KR100758476B1 - Security log analysis device and method for process control system - Google Patents

Abstract

The present invention relates to a security log analysis apparatus and method for a process control system for integrating a plurality of intrusion detection logs generated in an intrusion detection system into a single message and analyzing the association between the integrated message and process control system information. .

The present invention includes a database unit for storing intrusion detection log information transmitted from the intrusion detection system and log information and resource usage information transmitted from the process control system; A pre-processing unit for retrieving log information stored in the database unit, integrating the same or similar multiple intrusion detection logs from one of the logs transmitted from the intrusion detection system into a single message to generate an integrated warning message, and to report it to an administrator; And an association analysis unit for generating an association warning message by analyzing the association between the integrated warning message and resource usage information of the process control system stored in the database unit, and reporting the association warning message to the manager.

Intrusion Detection, Log, Association, Integration Alert Message, Association Alert Message

Description

Security log analysis apparatus and method for process control system {APPARATUS AND METHOD FOR ANALYZING SECURITY LOG FOR PROCESS CONTROL SYSTEM}

1 is a block diagram of a security log analysis device for a process control system according to an embodiment of the present invention.

2 is a classification diagram of an integrated alert message according to the present invention.

3 is a flowchart illustrating a process of constructing an integrated log tree according to the present invention.

4 is an exemplary diagram of a log tree generated using a count field of an integrated alert message according to the present invention.

5 is a conceptual diagram illustrating an example of a process of generating an integrated alert message according to an embodiment of the present invention.

 Explanation of symbols on the main parts of the drawings

10: intrusion detection system 20: process control system

110: database unit 120: preprocessing unit

130: association analysis unit

The present invention relates to an apparatus and method for analyzing a security log for a process control system. In particular, a plurality of intrusion detection logs generated by an intrusion detection system are integrated into a single message to generate an integrated warning message and to associate it with process control system information. The present invention relates to a security log analysis apparatus and method for a process control system that generates an associated alarm message by analyzing the data.

In general, a process control system is a system that is applied to perform measurement and control functions in various processes, and is widely used throughout the industry. As the application of general-purpose operating systems to these process control systems is increasing, system and network security threats are increasing, and therefore, application of security systems is required.

However, the process control system is developed with a focus on control and measurement functions, so that the system optimization is not performed, thereby generating a large amount of unnecessary packets. Since many process control systems are currently used in conjunction with each other, it takes too much effort and time to suppress unnecessary packet generation, which is not practical. These unnecessary packets cause a lot of difficulties in system management because the intrusion detection system generates a large number of identical or similar warning messages.

Conventional intrusion detection systems generate warning messages for intrusions in various ways, but have some problems as follows. The first is the flooding of warning messages. Intrusion detection systems send numerous warning messages to administrators for attacks such as IP or port scanning. The second is a false positive. This is not an attack, but is detected as an attack and sent a warning message to the administrator. There are many reasons for this positive detection error, but it can be caused by the similarity of normal traffic and attack patterns within the network, such as packets for network management (eg Ping packets) in the control network. Finally, current intrusion detection systems do not consider the relationship between attacks. Therefore, the administrator must analyze the common characteristics or relations among the warning messages generated in order to find the actual intrusion and respond.

Due to these problems, current intrusion detection systems generate multiple warning messages for one attack against intrusions into systems and networks. For example, an attack that generates a small amount of traffic, such as a buffer overflow attack, may perform several related attack attempts because the attacker cannot succeed in one attempt. In addition, the network configuration or scanning to find vulnerable systems prior to a full-scale attack. These attempts cause the attacker to generate a number of warning messages of the same or similar characteristics to the intrusion detection system.

The present invention has been proposed to solve the above-mentioned conventional problems, by integrating the same or similar multiple intrusion detection log generated in the intrusion detection system into a single message to generate an integrated warning message, the generated integrated warning message The purpose of the present invention is to provide a security log analysis apparatus and method for a process control system that generates a related warning message by analyzing the association with the information of the process control system and reports it to an administrator.

Security log analysis device for a process control system of the present invention for achieving the above object,

A database unit for storing intrusion detection log information transmitted from the intrusion detection system and log information and resource usage information transmitted from the process control system; A pre-processing unit for retrieving log information stored in the database unit, integrating the same or similar multiple intrusion detection logs from one of the logs transmitted from the intrusion detection system into a single message to generate an integrated warning message, and to report it to an administrator; And an association analysis unit for generating an association warning message by analyzing the association between the integrated warning message and resource usage information of the process control system stored in the database unit, and reporting the association warning message to the manager.

In one embodiment of the present invention, the integrated warning message is classified according to the attacker's IP address, the target system's IP address and the attack type.

In one embodiment of the present invention, the integrated warning message is divided into three bits of information, where the first bit represents the attacker's IP address, the second bit represents the IP address of the target system, and the third bit represents the type of attack. In this case, each bit is indicated by 0 or 1, and when the corresponding bit is 1, the corresponding IP address and the attack type are the same, and when the bit is 0, the corresponding IP address or the attack type is different.

In one embodiment of the present invention, the association analysis unit generates an association warning message by analyzing the association information between the information of the integrated alert message and the operating system, importance, log presence and system information of the process control system.

At this time, if the attack type of the integrated warning message is suitable for the operating system of the process control system, the associated warning message for the operating system is generated, and the attack on the process control system of the integrated warning message is an attack preset by an administrator. In case of reaching the criticality level, the relevant warning message is generated for the importance level, and if the related log remains in the process control system for a certain time by checking the attack type of the integrated warning message, the associated warning message for the presence or absence of the relevant log is displayed. It generates and, if the system usage exceeds the predetermined reference value by checking the information of the process control system and generates an associated warning message for the system information.

In addition, the security log analysis method for a process control system of the present invention for achieving the above object, the first step of storing the intrusion detection log transmitted from the intrusion detection system and the log information of the process control system; A second step of integrating the same or similar intrusion detection log among the stored intrusion detection logs into one message to generate an integrated warning message and report it to an administrator; And a third step of analyzing a correlation between the integrated warning message and log information of the stored process control system to generate a related warning message and report the result to the manager.

In one embodiment of the present invention, the integrated warning message is classified according to the attacker's IP address, the target system's IP address and the attack type.

In one embodiment of the present invention, the integrated warning message is divided into three bits of information, where the first bit represents the attacker's IP address, the second bit represents the IP address of the target system, and the third bit represents the type of attack. In this case, each bit is indicated by 0 or 1, and when the corresponding bit is 1, the corresponding IP address and the attack type are the same, and when the bit is 0, the corresponding IP address or the attack type is different.

In an embodiment of the present invention, the second step may include: a fourth step of configuring a first log of the stored plurality of intrusion detection logs as a root node of a log tree; A fifth step of comparing the nth log (n ≧ 2, integer) and the characteristic information of the first log; A sixth step of configuring the second log as a lower node of the first log when at least one characteristic is the same and configuring the nth node as a root node of a new log tree when the characteristics are different; And a seventh step of generating each node as one integrated warning message.

At this time, the characteristic information of the intrusion detection log includes the IP address of the attacker, the IP address of the target system and the attack type, respectively.

In an embodiment of the present disclosure, after the sixth step, when the n-th log is the same as a specific log configured as a node of a log tree, the count of the specific log is increased by the number of the n-th log. It may further comprise the step of.

In one embodiment of the present invention, the integrated alert message includes 111, 110, 101, 100, 011, 010, and 001 integrated alert message, wherein the 111 integrated alert message includes an attacker IP address, a target system IP address, and an attack. Generated when the count of the intrusion detection log of the same type all exceeds a predetermined first threshold value, the 110, 101, and 011 integrated warning message is generated by only two of the attacker IP address, the target system IP address, and the attack type. Generated when the count of the same intrusion detection log exceeds a preset second threshold value, the 100, 010, 001 integrated warning message is the same intrusion detection log with only one of the attacker IP address, the target system IP address, and the attack type. The count is generated when the count exceeds the predetermined third threshold.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 is a block diagram of a security log analysis device for a process control system according to an embodiment of the present invention.

1, the security log analysis apparatus 100 for a process control system according to the present invention includes a database unit 110, a preprocessor 120, and an association analysis unit 130.

The database unit 110 stores a plurality of log information of the process control system. In particular, the database unit 110 stores intrusion detection log information transmitted from the intrusion detection system 10 and system log information and resource usage information transmitted from the process control system 20.

 The preprocessing unit 120 retrieves log information stored in the database unit 110 and integrates a plurality of intrusion detection logs identical or similar among logs transmitted from the intrusion detection system 10 into a single message. Create and report it to the manager (30). This process is called preprocessing.

The association analysis unit 130 analyzes the correlation between the integrated alert message and the information of the process control system 20 stored in the database unit 110 to generate an association warning message, and the manager 30 generates the association warning message. Report to At this time, the correlation analysis in the above is to determine whether the information related to the information of the process control system 20 to at least one of the operating system, the importance, the presence or absence of the log, system information.

As such, the security log analysis apparatus 100 for a process control system according to the present invention integrates an intrusion detection log of the intrusion detection system 10 to generate one warning message, and the integrated warning message and the process control system 20. Correlation process with information of) is used to analyze the association with other logs to generate an association warning message. Notify the manager 30 of the generated integrated warning message and the associated warning message, respectively.

In addition, the security log analysis apparatus 100 for a process control system according to the present invention integrates a plurality of similar, identical or repeated intrusion detection logs generated by the intrusion detection system 10 into a single message to alert the user. (Preprocessing process). As such, the integrated warning message can be classified into seven types according to the similarity between the attacker's IP address, the target system's IP address, and the attack type. At this time, the seven types of integrated warning message can be preferably divided into three bits of information, where the first bit is the IP address of the attacker, the second bit is the IP address of the target system, and the third bit is the type of attack. Indicates. For example, the 111 consolidated log shows a log in which the attacker's IP address, the target system's IP address, and the type of attack are all the same. This integrated warning message will be described in more detail with reference to FIG. 2.

2 is a classification diagram of an integrated alert message according to the present invention.

Referring to FIG. 2, the integrated alert messages 21 to 27 according to the present invention are classified into seven types. When an intrusion detection log (for example, a warning message about an intrusion (attack)) is transmitted from the intrusion detection system 10, the intrusion detection log is stored in the database unit 110, and the preprocessing unit 120 stores a plurality of data stored in the database unit 110. Analyze intrusion alert messages in a single message to generate a single unified alert message. In other words, one of the seven integrated warning messages shown in FIG. 2 is generated.

First, the preprocessor 120 generates a 111 aggregate log, that is, 111 node 21 for the first attack message. In this case, the 111 node 21 is a root node in a log tree structure. Subsequently, the second attack message successively compares with the first attack message and determines whether it can be inserted into the seven types of consolidated logs of the first tree, thereby determining three comparison characteristics (ie, attacker IP address, target IP address, and attack type). ) If one or more of the properties are the same, it is inserted into the node of the tree. If all three comparison properties are different, a new 111 integrated log 21 is created. Each node has a count field that checks the same warning message that has been entered so far, in the case of duplicate messages, only the count is incremented without adding a new node. Here, the count field to be managed varies according to the type of the unified message. As shown in FIG. 2, the 110 unified node 22 has its own count field and counts for messages of different attack types in the sub-list managed by the node. Manage fields separately. In this case, the lower list specifically records information (corresponding to 0 out of 3 bits) except for the same information for different types of integrated messages. For example, the 011 node 25 (or the integrated log) manages the first information (the attacker IP address) corresponding to 0 as a lower list, and the second and third information corresponding to 0 (the target system for the 100 node 24). IP address and attack type) are managed in the sub list. Here, two zero nodes, that is, 100, 010, and 001 nodes 24, 26, and 27 have a count field for two pieces of information managed in a lower list.

The process of increasing the count field of each node and sub list is as follows. First, when a new attack message is input, all 111 nodes (root nodes) 21 of the log tree are searched, and any one of the three characteristics is repeatedly inserted into the matching node. In this case, when all three characteristics are the same, the count field of the 111 node 21 is increased by 1, and when only the first characteristic is the same, the count field of the 100 node 24 is increased by 1. If the newly inserted attack message is not the 111 node 21, the count is increased and at the same time, the corresponding position of the lower list is found and the count is increased or a member of the new list is created. Note that two zero nodes, that is, 001, 101, and 100 nodes 27, 23, and 24 separately manage counts for characteristics corresponding to zero in the lower list.

3 is a flowchart illustrating a process of constructing an integrated log tree according to the present invention.

In the integrated log tree configuration of the present invention, the intrusion warning message transmitted from the intrusion detection system 10 cannot be stored for an indefinite time. In other words, a warning message that could not be generated as a consolidated log after a certain time is discarded, and the tree is reconstructed based on this. The reconstruction of the log tree is performed by searching the tree by the depth first search method immediately after the warning message of the intrusion detection system 10 is transmitted to the preprocessing unit 120 so that the time set by the administrator 30 is increased. It proceeds by deleting the node that has not been modified.

Referring to FIG. 3, when a new warning message (intrusion detection log) is received from the intrusion detection system 10 (S300), it is determined whether a node having the same characteristics among the 111 nodes exists (S302). Add (S304), if not present, inserts the corresponding node in a related log tree in duplicate (S306). If the inserted node is 111 node (S308), the count of the 111 node is increased by 1 (S310), and if the inserted node is not 111 node (S308), it is determined whether the node is 0, that is, 110, 101,011 node. (S312).

If the inserted node is 110, 101,011 nodes in step S312, the count of each node is increased by 1 (S314), and then it is determined whether the lower list of each node has the same characteristic (S316). The count of nodes in the lower list is increased by 1 (318), and if it does not have the same characteristics, a new list is added (S320).

If the inserted node is not 110,101,011 nodes in step S312, it is determined whether the inserted node is a node having two zeros, that is, a 001,010,100 node (S322). If the inserted node is not a 110,101,011 node, the process is terminated. If the inserted node is a 110,101,011 node, the count of each of the 110,101,011 nodes is increased by 1 (S324), and it is determined whether the lower list of each node has the same characteristic (S326). If the lower list of each node has the same characteristic, the count of the corresponding list node is increased by 1 (S328). If the lower list of each node does not have the same characteristic, it is determined whether the inside of each lower list has the same characteristic (S330).

If the inside of each of the lower list has the same characteristic in step S330, the count of the corresponding characteristic is increased by 1 (S332), and if it does not have the same characteristic, a new list is added (S334).

4 is an exemplary diagram of a log tree generated using a count field of an integrated alert message according to the present invention.

Referring to FIG. 4, the merge warning message is classified into seven types, similar to the node type in the merge log. That is, from 111 integrated warning message to 001 integrated warning message, they are categorized according to their characteristics and each has different thresholds. The procedure of generating a warning message for each type is as follows.

(1) 111 integration warning message:

111 The integrated warning message is caused by repetition of the warning message with all three characteristics (the attacker's IP address, the target system's IP address, and the attack type). In the example diagram of FIG. 4, when the count fields of (1), (5), (6), (7), (11), (12), and (13) exceed the 111 integration threshold, a 111 integration warning message is generated.

(2) 110, 101, 011 unified warning message:

The 110 integrated alert message is generated when multiple attacks with the same attacker IP address and the target system IP address and different types of attacks are detected. In the example of FIG. 4, (2), (15), (17) Occurs when the count field of s exceeds the 110 integration threshold.

In addition, the 101 integrated warning message is a message generated when a plurality of attacks having the same attack type as the attacker's IP address and different from only the IP address of the target system are detected, and (4) and (16), Occurs when the count field in (13) exceeds the 110 integration threshold.

In addition, the 011 unified warning message is generated when a plurality of attacks having the same attack type as the target system IP address and only the attacker's IP address are detected. In the example of FIG. 4, (3), (14), ( It is generated when the count field of 18) exceeds the 110 integration threshold.

(3) 100,010,001 integrated warning message:

The 100 integrated warning message is generated when multiple attacks with only the attacker's IP address are the same and both the IP address and the attack type of the target system are detected. In the example of FIG. 4, the count field of (8) is 100. Occurs when the integration threshold is exceeded.

In addition, the 010 unification warning message is generated when a plurality of attacks having only the same target IP address and different attacker IP addresses and attack types are detected. Occurs when the 100 integration threshold is exceeded.

In addition, the 001 integrated warning message is a message generated when a plurality of attacks having only the same type of attack and different from both the attacker's IP address and the target system's IP address are detected. Occurs when the field exceeds the 100 integration threshold.

5 is a conceptual diagram illustrating an example of a process of generating an integrated alert message according to an embodiment of the present invention.

In FIG. 5, the warning message generation process is shown only for three cases of 111, 110, and 100 as an example. The analysis through the correlation process generates the association warning message using the 111 integration warning message among the integration warning messages that are the result of the preprocessing process analysis. In the correlation analysis, the operating system check, the importance check, the presence or absence of related logs, the presence or absence of related logs, and system information inspection are performed.

(1) operating system check:

An attack in which the type of attack is not suitable for the operating system of the target process control system by searching the table of the database unit 110 generated as the integrated warning message is not generated as the associated warning message.

(2) Importance check:

In system operation, system administrators can set the importance of critical attacks that have a critical impact on the system. The log analysis apparatus of the present invention generates an integrated warning message for the process control system having the importance according to the importance set by the system administrator as the related warning message.

(3) check for related logs:

If the importance is present and the operating systems match, the association analysis unit 130 checks the attack type of the 111 integrated warning message and checks whether the related log remains in the corresponding system. If the relevant log remains within a certain time, the integrated warning message is generated as the related warning message.

(4) system information survey:

If the importance is high and the operating systems match, various information of the system (CPU Usage, Memory Usage, Network Usage) is examined and if the CPU, Memory, and network usage are above a certain level, an integrated warning message is generated as an associated warning message.

The detailed description and contents of the drawings described above are limited to the preferred embodiments of the present invention, and the present invention is not limited thereto. It will be possible to substitute, change or delete the component according to the present invention within the scope of the technical idea of the present invention.

Accordingly, the scope of the present invention should be determined by the appended claims rather than by the foregoing description and drawings.

As described above, according to the security log analysis method of the present invention, by integrating intrusion detection logs that occur in the control system and similar or identical duplicates due to network attack packets into one integrated log message, It does not analyze every intrusion detection log generated by intrusion detection system but analyzes only the integrated message, which reduces the time and effort required for log analysis.

In addition, according to the present invention, by automatically correlating and analyzing the integrated log message with the operating system, system log, system resource usage information, and the like of the control system, the administrator does not analyze the relationship between all intrusion detection logs and process control and measurement system related information. There is an advantage that it can automatically find and respond to intrusion of reality.

Claims (17)

delete A database unit for storing intrusion detection log information transmitted from the intrusion detection system and log information and resource usage information transmitted from the process control system; A pre-processing unit for retrieving log information stored in the database unit, integrating the same or similar multiple intrusion detection logs from one of the logs transmitted from the intrusion detection system into a single message to generate an integrated warning message, and to report it to an administrator; And And an association analysis unit configured to analyze an association between the integrated warning message and resource usage information of the process control system stored in the database unit, and generate an association warning message and report it to the manager. The integration warning message, Security log analysis device for process control system classified by attacker's IP address, target system's IP address and attack type. The method of claim 2, wherein the integration warning message, It is divided into three bits of information, the first bit is the attacker's IP address, the second bit is the IP address of the target system, the third bit is a security log analysis device for a process control system, characterized in that the type of attack. The method of claim 3, wherein each bit, 0 or 1, and if the bit is 1, the corresponding IP address and attack type are the same, and if 0, the corresponding IP address or attack type is different. The method of claim 2, wherein the association analysis unit, And a related warning message by analyzing the information of the integrated warning message, the operating system, the importance, the presence or absence of the relevant log, and the system information of the process control system, to generate a related warning message. The method of claim 5, And generating an associated warning message for the operating system if the attack type of the integrated warning message is suitable for the operating system of the process control system. The method of claim 5, And an associated warning message for importance when an attack on the process control system of the integrated warning message reaches a priority of an attack preset by an administrator. The method of claim 5, Checking the attack type of the integrated warning message, if the associated log remains in the process control system for a predetermined time, the security log analysis device for a process control system, characterized in that for generating an associated warning message for the presence or absence of the related log. The method of claim 5, Checking the information of the process control system security log analysis device for a process control system, characterized in that for generating a warning message associated with the system information when the system usage exceeds a predetermined reference value. delete A first step of storing intrusion detection logs transmitted from the intrusion detection system and log information of the process control system; A second step of integrating the same or similar intrusion detection log among the stored intrusion detection logs into one message to generate an integrated warning message and report it to an administrator; And A third step of analyzing a correlation between the integrated warning message and the log information of the stored process control system to generate a related warning message and report it to the manager; Including, The integration warning message, Security log analysis method for process control system classified by attacker's IP address, target system's IP address and attack type. The method of claim 11, wherein the integration warning message, 3 bit information, the first bit is the attacker's IP address, the second bit is the IP address of the target system, and the third bit represents the type of attack. The method of claim 12, wherein each bit, 0 or 1, and if the bit is 1, the corresponding IP address and attack type are the same, and if 0, the corresponding IP address or attack type is different. The method of claim 11, wherein the second step, A fourth step of configuring a first log of the stored plurality of intrusion detection logs as a root node of a log tree; A fifth step of comparing the nth log (n ≧ 2, integer) and the characteristic information of the first log; A sixth step of configuring the second log as a lower node of the first log when at least one characteristic is the same and configuring the nth node as a root node of a new log tree when the characteristics are different; And A seventh step of generating each node as one integrated warning message; Security log analysis method for a process control system comprising a. The method of claim 14, wherein the characteristic information of the intrusion detection log, Security log analysis method for a process control system, characterized in that each containing a 1-bit attacker's IP address, the target system's IP address and the type of attack. The method of claim 14, wherein after the sixth step, If the n-th log is the same as a specific log already configured as a node of the log tree, increasing the count of the specific log by the number of the n-th log. Log analysis method. The method of claim 11, wherein the integration warning message, 111, 110, 101, 100, 011, 010, and 001 integrated alert messages, wherein the 111 integrated alert message has a count of the same intrusion detection log with the same attacker IP address, target system IP address, and attack type. The 110, 101, and 011 integrated warning message is generated when the first threshold is exceeded, and only two of the attacker IP address, the target system IP address, and the attack type have the same count in the intrusion detection log. Generated when two thresholds are exceeded, the integrated alert message 100, 010, 001 indicates that the count of the intrusion detection log equal to only one of the attacker IP address, the target system IP address, and the attack type exceeds the preset third threshold value. Security log analysis method for a process control system, characterized in that generated in the case.

Images