US Al (19) United States (12) Patent Application Publication (10) Pub. No.: US 2006/ A1 Choi et al. (43) Pub. Date: Sep.

Transcription

1 US A (19) United States (12) Patent Appication Pubication (10) Pub. No.: US A1 Choi et a. (43) Pub. Date: Sep. 14, 2006 (54) APPARATUS AND METHOD FOR ADAPTVELY PREVENTNG ATTACKS (76) nventors: Byeong Cheo Choi, Daejeon-city (KR); Dong Seo, Daejeon-city (KR); Jong S00 Jang, Daejeon-city (KR) Correspondence Address: BLAKELY SOKOLOFF TAYLOR & ZAFMAN WLSHRE BOULEVARD SEVENTH FLOOR LOS ANGELES, CA (US) (21) App. No.: 11187,758 (22) Fied: Ju. 22, 2005 (30) Foreign Appication Priority Data Mar. 10, 2005 (KR) Pubication Cassi?cation (51) nt. C. G06F 1214 ( ) (52) Us. or (57) ABSTRACT An apparatus and method for adaptivey preventing attacks Which can reduce fase positives and negatives for abnorma tra?ic and can adaptivey dea With unknown attacks are provided. The apparatus incudes: a behavior anaysis unit Which estimates an attack detection critica vaue by ana yzing the behavior of network traf?c; a traf?c determination unit Which determines What type of traf?c the network traf?c is using the estimated attack detection critica vaue; an attack determination unit Which determines Whether the network traf?c is abnorma by anayzing the network traf?c according to a set of determination rues; and an adaptive attack prevention unit Which handes the network traf?c based on the determination resuts provided by the attack determination unit. Accordingy, it is possibe to reduce fase positives and negatives for abnorma traf?c or unknown attacks input to a network SECURTY POLCY MANAGEMENT UNT BEHAVOR PROFLE THREATS GLOBAL NFORMATON BASE ADAPTVE ATTACK PREVENTON PROCESSOR BEHAVORAL PROFLE GENERATON UNT 1:9 " ADAPTVE BLACKLST CLASSFCATON TRAFFC ANALYSS UNT (ANALYSS OF EXTERNAL OR NTERNAL BEHAVOR) WHTEUST \ GRAYUST \ BEHAVOR PROFLNG ADAPTVE ATTACK PREVENTON FRAMEWORK 110

2 _ Patent Appication Pubication Sep. 14, 2006 Sheet 1 0f 4 US A1 FG. 1 SECURTY POLCY MANAGEMENT UNT BEHAVOR PROFLE THREATS GLOBAL NFORMATON BASE ADAPTVE ATTACK PREVENTON PROcEssOR BEHAVORAL PROFLE GENERATON UNT whneust :9 ADAPT'VE BLACKUST CLASSFCATON TRAFFO ANALYSS \ UNT (ANALYss OF EXTERNAL OR NTERNAL BEHAVOR) GRAYLST BEHAVOR PROFLNO 110 ADAPTVE ATTAOK PREVENTON FRAMEWORK

3

4 Patent Appication Pubication Sep. 14, 2006 Sheet 3 0f 4 US A1 FG. - 3 i 81 0 ESTMATE ATTACK DETECTON CRTTCAL VALUE BY ANALYZNG BEHAVOR OF NETWORK TRAFFC S20 DETERMNE WHAT TYPE NETWORK TRAFFC S USNG ESTMATED ATTACK DETECTON CRTCAL VALUE 1 S30 ANALYZE NETWORK TRAFFC ACCORDNG TO SET OF DETERMNATON RULES S40 ADAPTVELY DECDE TO PASS NETWORK - TRAFFC THROUGH, BLOCK NETWORK TRAFFC, OR CONTROL NETWORK TRAFFC BASED ON WHETHER NETWORK TRAFFC S

5 Patent Appication Pubication Sep. 14, 2006 FG. Sheet 4 0f 4 4 US A1 HOGOOTD BAD - FALSE <2: : FALSE POsTvE RATE Tom. T611 NEGATVE RATE TO- -TO1~ -» T \ BEHAVOR ATTACK 22 \ DETERMNATON ATTAOKPATTERN FACTOR1212 zoi BEHAVOR ATTACK [[> HHE> \ DETERMNATON (X) DETERMNATON ATTAOKPATTERN2 FACTOR2 203 TRAFFC \ BEHAVOR ATTAOK [> > \ DETERMNATON (X) DETERMNATON mu CLASS'F'ER [HU ATTAcKPATTERNa FACTORS m 1 1 D> TE> \ BEHAVOR ATTACK \ DETERMNATON \ ATTACKPATTEHNR FAcTORn 21n 232 WHTE LST GHAY LST 236 BLACK LST

6 US A1 Sep. 14, 2006 APPARATUS AND METHOD FOR ADAPTVELY PREVENTNG ATTACKS CROSS-REFERENCE TO RELATED PATENT APPLCATON [0001] This appication caims the bene?t of Korean Patent Appication No ,?ed on Mar. 10, 2005, in the Korean nteectua Property Of?ce, the disco sure of Which is incorporated herein in its entirety by reference. BACKGROUND OF THE NVENTON [0002] 1. Fied of the nvention [0003] The present invention reates to a network, and more particuary, to an apparatus and method for adaptivey preventing attacks, Which can reduce fase positives and negatives and can be We prepared to dea With unknown attacks by determining Whether traf?c input to a network is norma or abnorma using an attack detection critica vaue and a set of determination rues obtained through behavior based adaptive attack anaysis. [0004] 2. Description of the Reated Art [0005] Conventiona attack detection or prevention sys tems use signature-based determination rues. Even though some conventiona attack detection or prevention systems are capabe of detecting attacks through the behaviora anaysis of network tra?ic, these attack detection or preven tion systems sti suffer from the probem of high fase positives and negatives for the detection of abnorma traf?c and cannot adaptivey dea With unknown attacks, such as Super Worms, Which are attacks aunched upon a network via We-knoWn service ports, and Zero-day attacks, Which are attacks aunched upon a network before the patching of computer systems connected to the network is compete. SUMMARY OF THE NVENTON [0006] The present invention provides an apparatus for adaptivey preventing attacks, Which can prevent attacks Whie reducing fase positives and negatives by detecting abnorma traf?c or unknown attack traf?c input to a network using an attack detection critica vaue obtained through a behavior-based adaptive attack anaysis. [0007] The present invention aso provides a method of adaptivey preventing attacks, Which can prevent attacks Whie reducing fase positives and negatives by detecting abnorma traf?c or unknown attack traf?c input to a network using an attack detection critica vaue obtained through a behavior-based adaptive attack anaysis. [0008] According to an aspect of the present invention, there is provided an apparatus for adaptivey preventing attacks. The apparatus incudes: a behavior anaysis unit Which estimates an attack detection critica vaue by ana yzing the behavior of network traf?c; a traf?c determination unit Which determines What type of traf?c the network traf?c is using the estimated attack detection critica vaue; an attack determination unit Which determines Whether the network traf?c is abnorma by anayzing the network traf?c according to a set of determination rues; and an adaptive attack prevention unit Which handes the network traf?c based on the determination resuts provided by the attack determination unit. [0009] The determination rues may incude a grayist, a Whiteist, and a backist. The grayist may incude a set of rues used to determine Whether the network traf?c is abnorma. The Whiteist may incude information regarding secure systems, nodes, or users. The backist may incude information regarding ess secure systems, nodes, or users. [0010] The apparatus may aso incude a security poicy management unit Which automaticay generates a behav iora pro?e of a norma user, and a grayist, a Whiteist, and a backist reated to abnorma traffic and manages the behaviora pro?e of the norma user, and the grayist, the Whiteist, and the backist by storing them in a threats goba information base. Here, the security poicy management unit may provide the grayist, the Whiteist, and the backist reated to the abnorma traf?c to the attack determination unit. [0011] The adaptive attack prevention unit may aow transmission of the network traf?c, bock the network traf?c, or contro the network traffic according to Whether the network traffic is abnorma. [0012] According to another aspect of the present inven tion, there is provided a method of adaptivey preventing attacks. The method incudes: estimating an attack detection critica vaue by anayzing the behavior of network traf?c; determining What type of traf?c the network traffic is using the estimated attack detection critica vaue; determining Whether the network traf?c is abnorma by anayzing the network traffic according to a set of determination rues; and adaptivey aowing transmission of the network traf?c, bocking the network traffic, or controing the network traffic based on the determination resuts. [0013] The determination rues may incude a grayist, a Whiteist, and a backist. The grayist may incude a set of rues used to determine Whether the network traf?c is abnorma. The Whiteist may incude information regarding secure systems, nodes, or users. The backist may incude information regarding ess secure systems, nodes, or users. BREF DESCRPTON OF THE DRAWNGS [0014] The above and other features and advantages of the present invention Wi become more apparent by describing in detai exempary embodiments thereof With reference to the attached drawings in Which: [0015] FG. 1 is a schematic diagram of an apparatus for adaptivey preventing attacks according to an exempary embodiment of the present invention; [0016] FG. 2 is a bock diagram of an apparatus for adaptivey preventing attacks according to an exempary embodiment of the present invention; [0017] FG. 3 is a?owchart iustrating a method of adaptivey preventing attacks according to an exempary embodiment of the present invention; [0018] FG. 4 is a graph of the probabiity of network traffic being norma and abnorma according to an attack detection critica vaue used in behavior-based adaptive attack determination; and [0019] FG. 5 is a bock diagram expaining an adaptive cassi?cation method according to an exempary embodi ment of the present invention.

7 US A1 Sep. 14, 2006 DETALED DESCRPTON OF THE NVENTON [0020] The present invention Wi now be described more fuy With reference to the accompanying drawings in Which exempary embodiments of the invention are shown. Terms used in this discosure have been de?ned in consideration of their functions in this discosure and may have different meanings depending on a user s intent or understanding. Therefore, the terms are de?ned based on the invention caimed in this discosure. [0021] FG. 1 is a schematic diagram of an apparatus 1 for adaptivey preventing attacks according to an exempary embodiment of the present invention. Referring to FG. 1, the apparatus 1 uses behavior-based adaptive attack anaysis and performs an attack contro using a grayist, a Whiteist, and a backist. [0022] The apparatus 1 incudes an adaptive attack pre vention processor 110 and a security poicy management unit 120. [0023] The adaptive attack prevention processor 110 gen erates a behaviora pro?e by anayzing network traf?c; cassi?es the network traf?c; adaptivey appies an attack detection critica vaue to the network traf?c; estabishes adaptive countermeasures against attacks by using a set of determination rues, incuding a grayist, a Whiteist, a back ist, and a decision-by-majority rue; and aows transmis sion of the network traf?c, bocks the network traf?c, or contros the network traf?c using rate imitations. [0024] The security poicy management unit 120 auto maticay generates a behaviora pro?e, a grayist, Which incudes a set of rues used to determine Whether network traf?c is abnorma, a Whiteist, Which incudes information regarding secure systemsnodesusers, and a backist, Which incudes information regarding ess secure systemsnodes users, and manages the behaviora pro?e, the grayist, the Whiteist, and the backist by storing them in a threats goba information base (TGB) 130. [0025] FG. 2 is a bock diagram of an apparatus 1 for adaptivey preventing attacks according to an exempary embodiment of the present invention. Referring to FG. 2, the apparatus 1 incudes a behavior anaysis unit 10, a traf?c determination unit 20, an attack determination unit 30, an adaptive attack prevention unit 40, a security poicy man agement unit 80, and a TGB 90. [0026] The behavior anaysis unit 10 estimates an attack detection critica vaue by anayzing the behavior of network traf?c. The traf?c determination unit 20 determines What type of traf?c the network tra?ic is based on the estimated attack detection critica vaue. [0027] The attack determination unit 30 determines Whether the network tra?ic is abnorma by anayzing the network traf?c according to a set of determination rues. The determination rues incude a grayist, a Whiteist, and a backist. The grayist incudes a set of rues used to deter mine Whether network traf?c is abnorma, the Whiteist incudes information regarding secure systemsnodesusers, and the backist incudes information regarding ess secure systemsnodesusers. [0028] The adaptive attack prevention unit 40 adaptivey deas With the network traf?c based on the determination resuts provided by the attack determination unit 30. For exampe, the adaptive attack prevention unit 40 may decide to aow transmission (50) of the network tra?ic, bock (60) the network traf?c, or contro (70) the network traf?c using rate imitations based on the determination resuts provided by the attack determination unit 30. [0029] The security poicy management unit 80 manages rue information by storing it in the TGB 90. The rue information incudes a behaviora pro?e of a norma user, and a grayist, a Whiteist, and a backist reated to abnorma tra?ic. The security poicy management unit 80 may auto maticay generate and manage the rue information. n addition, the security poicy management unit 80 provides the rue information to the attack determination unit 30 so that the attack determination unit 30 can determine What type of traf?c the network traf?c is by using the gray, White, and backists reated to the abnorma traf?c incuded in the rue information. [0030] FG. 3 is a?owchart iustrating a method of adaptivey preventing attacks according to an exempary embodiment of the present invention. Referring to FG. 3, in operation S10, an attack detection critica vaue is esti mated by anayzing the behavior of network traf?c. n operation S20, it is determined What type of traf?c the network traf?c is using the estimated attack detection critica vaue. n operation S30, it is determined Whether the net Work traf?c is abnorma by anayzing the network traf?c according to a set of determination rues. [0031] The determination rues incude a grayist, a Whiteist, and a backist. The grayist incudes a set of rues used to determine Whether network traf?c is abnorma, the Whiteist incudes information regarding secure systems nodesusers, and the backist incudes information regard ing ess secure systemsnodesusers. [0032] n operation S40, it is determined Whether to aow transmission of the network traf?c, bock the network traf?c, or contro the network traf?c using rate imitations depend ing on the anaysis resuts obtained in operation S30 indi cating Whether the network traf?c is abnorma. [0033] n the present embodiment, it is determined Whether to pass the network traf?c through, bock the network traf?c, or contro the network tra?ic using rate imitations by processing the network using a grayist, a Whiteist, and a backist in parae and appying a decision by a majority rue. Thus, it is possibe to prevent attacks Whie reducing fase network attack aarm rates. n addition, it is possibe to prevent unknown attacks, such as Super Worms and Zero-day attacks, by adaptivey detecting, anayzing, and deaing With the unknown attacks. [0034] FG. 4 is a graph of the probabiity of network tra?ic being norma and abnorma according to an attack detection critica vaue used in behavior-based adaptive attack determination. Referring to FG. 4, the attack detec tion critica vaue is appropriatey adaptivey adjusted so that the occurrence of fase positives and fase negatives is reduced. n other Words, it is possibe to minimize fase positives and negatives by using the apparatus and method for adaptivey preventing attacks according to exempary embodiments of the present invention. [0035] n detai, When estimating the attack detection critica vaue by anayzing the behavior of network tra?ic in

8 US A Sep. 14, 2006 the apparatus for adaptivey preventing attacks according to an exempary embodiment of the present invention, the attack detection critica vaue, Which is initiay T01 as a resut of binary hypothesis testing, is adaptivey moved to T001 or T011, in Which case, the occurrence of fase positives and fase negatives decreases. Here, a fase posi tive occurs When norma network traf?c is identi?ed as abnorma attack traffic, and a fase negative occurs When abnorma attack traffic is identi?ed as norma network traf?c. [0036] FG. 5 is a bock diagram expaining an adaptive cassi?cation method according to an exempary embodi ment of the present invention. Speci?cay, FG. 5 iustrates an adaptive cassi?cation modue inside the adaptive attack prevention processor 110 of FG. 1, the traf?c determination unit 20 and the attack determination unit 30 of FG. 2, and the method of adaptivey preventing attacks as iustrated in FG. 3 in further detai. Referring to FG. 5, modues 201, 202, 203,..., 20n extract behavior determination attack patterns 1 through n from network traffic, and the extracted behavior determination attack patterns 1 through n are mutipied by attack determination factors 1 through n, (211 through 21n), respectivey. Thereafter, a traf?c cassi?er 220 cassi?es the network traf?c based on the mutipied resuts and then stores the network traf?c in one of a Whiteist 232, a grayist 234, and a backist 246 so that the network traf?c is adaptivey handed. [0037] n the present invention, an adaptive attack pre vention technique capabe of minimizing fase positives and negatives by setting an adaptive attack detection critica vaue through the behaviora pro?ing of a harmfu traf?c is provided. Thus, it is possibe to maximize the ef?ciency of determining Whether network traf?c is norma or abnorma. [0038] The apparatus for adaptivey preventing attacks according to the present invention reaizes an adaptive attack prevention technique for setting an adaptive attack detection critica vaue by adaptivey anayzing, detecting, and han ding network traf?c based on the behaviora pro?e and characteristics of the network traffic. Thus, the apparatus for adaptivey preventing attacks according to the present inven tion can efficienty detect and dea With attacks even in an environment Where it is extremey difficut to determine Whether tra?ic currenty input to a network are norma or abnorma. [0039] n addition, according to the present invention, it is possibe to maximize the ef?ciency of determining Whether network traffic is norma or abnorma and reduce fase positives and negatives. [0040] The present invention can be reaized as computer readabe code Written on a computer-readabe recording medium. The computer-readabe recording medium may be any type of recording device-in Which data is stored in a computer-readabe manner. Exampes of the computer-read abe recording medium incude a ROM, a RAM, a CD ROM, a magnetic tape, a?oppy disc, an optica data storage, and a carrier Wave (e.g., data transmission through the nternet). The computer-readabe recording medium can be distributed over a puraity of computer systems connected to a network so that a computer-readabe code is Written thereto and executed therefrom in a decentraized manner. Functiona programs, code, and code segments needed for reaizing the present invention can be easiy deduced by one of ordinary ski in the art. [0041] As described above, it is possibe to reduce fase positives and negatives for abnorma traf?c or unknown attack traf?c input to a network. [0042] n addition, it is possibe to adaptivey detect, anayze, and dea With unknown attacks, such as Super Worms or Zero day attacks. [0043] Whie the present invention has been particuary shown and described With reference to exempary embodi ments thereof, it Wi be understood by those of ordinary ski in the art that various changes in form and detais may be made therein Without departing from the spirit and scope of the present invention as de?ned by the foowing caims. What is caimed is: 1. An apparatus for adaptivey preventing attacks com prising: a behavior anaysis unit Which estimates an attack detec tion critica vaue by anayzing the behavior of network traffic; a traf?c determination unit Which determines What type of traffic the network traf?c is using the estimated attack detection critica vaue; an attack determination unit Which determines Whether the network traffic is abnorma by anayzing the net Work traf?c according to a set of determination rues; and an adaptive attack prevention unit Which handes the network traf?c based on the determination resuts pro vided by the attack determination unit. 2. The apparatus of caim 1, Wherein the determination rues comprise a grayist, a Whiteist, and a backist; the grayist comprises a set of rues used to determine Whether the network traf?c is abnorma; the Whiteist comprises information regarding secure systems, nodes, or users; and the backist comprises information regarding ess secure systems, nodes, or users. 3. The apparatus of caim 2 further comprising a security poicy management unit Which automaticay generates a behaviora pro?e of a norma user, and a grayist, a Whiteist, and a backist reated to abnorma traf?c and manages the behaviora pro?e of the norma user, and the grayist, the Whiteist, and the backist by storing them in a threats goba information base, Wherein the security poicy management unit provides the grayist, the Whiteist, and the backist reated to the abnorma traf?c to the attack determination unit. 4. The apparatus of caim 1, Wherein the adaptive attack prevention unit aows transmission of the network traf?c, bocks the network traf?c, or contros the network traf?c according to Whether the network traf?c is abnorma. 5. A method of adaptivey preventing attacks comprising: estimating an attack detection critica vaue by anayzing the behavior of network traf?c; determining What type of traffic the network traf?c is using the estimated attack detection critica vaue; determining Whether the network traf?c is abnorma by anayzing the network traf?c according to a set of determination rues; and

9 US A1 Sep. 14, 2006 adaptivey aowing transmission of the network traf?c, bocking the network traf?c, or controing the network tra?ic based on the determination resuts. 6. The method of caim 5, wherein the determination rues comprise a grayist, a whiteist, and a backist; the grayist comprises a set of rues used to determine whether the network traf?c is abnorma; the whiteist comprises infor mation regarding secure systems, nodes, or users; and the backist comprises information regarding ess secure sys tems, nodes, or users. 7. A computer-readabe recording medium storing a com puter program is 5 for executing the method of caim 5 or 6. * * * * *