating the accuracy of the security simulation policy information.

The signature management module 140 includes a traffic monitoring unit 141 that detects the amount of traffic generated between the external network and the server 100 and the client 400 in real time or at intervals set by the administrator and outputs it in a graph form. can be

The signature management module 140 includes log file information, category information, log file information designated as an analysis target by the upper event log file generation detection unit 114, labeling information, encoding information, threshold reference information, and related rule information. , signature information, security simulation policy information, traffic arrival destination changed by the destination change processing unit 133, pattern matching information, validity information, and the accuracy value of the security simulation policy information calculated by the security policy accuracy calculation unit 136 When any one or more of the information is selected by an administrator, the log file management unit 142 may be configured to output a log record for the selected information so that the administrator can check it.

The signature management module 140 may be configured to include a category management unit 143 for adding, modifying, and deleting category information of the upper category information generation unit 113 under the control of an administrator.

The signature management module 140, under the control of the administrator, gives a threshold standard to the upper threshold reference information generation unit 122, and transmits the signature of the lower signature generation module 320 of the micro-security gateway device 300 It may be configured to include a signature management unit 144 that receives the signature information transmitted from the processing unit 325 and stores it in the memory module 150 .

At this time, the signature management unit 144 controls the micro-security gateway device 300 under the control of the administrator to activate or deactivate at least one operation of the sub-traffic processing module 310 and the sub-signature generating module 320 . can be configured to

The signature management module 140 controls the traffic generation of the traffic generation processing unit 132 under the control of the administrator, and converts the signature information verified through simulation or the signature information selected as the security policy by the administrator as the final security policy. A security policy management unit 145 that promotes, generates and stores the finalized security policy information in the memory module 150, and applies the generated finalized security policy information to the security policy of the server 100 or transmits it to the micro-security gateway device 300 ) may be included.

The signature management module 140 receives a threshold value from the manager, and when the amount of traffic detected by the traffic monitoring unit 141 is less than or equal to the threshold value, the signature transmission processing unit 325 of the lower signature generation module 320 is Control to receive the signature information generated by the sub-signature generator 324 and store it in the memory module 150. When the amount of traffic detected by the traffic monitoring unit 141 exceeds a threshold, the sub-signature is generated. A traffic conditional synchronization processing unit 146 for controlling the signature transmission processing unit 325 of the module 320 to block transmission of the signature information generated by the sub-signature generation unit 324 may be included.

The memory module 150, traffic packet information, log file information, category information, labeling information, encoding information, threshold reference information, related rule information, signature information, security simulation policy information, traffic arrival destination, pattern matching information, validity It may be configured to include a memory module 150 for storing at least one of information, accuracy calculation information, and fixed security policy information.

The hub 200 is configured to branch a network from the server 100 to a plurality of nodes.

On the other hand, referring to FIGS. 7 to 10 , the micro-security gateway device 300 of the present invention according to an embodiment includes a sub-traffic processing module 310 , a sub-signature generating module 320 , and a security policy application module 330 . ) and a sub-memory 340 , and may be configured to be installed in order to network-connect the client 400 to each node branched by the hub 200 .

The sub-traffic processing module 310 collects the traffic files generated between a plurality of nodes branched by the hub 200 together with packet data, generates traffic packet information, and stores the sub-traffic information in the sub-memory 340 . It may be configured to include a packet information collection unit (311).

The sub-traffic processing module 310 extracts a log source for optimizing security from the traffic packet information generated by the sub-traffic packet information collection unit 311, generates log file information, and stores it in the sub-memory 340 It may be configured to include a sub-log file information generating unit 312 that is.

The sub-traffic processing module 310 classifies the log file information generated by the sub-log file information generating unit 312 by characteristic type to generate category information according to the classification, and according to the category information classified for each characteristic type, It may be configured to include a sub-category information generating unit 313 that stores log file information in the sub-memory 340 .

The sub-traffic processing module 310 detects whether the log file information generated by the sub-log file information generating unit 312 matches the category information generated by the sub-category information generating unit 313, and the category When traffic containing log file information of a new characteristic that does not match the information is detected, a sub-event log file generation detection unit 314 for designating log file information for the detected traffic as an analysis target may be included. .

The sub-traffic processing module 310 generates labeling information by labeling the log file information designated as an analysis target from the sub-event log file generation detection unit 314, and stores the labeling information in the sub-memory 340. A sub-labeling information generating unit 315 may be included.

The sub-signature generating module 320 encodes the labeling information into data in a form readable by the sub-association rule information generating unit 323 to generate encoding information and to store the sub-memory 340 in the sub-memory 340. A sub-encoding information generating unit 321 may be included.

The sub-signature generating module 320 may be configured to include a sub-threshold reference information generating unit 322 that generates threshold reference information by receiving support, reliability, and improvement threshold criteria from an administrator.

The sub-signature generating module 320 generates association rule information by extracting an association rule that matches the threshold reference information from the encoding information based on the apriori algorithm, and generates lower association rule information to be stored in the sub-memory 340 . It may be configured to include a portion 323 .

The sub-signature generation module 320 generates the signature information by transforming the association rule information into a form suitable for the characteristics of the security method so as to be readable in a virtual or physical security method, and generates the sub-signature to be stored in the sub-memory 340 . A portion 324 may be included.

The sub-signature generating module 320 transmits the signature information generated by the sub-signature generating unit 324 to the memory module 150 of the server 100 under the control of the traffic conditional synchronization processing unit 146. It may be configured to include a signature transmission processing unit (325).

The security policy application module 330 includes a security policy receiving unit 331 that receives the finalized security policy information transmitted from the security policy management unit 145 of the signature management module 140 of the server 100 . can be configured.

The security policy application module 330 is configured to include a security policy application unit 332 for applying the determined security policy information received in the security policy receiving unit 331 to the security policy of the micro security gateway device 300 . can

The sub-memory 340 is configured to store at least one of traffic packet information, log file information, category information, labeling information, encoding information, threshold reference information, related rule information, signature information, and fixed security policy information. can be

Therefore, the present invention classifies traffic suspected of being harmful to traffic generated in the external network and the internal network, analyzes the signature of the classified traffic to establish a virtual security policy, and then uses the entire generated traffic to create a virtual It calculates the accuracy by simulating the security policy of provide possible effects.

That is, the conventional security system could not effectively block harmful traffic generated from the lower traffic of the internal network. Since it can be applied as a policy, it is possible to provide a security optimization function that can effectively block harmful traffic that can only occur in the internal network.

In addition, when establishing security policies for harmful traffic in internal and external networks, a verified signature-based security policy is automatically established and applied to security without the need for an administrator to directly manage and detect new attacks and As the security policy is quickly established and the security policy for both upper and lower traffic is established, it is possible to provide security policies for harmful traffic that occur between internal as well as external networks in an optimized form according to the network environment. there will be

In the above, the present invention has been described based on the bar shown in the drawings, but this is only exemplary, and various substitutions, modifications and changes are possible within the scope without departing from the technical spirit of the present invention, so it is limited to the above-described embodiments and drawings it's not going to be

100 : server
200 : Herb
300: ultra-small security gateway device
400 : client

Claims (7)

In a network security system for security of a network consisting of a server 100, a hub 200, and a plurality of clients 400,
Includes an upper traffic packet information collecting unit 111 that collects upper traffic files generated between the external network and the server 100 and the hub 200 together with packet data to generate traffic packet information and stores it in the memory module 150 The upper traffic processing module 110, which is configured by
The upper threshold reference information generation unit 122 for generating threshold reference information by receiving support, reliability, and improvement threshold standards from the manager;
An upper association rule information generating unit 123 that extracts association rules that match the threshold reference information from the traffic packet information based on the apriori algorithm, generates association rule information, and stores the association rule information in the memory module 150;
An upper level comprising an upper signature generator 124 that generates signature information by transforming the association rule information into a form suitable for the characteristics of a security method so as to be readable in a virtual or physical security method, and stores it in the memory module 150 A signature generation module 120, and
The signature information newly stored in the memory module 150 is set as the standard of the security simulation policy, or the signature information selected by the administrator among the signature information stored in the memory module 150 is set as the standard of the security simulation policy to secure Security simulation policy information generating unit 131 for generating simulation policy information,
A traffic generation processing unit 132 that generates traffic for simulating the security simulation policy information by using the traffic packet information stored in the memory module 150;
a destination change processing unit 133 for changing the traffic destination so that the traffic generated by the traffic generation processing unit 132 is directed toward the pattern matching simulation unit 134;
By analyzing the pattern matching between the traffic packet information and the security simulation policy information flowing in by the traffic generation processing unit 132 and the destination change processing unit 133, the security policy is simulated while blocking the matching traffic packet information. , a pattern matching simulation unit 134 that generates the blocked traffic packet information as pattern matching information and stores it in the memory module 150;
A validity information generation unit 135 for generating validity information by analyzing the validity of the pattern matching information generated by the pattern matching simulation unit 134;
Signature information generated by the validity information generated by the validity information generating unit 135, traffic packet information flowing into the pattern matching simulation unit 134, security simulation policy information generated by the security simulation policy information generating unit 131, A security policy accuracy calculation unit 136 that comprehensively compares and analyzes the pattern matching information generated by the pattern matching simulation unit 134 to calculate the accuracy of the security simulation policy information to generate the accuracy calculation information and store it in the memory module 150 . A signature verification module 130 comprising a, and
Category management unit 143 for adding, modifying and deleting category information of the upper category information generation unit 113 under the control of the administrator;
Controls the traffic generation of the traffic generation processing unit 132 under the control of the administrator, and promotes the signature information verified through simulation or the signature information selected as the security policy by the administrator to the final security policy to generate the final security policy information, A signature management module configured to include a security policy management unit 145 that stores in the memory module 150 and applies the generated fixed security policy information to the security policy of the server 100 or transmits to the micro security gateway device 300 . (140) and;
a server 100 configured to include a memory module 150;
a hub 200 for branching a network from the server 100 to a plurality of nodes;
A security policy receiving unit 331 that receives the fixed security policy information transmitted from the security policy management unit 145 of the signature management module 140 of the server 100;
A security policy application module 330 configured including a security policy application unit 332 for applying the determined security policy information received in the security policy receiving unit 331 to the security policy of the micro security gateway device 300;
a micro-security gateway device 300 configured to include a sub-memory 340 for storing fixed security policy information, and installed to connect a client 400 to a network connection to each node branched by the hub 200; A network security system that provides a security optimization function of the internal network, characterized in that it comprises a.
The method of claim 1,
The upper-level traffic processing module 110,
Upper log file information generating unit 112 that extracts a log source for optimizing security from the traffic packet information generated by the upper traffic packet information collection unit 111, generates log file information, and stores it in the memory module 150 A network security system that provides a security optimization function of the internal network, characterized in that it further comprises a.
3. The method of claim 2,
The upper-level traffic processing module 110,
The log file information generated by the upper log file information generating unit 112 is classified by characteristic type to generate category information according to the classification, and log file information according to the category information classified for each characteristic type is stored in the memory module 150 . A network security system providing a security optimization function of an internal network, characterized in that it further comprises a higher category information generation unit 113 to store.
4. The method of claim 3,
The upper-level traffic processing module 110,
Detects whether the log file information generated by the upper log file information generation unit 112 matches the category information generated by the upper category information generation unit 113, and a log file of a new characteristic that does not match the category information When traffic containing information is detected, the security optimization function of the internal network, characterized in that it further includes an upper event log file generation detection unit 114 for designating log file information for the detected traffic as an analysis target. Network security system provided.
5. The method of claim 4,
The upper-level traffic processing module 110,
The upper event log file generation detection unit 114 labels the log file information designated as an analysis target to generate labeling information and to further include an upper labeling information generation unit 115 for storing the labeling information in the memory module 150 . A network security system that provides an internal network security optimization function.
6. The method of claim 5,
The upper signature generating module 120,
The higher-order association rule information generating unit 123 encodes the labeling information into readable data to generate the encoding information and further comprises a higher-order encoding information generating unit 121 for storing it in the memory module 150. A network security system that provides an internal network security optimization function.
7. The method of claim 6,
The memory unit 150,
Traffic packet information, log file information, category information, labeling information, encoding information, threshold reference information, related rule information, signature information, security simulation policy information, traffic arrival destination, pattern matching information, validity information, accuracy calculation information, fixed security A network security system that provides a security optimization function of an internal network, characterized in that it is configured to store at least any one or more of the policy information.

Images