US20090094699A1 - Apparatus and method of detecting network attack situation - Google Patents
Apparatus and method of detecting network attack situation Download PDFInfo
- Publication number
- US20090094699A1 US20090094699A1 US12/275,906 US27590608A US2009094699A1 US 20090094699 A1 US20090094699 A1 US 20090094699A1 US 27590608 A US27590608 A US 27590608A US 2009094699 A1 US2009094699 A1 US 2009094699A1
- Authority
- US
- United States
- Prior art keywords
- alarm
- data
- hash
- alarms
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/82—Protecting input, output or interconnection devices
- G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Definitions
- the present invention relates to a network security technology, and more particularly, to an apparatus and method of detecting a network attack situation in real time by processing alarms indicating intrusion detection with high efficiency.
- Network attack situation detection refers to analyzing interrelation among a plurality of alarms indicating intrusion detection, which are raised at a plurality of locations in a network, and presuming an attack situation based on the analysis. For example, if a plurality of alarms are raised about a host, it can be presumed that the host is being attacked. Since the network attack situation detection reflects a current network attack situation, real-time analysis is particularly important.
- the present invention provides an apparatus and method of detecting network attack situations classified into ten groups in real time based on a great number of alarms indicating intrusion detection.
- an apparatus for detecting a network attack situation including: an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory.
- a method of detecting a network attack situation including: collecting a plurality of alarms raised in a network; extracting attributes of the alarms and generating at least one first data characterized by a combination of the attributes; and determining an attack situation in the network based on whether a number of times that the first data is generated exceeds a predetermined critical value.
- FIG. 1 is a table showing ten groups of network attack situations according to an embodiment of the present invention
- FIG. 2 is a block diagram of an apparatus for detecting a network attack situation according to an embodiment of the present invention
- FIG. 3 is a detailed block diagram of an alarm processor illustrated in FIG. 2 ;
- FIG. 4 illustrates a hash structure of a hash memory
- FIG. 5 illustrates the structure of a hash entry counter
- FIG. 6 illustrates a pseudocode showing a counting algorithm
- FIG. 7 is a flowchart illustrating a method of detecting a network attack situation according to an embodiment of the present invention.
- FIG. 1 is a table showing ten groups of network attack situations according to an embodiment of the present invention. Detecting a network attack situation based on an analysis of interrelation among alarms indicating intrusion detection involves measuring the number of times that alarms having identical attributes are raised during a predetermined interval and presuming an attack situation in a network. FIG. 1 illustrates ten groups of attack situations. In other words, there are ten groups of attack situations divided according to four attributes such as an attack type 120 , an attacker IP address 130 , a target IP address 140 and a service type 150 , and each group of attack situations have identical attributes.
- Such groups are yardsticks for measuring the number of times that attacks having identical attributes are staged on a network. For example, if an attacker repeatedly attempts to make the same attack on a host, such attempts will be detected as attack situation 1 - 1 as illustrated in FIG. 1 . A description of each group of attack situations is made under description 160 of FIG. 1 and thus will be omitted from the Detailed Description of the Invention.
- the occurrence of an attack situation can be determined by observing the occurrence of alarms having identical attributes. In other words, the occurrence of an attack situation can be determined by measuring the number of times that alarms having identical attributes have been raised. Whether an attack situation has occurred is determined based on attack information having identical attributes and measured during a predetermined interval. In other words, detecting an attack situation is to determine whether the number of alarms having identical attributes and measured during a predetermined interval exceeds a critical value.
- the predetermined interval indicates the length of time for limiting valid alarms indicating intrusion detection.
- FIG. 2 is a block diagram of an apparatus for detecting a network attack situation according to an embodiment of the present invention.
- FIG. 7 is a flowchart illustrating a method of detecting a network attack situation according to an embodiment of the present invention.
- the apparatus includes an alarm receiver 210 receiving alarms from network to detect a network attack situation with high efficiency, an alarm processor 220 processing the alarms and detecting an attack situation, a hash memory 230 storing data needed for processing the alarms, a control memory 240 storing control data, and an external interface 250 .
- the alarm receiver 210 receives alarms from a network (S 710 ), converts the alarm into alarm data, and transmits the alarm data to the alarm processor 220 .
- the alarm processor 220 processes the alarm data and determines whether an attack situation has occurred using lookup and storing functions of hash entries stored in the hash memory 230 . When the alarm processor 220 determines that an attack situation has occurred, it transmits the detected attack situation to the external interface 250 .
- the external interface 250 provides an interface function with the external apparatus needed to report the detected attack situation.
- the external interface 250 also provides an interface function for control from the external apparatus. Control information, such as critical values, received from the external apparatus transmitted to the alarm processor 240 . Then, the alarm processor 240 transmits the control information to the control memory 240 , which then stores the control information.
- FIG. 3 is a detailed block diagram of the alarm processor 220 illustrated in FIG. 2 .
- the alarm processor 220 includes an alarm buffer unit 310 , an alarm-parsing unit 320 , a hash engine unit 330 , a detection engine unit 340 , and an interface control unit 350 .
- the alarm buffer unit 310 receives alarm data from the alarm receiver 210 .
- the alarm-parsing unit 320 receives alarms from the alarm buffer unit 310 , extracts attributes of the alarms, creates data having the extracted attributes, and transmits the data to each of hash engines included in the hash engine unit 330 .
- the hash engine unit 330 generates hash entries having identical attributes through a hash lookup. If the hash lookup fails, the hash engine unit 330 generates a new hash entry and transmits the new hash entry to the detection engine unit 340 .
- the detection engine unit 340 receives hash entries of alarm data having identical attributes from the hash engine unit 330 , determines whether the number of alarms exceeds a critical value based on the hash entries, and detects an attack situation based on the determination.
- the interface control unit 350 provides an interface with the external interface 250 .
- the alarm-parsing unit 320 extracts four attributes such as an attack type, an attacker IP address, a target IP address, and a service type from alarm data received from the alarm buffer unit 310 .
- the alarm-parsing unit 320 determines to which group of attack situations the alarm data belongs based on the attributes as defined in the table of FIG. 1 and transmits information regarding a determined group of attack situation to the hash engine unit 330 (S 720 ).
- the hash engine unit 330 generates a hash key using the determined group of attack situations received from the alarm-parsing unit 320 (S 730 ) and determines whether the hash memory 230 includes hash entries having identical attributes. If hash entries having identical attributes are found, the hash engine unit 330 transmits the hash entries to the detection engine unit 330 . If hash entries having identical attributes are not found, the hash engine unit 330 generates a new hash entry and transmits the new hash entry to the detection engine unit 330 .
- the alarm-parsing unit 320 generates ten groups of attack situations (see FIG. 1 ).
- the hash engine unit 330 includes ten parallel engines, i.e., zeroth through ninth hash engines.
- the ten parallel engines included in the hash engine unit 330 process the ten groups of attack situations, respectively (S 740 ).
- FIG. 4 illustrates a hash structure maintained in the hash memory 230 controlled by the hash engine unit 330 .
- the hash memory 230 includes an index memory 410 and a data memory 420 .
- the index memory 410 can be accessed using a hash key. Since the index memory 410 may have the same hash key even if index entries 430 have different attributes, the index entries 430 are maintained for respective indexes.
- Each of the index entries 430 includes an effective bit indicating whether a corresponding index entry is effective and an address field indicating an address of a real data memory if the index entry is effective. Entries included in the data memory 420 are addressed by the index entries 430 .
- Each of first through N th entries includes attribute information such as the attack pattern, the attacker IP address, the target IP address and the service pattern, and counter information managed by the detection engine unit 340 .
- the detection engine unit 340 counts the number of alarms having identical attributes in a hash entry received from the hash engine unit 330 .
- the detection engine unit 340 also determines how many times the alarms have been raised within a valid time and whether the number of times that the alarms have been raised exceeds a critical value. If the number of times that the alarms have been raised exceeds the critical value, the detection engine unit 340 detects it as an attack situation and notifies information regarding the detection of the attack situation to the interface control unit 350 .
- FIG. 5 illustrates an entry structure that the detection engine unit 330 manages using hash entries. Such entries are managed for respective identical attributes. In other words, each entry is managed for each identical attribute.
- an LTT field 510 stores time information generated by an alarm that is raised last among alarms having identical attributes.
- Zero th through (N ⁇ 1) th SLOTs 530 store counter information generated in each time slot and a SUM field 520 indicates the sum of all slot counters.
- FIG. 6 illustrates an algorithm of counting alarms having identical attributes and determining whether the number of alarms exceeds a critical value using information of an entry structure as illustrated in FIG. 5 .
- an analysis process is applied only to alarms occurred within a valid time.
- a separate counter is prepared for each time unit and a slot counter is moved as time goes by.
- a value of the LTT is replaced with a value of the ATT and a value of SLOT is reset to zero.
- the value of the SLOT i.e., the remainder obtained by dividing the ATT value by N, is stored as one and a value of SUM is also stored as one.
- the count of the SLOT indexed by the LTT and the SUM are increased by one. If ATT ⁇ LTT is greater than zero and smaller than N, a sum of counter values respectively generated in a SLOT indexed by LTT+1 through a SLOT indexed by ATT ⁇ 1 is subtracted from the SUM and the SLOT is reset to zero.
- the SLOT indexed by the ATT is stored as one and the value of the SUM is increased by one.
- the detection engine unit 340 When the detection engine unit 340 completes counting the number of alarms in the entry, it determines whether an attack situation has occurred based on whether the value of the SUM exceeds a critical value.
- the critical value can be set through the external interface 250 .
- Setting information transmitted to the external interface 250 is transmitted again to the interface control unit 350 , which then stores the setting information in the control memory 240 .
- data on a critical value used by the detection engine unit 340 is amended (S 750 ).
- the present invention can also be implemented as computer-readable code on a computer-readable recording medium.
- the computer-readable recording medium is any data storage device that can store data which can be thereafter read by a computer system. Examples of the computer-readable recording medium include read-only memory (ROM), random-access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet).
- the computer-readable recording medium can also be distributed over network-coupled computer systems so that the computer-readable code is stored and executed in a distributed fashion.
- a font-ROM data structure according to the present invention can also be implemented as computer-readable code on a computer-readable recording medium such as ROMs, RAMs, CD-ROMs, magnetic tapes, hard disks, floppy disks, flash memories, and optical data storage devices.
- a network attack situation As described above, according to an apparatus and method of detecting a network attack situation, equal numbers of hash engines and detection engines for processing alarms in a network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
Description
- This application claims the priority of Korean Patent Application No. 10-2004-0101086, filed on Dec. 3, 2004, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.
- 1. Field of the Invention
- The present invention relates to a network security technology, and more particularly, to an apparatus and method of detecting a network attack situation in real time by processing alarms indicating intrusion detection with high efficiency.
- 2. Description of the Related Art
- Network attack situation detection refers to analyzing interrelation among a plurality of alarms indicating intrusion detection, which are raised at a plurality of locations in a network, and presuming an attack situation based on the analysis. For example, if a plurality of alarms are raised about a host, it can be presumed that the host is being attacked. Since the network attack situation detection reflects a current network attack situation, real-time analysis is particularly important.
- However, there are limitations on analyzing alarms in a network in real time through a conventional database inquiry. For example, when alarm “A” is raised, if the conventional database inquiry is made to determine the number of times that the same alarm has been repeatedly raised during a predetermined interval, the alarm “A” must be compared with a great number of other alarms. Also, if such comparisons are made for every alarm, the performance of an apparatus for detecting network attack situations will be severely undermined.
- In particular, since network size is increasing and a tremendous number of alarms are being raised due to a high false-positive rate, it is required for the apparatus to process a large amount of data to analyze alarms indicating intrusion detection.
- The present invention provides an apparatus and method of detecting network attack situations classified into ten groups in real time based on a great number of alarms indicating intrusion detection.
- According to an aspect of the present invention, there is provided an apparatus for detecting a network attack situation including: an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory.
- According to another aspect of the present invention, there is provided a method of detecting a network attack situation including: collecting a plurality of alarms raised in a network; extracting attributes of the alarms and generating at least one first data characterized by a combination of the attributes; and determining an attack situation in the network based on whether a number of times that the first data is generated exceeds a predetermined critical value.
- The above and other features and advantages of the present invention will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings in which:
-
FIG. 1 is a table showing ten groups of network attack situations according to an embodiment of the present invention; -
FIG. 2 is a block diagram of an apparatus for detecting a network attack situation according to an embodiment of the present invention; -
FIG. 3 is a detailed block diagram of an alarm processor illustrated inFIG. 2 ; -
FIG. 4 illustrates a hash structure of a hash memory; -
FIG. 5 illustrates the structure of a hash entry counter; -
FIG. 6 illustrates a pseudocode showing a counting algorithm; and -
FIG. 7 is a flowchart illustrating a method of detecting a network attack situation according to an embodiment of the present invention. - The present invention will now be described more fully with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. The invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth therein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art.
-
FIG. 1 is a table showing ten groups of network attack situations according to an embodiment of the present invention. Detecting a network attack situation based on an analysis of interrelation among alarms indicating intrusion detection involves measuring the number of times that alarms having identical attributes are raised during a predetermined interval and presuming an attack situation in a network.FIG. 1 illustrates ten groups of attack situations. In other words, there are ten groups of attack situations divided according to four attributes such as anattack type 120, anattacker IP address 130, atarget IP address 140 and aservice type 150, and each group of attack situations have identical attributes. - Such groups are yardsticks for measuring the number of times that attacks having identical attributes are staged on a network. For example, if an attacker repeatedly attempts to make the same attack on a host, such attempts will be detected as attack situation 1-1 as illustrated in
FIG. 1 . A description of each group of attack situations is made underdescription 160 ofFIG. 1 and thus will be omitted from the Detailed Description of the Invention. - As described above, the occurrence of an attack situation can be determined by observing the occurrence of alarms having identical attributes. In other words, the occurrence of an attack situation can be determined by measuring the number of times that alarms having identical attributes have been raised. Whether an attack situation has occurred is determined based on attack information having identical attributes and measured during a predetermined interval. In other words, detecting an attack situation is to determine whether the number of alarms having identical attributes and measured during a predetermined interval exceeds a critical value. The predetermined interval indicates the length of time for limiting valid alarms indicating intrusion detection.
-
FIG. 2 is a block diagram of an apparatus for detecting a network attack situation according to an embodiment of the present invention.FIG. 7 is a flowchart illustrating a method of detecting a network attack situation according to an embodiment of the present invention. Referring toFIG. 2 , the apparatus includes an alarm receiver 210 receiving alarms from network to detect a network attack situation with high efficiency, analarm processor 220 processing the alarms and detecting an attack situation, ahash memory 230 storing data needed for processing the alarms, acontrol memory 240 storing control data, and anexternal interface 250. - The alarm receiver 210 receives alarms from a network (S710), converts the alarm into alarm data, and transmits the alarm data to the
alarm processor 220. Thealarm processor 220 processes the alarm data and determines whether an attack situation has occurred using lookup and storing functions of hash entries stored in thehash memory 230. When thealarm processor 220 determines that an attack situation has occurred, it transmits the detected attack situation to theexternal interface 250. - The
external interface 250 provides an interface function with the external apparatus needed to report the detected attack situation. Theexternal interface 250 also provides an interface function for control from the external apparatus. Control information, such as critical values, received from the external apparatus transmitted to thealarm processor 240. Then, thealarm processor 240 transmits the control information to thecontrol memory 240, which then stores the control information. -
FIG. 3 is a detailed block diagram of thealarm processor 220 illustrated inFIG. 2 . Thealarm processor 220 includes analarm buffer unit 310, an alarm-parsing unit 320, ahash engine unit 330, adetection engine unit 340, and aninterface control unit 350. - The
alarm buffer unit 310 receives alarm data from the alarm receiver 210. The alarm-parsing unit 320 receives alarms from thealarm buffer unit 310, extracts attributes of the alarms, creates data having the extracted attributes, and transmits the data to each of hash engines included in thehash engine unit 330. Thehash engine unit 330 generates hash entries having identical attributes through a hash lookup. If the hash lookup fails, thehash engine unit 330 generates a new hash entry and transmits the new hash entry to thedetection engine unit 340. - The
detection engine unit 340 receives hash entries of alarm data having identical attributes from thehash engine unit 330, determines whether the number of alarms exceeds a critical value based on the hash entries, and detects an attack situation based on the determination. Theinterface control unit 350 provides an interface with theexternal interface 250. - The alarm-
parsing unit 320 extracts four attributes such as an attack type, an attacker IP address, a target IP address, and a service type from alarm data received from thealarm buffer unit 310. The alarm-parsing unit 320 determines to which group of attack situations the alarm data belongs based on the attributes as defined in the table ofFIG. 1 and transmits information regarding a determined group of attack situation to the hash engine unit 330 (S720). - The
hash engine unit 330 generates a hash key using the determined group of attack situations received from the alarm-parsing unit 320 (S730) and determines whether thehash memory 230 includes hash entries having identical attributes. If hash entries having identical attributes are found, thehash engine unit 330 transmits the hash entries to thedetection engine unit 330. If hash entries having identical attributes are not found, thehash engine unit 330 generates a new hash entry and transmits the new hash entry to thedetection engine unit 330. - In the present embodiment, the alarm-parsing
unit 320 generates ten groups of attack situations (seeFIG. 1 ). To process the ten groups of attack situations with high efficiency, thehash engine unit 330 includes ten parallel engines, i.e., zeroth through ninth hash engines. In other words, the ten parallel engines included in thehash engine unit 330 process the ten groups of attack situations, respectively (S740). -
FIG. 4 illustrates a hash structure maintained in thehash memory 230 controlled by thehash engine unit 330. Thehash memory 230 includes anindex memory 410 and adata memory 420. Theindex memory 410 can be accessed using a hash key. Since theindex memory 410 may have the same hash key even ifindex entries 430 have different attributes, theindex entries 430 are maintained for respective indexes. - Each of the
index entries 430 includes an effective bit indicating whether a corresponding index entry is effective and an address field indicating an address of a real data memory if the index entry is effective. Entries included in thedata memory 420 are addressed by theindex entries 430. Each of first through Nth entries includes attribute information such as the attack pattern, the attacker IP address, the target IP address and the service pattern, and counter information managed by thedetection engine unit 340. - The
detection engine unit 340 counts the number of alarms having identical attributes in a hash entry received from thehash engine unit 330. Thedetection engine unit 340 also determines how many times the alarms have been raised within a valid time and whether the number of times that the alarms have been raised exceeds a critical value. If the number of times that the alarms have been raised exceeds the critical value, thedetection engine unit 340 detects it as an attack situation and notifies information regarding the detection of the attack situation to theinterface control unit 350. -
FIG. 5 illustrates an entry structure that thedetection engine unit 330 manages using hash entries. Such entries are managed for respective identical attributes. In other words, each entry is managed for each identical attribute. Referring toFIG. 5 , anLTT field 510 stores time information generated by an alarm that is raised last among alarms having identical attributes. Zeroth through (N−1)thSLOTs 530 store counter information generated in each time slot and aSUM field 520 indicates the sum of all slot counters. -
FIG. 6 illustrates an algorithm of counting alarms having identical attributes and determining whether the number of alarms exceeds a critical value using information of an entry structure as illustrated inFIG. 5 . As described above, according to a mechanism of the present invention, such an analysis process is applied only to alarms occurred within a valid time. For the sake of high accuracy, a separate counter is prepared for each time unit and a slot counter is moved as time goes by. - Referring to the algorithm of
FIG. 6 , if the difference between an arrived time tick (ATT) and a last time tick (LTT) of last alarm data stored in a hash entry is greater than or equal to a window size (N), a value of the LTT is replaced with a value of the ATT and a value of SLOT is reset to zero. In addition, the value of the SLOT, i.e., the remainder obtained by dividing the ATT value by N, is stored as one and a value of SUM is also stored as one. - When the ATT and LTT values are equal, the count of the SLOT indexed by the LTT and the SUM are increased by one. If ATT−LTT is greater than zero and smaller than N, a sum of counter values respectively generated in a SLOT indexed by LTT+1 through a SLOT indexed by ATT−1 is subtracted from the SUM and the SLOT is reset to zero. The SLOT indexed by the ATT is stored as one and the value of the SUM is increased by one.
- When the
detection engine unit 340 completes counting the number of alarms in the entry, it determines whether an attack situation has occurred based on whether the value of the SUM exceeds a critical value. The critical value can be set through theexternal interface 250. Setting information transmitted to theexternal interface 250 is transmitted again to theinterface control unit 350, which then stores the setting information in thecontrol memory 240. Thus, data on a critical value used by thedetection engine unit 340 is amended (S750). - The present invention can also be implemented as computer-readable code on a computer-readable recording medium. The computer-readable recording medium is any data storage device that can store data which can be thereafter read by a computer system. Examples of the computer-readable recording medium include read-only memory (ROM), random-access memory (RAM), CD-ROMs, magnetic tapes, floppy disks, optical data storage devices, and carrier waves (such as data transmission through the Internet).
- The computer-readable recording medium can also be distributed over network-coupled computer systems so that the computer-readable code is stored and executed in a distributed fashion.
- A font-ROM data structure according to the present invention can also be implemented as computer-readable code on a computer-readable recording medium such as ROMs, RAMs, CD-ROMs, magnetic tapes, hard disks, floppy disks, flash memories, and optical data storage devices.
- As described above, according to an apparatus and method of detecting a network attack situation, equal numbers of hash engines and detection engines for processing alarms in a network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.
- While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the following claims.
Claims (8)
1. An apparatus for detecting a network attack situation comprising:
an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data;
an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated;
a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and
an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory.
2. The apparatus of claim 1 , wherein the alarm processor comprises:
an alarm parsing unit extracting attributes of the alarms based on the alarm data and generating at least one first data characterized by the attributes;
a hash engine unit being equal to the number of the first data and generating a hash key based on the first data, and generating a plurality of hash entries having identical attributes or generating a new hash entry if a lookup fails;
a detection engine unit receiving the hash entries, determining whether the critical value is exceeded based on the hash entries, and corresponding to the hash engine unit one to one; and
an interface control unit transmitting/receiving information regarding whether the critical value is exceeded to/from the external device.
3. The apparatus of claim 2 , wherein the alarm parsing unit extracts such attributes as an attack type, an attacker IP address, a target IP address, and a service type from the alarm data and generates the first data characterized by a combination of the extracted attributes.
4. The apparatus of claim 1 , wherein the memory comprises:
a hash memory unit storing the hash entries; and
a control memory unit storing control data including the critical value.
5. The apparatus of claim 4 , wherein the hash memory unit comprises an index memory accessed by the hash key and storing k (k is a positive integer) indexes having m (m is a positive integer) index entries and a data memory addressed by the m index entries and storing n (n is a positive integer) entries containing predetermined attribute information and counter information, and is operated by the hash engine unit.
6. The apparatus of claim 5 , wherein the attribute information comprises the attack type, the attacker IP address, the target IP address, and the service type.
7. The apparatus of claim 2 , wherein the detection engine unit counts the number of alarms having identical attributes based on the hash entries received from the hash engine unit, calculates the number of times that the alarms have been raised within a valid time, and determines whether the number of alarms exceeds the critical value.
8-12. (canceled)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/275,906 US20090094699A1 (en) | 2004-12-03 | 2008-11-21 | Apparatus and method of detecting network attack situation |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
KR1020040101086A KR100628317B1 (en) | 2004-12-03 | 2004-12-03 | Apparatus for detecting attacks toward network and method thereof |
KR10-2004-0101086 | 2004-12-03 | ||
US11/081,682 US7596810B2 (en) | 2004-12-03 | 2005-03-17 | Apparatus and method of detecting network attack situation |
US12/275,906 US20090094699A1 (en) | 2004-12-03 | 2008-11-21 | Apparatus and method of detecting network attack situation |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/081,682 Division US7596810B2 (en) | 2004-12-03 | 2005-03-17 | Apparatus and method of detecting network attack situation |
Publications (1)
Publication Number | Publication Date |
---|---|
US20090094699A1 true US20090094699A1 (en) | 2009-04-09 |
Family
ID=36573570
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/081,682 Expired - Fee Related US7596810B2 (en) | 2004-12-03 | 2005-03-17 | Apparatus and method of detecting network attack situation |
US12/275,906 Abandoned US20090094699A1 (en) | 2004-12-03 | 2008-11-21 | Apparatus and method of detecting network attack situation |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/081,682 Expired - Fee Related US7596810B2 (en) | 2004-12-03 | 2005-03-17 | Apparatus and method of detecting network attack situation |
Country Status (2)
Country | Link |
---|---|
US (2) | US7596810B2 (en) |
KR (1) | KR100628317B1 (en) |
Families Citing this family (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2006352831A (en) * | 2005-05-20 | 2006-12-28 | Alaxala Networks Corp | Network controller and method of controlling the same |
US20070204344A1 (en) * | 2006-02-26 | 2007-08-30 | Chun Xue | Parallel Variable Length Pattern Matching Using Hash Table |
US20080079596A1 (en) * | 2006-09-29 | 2008-04-03 | Rockwell Automation Technologies, Inc. | Buffering alarms |
KR100809422B1 (en) * | 2006-09-29 | 2008-03-05 | 한국전자통신연구원 | Intrusion prevention apparatus based on alert severity of signiture detection and abnormal traffic and method thereof |
US7675406B2 (en) * | 2006-09-29 | 2010-03-09 | Rockwell Automation Technologies, Inc. | Generation of timestamps within field devices |
KR100832536B1 (en) * | 2006-11-06 | 2008-05-27 | 한국전자통신연구원 | Method and apparatus for managing security in large network environment |
US7743003B1 (en) | 2007-05-16 | 2010-06-22 | Google Inc. | Scaling machine learning using approximate counting that uses feature hashing |
US9100417B2 (en) * | 2007-09-12 | 2015-08-04 | Avaya Inc. | Multi-node and multi-call state machine profiling for detecting SPIT |
US9178898B2 (en) * | 2007-09-12 | 2015-11-03 | Avaya Inc. | Distributed stateful intrusion detection for voice over IP |
US9438641B2 (en) * | 2007-09-12 | 2016-09-06 | Avaya Inc. | State machine profiling for voice over IP calls |
US9736172B2 (en) * | 2007-09-12 | 2017-08-15 | Avaya Inc. | Signature-free intrusion detection |
US8656492B2 (en) * | 2011-05-16 | 2014-02-18 | General Electric Company | Systems, methods, and apparatus for network intrusion detection |
KR101420301B1 (en) * | 2012-09-05 | 2014-07-17 | 주식회사 시큐아이 | Method and apparatus for detecting ddos attack |
MY184710A (en) * | 2015-03-18 | 2021-04-19 | Ensign Infosecurity Cybersecurity Pte Ltd | System and method for information security threat disruption via a border gateway |
CN107958165A (en) * | 2016-10-18 | 2018-04-24 | 国民技术股份有限公司 | A kind of anti-attack system, method and electronic equipment |
Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6353385B1 (en) * | 2000-08-25 | 2002-03-05 | Hyperon Incorporated | Method and system for interfacing an intrusion detection system to a central alarm system |
US20020107953A1 (en) * | 2001-01-16 | 2002-08-08 | Mark Ontiveros | Method and device for monitoring data traffic and preventing unauthorized access to a network |
US20020129264A1 (en) * | 2001-01-10 | 2002-09-12 | Rowland Craig H. | Computer security and management system |
US20030069959A1 (en) * | 2001-10-04 | 2003-04-10 | Edwin Tse | Alarm lists synchronization in an alarm management system |
US20030088429A1 (en) * | 2001-11-05 | 2003-05-08 | Schmeling Garth F. | Secure and mediated access for E-services |
US20030105914A1 (en) * | 2001-12-04 | 2003-06-05 | Dearth Glenn A. | Remote memory address translation |
US20030196123A1 (en) * | 2002-03-29 | 2003-10-16 | Rowland Craig H. | Method and system for analyzing and addressing alarms from network intrusion detection systems |
US20030200464A1 (en) * | 2002-04-17 | 2003-10-23 | Computer Associates Think, Inc. | Detecting and countering malicious code in enterprise networks |
US20040193943A1 (en) * | 2003-02-13 | 2004-09-30 | Robert Angelino | Multiparameter network fault detection system using probabilistic and aggregation analysis |
US20060075489A1 (en) * | 2004-09-30 | 2006-04-06 | Lucent Technologies, Inc. | Streaming algorithms for robust, real-time detection of DDoS attacks |
US7043759B2 (en) * | 2000-09-07 | 2006-05-09 | Mazu Networks, Inc. | Architecture to thwart denial of service attacks |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5819028A (en) * | 1992-06-10 | 1998-10-06 | Bay Networks, Inc. | Method and apparatus for determining the health of a network |
US5768501A (en) * | 1996-05-28 | 1998-06-16 | Cabletron Systems | Method and apparatus for inter-domain alarm correlation |
US6088804A (en) * | 1998-01-12 | 2000-07-11 | Motorola, Inc. | Adaptive system and method for responding to computer network security attacks |
US6327677B1 (en) * | 1998-04-27 | 2001-12-04 | Proactive Networks | Method and apparatus for monitoring a network environment |
US7143442B2 (en) * | 2000-08-11 | 2006-11-28 | British Telecommunications | System and method of detecting events |
KR100432421B1 (en) | 2001-12-21 | 2004-05-22 | 한국전자통신연구원 | method and recorded media for attack correlation analysis |
FR2840139B1 (en) * | 2002-05-23 | 2004-12-17 | Cit Alcatel | DEVICE AND METHOD FOR CLASSIFYING ALARM MESSAGES RESULTING FROM A BREACH OF SERVICE LEVEL AGREEMENT IN A COMMUNICATIONS NETWORK |
-
2004
- 2004-12-03 KR KR1020040101086A patent/KR100628317B1/en not_active IP Right Cessation
-
2005
- 2005-03-17 US US11/081,682 patent/US7596810B2/en not_active Expired - Fee Related
-
2008
- 2008-11-21 US US12/275,906 patent/US20090094699A1/en not_active Abandoned
Patent Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6353385B1 (en) * | 2000-08-25 | 2002-03-05 | Hyperon Incorporated | Method and system for interfacing an intrusion detection system to a central alarm system |
US7043759B2 (en) * | 2000-09-07 | 2006-05-09 | Mazu Networks, Inc. | Architecture to thwart denial of service attacks |
US20020129264A1 (en) * | 2001-01-10 | 2002-09-12 | Rowland Craig H. | Computer security and management system |
US20020107953A1 (en) * | 2001-01-16 | 2002-08-08 | Mark Ontiveros | Method and device for monitoring data traffic and preventing unauthorized access to a network |
US20030069959A1 (en) * | 2001-10-04 | 2003-04-10 | Edwin Tse | Alarm lists synchronization in an alarm management system |
US20030088429A1 (en) * | 2001-11-05 | 2003-05-08 | Schmeling Garth F. | Secure and mediated access for E-services |
US20030105914A1 (en) * | 2001-12-04 | 2003-06-05 | Dearth Glenn A. | Remote memory address translation |
US20030196123A1 (en) * | 2002-03-29 | 2003-10-16 | Rowland Craig H. | Method and system for analyzing and addressing alarms from network intrusion detection systems |
US20030200464A1 (en) * | 2002-04-17 | 2003-10-23 | Computer Associates Think, Inc. | Detecting and countering malicious code in enterprise networks |
US20040193943A1 (en) * | 2003-02-13 | 2004-09-30 | Robert Angelino | Multiparameter network fault detection system using probabilistic and aggregation analysis |
US20060075489A1 (en) * | 2004-09-30 | 2006-04-06 | Lucent Technologies, Inc. | Streaming algorithms for robust, real-time detection of DDoS attacks |
Also Published As
Publication number | Publication date |
---|---|
KR100628317B1 (en) | 2006-09-27 |
US7596810B2 (en) | 2009-09-29 |
KR20060062298A (en) | 2006-06-12 |
US20060119486A1 (en) | 2006-06-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7596810B2 (en) | Apparatus and method of detecting network attack situation | |
US10867034B2 (en) | Method for detecting a cyber attack | |
US8260914B1 (en) | Detecting DNS fast-flux anomalies | |
CN112953933A (en) | Abnormal attack behavior detection method, device, equipment and storage medium | |
EP2284752B1 (en) | Intrusion detection systems and methods | |
CN112544059A (en) | Method, device and system for network traffic analysis | |
CN111885086B (en) | Malicious software heartbeat detection method, device and equipment and readable storage medium | |
CN112866023A (en) | Network detection method, model training method, device, equipment and storage medium | |
CN110071934B (en) | Local sensitivity counting abstract method and system for network anomaly detection | |
CN112385196B (en) | System and method for reporting computer security incidents | |
CN110958245B (en) | Attack detection method, device, equipment and storage medium | |
JP2008052637A (en) | Abnormality detector, abnormality detection program, and recording medium | |
JP2008507222A5 (en) | ||
Giacinto et al. | Alarm clustering for intrusion detection systems in computer networks | |
CN112583827B (en) | Data leakage detection method and device | |
CN112788039A (en) | DDoS attack identification method, device and storage medium | |
CN109257384B (en) | Application layer DDoS attack identification method based on access rhythm matrix | |
CN102111302B (en) | Worm detection method | |
CN116599705A (en) | Internet attack prediction method, system, equipment and medium | |
CN114189361B (en) | Situation awareness method, device and system for defending threat | |
CN114006719B (en) | AI verification method, device and system based on situation awareness | |
TWI777766B (en) | System and method of malicious domain query behavior detection | |
CN115296904A (en) | Domain name reflection attack detection method and device, electronic equipment and storage medium | |
CN112087448B (en) | Security log extraction method and device and computer equipment | |
US11184369B2 (en) | Malicious relay and jump-system detection using behavioral indicators of actors |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTIT Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KIM, JIN OH;SOHN, SEON GYOUNG;BANG, HYOCHAN;AND OTHERS;REEL/FRAME:021877/0187 Effective date: 20050214 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |