KR100640004B1 - Session state management device and method - Google Patents

Abstract

The present invention relates to an apparatus and method for managing a session state, comprising: a session index unit for generating or managing an index including 5 tuple information of a session corresponding to an input packet within a TCP handshaking process, within a predetermined time before and after establishing a connection of a session A detailed information management unit which extracts state information of a session corresponding to intrusion detection from an input packet when generating an index and creates and manages an entry for the session of the index, and a session after a predetermined time has elapsed after the session is established. A summary information management unit for generating and managing an entry having session state information including connection, termination state information of the corresponding session, and directional information of the input packet, and searching whether the index of the session corresponding to the input TCP packet exists in the session index unit. If the index does not exist, the summary information manager It comprises a search unit of the color. As a result, even in a giga Internet environment, there is an effect of detecting an attack more accurately using less resources.

Description

Apparatus and Method for managing Session State

1 is a block diagram of an intrusion detection structure based on session state according to an embodiment of the present invention.

2 shows a session state management apparatus.

3 illustrates a method for managing two-step session state information in the apparatus and method for managing session state of the present invention.

4 illustrates an embodiment of detailed session state information stored in the detailed information management unit of FIGS. 2 and 3.

FIG. 5 illustrates one embodiment of brief session state information stored in the summary information management unit of FIGS. 2 and 3.

6 illustrates a memory management scheme of a detail information management unit to provide a defense mechanism against a DoS attack.

7 illustrates a structure of a detailed information management unit according to an exemplary embodiment of the present invention.

FIG. 8 illustrates a process of performing TTL tracking as a part of a self attack detection function in a detailed information management unit according to an embodiment of the present invention.

FIG. 9 illustrates a process of Sequence / Acknowledge Number Tracking as a part of a self attack detection function in a detailed information management unit according to an embodiment of the present invention.

10 is a flowchart illustrating the processing of a SYN packet according to a preferred embodiment of the present invention.

11 shows a flowchart of processing of a SYN / ACK packet according to a preferred embodiment of the present invention.

12 is a flowchart illustrating the processing of an ACK packet as a preferred embodiment of the present invention.

13 is a flowchart showing the processing of an RST packet as one preferred embodiment of the present invention.

14 is a flowchart illustrating the processing of an FIN packet as one preferred embodiment of the present invention.

FIG. 15 shows a flowchart of processing of another packet not shown in FIG. 10 in FIG. 10 as a preferred embodiment of the present invention.

The present invention relates to an apparatus and method for managing session state for stateful packet inspection (hereinafter referred to as "SPI").

The conventional stateless analysis system, which determines whether an intrusion is based on one packet at a time, is a false alarm (IDS Evasion Tool) due to an intrusion detection system evasion tool such as "Stick" or "Snot". False positive alert).

To solve this problem, session state based intrusion detection techniques such as SPI have been developed. However, when intrusion detection is performed by enabling session state tracking for more effective intrusion detection using the newly developed session state-based intrusion detection technique, most of the currently developed products are giga-class. Under the Internet network which is rapidly changing to the network environment, there is a problem that the original function cannot be performed due to the sudden decrease in performance.

Therefore, the system using the state-based intrusion detection techniques currently developed is required to improve the performance to keep pace with the rapidly evolving Internet network. To this end, most existing software-based products are changing to hardware-based products.

In addition, even if the product is developed based on hardware, the state-based intrusion detection technique maintains information of hundreds of thousands to millions of sessions and solves resource shortages in order to perform properly in the rapidly changing Internet network. The challenge is to meet the performance of efficient performance in the giga-level network and the Internet.

In addition, the session state-based intrusion detection system maintains the information of the sessions and is therefore essentially vulnerable to Denial of Service (DoS) attacks such as SYN Flooding. To solve this problem, various techniques such as Syn Cache, Syn Cookies, SynDefender, Syn proxying, and Synkill have been proposed, but there are still considerable difficulties in the solution.

In order to solve the above problems, the session state management apparatus and method of the present invention reduces the false alarm rate of the intrusion alarm of the conventional stateless analysis system, the rapid system of activation of the existing session state-based system This is to provide efficient session management, memory management, and defense mechanism against Dos attack by overcoming the problem of inability to perform its original functions due to performance degradation.

In a preferred embodiment of the present invention, in the TCP handshaking process, the apparatus for managing session state includes a session index unit for generating or managing an index including 5-tuple information of a session corresponding to an input packet; A detailed information manager configured to generate and manage an entry by extracting state information of a session corresponding to intrusion detection from the input packet when generating the index, for a session within a predetermined time before and after establishing a connection of the session; A summary information manager for generating and managing an entry including a connection, an end state, and directional information of a packet corresponding to the input packet, for a session after a predetermined time elapses after the connection is established; And a search unit for searching whether an index of a session corresponding to an input TCP packet exists in the session index unit and searching for the summary information manager after connection establishment of the session if the index does not exist. .

Further, in the apparatus for managing the session state, the detailed information management unit receives an SYN packet in an initial linked list generation step, a TCP 3-way handshaking step, a SYN / ACK packet transmission step, and an ACK packet reception step, respectively. Generate a linked list, add the entry to the tail of the linked list in the step corresponding to the packet upon receipt of each packet, and time for the entry to be added to the linked list is a predetermined threshold. If exceeded, the entry is added to the tail portion of the initial linked list. It is characterized by inserting.

The session index unit sequentially stores the index, and when the session index unit is full, an LRU algorithm for deleting the oldest index is applied.

The detailed information manager stores the entries sequentially, and when the detailed information manager is FULL, an LRU algorithm for deleting the oldest entries is applied.

In addition, in an exemplary embodiment of the present invention, when the session connection is established, the apparatus for managing the session state may have a difference between a TTL value of a current packet and a TTL value of a previous packet in order to determine whether a packet belonging to the session is normal. Characterized in that it further comprises; TTL tracking alarm unit for generating an alarm when the set threshold is exceeded.

In addition, according to an embodiment of the present invention, the apparatus for managing session state may include a case in which the sequence number of a packet transmitted after receiving the input packet is smaller than the last ACK number of the input packet or the sum of the sequence number and the payload size. And a SEQ / ACK number tracking alert for generating an alert when the value obtained by subtracting the last ACK number is greater than the window size.

In another preferred embodiment of the present invention, in the TCP handshaking process, the session state management method includes the steps of: (a) creating an index table by creating or managing an index including 5-tuple information of a session corresponding to an input packet; ; (b) generating a first entry table by extracting state information of a session for responding to intrusion detection from the input packet when generating the index, for a session within a predetermined time before and after establishing a connection of the session; step; (c) generating a second entry table by generating and managing an entry in which the input packet includes connection, termination state information, and directionality information of the corresponding packet, for a session after a predetermined time elapses after the connection is established; ; And (d) searching whether an input TCP packet has an index of the corresponding session in the index table, and if the index does not exist, searching the second entry table after establishing a session. It is done.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. It should be noted that the same elements among the drawings are denoted by the same reference numerals and symbols as much as possible even though they are shown in different drawings.

In the following description of the present invention, detailed descriptions of related known functions or configurations will be omitted when it is determined that the detailed description may unnecessarily obscure the subject matter of the present invention.

1 is a block diagram of an intrusion detection structure based on session state according to an embodiment of the present invention.

Intrusion detection system based on session state includes IP De-fragmentation module 110, packet parser 120, state management unit 130, state information generation unit 140, packet forwarding unit 150, and TCP recombination unit. 160, an alarm generator, an intrusion detector 101, an alarm generator, an alarm manager, and an intrusion counterpart 102.

When the packet is input, the IP packet is reassembled through the IP De-fragmentation module 110 and the packet parser 120 frequently uses sequence number, acknowledge number, window size, and TCP flags in the packet header information. Extract information such as

The state manager 130 performs a function of creating, managing, and deleting a session corresponding to an input packet. To this end, the state manager 130 efficiently manages tens to millions of sessions while using less resources using a two-stage state table management technique, and responds to Dos attacks through memory management. This will be described later in more detail.

The state information generation unit 140 generates state information of a session corresponding to an input packet managed through a two-stage state table of the state management unit 130, and transmits this information to the intrusion detection unit 101.

The packet forwarding unit 150 transmits the state information of the session to the intrusion detecting unit 101 through the state information generating unit 140.

The TCP recombination unit 160 reassembles the TCP packet using the packet information transmitted from the state management unit 130 and the state information of the session transmitted from the state information generation unit 140, and then recombines the TCP packet through the packet forwarding unit 150. Transfer to intrusion detection unit 101.

The intrusion detection unit 101 performs an intrusion detection function based on the information received from the state information generation unit 140 and the packet forwarding unit 150.

The state manager 130 tracks state information of the session during TCP handshaking to generate an alert for a packet that is transitioned to an abnormal state, and the intrusion counterpart 102 responds to the attack.

2 shows a session state management apparatus.

The session state management apparatus 200 includes a session index unit 210, a detailed information manager 220, a summary information manager 230, a searcher 240, and an updater 250.

Attacks on TCP occur within seconds after TCP 3-way handshaking is performed. Accordingly, in the session state management apparatus of the present invention, a session in which TCP 3-way handshaking is still performed and a session that has not elapsed long time after establishing a session connection manage more detailed and more state information, For sessions that have elapsed since the establishment of time, only state information of brief sessions is managed, so that the state information of many sessions is managed with relatively few resources. Looking at a more detailed configuration as follows.

The session index unit 210 generates or manages an index including 5-tuple information (protocol, source IP address, destination IP address, source port number, and destination port number) of a session corresponding to the input packet.

The index points to an address of an entry in which state information of a session corresponding to an input packet is stored in the detailed information manager 220 and / or the summary information manager 230.

The detailed information management unit 220 generates and manages an entry for a session within a predetermined time before and after establishing a connection, by extracting state information of a session corresponding to intrusion detection from the input packet when generating the index.

The detailed information management unit 220 responds to the TCP attack by managing more detailed and more state information for the session which has not yet elapsed time since the session and the session connection established with the TCP 3-way handshaking are established. One preferred embodiment of the detail information management unit 220 is shown in FIG.

The summary information manager 230 generates and manages an entry including the connection, the termination status information, and the directional information of the packet corresponding to the input packet for the session after a predetermined time elapses after the connection is established.

The summary information manager 230 may provide the state information of a plurality of sessions while significantly reducing memory resources by generating and managing only the state information of a brief session for sessions that have elapsed since the session connection is established. . One preferred embodiment of the summary information manager 230 is illustrated in FIG. 5.

The search unit 240 searches whether the session index corresponding to the input TCP packet exists in the session index unit 210. If the index does not exist, the search unit 240 searches the summary information manager 230 after the connection is established. do.

When the search unit 240 cannot search the index of the corresponding session when inputting a SYN packet requesting connection of a session, the session index unit 210 pulls the session index unit 210 when creating a new index. If the session index unit 210 is full, delete the oldest index using the LRU (Least Recently Used) algorithm, and create a new index including 5-tuple information of the session. do. A more detailed description will be described later with reference to FIG. 6.

If the session index corresponding to the input TCP packet does not exist after the connection of the session is established in the searcher 240, the searcher 240 searches the summary information manager 230. At this time, the index points to an entry in the summary information manager 230 corresponding to the input packet by using a hash address generated based on the 5-tuple information of the session. As a result, the entry in the summary information manager 230 may be searched more quickly.

The hash address is generated by a hash key generator (see FIG. 3) using 5 tuple information of a session corresponding to an input packet as a key.

The updater 250 updates the entry of the detailed information manager, which the index points to, when the index of the session corresponding to the search result input TCP packet exists in the session index part.

The update unit 250 searches for the session index unit 210 when a SYN / ACK packet is received in response to a SYN (Synchronize Sequence Number) packet, and when the search result index is searched, the detailed information management unit that the index points to. Update 220. However, when the index is not searched in the session index unit 210 when the SYN / ACK packet is received, an alarm is generated because it is an abnormal packet received even though no SYN packet was transmitted.

3 illustrates a method for managing session state information in two steps in the apparatus and method for managing session state of the present invention.

As a preferred embodiment, a technique for managing session state information in a two-step process in the session management device according to the TCP 3-way handshaking process is as follows. When a SYN packet for requesting a TCP session comes in, the session index unit 310 generates an index including 5-tuple information of the session. The index generated in this way is used by the detailed information manager 320 or the summary information manager 330 to search for a session corresponding to an input packet with respect to a specific packet.

When the index is generated, detailed information of the session state extracted from each field of the input packet is filled in the detailed information manager 320.

Thereafter, when a SYN / ACK packet is received in response to the SYN packet, the search unit (FIG. 2, 240) searches for the session index unit 310, and if there is an index of the session corresponding to the input packet, the update unit ( 2 and 250 update the detailed information management unit 320.

Then, when an acknowledgment (ACK) packet indicating that the packet transmitted in response to the SYN / ACK packet arrives, the search unit 240 searches for the session index unit 310, and the session corresponding to the input packet of the session is received. If there is an index, the updater 250 updates the detailed information manager 320 and generates an entry including brief state information of the session in a hash table in the summary information manager 340.

The hash key generator 330 generates a hash address based on the session 5-tuple information included in the index, and the hash address points to an entry corresponding to an input session in the summary information manager 340.

4 illustrates an embodiment of detailed session state information stored in the detailed information management unit of FIGS. 2 and 3.

Detailed state information of the session stored in the detailed information manager 220 is state information of a session corresponding to intrusion detection, and is information for more accurately determining a connection state of the session. That is, information for inspecting and tracking the field of the packet to determine whether the input packet is normal.

To this end, as the state information of the session corresponding to the intrusion detection stored in the detailed information management unit 220, client state information, server state information, scalable for state tracking at the application protocol level Connection state information, TTL tracking information as shown in one embodiment in FIGS. 7 and 8, information for abnormal packet detection for Seq / Ack Number Tracking, and other necessary information. .

FIG. 5 illustrates one embodiment of brief session state information stored in the summary information management unit of FIGS. 2 and 3.

The simplified state information of the session stored in the summary information management unit 230 is information that minimizes only state information, which is the core of information used in intrusion detection such as a TCP attack.

As an example of the simplified state information of the session, there is a connection of the session indicating whether the input packet is a currently connected session, termination state information, and directional information of the packet.

Another day As an example, unlike the detailed information manager 220, the summary information manager 230 does not store state information of a large amount of detailed sessions. Therefore, since it is difficult to clearly track the end of the session, Half-Close information is included for tracking the end of the process by using the number of input FIN packets.

However, it should be noted that the above-described information is an example, and the information stored in the summary information manager 230 may be expanded.

6 illustrates a memory management scheme of a detail information management unit to provide a defense mechanism against a DoS attack.

Devices that track session state are inherently vulnerable to SYN Flooding attacks. That is, when a session is initiated between a TCP client and a server on a network, there is a very small buffer to expedite the handshaking that establishes the session. The session establishment packet includes a SYN field for recognizing the order of message exchange.

An attacker sends a large number of connection requests very quickly, and after a certain period of time with no response, the remaining packets in the buffer are eventually discarded, but a large number of fake connection requests make it difficult to establish a legitimate connection request session. In order to solve this problem, the length of the elapsed time needs to be adjusted.

To counter this attack, the detailed information management unit manages sessions with four linked lists (IDLE Link 610, SYN Link 620, SYN / ACK Link 630, EST Link 640). do.

In the TCP 3-way handshaking process, the detailed information manager generates a linked list for each SYN packet reception step, SYN / ACK packet transmission step, and ACK packet reception step. Session entries are moved from IDLE Link 610 to EST Link 640 by packets during TCP 3-way handshaking. This link movement not only manages the connection state information of the session, but also enables efficient memory management.

In more detail, IDLE Link 610 is a list of links to which a current session is not assigned, and the present invention assigns a link at the head of IDLE Link 610 when a new session is created, thereby assigning a session to a tail of a newly created linked list. If the session is deleted after timeout, the link is returned to the tail portion of the IDLE Link 610 to perform memory management.

When the SYN packet is inputted to request a new session, the IDLE Link 610 allocates a link and adds the session to the Tail of the SYN Link 620. After the SYN / ACK packet is input, the SYN Link 620 moves from the SYN / ACK Link 630, and when the ACK packet is input, the SYN / ACK Link 630 moves from the SYN / ACK Link 630 to the EST Link 640.

At this time, the network administrator may set a time at which an entry moves from one link to the next link and is added to the tail of the next link. That is, the network administrator sets a predetermined threshold (hereinafter, a time-out value) at the time of movement to actively prevent the entry table of the detailed information management unit from being pulled due to the intentional attack of the network attacker. To prevent.

The network administrator may still use the "Embryonic Connection" (650) from IDLE Link (610) to SYN Link (620) and SYN Link (620) to SYN / ACK Link (630). Is set to a relatively small value (e.g., 3 seconds), and the timeout value is set when the session is established when moving from SYN / ACK Link (630) to EST Link (640) with "Established Connection" (660). Since it is set to a relatively larger value than the "Embryonic Connection" (650) (for example, 3600 seconds).

If a timeout occurs on each link, the session entry is returned to the tail of the previous linked-list. That is, when a timeout occurs in the SYN Link 620, the session entry is inserted into the tail portion of the IDLE Link 610 again.

By using such an Aggressive Aging technique, the entry table of the detailed information management unit is actively prevented from becoming full, thereby responding to DoS attacks such as Syn Flooding. In addition, the session entry information returned on timeout provides useful information for detecting DDoS or Internet Warm.

The link movement is always attached to the tail so that when the entry table of the detailed information management unit is full, the header part where the longest used session is located is deleted so that the least recently used algorithm is applied.

Because the entry table that manages sessions is limited in capacity, there is always a possibility of being full. If the session entry is full, if it is necessary to create a new entry, the LRU algorithm deletes the oldest unused session entry and adds a new entry. This is according to the basic requirements of the session state based intrusion detection system that should be detected when a new attack comes in even if the entry table is full.

7 illustrates a structure of a detailed information management unit according to an exemplary embodiment of the present invention.

The detailed information manager uses 5-tuple information of a session composed of a protocol, a source IP address, a destination IP address, a source port number, and a destination port number included in the index to distinguish each session entry.

In one preferred embodiment of the present invention, the index including the 5-tuple information of the session is stored in the TCAM (Ternary Content Addressable Memory) 710.

In a preferred embodiment of the present invention, the detailed information management unit including the actual state information of the session corresponding to the input packet is stored in the static random access memory (SRAM) 720.

Each index stored in the TCAM 710 points to the memory address of the entry stored in the SRAM 720. This is an embodiment in which the session index unit and the detailed information management unit are implemented in hardware in the present invention, and it should be noted that substitutions, changes, and substitutions can be made without departing from the technical spirit.

FIG. 8 illustrates a process of performing TTL tracking as a part of a self attack detection function in a detailed information management unit according to an embodiment of the present invention.

The details management section includes a TTL tracing alert (not shown), and when the session is established, the packets belonging to the session are not normal because the hop counts between packets belonging to the same session are not significantly different. An alarm is generated when a difference between a time to live (TTL) value of a current packet and a TTL value of a previous packet exceeds a preset threshold in order to determine whether the recognition is performed (810, 820).

FIG. 9 illustrates a process of Sequence / Acknowledge Number Tracking as a part of a self attack detection function in a detailed information management unit according to an embodiment of the present invention.

Assuming that hosts A and B are communicating with each other, the Acknowledge Number and Window Size information (window size on the sending side) of the packet transmitted from A to SEQ / ACK number tracking alerting unit (FIGS. Save it. Then, if a packet is transmitted from A to B, the sequence number of this packet is smaller than the last Ack transmitted from B to A (910), or the payload size is subtracted from the last number from the sequence number plus Window Size. If greater than 920, an alarm is reported as an abnormal packet.

10 to 15 illustrate a technique of processing a packet according to a TCP flag value.

10 is a flowchart illustrating the processing of a SYN packet according to a preferred embodiment of the present invention. The Synchronize Sequence Number (SYN) Flag is used only when a session is connected and synchronizes the sequence number of both the client and server prior to sending data.

Referring to FIG. 6, when a SYN packet is received (S1010), the detailed information management unit searches for the SYN Link 620, and if a session entry corresponding to the packet exists (S1020, S1030), the SYN packet is retransmitted. The entry containing the session state information is updated and adjusted to move from the SYN Link 620 of the linked list shown in FIG. 6 to the tail portion (S1031, S1032).

If the session entry corresponding to the packet does not exist by searching the SYN Link 620, and if the session index portion is not full, a new index is generated (S1040, S1050), and the session index portion is full. In this case, after deleting the oldest index using the LRU algorithm, new indexes are generated (S1040 and S1041).

11 shows a flowchart of processing of a SYN / ACK packet according to a preferred embodiment of the present invention.

Referring to FIG. 6, when a SYN / ACK packet is received (S1110), the detailed information manager searches for SYN Link 620 and SYN / ACK Link 630 (S1120). The session entry is moved to the ACK Link 630, and the session state information of the entry is updated (S1130, S1131, and S1132).

When the SYN / ACK Link 630 is found, the SYN / ACK packet is retransmitted, so that the corresponding session state information is updated, and the link is adjusted to move to the tail portion in the same SYN / ACK Link 630.

12 is a flowchart illustrating processing of an ACK packet according to a preferred embodiment of the present invention.

The ACK (Acknowledgement) Flag is used to inform that the transmitted packet has arrived well. When an ACK packet is received (S1210), the SYN / ACK Link 630 and the EST Link 640 are searched (S1220).

If the session entry is found in the SYN / ACK Link 630, the entry is moved to the EST Link 640, and the simplified state management unit stores the simplified state information of the session (S1230-S1234).

If the session information is not retrieved from the detailed information management unit, the summary information management unit is searched, an entry having the simplified state information of the session is generated and stored, and the packet is forwarded (S1240-S1242).

13 is a flowchart showing the processing of an RST packet as one preferred embodiment of the present invention.

The RST (Reset) Flag is to unconditionally reset the connection state of a related session. When an RST packet is input (S1310), both the detailed information management unit and the summary information management unit are searched (S1320, S1340) so that an entry of the session corresponding to the input packet is entered. If present (S1330, S1350) deletes the entries in the entry table of the detailed information management unit and the entry table of the summary information management unit, respectively, and generates the state information of the session (S1360) to forward the packet.

14 is a flowchart illustrating the processing of an FIN packet according to a preferred embodiment of the present invention.

FIN (Finish) Flag indicates that the sending TCP has no data to send anymore, and the session is disconnected. When the FIN packet is input (S1410), the detailed information management unit is searched and an entry of the session corresponding to the Fin packet exists. In step S1430, if there is a session entry, the summary information manager is searched, and if the session entry does not exist, the session information is generated and the packet is forwarded.

FIG. 15 shows a flowchart of processing of another packet not shown in FIG. 10 in FIG. 10 as a preferred embodiment of the present invention.

When packets other than SYN, SYN / ACK, ACK, RST, and FIN packets are received, the detailed information manager and the summary information manager are sequentially searched, and then detailed information is generated to forward the packet.

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system.

Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

The best embodiments have been disclosed in the drawings and specification above. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims.

Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

The present invention achieves more efficient performance in hundreds of thousands to millions of sessions on fewer resources in a giga-class Internet environment.

By tracking the session state information and generating useful state information, it can be delivered to the intrusion detection engine to reduce false positive alerts, and the session state management device uses the packet information and the session state information itself. Attack detection and Abnormal Packets can be detected.

In addition, the present invention enables active response to Denial of Service (DoS) attacks such as SYN flooding through memory management techniques.

In addition, the present invention can detect the attack more accurately by adding state information to the conventional hardware-based simple pattern matching intrusion detection function.

In addition, the present invention, the existing firewall (Firewall), virtual private network (VPN), traffic monitoring (Traffic Monotoring), traffic load balancing (Traffic Load Balancing), accounting and charging (Accounting and Charging), network intrusion detection system ( It can be applied in various ways to NIDS (Network Intrusion Detection System).

Especially when applied to session state-based network intrusion detection system (Session State-based NIDS), the result is excellent in function and performance.

Claims (23)

In the TCP handshaking process, apparatus for managing session state, A session index unit for generating or managing an index including 5-tuple information of a session corresponding to an input packet; A detailed information manager configured to generate and manage an entry by extracting state information of a session corresponding to intrusion detection from the input packet when generating the index, for a session within a predetermined time before and after establishing a connection of the session; A summary information management unit for generating and managing an entry having session state information including connection, termination state information, and directional information of the input packet of the corresponding session, for a session after a predetermined time elapses after the session is established. ; And And a search unit for searching whether the index of the session corresponding to the input TCP packet exists in the session index unit and searching for the summary information manager after connection establishment of the session if the index does not exist. State management device. The method of claim 1, wherein the session index unit And storing the index sequentially and applying the LRU algorithm to delete the longest used index when the session index unit is FULL. The method of claim 1, wherein the detailed information management unit And storing the entries sequentially and if the detailed information management unit is full, an LRU algorithm for deleting the oldest entry first is applied. The method of claim 1, wherein the detailed information management unit In addition to the initial linked list, in addition to the initial linked list, in the TCP 3-way handshaking process, each linked list is further generated by receiving a SYN packet, transmitting a SYN / ACK packet, and receiving an ACK packet. Add the entry to the tail of the linked list in the step corresponding to the packet upon receipt If the time the entry is added to the linked list exceeds a predetermined threshold, the entry is added to the tail portion of the initial linked list. Session state management apparatus, characterized in that the insertion. The method of claim 1, wherein the session index unit And a session index corresponding to the SYN packet does not exist in the search unit, when the SYN packet is input, generating an index including 5-tuple information of the corresponding session. The method of claim 1, wherein the search unit And an updating unit for updating an entry of the detailed information management unit when an index of a session corresponding to an input TCP packet exists in the session index unit. The method of claim 1, wherein Index is And a memory address of the entry corresponding to the input packet. The method of claim 1, wherein the index is And the entry in the summary information manager corresponding to the input packet using a hash address generated based on the 5-tuple information of the session. The method of claim 1, wherein the detailed information management unit If the session is established, the TTL tracking alarm unit for generating an alarm when the difference between the TTL value of the current packet and the TTL value of the previous packet exceeds a predetermined threshold to determine whether the packet belonging to the session is normal; Session state management apparatus, characterized in that. The method of claim 1, wherein the detailed information management unit An alarm is generated when the sequence number of the packet transmitted after receiving the input packet is smaller than the last ACK number of the input packet or when the value obtained by subtracting the last ACK number from the sum of the sequence number and the payload size is larger than the window size. Session state management apparatus further comprises; SEQ / ACK number tracking alerting unit. The method of claim 1, wherein the session index unit Session state management apparatus, characterized in that implemented in TCAM (Ternary Content Addressable Memory). The method of claim 1, wherein the detailed information management unit Session state management apparatus, characterized in that implemented in static random access memory (SRAM). The method of claim 1, wherein the TCP flag value of the input packet is RST. And when the entry including the status information exists in the detailed information manager or the summary information manager, delete the entry from the detailed information manager or the summary information manager, respectively. In the TCP handshaking process, a method for managing session state, (a) creating an index table by generating or managing an index including 5-tuple information of a session corresponding to an input packet; (b) generating a first entry table by extracting state information of a session for responding to intrusion detection from the input packet when generating the index, for a session within a predetermined time before and after establishing a connection of the session; step; (c) For a session after a predetermined time has elapsed since the connection was established, an entry having the state information of the session including the connection, termination state information of the corresponding session, and directional information of the input packet is generated and managed. Generating a second entry table; And (d) searching whether an index of the session corresponding to an input TCP packet exists in the index table, and if the index does not exist, searching the second entry table after connection establishment of the session; To manage session state. 15. The system of claim 14, wherein the index table is And storing the index sequentially, and when the session index unit is full, an LRU algorithm for deleting from the longest used index is applied. 15. The system of claim 14, wherein the first entry table is And storing the entries sequentially and if the detailed information management unit is full, an LRU algorithm for deleting the oldest entry first is applied. 15. The system of claim 14, wherein the first entry table is Generating an initial linked list; Generating a linked list for each step of receiving a SYN packet, transmitting a SYN / ACK packet, and receiving an ACK packet in a TCP 3-way handshaking process; Adding the entry to the tail of the linked list of steps corresponding to the packet upon receipt of each packet; Determining whether a time at which the entry is added to the linked list exceeds a predetermined threshold; And The entry to the tail portion of the initial linked list if the additional time exceeds the preset threshold. Session state management method comprising the ;. The method of claim 14, wherein step (a) And when the index of the corresponding session is not found when the SYN packet is input in step (d), generating an index including the 5-tuple information of the corresponding session of the SYN packet. The method of claim 14, (e) updating the entry of the first entry table when the index of the session corresponding to the input TCP packet in step (d) exists as a search result. 15. The system of claim 14, wherein the first entry table is When the connection of the session is established, if the difference between the TTL value of the current packet and the TTL value of the previous packet exceeds the predetermined threshold to determine whether the packet belonging to the session; further comprising a; Characterized by session state management methods. 15. The system of claim 14, wherein the first entry table is An alarm is generated when the sequence number of the packet transmitted after receiving the input packet is smaller than the last ACK number of the input packet or when the value obtained by subtracting the last ACK number from the sum of the sequence number and the payload size is larger than the window size. And session state management method further comprising. The method of claim 14, wherein Index is And a memory address of the entry corresponding to the input packet. 15. The method of claim 14, wherein the index is And session the entry in the summary information manager corresponding to the input packet using a hash address generated based on the 5-tuple information of the session.

Images