KR20060079714A - Optimal update method of harmful traffic determination information - Google Patents

Abstract

Disclosed is a method of optimizing harmful traffic determination information according to the number that can be supported by a network security device when updating harmful traffic determination information. When the management terminal periodically accesses the update server, downloads new harmful traffic identification information, and adds it to the harmful traffic database, the total number of harmful traffic identification information exceeds a predetermined number of harmful traffic according to the first predetermined policy. Select and exclude harmful traffic discrimination information that is not applicable to detection, and nevertheless, add harmful traffic detection non-applied harmful traffic information according to a predetermined second policy and in some cases, if the number is still exceeded. After selecting and excluding it, the remaining harmful traffic identification information is transmitted to the network security equipment to enable efficient harmful traffic determination within the resource available range of the security equipment.

Harmful Traffic, Worms, IPS, IDS, Management Terminal, Network Security Equipment

Description

Optimal updating method of harmful traffic discrimination information {Optimum updating method of injurious traffic discriminating information}             

1 is a block diagram of a network system to which the optimization method of harmful traffic determination information according to the present invention is applied.

2 is a field structure diagram of a harmful traffic database provided in a management terminal of a network system to which the present invention is applied;

3 is a flowchart illustrating a process of optimizing the harmful traffic determination information according to the present invention.

Figure 4 is a combination of conditions of the first policy applied to the optimization method of harmful traffic determination information according to the present invention.

5 is a condition combination diagram of a second policy applied to the optimization method of harmful traffic discrimination information according to the present invention;

6 is a condition combination diagram of a third policy applied to the optimization method of harmful traffic discrimination information according to the present invention;

The present invention relates to a method of optimizing harmful traffic identification information according to the number that can be supported by the network security equipment when the harmful traffic identification information is updated. More specifically, when the management terminal periodically connects to the update server, downloads the discrimination information of the new harmful traffic, and adds it to the harmful traffic database, when the total number of stored harmful traffic discrimination information exceeds a predetermined number, the predetermined first According to the policy, harmful traffic detection information that is not applicable to harmful traffic detection is selected and excluded. Nevertheless, if the number still exceeds the predetermined number, harmful traffic detection is not applicable according to the second and in some cases, the third policy. After further selecting and excluding the traffic discrimination information, the remaining harmful traffic discrimination information is transmitted to the network security device, thereby enabling efficient harmful traffic discrimination within the resource available range of the security device.

Looking at the process of updating the harmful traffic determination information in the conventional network system as follows.

The management terminal periodically accesses the update server, retrieves new harmful traffic determination information, downloads it, and stores it in its harmful traffic database. In this case, the total number of harmful traffic determination information stored in the database may be problematic.

In general, the security equipment of the network system blocks harmful traffic such as worms, UDP flooding, and IP spoofing from the external network to prevent unexpected damage to the internal network. Play a role. Such security equipment itself has various types of harmful traffic information as described above, that is, information for determining that the traffic is harmful, and captures traffic flowing into the security equipment in real time and compares it with the harmful traffic identification information. To detect harmful traffic.

However, the number of harmful traffic discrimination information that the security equipment can usually cover is limited because the resource (memory space for storing harmful traffic discrimination information or the number of harmful traffic discrimination information that can be processed by the processor) is limited. Is determined to be constant.

Therefore, when the number of harmful traffic discrimination information exceeds the number of processing of the security equipment due to the update of the management terminal, the specific discrimination information is not applied to the harmful traffic detection by the number of the exceeded discrimination information.

However, in the conventional network system, in order to know that the discrimination information has been exceeded as described above, the administrator has to inquire manually the harmful traffic database of the management terminal or access the security equipment to query predetermined log information. .

In addition, when the number of discrimination information is exceeded as described above, in the policy regarding which harmful traffic discrimination information is to be excluded from the target of detection, the conventional policy does not have a specific automated policy, and thus the specific harmful traffic is determined according to the basic policy of the operating system. There was no choice but to exclude the traffic judgment information. As a result, it was unreasonable to be excluded despite the fact that it is discriminating information about harmful traffic that is likely to appear.

The present invention has been proposed to solve the above problems, and when the harmful traffic determination information is updated and added to the existing information, the number of the total information as a result exceeds the predetermined policy when the number of information supported by the security equipment exceeds the predetermined number. By the purpose of automatically selecting and excluding harmful traffic detection information by harmful traffic detection, the purpose of the security equipment is to always maintain the optimal harmful traffic prevention function.

According to another object of the present invention, even when the specific information is selected and excluded by the predetermined policy, the harmful traffic detection non-applied harmful traffic information is applied by the predetermined second policy when the total number of information still exceeds the predetermined number. It is to provide a method for automatic selection and exclusion.

It is another object of the present invention to detect harmful traffic by a predetermined third policy when the number of total information exceeds a predetermined number even though specific information is selected and excluded by the predetermined second policy. It is intended to provide a way to automatically select and exclude information.

The present invention for achieving the above object, harmful traffic comprising a management terminal having a harmful traffic database, an update server having new harmful traffic identification information and network security equipment for blocking traffic determined as harmful traffic In the blocking system, in a method in which a management terminal updates harmful traffic determination information, the management terminal periodically accesses an update server to download new harmful traffic determination information and adds the harmful traffic to the harmful traffic database. Additionally, when the total number of harmful traffic discrimination information exceeds a predetermined number, a second step of selecting harmful traffic discrimination information to be excluded as non-detection target according to a predetermined first policy; and excluding the non-detection target. Network of remaining harmful traffic discrimination information And a third step of transmitting to the security device is characterized in that formed.

The harmful traffic database may include a harmful traffic identifier field, a harmful traffic identification information generation date field, a harmful traffic identification information update date field, a last detection date field, a detection frequency field for a predetermined period, and a risk field. In this case, the number of detections during the predetermined period may specify the number of times detected for 30 days, and the generation date of the harmful traffic identification information may be specified as one of a date when the harmful traffic identification information is first generated or a date downloaded from the update server. have.

Here, the first policy is based on the determination of harmful traffic that has not been detected for a predetermined period of time, but excludes harmful traffic identification information updated within the predetermined period of time, and has a low risk from the harmful traffic database. In order, it may be to select harmful traffic discrimination information that is not applicable to detection.

In this case, when one or more harmful traffic discrimination information having the same risk exists, the harmful traffic discrimination information, which is a non-detection target, is selected in order of generation date of the harmful traffic discrimination information.

However, when the total number of the remaining harmful traffic discrimination information still exceeds the predetermined number despite the selection of the non-detection target according to the first policy, the harmful traffic discrimination information that is not applicable to the harmful traffic detection according to the predetermined second policy. The step 2-1 of further selecting may be further included.

In this case, the second policy is based on the discrimination information of harmful traffic detected for a predetermined period, except that the harmful traffic identification information updated within the predetermined period is excluded. It may be to select harmful traffic discrimination information that is not applied to detection in the oldest order.

At this time, if one or more harmful traffic discrimination information having the same last detection date exists, the harmful traffic discrimination information that is the non-detection target is selected in the order of low risk, and if there is one or more harmful traffic discrimination information having the same risk, Again, harmful traffic discrimination information that is not applied to detection is selected in order of generation date of harmful traffic discrimination information.

However, if the total number of harmful traffic discrimination information to be applied still exceeds the predetermined number despite the selection of the non-detection target according to the second policy, harmful traffic discrimination information to be detected non-applied according to the third policy is applied. In addition, the step 2-2 of selecting may be further included.

In this case, the third policy may be to select harmful traffic discrimination information, which is a non-detection target, in order of low risk from the harmful traffic database, for all harmful traffic discrimination information.

In this case, when one or more harmful traffic discrimination information having the same risk exists, the harmful traffic discrimination information that is the non-detection target is selected in order of the last detection date.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a network system to which the optimization method of harmful traffic discrimination information according to the present invention is applied.

The management terminal 110 is provided with a predetermined application program (network management program, NMS; Network Management System), grasps the status information of the security equipment 130 in real time and outputs to the console, and associated with various networks of the security equipment Automatically modify or update the settings according to the administrator's discretion or according to a predetermined policy. In the present invention, in particular, by periodically connecting to the update server 140 to download the newly registered harmful traffic identification information and store it further in the harmful traffic database, the number of additional stored harmful traffic identification information can be covered by the security equipment If the number is exceeded, a predetermined policy is applied to the harmful traffic database to exclude identification information on harmful traffic, which is relatively unlikely, as a non-target for harmful traffic detection.

The harmful traffic database 120 specifically includes log information of each harmful traffic and information for determining the corresponding harmful traffic, and FIG. 2 illustrates a field structure of such harmful traffic database.

The harmful traffic database includes records for one or more harmful traffic, and each record includes a harmful traffic identifier field 201 for storing information on different harmful traffic and distinguishing each of them.

The harmful traffic determination information field 202 includes information for determining whether specific traffic is harmful traffic, and generally stores pattern information of harmful traffic.

The harmful traffic determination information generation date field 203 records a date downloaded from the update server when the actual generation date or the actual generation date of the harmful traffic determination information is unclear.

The harmful traffic determination information update date field 204 records the date of downloading the determination information from the update server.

The last detection date field 205 records the most recent date that the harmful traffic was detected by the security equipment, and the predetermined period detection count field 206 records the number of times of detection for a predetermined period of time, such as 30 days. do.                     

The risk field 207 quantitatively records the impact of the harmful traffic on the network system, and simply causes the system to be busy for a long time from a minor hazard such as briefly leaving the system busy. Cases of serious hazards such as stopping or rebooting are classified by case and stored.

In addition, a harmful traffic detection non-applicable target field (not shown) may be further provided, which is a predetermined policy when the number of total discrimination information exceeds the applicable number of security equipment according to the update of the harmful traffic discrimination information. This is to indicate that the object has been selected by the non-detection target.

Since the security equipment 130 and the update server 140 have already been described in the prior art, a description thereof will be omitted here.

3 is a flowchart illustrating a process of optimizing the harmful traffic determination information according to the present invention.

The management terminal periodically accesses the update server, checks whether there is harmful traffic discrimination information newly registered in the update server, and downloads it if there is new discrimination information (S301). At this time, the management terminal extracts the identifier for each information from the harmful traffic database, stores it as a file and transmits it to the update server, and the update server analyzes the received file and identifies the identifiers of the harmful traffic identification information that it owns. By comparing, if it is determined that the management terminal has new discrimination information that is not held by the management terminal, it automatically downloads the determination information to the management terminal or sends an update notification message including a list of determination information to be updated to the management terminal. By transmitting, the management terminal reconnects to the update server and downloads the corresponding file.

The management terminal that has downloaded the updated harmful traffic determination information is added to the harmful traffic database and stored (S303).

At this time, if the total number of harmful traffic determination information stored in the determination information database is less than the number that can be handled by the security equipment connected to the management terminal due to the additional storage in step S303, the updated harmful traffic determination information is immediately updated. Transmission to the security equipment (S517). However, if the number of processes of security equipment is exceeded, a predetermined first policy is applied to the discrimination information database, and the corresponding harmful traffic discrimination information is selected and deactivated as harmful traffic detection non-application target (S307).

4 is a diagram illustrating a combination of conditions of a first policy applied to the method for optimizing harmful traffic discrimination information according to the present invention.

That is, the first policy is to exclude the harmful traffic discrimination information updated within the predetermined time period from the harmful traffic detection information that has not been detected for a predetermined period (for example, 30 days). We have focused on the fact that harmful traffic that has not been detected for a certain period of time is relatively smaller than other harmful traffic in the future as a rule of thumb, and the updated discrimination information within a predetermined period is discrimination information about recently discovered harmful traffic. It is likely to reappear at probabilistic times, so it should be excluded from harmful traffic detection.

Now, among the above objects, harmful traffic discrimination information, which is a non-detection target, is selected in the order of low risk (priority first condition) 402. If certain harmful traffic enters the network and causes significant disruption, such as a network system crashing, rebooting and resetting, or disrupting the normal operation of the system with a significant impact on marketing, this is a relatively high risk of harmful traffic. As it should be seen, such harmful traffic must be applied by the security equipment, and therefore, discrimination information on relatively low risk harmful traffic is not applied to harmful traffic detection.

If one or more pieces of discrimination information having the same risk exist, the harmful traffic discrimination information that is the non-detection target is selected in order of the generation date of the harmful traffic discrimination information (second priority condition) 403. The generation date of the harmful traffic determination information may be the actual generation date, or if it is unclear, the date downloaded from the update server. If it is old discrimination information that has been created or updated relatively long ago, it is harmful traffic that appeared long time ago, so it appears that relatively harmful traffic tends to follow trends (or similar trends). This means that it is less likely to do so, and therefore, it is first applied to harmful traffic detection.

If the number of the remaining discrimination information except the harmful traffic discrimination information selected as the non-hazardous traffic detection non-applicability target due to the application of the first policy is less than or equal to the processing range of the security equipment, step S317 is performed.

However, if the number of processing ranges of the security device is still exceeded despite the application of the first policy, the predetermined second policy is applied to select harmful traffic detection non-application target identification information. FIG. 5 is a combination of conditions of a second policy applied to the optimization method of harmful traffic discrimination information according to the present invention. Referring to this, each priority condition of the second policy will be described as follows.

That is, the second policy includes the target 501 excluding the harmful traffic discrimination information updated within the predetermined period of the harmful traffic discrimination information detected during the predetermined period (for example, 30 days). The former is for further selecting harmful traffic detection non-applicable targets from discrimination information other than the discrimination information selected in the first policy, and the latter condition is designated for the same purpose as described in the first policy. Therefore, the discrimination information selected by the second policy does not overlap with the discrimination information selected by the first policy, resulting in an additionally selected result.

The harmful traffic detection non-application targets are selected from the above targets in the order of the smallest number of times detected during the predetermined period (priority first condition) 502. This is because the smaller the number of detections in a given period, the less likely it is to reappear at similar times.

The priority second condition 503 and the third condition 504 have the same meaning as the priority first condition 402 and the second condition 403 in the first policy, and thus description thereof is omitted here. .

If the number of the remaining discrimination information except the harmful traffic discrimination information selected as the non-harmful traffic detection target is not less than the processing range of the security equipment by applying the first policy and the second policy, step S317 is performed.

However, if the number of processing ranges of the security device is still exceeded despite the application of the first policy and the second policy, the predetermined third policy is further applied to further select harmful traffic detection non-application target identification information. 6 is a combination of conditions of a third policy applied to the method for optimizing harmful traffic discrimination information according to the present invention. Referring to this, each priority condition of the third policy will be described below.

That is, the second policy makes all harmful traffic discrimination information the selection target (601). Compared with the first policy and the second policy, the harmful traffic that is unlikely to appear based on the facts that actually appeared for a predetermined period of time and the update facts that are expected to appear is not limited thereto, and the remaining harmful traffic is not bound thereto. The intention is to broaden the possibility of selecting non-hazardous traffic detection targets.

The priority first condition 602 and the priority third condition 603 of the third policy to be applied later are the priority first condition 402 in the first policy and the priority priority in the second policy. Since the condition 1 and the purpose thereof are the same, the description thereof will be omitted.

If the first, second, and third policies are still applied, the number of security device processing ranges is still exceeded. Therefore, specific harmful information traffic discrimination information is arbitrarily selected and deactivated for harmful traffic detection in the conventional manner. do. However, as the third policy is applied, most of the cases will be kept below the processing range number of the security equipment, so it can be said that such a case rarely occurs.

Therefore, if the total number of harmful traffic discrimination information is maintained below the processing range number of the security equipment by applying the above policies, the management terminal secures the remaining information except the harmful traffic discrimination information selected as the non-applicable harmful traffic detection target. It transmits to the terminal to update existing harmful traffic discrimination information of the security terminal, or has a list of harmful traffic discrimination information held by the security terminal in advance, and then removes the harmful traffic discrimination information selected as the non-applicable harmful traffic detection target. In comparison with the list of information, only the remaining discrimination information is transmitted except the discrimination information already held (S317).

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

According to the present invention having the above configuration steps, when harmful traffic determination information is updated and added to the existing information, the harmful information is determined by a predetermined policy when the total number of information exceeds a predetermined number supported by the security equipment. By automatically selecting and excluding harmful traffic discrimination information to which traffic detection is not applied, nevertheless, the predetermined second and third policies are further supplemented when the total number of information exceeds the predetermined number, Eliminate the need for administrators to search the harmful traffic database each time or check security devices to find out whether they have exceeded them, and by selecting and excluding the least applicable information, ensuring that security devices always maintain optimal operating conditions. do.

Claims (13)

In a harmful traffic blocking system comprising a management terminal having a harmful traffic database, an update server having new harmful traffic discrimination information, and a network security device that blocks traffic determined as harmful traffic, the management terminal includes harmful traffic discrimination information. In the method of updating, A first step in which the management terminal periodically accesses the update server, downloads the discrimination information of the new harmful traffic, and adds it to the harmful traffic database; A second step of selecting harmful traffic discrimination information to be excluded as non-detection target according to a predetermined first policy when the total number of harmful traffic discrimination information by the addition exceeds a predetermined number; Transmitting harmful traffic discrimination information other than the non-detection target to a network security device; Optimal update method of harmful traffic determination information, characterized in that comprises a. The method of claim 1, The harmful traffic database, Optimizing harmful traffic identification information, comprising: harmful traffic identifier field, harmful traffic identification information generation date field, harmful traffic identification information update date field, last detection date field, detection frequency field for a predetermined period, risk field How to update. The method of claim 2, And the number of detections during the predetermined period is the number of detections for 30 days. The method of claim 2, The harmful traffic determination information generation date, the harmful traffic determination information optimal update method, characterized in that any one of the first generated date or the date downloaded from the update server. The method according to any one of claims 2 to 4, The first policy is, Determining harmful traffic that has not been detected for a predetermined period of time, except that harmful traffic identification information updated within the predetermined period of time is excluded. Optimal update method of harmful traffic identification information, characterized in that for selecting information. The method of claim 5, If one or more harmful traffic identification information with the same risk exists, Among them, harmful traffic discrimination information is selected in order of generation of harmful traffic discrimination information in the oldest order. The method of claim 5, If the total number of the remaining harmful traffic discrimination information still exceeds the predetermined number despite the selection of the non-detection target according to the first policy, the harmful traffic discrimination information that is not the harmful traffic detection target is added according to the second policy. The second-first step of selecting to further include the harmful traffic identification information, characterized in that the update method. The method of claim 7, wherein The second policy is, Harmful traffic that is targeted for detection of harmful traffic detected for a predetermined period of time, but excludes harmful traffic identification information updated within the predetermined period of time, from the harmful traffic database in order of the last detection date in the oldest order. Optimal update method of harmful traffic discrimination information, characterized in that for selecting the discrimination information. The method of claim 8, If one or more harmful traffic identification information with the same last detection date exists, Among them, the harmful traffic discrimination information is selected in order of low risk, and the harmful traffic discrimination information is updated. The method of claim 9, If one or more harmful traffic identification information with the same risk exists, Among them, harmful traffic discrimination information is selected in order of generation of harmful traffic discrimination information in the oldest order. The method of claim 7, wherein If the total number of harmful traffic discrimination information to be applied still exceeds the predetermined number despite the selection of non-detection target according to the second policy, additional harmful traffic discrimination information to be detected non-applied according to the third policy is further added. Step 2-2 of selecting further comprising the optimal update method of harmful traffic identification information, characterized in that it further comprises. The method of claim 11, The third policy is, The harmful traffic discrimination information is selected from the harmful traffic database in order of low risk in order of all harmful traffic discrimination information. The method of claim 12, If one or more harmful traffic identification information with the same risk exists, Among them, the harmful traffic discrimination information is selected in order of the last detection date in the oldest order.

Images