KR100512145B1 - Method for inspecting file faultless in invasion detection system - Google Patents

Abstract

The present invention stores a file input by a user in a file access detection policy, generates integrity data for the stored file, determines whether it is correct, stores the received file, and receives integrity check environment information input by the user. And storing an event for each of the stored files to detect whether or not an access occurs, and generating integrity data for the accessed file to determine whether it is correct.If the integrity data of the corresponding file is incorrect, By performing a preset response action and outputting alarm information to the user, any access to the file to be protected is immediately executed and an integrity check is notified to the administrator and the system automatically responds to the system. To increase safety Can.

Description

Method for inspecting file faultless in invasion detection system

The present invention relates to a file integrity check method in an intrusion detection system that performs an integrity data check and immediately provides the result to an administrator when an external user / processor or the like is detected.

As the knowledge-information society gets more advanced, the dependence of the main tasks on the network and the information system is increasing, and the area of information service through the network is increasing rapidly. On the other hand, the case of informatization dysfunction is also increasing day by day. The representative informatization dysfunction is intrusion and attack on major information systems on corporate / institutional networks through the Internet, so-called hacking.

In preparation for such intrusion and attack, various network and system security techniques and devices are being developed to protect the network and important information systems. An intrusion detection system is a network and system security device that monitors hosts running network and critical information services, alerts security administrators when suspicious activity is found, submits detailed reports of intruder actions, and It is a system that provides security measures.

The intrusion detection system is divided into NIDS and HIDS according to whether the target is a network or a host, and there is a hybrid IDS system combining the NIDS and HIDS.

In the intrusion detection system as described above, the integrity verification processor periodically detects whether the main system file is tampered with and detects the intrusion.

In order to implement the integrity verification process as described above, a fingerprint of key system files and directories, files and directories selected by a user, and MD5 checksum values, creation time, and access authority are made and databased. keep it. Then, based on a predetermined schedule, periodically or when an intrusion is suspected, the administrator manually manipulates and verifies tampering / adding / deleting with the fingerprint of the current file and directory at the time of verification.

As described above, the file integrity check manually generates the integrity data for each file, stores the generated data in a file or a database, and compares the stored file integrity data with the newly generated file integrity data on an irregular or regular basis. To determine if the file has been modified.

As a result of the determination, if a modified fact is found for the integrity data, the administrator is provided with information about it and appropriately responded to protect the system.

Here, there are various methods of generating the integrity data, but a file integrity method using a hash algorithm is commonly used. Representative hash algorithms include algorithms such as MD5 and SHA-1. In the case of the SHA-1 algorithm, Generates messages of less than bits as shortened data of 160 bits (20 bytes) in length. The 20 bytes of integrity data can be compared to check if the contents of the file have been altered.

Hereinafter, a method of checking integrity data will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a method of checking integrity data in a conventional intrusion detection server.

Referring to FIG. 1, the intrusion detection server receives and stores a file list input by a user (S100). That is, the user sets files to be protected in the intrusion detection server, lists the exact location and file name for the files, and stores them in the intrusion detection server.

After performing step 100, the intrusion detection server generates first integrity data for the stored file (S102), and generates second integrity data for each file to determine whether the generated integrity data is correct. (S104).

The intrusion detection server then determines whether the first integrity data corresponds to the second integrity data (S106).

If it is determined in step 106 that the first integrity data corresponds to the second integrity data, the intrusion detection server determines that the first integrity data is correct and stores it (S108).

That is, the intrusion detection server sequentially generates the first integrity data of the stored files using a hash algorithm selected by a user. When generation of the first integrity data for each file is completed, the intrusion detection server generates second integrity data for each file and compares them to match each other to confirm that the generated first integrity data is correct. Only if verification is complete.

If it is determined in step 106 that the first integrity data does not correspond to the second integrity data, the intrusion detection server determines that the first integrity data is not correct and performs the process again from step 102. That is, if the first integrity data and the second integrity data do not correspond, the intrusion detection server regenerates the integrity data for the file.

After performing step 108, the intrusion detection server receives and stores the integrity check environment information input by the user (S110). The integrity test environment information refers to test method information and alarm information output method. The inspection method includes a method of manually inspecting the test to be automatically performed at a predetermined time interval or as required by an administrator. Therefore, the user sets one of the inspection methods such as automatic or manual.

The alarm information output method indicates how the test results are to be transmitted to the administrator when an error is detected in the file integrity after performing the integrity check. There are a method such as an email, a text message, and a voice message.

After performing step 110, the intrusion detection server determines whether the integrity data inspection time is reached according to the integrity inspection environment information set by the user (S112). In other words, the intrusion detection server determines whether an inspection time is reached when the integrity checking method is automatic checking, or whether an integrity checking request command is received from the user in the case of manual checking.

When the determination result of the step 112 is the integrity data check time, the intrusion detection server checks the integrity data for each file (S114), and determines whether each integrity data is correct (116).

If the integrity data is correct as the determination result of step 116, the intrusion detection server determines that the file is normal (S118), and performs step 112.

If the integrity data is incorrect as a result of the determination of step 116, the intrusion detection server generates integrity error information (S120) and outputs alarm information indicating that an error has occurred to the administrator (S122). The alarm information is output by a method previously set by the user, for example, a mail or a text message. Accordingly, the alarm information is output as a text message or an e-mail in the form of 'an error has occurred'.

Then, the administrator checks the alarm information output from the intrusion detection server, and then takes action on the file where the abnormality is found, so as not to cause a problem in the entire system.

However, in the related art, since error information is not transmitted to an administrator as soon as a file to be protected is deformed, a fatal system error occurs in a system requiring immediate response.

In addition, when an error occurs in the integrity data, the cause and time information may not be confirmed.

In addition, in order to increase the security of the system, the integrity check must be frequently performed, and during the inspection, the CPU usage of the system increases, which causes a problem that the utilization of the system decreases.

In addition, when a file to be protected is copied, since the contents are not altered, the integrity data values are matched so that an error message does not occur. Therefore, there is a problem in that external leakage of important files cannot be prevented.

Accordingly, an object of the present invention is to provide a file integrity checking method in an intrusion detection system that immediately executes an integrity check and notifies an administrator and automatically responds to a system regardless of any access to a file to be protected.

Another object of the present invention is to provide a file integrity checking method in an intrusion detection system that can identify a user or process attempting to modify a file, and the date and time at which the file is modified.

It is still another object of the present invention to provide a file integrity checking method in an intrusion detection system capable of reducing CPU usage by performing integrity checking only when a file modification is attempted.

It is still another object of the present invention to provide a file integrity checking method in an intrusion detection system capable of preventing an external leak of important information by generating a log and performing a corresponding action by simply copying or reading a file.

According to an aspect of the present invention to achieve the above objects, the file input by the user is stored in the file access detection policy, and after generating the integrity data for the stored file to determine whether it is correct, the user, Receives and saves the integrity check environment information input by the user, monitors the event for each of the stored files to detect whether access occurs, and generates integrity data for the accessed file to determine whether it is correct. If the integrity data of the file is incorrect as a result of the determination, a file integrity test method is provided in the intrusion detection system, characterized in that to perform a preset response action and output alarm information to the user.

After generating integrity data for the stored file to determine whether it is correct, storing the generated file generates first integrity data and second integrity data using a hash algorithm selected by a user for the stored file, and generating the generated integrity data. If the first integrity data corresponds to the second integrity data, the first integrity data is determined to be correct and stored. If the first integrity data does not correspond, the first integrity data is determined to be incorrect and the integrity data check is performed again.

The integrity check environment information includes a corresponding behavior information and an alarm information output method for an error occurrence file.

The file access may be an operation including opening, reading, writing, creating, and deleting a file.

Determining whether or not the correct data is generated by generating the integrity data of the accessed file, generating the third integrity data of the accessed file, and the generated third integrity data is generated and stored in advance. Is determined, and if the third integrity data corresponds to the first integrity data, the integrity data is determined to be correct, and if not, the integrity data is determined to be incorrect.

If the integrity data is correct, the file is determined to be normal, and if it is not correct, it is determined that an error has occurred in the file.

The preset corresponding behavior is corresponding behavior information in the integrity check environment information preset and stored by the user.

The alarm information includes integrity error information including a user / processor attempting to access a file, a date, and a time, and is output in the form of a mail, a message, or a text message.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Figure 2 is a block diagram schematically showing the configuration of a host intrusion detection system according to an embodiment of the present invention.

Referring to FIG. 2, the host intrusion detection system includes a host intrusion detection server 200 and a management server 210.

The host intrusion detection server 200 is a server on which an intrusion detection only program is installed to protect from an external attack, and may be a database server 202, a web server 204, a file server 204, or the like.

The management server 210 is a management server for operating the host intrusion detection server 200, and manages logs and policies for intrusion detection of the host intrusion detection server 200.

The host intrusion detection system configured as described above basically performs network intrusion detection, file access, registry access, user login, file integrity check function, etc. of the server 200 to be protected.

In particular, the host intrusion detection server 200 registers the integrity check file list input by the user in the file access detection policy and generates integrity data. Then, if the host intrusion detection server 200 detects the access to the integrity data, the host intrusion detection server 200 checks whether the integrity data is correct.

If the integrity data is not correct as a result of the inspection, the intrusion detection server executes a response action predetermined by the user for the error, and outputs alarm information to the user. The alarm information is information indicating when a file is modified by what user or process and when.

3 is a flowchart illustrating a method of checking integrity data in an intrusion detection server according to an exemplary embodiment of the present invention.

Referring to FIG. 3, the intrusion detection server registers the protection target file input by the user in the file access detection policy (S300).

That is, the user registers files to be protected in the host intrusion detection system in the file access detection policy and defines the file access method in detail. The file access method may be open, read, write, create, delete, and the like. In addition, set integrity check file options for integrity check target files.

After performing step 300, the intrusion detection server generates first integrity data with respect to the registered file (S302).

That is, the intrusion detection server generates integrity data using a hash algorithm only for the integrity check target file registered in the file access detection policy. The hash algorithm may be an algorithm selected by a user.

After performing step 302, the intrusion detection server generates second integrity data for each registered file to determine whether the generated first integrity data is correct (S304).

The intrusion detection server then determines whether the first integrity data corresponds to the second integrity data (S306).

If it is determined in step 306 that the first integrity data corresponds to the second integrity data, the intrusion detection server determines that the first integrity data is correct and stores it (S308).

That is, the intrusion detection server sequentially generates the first integrity data of the stored files using a hash algorithm selected by a user. When generation of the first integrity data for each file is completed, the intrusion detection server generates second integrity data for each file and compares them to match each other to confirm that the generated first integrity data is correct. Only if verification is complete.

If the first integrity data does not correspond to the second integrity data as a result of the determination of step 306, the intrusion detection server determines that the first integrity data is not correct and performs the process again from step 302. That is, if the first integrity data and the second integrity data do not correspond, the intrusion detection server regenerates the integrity data for the file.

After performing step 308, the intrusion detection server receives and stores the integrity check environment information input by the user (S310).

The integrity check environment information refers to a response action information and an alarm information output method for a file where an integrity error has occurred. The response behavior information for the file in which the integrity error occurs refers to a response action to be dealt with when an integrity error occurs after performing an integrity check on the file in which the file access has occurred. The corresponding action methods include network logoff, local logoff, local logon prohibition, network logon prohibition, system lockout, system shutdown, process termination, and script execution.

The alarm information output method indicates how the test results are to be transmitted to the administrator when an error is detected in the file integrity after performing the integrity check. There are a method such as an email, a text message, and a voice message.

Therefore, the user appropriately selects the integrity check environment information including the response action and the integrity error information to be handled when an integrity error occurs and inputs the information to the intrusion detection server, and the intrusion detection server checks the integrity input by the user. Save environment information.

After performing step 310, the intrusion detection server monitors an event for a file stored in the file access detection policy (S312), and determines whether file access is made (S314). That is, the intrusion detection server monitors an event for a file stored in the file access detection policy to determine whether the file is opened, read, written, created, or deleted for each file.

As a result of the determination in step 314, when the file is accessed, the intrusion detection server examines the integrity data for the file (S316), and determines whether the integrity data is correct (S318).

If the integrity data is correct as a result of the determination in step 318, the intrusion detection server determines that the file is normal (S320).

That is, the intrusion detection server generates third integrity data with respect to the file from which the file has been accessed, and determines whether the generated third integrity data corresponds to the first integrity data generated and stored in step 308.

As a result of the determination, if the generated integrity data corresponds to the stored integrity data, it is determined that the file is normal. If not, it is determined that an error has occurred in the file.

If the integrity data is not correct as a result of the determination in step 318, the intrusion detection server executes a predetermined response action in step 310 and generates integrity error information (S322). The integrity error information refers to information about a user, a processor, a date, a time, etc. that attempted to access a file.

For example, when the user sets the corresponding action in the integrity check environment information as system shutdown, if the integrity data is not correct, the system is shut down, and the intrusion detection server generates integrity error information.

After performing step 322, the intrusion detection server outputs alarm information including the generated integrity error information to the user in a predetermined alarm information output method in step 310 (S324).

For example, if the integrity check environment information outputs alarm information in a text message, the intrusion detection server outputs alarm information in a text message to the corresponding user.

Accordingly, the user may know whether the user or processor attempting to modify the file, the date and time, and the corresponding method are correctly executed based on the alarm information.

The present invention is not limited to the above embodiments, and many variations are possible by those skilled in the art within the spirit of the present invention.

As described above, according to the present invention, any access to a file to be protected occurs, an integrity check is immediately executed to notify an administrator and automatically respond to the system, thereby inducing an intrusion detection system that can increase the safety of the system. Can provide a method for checking file integrity.

In addition, according to the present invention, it is possible to provide a file integrity check method in an intrusion detection system that can know the user or process attempts to modify a file, the date and time the file modification was attempted through a log.

In addition, according to the present invention, since integrity checking is performed only when a file modification is attempted, a file integrity checking method may be provided in an intrusion detection system in which CPU utilization is not large and system utilization may be increased.

In addition, according to the present invention, since a log is generated and a corresponding action is performed by simply copying or reading a file, a file integrity checking method can be provided in an intrusion detection system that can prevent external leakage of important information.

In addition, according to the present invention, if the protected file is an operating system file and an executable file or a system data file that is frequently read but does not change data, there is no problem with integrity, so it can be classified as a normal access form rather than an error. An intrusion detection system can provide a file integrity check method.

1 is a flowchart illustrating a method of checking integrity data in a conventional intrusion detection server.

Figure 2 is a block diagram schematically showing the configuration of a host intrusion detection system according to an embodiment of the present invention.

3 is a flowchart illustrating a method of checking integrity data in an intrusion detection server according to an exemplary embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

200: host intrusion detection server 210: management server

Claims (9)

Storing the file input by the user in a file access detection policy; Generating integrity data with respect to the stored file to determine whether it is correct and then storing the integrity file; Receiving and storing integrity check environment information input by a user; Monitoring an event for each of the stored files to detect whether an access occurs; Generating integrity data on the accessed file to determine whether it is correct; and If the integrity data of the corresponding file is incorrect as a result of the determination, performing a preset corresponding action and outputting alarm information to the user File integrity check method in the intrusion detection system comprising a. The method of claim 1, After generating the integrity data for the stored file to determine whether it is correct, and storing Generating first integrity data for the stored file using a hash algorithm selected by a user; Generating second integrity data for the stored file using a hash algorithm selected by a user; Determining whether the generated first integrity data corresponds to the second integrity data; As a result of the determination, if the generated first integrity data corresponds to the second integrity data, the first integrity data is determined to be correct and stored. If not, the first integrity data is determined to be incorrect and the integrity data check is performed again. A method of file integrity checking in an intrusion detection system, characterized in that it comprises a step of performing. The method of claim 1, The integrity check environment information includes a method of outputting corresponding action information and an alarm information on an error-producing file. The method of claim 1, And accessing the file comprises opening, reading, writing, creating and deleting a file. The method of claim 1, The step of generating integrity data on the accessed file to determine whether it is correct Generating third integrity data for the file from which the access occurred; Determining whether the generated third integrity data corresponds to previously generated and stored first integrity data; Determining that the integrity data is correct when the third integrity data corresponds to the first integrity data, and determining that the integrity data is not correct when the third integrity data corresponds to the first integrity data. To check file integrity on Windows. The method of claim 5, The file integrity check method of the intrusion detection system, characterized in that if the integrity data is correct, the file is determined to be normal, and if the file is incorrect, it is determined that an error has occurred in the file. The method of claim 1, And wherein the preset corresponding behavior is corresponding behavior information in the integrity check environment information preset and stored by the user. The method of claim 1, And the alarm information includes integrity error information including a user / processor, date, and time attempting to access a file. The method according to claim 1 or 8, And the alarm information is output in the form of a mail, a message, a text message, or the like.