KR101424490B1 - Reverse access detecting system and method based on latency - Google Patents

Abstract

The disclosed technology relates to a technology for detecting reverse access traffic from the outside of a network through behavior-based analysis in a network security device, and a delay time based reverse connection detection system according to the disclosed technology includes a packet collecting packets transmitted and received between a client and a server A session manager for analyzing the packets collected by the packet collecting unit and classifying the packets according to the sessions; a client management unit for analyzing packets collected by the client collecting unit, based on a time when inbound packets and outbound packets are transmitted and received, And a detection unit for detecting the reverse access traffic by comparing and analyzing the client delay time and the stored rule based on the server delay time.

Description

TECHNICAL FIELD [0001] The present invention relates to a delay time based reverse link detection system and a detection method thereof,

The disclosed technology relates to a technique for detecting or blocking reverse access traffic in a network security device, and more particularly, to a reverse access detection system for detecting reverse access traffic from outside the network by analyzing behaviors between a client and a server, .

BACKGROUND ART [0002] With the recent development of digital processing apparatuses, data transmission and reception through a communication network, in particular the Internet has become common, and among digital processing apparatuses for transmitting and receiving data through such communication networks, a digital processing apparatus that generally provides data is called a server, The digital processing device that requests and receives is defined as a client.

Network security devices such as Intrusion Detection System (IDS) and Intrusion Protection System (IPS) can be used to detect or block reverse access traffic, harmful traffic, unauthorized traffic, etc. accessing a network or a server. IDS and IPS analyze log or network traffic to detect or block illegal system access or privilege violation by external or internal users.

Behavior Detection and Signature Base Detection are methods to detect reverse traffic, harmful traffic and unauthorized traffic in network security devices. Behavior based detection is a technique to detect reverse traffic, harmful traffic, unauthorized traffic based on the actions occurring in the system. It can actively respond to unknown attack, but has a high error rate. Signature based detection is a technique that detects reverse traffic, harmful traffic, unauthorized traffic, etc. by comparing the incoming data stream with the signature or string of the security device. It has the advantage of providing scan speed, but is vulnerable to unknown attack.

As an example of the behavior-based detection technique, as described in Korean Unexamined Patent Publication No. 10-2012-0020609 (March 23, 2012) 'Method for detecting a private bot of online games', a bot- , Code injection, and the like.

Korean Patent Publication No. 10-2012-0020609, 2012.03. 08

The object of the reverse access detection system and its detection method according to the disclosed technique is to detect or block reverse access traffic from outside the network in network security equipment through behavior based traffic analysis (e.g., delay time analysis).

The purpose of the disclosed technique is to detect or block the connection between a client and a command and control (C & C) server installed with a Remote Administration Tool (RAT) tool through traffic analysis.

Also, the purpose of the disclosed technique is to prevent leakage of internal information to an external C & C server through a RAT tool frequently used in an APT (Advanced Persist Threat) attack.

A delay time based reverse link detection system according to the disclosed technology includes a packet collection unit for collecting packets transmitted and received between a client and a server, a session management unit for analyzing packets collected by the packet collection unit and classifying the packets according to sessions, A delay time analyzer for calculating a client delay time and a server delay time on the basis of the time when the inbound packet and the outbound packet are transmitted and received, and comparing and analyzing the stored rule based on the client delay time and the server delay time, As shown in FIG.

The delay time analyzer calculates a client delay time and a server delay time on the basis of an inbound packet and an outbound packet excluding an analysis exception packet, and the analysis exception packet includes a protocol control packet and a request packet by a multiple link of a web page do.

The delay time analyzer calculates a time interval between a time when the server-side last inbound packet is received and a time when the first outbound packet is received after the traffic direction is changed, as a client delay time, and the client- The time interval between the time when the received time and the direction of the traffic is changed and the time when the server-side first inbound response packet is received is calculated as the server delay time.

If the client delay time is greater than a threshold value and the server delay time is smaller than the reference value, the detection unit classifies traffic of the session as normal traffic.

If the client delay time is smaller than the reference value, the server delay time is larger than the reference value, and the client delay time and the server delay time are both smaller than the reference value, the detection unit detects the traffic from the outside of the network And classified as connection traffic.

In addition, if the first packet received after the delay time longer than the reference value is in the inbound direction, the detection unit classifies the traffic of the session into the reverse traffic from the outside of the network.

The delay time based reverse link detection system according to the disclosed technology may further include a blocking unit for blocking a session in which reverse link traffic is detected.

The delay time based reverse connection detection method according to the disclosed technology includes the steps of (a) collecting packets transmitted and received between a client and a server in a packet collection unit, (b) analyzing the collected packets in a session management unit, (C) calculating a client delay time and a server delay time based on a time when the inbound packet and the outbound packet are transmitted and received for each session in the delay time analyzing unit; and (d) And comparing the delayed time with a pre-stored rule based on the delay time to detect the reverse connection.

The delay time based reverse connection detection method according to the disclosed technology may further include excluding the analysis exception packet after classifying the packets according to the session and the analysis exception packet includes a protocol control packet and a multi link Lt; / RTI >

As described above, the delay time based reverse link detection system and method according to the disclosed technology can detect or block reverse link from outside the network through delay time analysis.

Also, the delay time based reverse link detection system and method according to the disclosed technology can effectively detect or block reverse link traffic without increasing the amount of computation and system complexity through delay time analysis, and can detect / It is effective.

In addition, the delay time based reverse connection detection system and method according to the disclosed technology can detect or block a connection between a client installed with a Remote Administration Tool (RAT) tool and a C & C (Command and Control) server, It is possible to prevent leakage of internal information to the server.

1 is a configuration diagram showing a general network configuration;
2 is a block diagram showing a detailed configuration of a delay time based reverse connection detection system of a network security device according to the disclosed technology;
3 shows a pattern of normal traffic.
4 is a diagram showing a first traffic pattern between a bot and a C & C server as a reverse connection pattern;
5 is a diagram showing a second traffic pattern between a bot and a C & C server as a reverse connection pattern;
6 is a flow chart illustrating a delay time based reverse connection detection method of a network security device in accordance with the disclosed technology.
7 is a flowchart showing a rule analysis process of FIG.

The description of embodiments of the disclosed technique is merely illustrative for the structural and functional explanations of the disclosed technology, and thus the scope of the disclosed technology should not be construed as limited by the embodiments described herein. In other words, it should be understood that the embodiments of the disclosed technology are capable of various changes and various forms, and therefore, are capable of implementing the technical idea of the disclosed technology.

It is to be understood that the singular forms "a", "an", ",", "an", "an" , Parts or combinations thereof, and does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof .

Each step described in the disclosed technique may take place differently from the stated order unless explicitly stated in the context of the specific order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

Hereinafter, the pattern matching system and the pattern matching method of the network security apparatus according to the present invention will be described in detail.

[Fig. 1] is a configuration diagram showing a general network configuration.

The server 140 is connected to the external network 110 through the router 120 and protects the server 140 from the reverse connection traffic, the harmful traffic, the unauthorized traffic, etc. between the server 140 and the external network 110 A network security device 130 is provided. For example, an IDS (Intrusion Detection System), an IPS (Intrusion Protection System), and the like are used to detect or block the reverse access traffic, harmful traffic, unauthorized traffic, .

The disclosed technique relates to a technique for detecting or blocking reverse access traffic from outside the network based on the delay time in the network security device 130. [

FIG. 2 is a configuration diagram showing a detailed configuration of a delay time based reverse connection detection system of a network security device according to the disclosed technology. Referring to FIG. 2, the delay time based reverse link detection system includes a packet collection unit 210, a session management unit 220, a delay time analysis unit 230, and a detection unit 240. In one embodiment, the delay time based reverse link detection system may further include a blocking unit for blocking the session in which reverse link traffic is detected.

The packet collecting unit 210, the session managing unit 220, the delay time analyzing unit 230 and the detecting unit 240 classify each process processing block of the analysis engine according to functions for convenience. Or integrated. In one embodiment, each component may be implemented as a software module.

The packet collecting unit 210 collects packets transmitted and received between the client and the server. The packet collecting unit 210 may include an inline method, a mirroring method of collecting packets through a mirroring port, a tap method of collecting packets through a network tap or a tap driver, You can collect packets through. The packet collecting unit 210 can distinguish between an inbound direction and an outbound direction, and can confirm a transmission / reception direction of a packet.

The session managing unit 220 analyzes the packets collected by the packet collecting unit 210, classifies the packets according to sessions, and records the start time and the last time of collecting the packets in the same session. The session management unit 220 analyzes the TCP / IP header of the packet to identify 5 tuples (source IP, source port, destination IP, destination IP, and protocol in use), classifies the session based on 5 tuples can do. For example, a packet with the same 5 tuples can be classified as the same session.

At this time, the session management unit 220 classifies the packet in the inbound direction and the packet in the outbound direction into the same session. In other words, packets with opposite source and destination directions in 5 tuples are classified as the same session.

If the five tuples of the collected packets do not match the values of the existing session, the session management unit 220 creates a new session based on the five tuples. In the case of a session in which a session end message such as a TCP FIN is generated after a session is created or a session in which a packet is not collected during an inactive time, the session management unit 220 removes the session from the management list.

The delay time analyzer 230 calculates the client delay time and the server delay time for each session based on the time when the inbound packet and the outbound packet are transmitted and received. The delay time analyzer 230 calculates the time interval between the time when the server-side last inbound packet is received and the time when the first outbound packet is received after the traffic direction is changed, as the client delay time, The time interval between the reception of the bound packet and the reception of the first inbound packet on the server side after the traffic direction is changed is calculated as the server delay time. For example, when the direction of traffic changes, that is, when the direction of traffic changes from inbound to outbound or from outbound to inbound, the time between the time the last packet in the previous direction was collected and the time the currently collected packet was collected The interval is calculated as a delay time.

At this time, the delay time analyzer 230 calculates the client delay time and the server delay time based on the inbound packet and the outbound packet excluding the analysis exception packet.

The analysis exception packet includes a protocol control packet and a request packet by a multiple link of a web page. For example, protocol control packets such as TCP SYN, TCP ACK, and TCP FIN, and automatic request packets by multiple links contained in one web page can be excluded as analysis exception packets. In one embodiment, the delay time analyzer 230 may classify the packet as the automatic request packet by the multi-link and exclude it as the analysis exception packet in the case of the packet whose client delay time is less than the set value. The analysis exception packet can be preset by the user depending on the system condition and the like.

The detection unit 240 compares the client delay time and the server delay time calculated by the delay time analyzer 230 with previously stored rules and detects reverse traffic from outside the network. Hereinafter, the process of detecting reverse access traffic based on the delay time will be described in detail with reference to FIG. 3 to FIG. 5.

[Fig. 3] is a diagram showing a pattern of normal traffic.

3, the detection unit 240 of the network security device 320 detects the time when the last outbound packet 340 transmitted by the client 310 is collected before the traffic direction is changed, The time difference when the first inbound packet 350 transmitted by the first inbound packet 330 is collected is calculated as the server delay time. The time difference between the time when the last inbound packet 360 is collected before the traffic direction is changed and the time when the first outbound packet 370 is collected after the traffic direction is changed is calculated as a client delay time.

Generally, when a person other than a bot infected with malicious code operates the client 310, the client delay time is larger than a specific value, and the server delay time automatically operated by the system is smaller than a specific value. Accordingly, when the client delay time is larger than the reference value and the server delay time is smaller than the reference value, the detection unit 240 classifies the traffic of the session as normal traffic. In one embodiment, the reference value for the client delay time and the reference value for the server delay time may be the same value or different values. The reference values may be preset to an experimental value or automatically set to a specific value corresponding to the average delay time calculated in the system.

4 is a diagram showing a first traffic pattern between the bot and the C & C server as a reverse connection pattern.

Referring to FIG. 4, it is assumed that the network security device 420 is located between the bot 410 infected with the malicious code and the command and control (C & C) server 430.

The detection unit 240 of the network security device 420 determines whether the client side first outbound packet 450 is collected after the time when the server side last inbound packet 440 is collected before the traffic direction is changed and the traffic direction is changed The time difference is calculated as the client delay time. The time difference between the collected time of the last outbound packet 460 before the traffic direction is changed and the time of the first inbound packet 470 after the traffic direction is changed is calculated as the server delay time.

Through the C & C server, users can access and control infected bots with Remote Administration Tool (RAT) tools such as Netcat and Poinson Ivy. When the user operates the C & C server, the delay time of the client automatically responding to the bots is smaller than a specific value, and the delay time of the server controlled by the user is larger than a specific value. Accordingly, when the client delay time is smaller than the reference value and the server delay time is larger than the reference value, the detection unit 240 classifies the traffic of the session as the reverse access traffic.

In one embodiment, the reference value for the client delay time and the reference value for the server delay time may be the same value or different values. The reference values may be preset to an experimental value or automatically set to a specific value corresponding to the average delay time calculated in the system.

5 is a diagram showing a second traffic pattern between the bot and the C & C server as a reverse connection pattern.

Referring to FIG. 5, it is assumed that the network security device 520 is located between the bot 510 infected with malicious code and the C & C server 530.

The detection unit 240 of the network security device 520 determines whether the client side first outbound packet 550 is collected after the time when the server side last inbound packet 540 is collected before the traffic direction is changed and the traffic direction is changed The time difference is calculated as the client delay time. The time difference between the time when the last outbound packet 560 is collected before the traffic direction is changed and the time when the first inbound packet 570 is collected after the traffic direction is changed is calculated as the server delay time.

When the C & C server is infected and automatically operated by the RAT tool, the latency of the client that the bot responds to automatically is smaller than the specified value, and the latency of the server that is automatically controlled is also smaller than the specified value. Accordingly, when both the client delay time and the server delay time are smaller than the reference value, the detection unit 240 classifies the traffic of the session as the reverse access traffic.

In one embodiment, the reference value for the client delay time and the reference value for the server delay time may be the same value or different values. The reference values may be preset to an experimental value or automatically set to a specific value corresponding to the average delay time calculated in the system.

In one embodiment, if the initial traffic direction after a delay time of more than a certain value is the inbound direction sent from the server side, the packet of traffic may be a request from the C & C server or the C & C server sending a keepalive message to the bot. Accordingly, when the first packet received after the delay time equal to or longer than the reference value is in the inbound direction, the detection unit 240 classifies the traffic of the session as the reverse access traffic.

6 is a flowchart illustrating a delay time based reverse connection detection method of a network security device according to the disclosed technology.

The network security apparatus collects packets transmitted and received between the client and the server through the packet collecting unit (step S610), analyzes packets collected through the session managing unit, and classifies the packets according to sessions (step S620). The session manager can classify sessions based on five tuples of the packet.

After classifying the packets by session, the delay time analyzing unit excludes the analysis exception packet (step S630), and calculates the client delay time and the server delay time based on the time when the inbound packet and the outbound packet are transmitted and received for each session S640). The analysis exception packet includes a protocol control packet and a request packet by a multiple link of a web page.

The detection unit compares and analyzes the pre-stored rules based on the client delay time and the server delay time (step S650), and detects the reverse access traffic from outside the network (step S660). In one embodiment, the detection unit can inform the user of the detected reverse access traffic. Alternatively, the network security equipment may automatically block the reverse-connection traffic detected by the detection unit through the blocking unit.

FIG. 7 is a flowchart showing the rule analysis process of FIG. 6;

The detection unit analyzes the client delay time and the server delay time (step S710). If the client delay time is larger than the reference value and the server delay time is smaller than the reference value, it is classified as normal traffic (step S720).

If the client delay time is smaller than the reference value and the server delay time is larger than the reference value, the detection unit classifies the traffic as the reverse access traffic (step S730). For example, the detector can classify the traffic into traffic between the bot and the C & C server controlled by the user.

If both the client delay time and the server delay time are smaller than the reference value, the detecting unit classifies the corresponding traffic as the reverse access traffic (step S740). For example, the detectors can classify the traffic as traffic between the bot and automatically controlled C & C servers.

In one embodiment, if the first packet received after the delay time equal to or greater than the reference value is in the inbound direction, the detection unit may classify the traffic of the session as the reverse access traffic.

As described above, according to the delay time based reverse connection detection system and method according to the disclosed technology, it is possible to detect or block the reverse connection traffic from the outside of the network through the delay time analysis.

In addition, the delay time based reverse link detection system and method according to the disclosed technology can effectively detect or block reverse link traffic without increasing the amount of computation and system complexity through delay time analysis, and can detect and block unknown attacks .

In addition, the delay time based reverse connection detection system and method according to the disclosed technology can detect or block the connection between a client installed with the RAT tool and the C & C server, and prevent leakage of internal information to the external C & C server through the RAT tool have.

Although the present invention has been described with reference to the exemplary embodiments of the present invention, the technical idea of the present invention is not limited to the above embodiments, and various delay time based reverse link detection systems and detection methods thereof can be implemented in a range that does not depart from the technical idea of the present invention .

210: Packet collecting unit 220:
230: delay time analyzer 240:

Claims (15)

A packet collecting unit for collecting packets transmitted and received between the client and the server;
A session management unit for analyzing the packets collected by the packet collection unit and classifying the packets according to sessions;
A delay time analyzer for calculating a client delay time and a server delay time based on a time when an inbound packet and an outbound packet are transmitted and received for each session; And
And a detection unit for detecting reverse access traffic by comparing and analyzing the pre-stored rules based on the client delay time and the server delay time,
The detection unit
If the client delay time is smaller than the reference value and the server delay time is larger than the reference value, the traffic of the session is classified as the reverse access traffic,
If the client delay time and the server delay time are both smaller than the reference value, the traffic of the session is classified as the reverse access traffic,
If the first packet received after the delay time longer than the reference value is the inbound direction transmitted from the server side, classifies the traffic of the session as the reverse access traffic. 2. The apparatus of claim 1, wherein the delay time analyzer
Wherein the client delay time and the server delay time are calculated on the basis of the inbound packet and the outbound packet excluding the analysis exception packet. 3. The method of claim 2, wherein the analysis exception packet
A protocol control packet and a request packet by a multiple link of a web page. 2. The apparatus of claim 1, wherein the delay time analyzer
A time interval between the reception time of the server-side last inbound packet and the reception time of the client-side first outbound packet after the traffic direction is changed is calculated as the client delay time,
Wherein the time interval between the time when the client-side last outbound packet is received and the time when the server-side first inbound response packet is received after the traffic direction is changed is calculated as the server delay time. The apparatus of claim 1, wherein the detecting unit
If the client delay time is greater than a threshold value and the server delay time is less than a reference value, the traffic of the session is classified as a normal traffic. delete delete delete The method according to claim 1,
Further comprising a blocking unit for blocking a session in which the reverse access traffic is detected. (a) collecting packets transmitted and received between a client and a server in a packet collecting unit;
(b) analyzing the collected packets in the session management unit and classifying the collected packets by session;
(c) calculating a client delay time and a server delay time based on a time when the inbound packet and the outbound packet are transmitted and received for each session in the delay time analyzing unit; And
(d) detecting a reverse access traffic by comparing and analyzing with the pre-stored rule based on the client delay time and the server delay time at the detecting unit,
The step of detecting the reverse access traffic
If the client delay time is smaller than the reference value and the server delay time is larger than the reference value, the traffic of the session is classified as the reverse access traffic,
If the client delay time and the server delay time are both smaller than the reference value, the traffic of the session is classified as the reverse access traffic,
And if the first packet received after the delay time equal to or greater than the reference value is in the inbound direction, the traffic of the session is classified as the reverse connection traffic. 11. The method of claim 10,
Further comprising the step of classifying the packets by session and excluding an analysis exception packet. 11. The method of claim 10, wherein detecting the reverse-
And if the client delay time is greater than a reference value and the server delay time is less than the reference value, the traffic of the session is classified as normal traffic. delete delete delete

Images