KR101553264B1 - System and method for preventing network intrusion - Google Patents

Abstract

The present invention relates to an intrusion detection system, which operates in conjunction with an intrusion detection program, analyzes a security threat, determines an intrusion detection module for delivering threat information to an intrusion prevention determination module when an intrusion is detected, An intrusion prevention determination module having an access control function for an intrusion prevention execution module, a network intrusion prevention system including an intrusion prevention execution module that performs an intrusion prevention function for an internal network and is controlled by the intrusion prevention determination module by SDN technology And methods.

Description

[0001] System and method for preventing network intrusion [

The present invention relates to an intrusion detection system, which operates in conjunction with an intrusion detection program, analyzes a security threat, determines an intrusion detection module for delivering threat information to an intrusion prevention determination module when an intrusion is detected, An intrusion prevention determination module having an access control function for an intrusion prevention execution module, a network intrusion prevention system including an intrusion prevention execution module that performs an intrusion prevention function for an internal network and is controlled by the intrusion prevention determination module by SDN technology And methods.

Despite the explosive growth of Internet backbone bandwidth, increased complexity of the general-purpose network is a bottleneck in data transmission performance. In particular, bottlenecks in the last-mile network due to stateful firewalls cause packet loss and greatly degrade the transmission performance of large-capacity scientific data.

Research has been conducted on network buffer areas such as Science DMZ to mitigate performance bottlenecks of users' networks due to firewalls and to ensure high-speed transmission of high-capacity scientific data. In recent years, in order to flexibly interlock DMZ internal and external networking resources, SDN (Software Defined Networking) technology is being applied to the DMZ environment. However, the coverage of SDN is focused on securing networking flexibility, such as setting up a virtual circuit, and thus there is no consideration for enhancing the security of the DMZ environment.

Therefore, the intrusion prevention system for the internal network should have data processing performance and low cost structure and flexibility of policy rule setting and ease of management. There is a trade-off relationship between the speed of data transmission between the inside and the outside of the network and the application of the intrusion prevention system. There is a disadvantage that the related equipment is expensive because some problems related to the transmission rate decrease can be solved through the application of the high performance intrusion prevention system , The applied intrusion prevention system should not cause a decrease in data transmission speed and should be able to reduce the initial construction cost by securing system extensibility.

In addition, access control of network resources due to the use of a firewall can cause data communication to be disconnected. Static application of access control rules in firewalls causes communication disconnection of UDP applications using arbitrary port numbers. In order to solve communication disconnection problem of many applications, frequent change of firewall setting is required. However, , The intrusion detection system should be able to reduce the operating cost by securing flexibility in management and operation aspects.

The present invention proposes a network intrusion prevention system using an SDN-Assisted Firewall Environment (SAFE), an SDN-based intrusion prevention framework that enables flexible security application in a DMZ environment. The network intrusion prevention system aims to physically disperse the intrusion detection, prevention decision, and intrusion prevention functions of Intrusion Prevention System (IPS) and interworking with SDN.

By physically separating the existing firewall functions such as intrusion detection, intrusion prevention decision and intrusion prevention execution and interworking with SDN technology, flexible application of security policy and automation of security system management operation become possible.

The technical problem to be solved by the present invention is not limited to the technical problems mentioned above, and various technical problems can be included within the scope of what is obvious to the ordinary skilled in the art from the following description.

According to an aspect of the present invention, there is provided a network intrusion prevention system, which operates in conjunction with an intrusion detection program, analyzes security threats and transmits threat information to an intrusion prevention determination module when an intrusion is detected Intrusion detection module; An intrusion prevention determination module that performs access control to the intrusion detection module and the intrusion prevention execution module and determines intrusion prevention for the packet flow; An intrusion prevention execution module interworking with the intrusion prevention determination module through software defined networking (SDN), and performing an intrusion prevention operation on the internal network according to the access permission determined by the intrusion prevention determination module; .

In the network intrusion prevention system according to an embodiment of the present invention, the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated and are interlocked by the SDN .

Also, the intrusion detection module of the network intrusion prevention system according to an embodiment of the present invention may include a threat analysis unit, which analyzes security threats of an internal network in real time in connection with an intrusion detection program; A threat reporting unit reporting the analysis result to the intrusion prevention determination module; And further comprising:

At this time, the threat analysis unit collects security threats of the internal network and the system, classifies security threats according to a security policy of the intrusion prevention system, recategorizes security threats in stages, and the threat reporting unit reports E2N (End to Network message and then reports the message to the intrusion prevention determination module.

In addition, the intrusion prevention determination module of the network intrusion prevention system according to an embodiment of the present invention may be configured such that when the intrusion detection module provides threat information and the intrusion prevention execution module requests packet flow table inquiry, Determines whether the access permission or denial is permitted, reflects the result in the flow entry, installs the result in the intrusion prevention execution module, and processes the flow according to the operation instructions.

In this case, the intrusion prevention determining module may include an intrusion prevention determining unit determining access permission or denial of access to the internal network according to a security rule; A system interworking part for setting an inter-network environment when an intrusion detection module and an intrusion prevention execution module are directly connected; An access control unit for performing access control based on an IP address to block an unauthorized intrusion prevention execution module and an unauthorized intrusion detection module from accessing the intrusion prevention determination module; A security threat database storing threat information confirmed by the intrusion detection module; And further comprising:

In addition, the system interworking unit may perform packet filtering, change a network address and a port address of an IP packet, encapsulate and encapsulate an IP packet using a system command, and the system command may include FORWARD, DROP, A SET_FIELD, and a SET_TUNNEL command. The system interfacing unit simulates an operating environment of an intrusion detection program or a firewall, and automatically sets an inter-network environment through a network address changing method.

In addition, the system interworking unit collects, opens or shares security threat information including an IP address of an attacker to cooperatively prevent an attack on a plurality of servers.

Then, the intrusion prevention execution module of the network intrusion prevention system according to an embodiment of the present invention searches for a flow entry according to the priority of the matching table when a packet is received, and processes the packet according to the assigned operation instruction . In this case, the matching table is characterized by being a priority in the order of an exact match, a signature match, and a wildcard match.

In addition, the intrusion prevention enforcement module of the network intrusion prevention system according to an embodiment of the present invention may be configured to store a signature of a packet in advance and use a Bloom filter for localizing a signature-based packet processing .

In this case, the intrusion prevention execution module configures a flow entry including an active bloom filter and an atmospheric bloom filter, and if t or more flows are recorded in the active bloom filter according to Equation (1), the corresponding filter is initialized The standby bloom filter is switched to the standby state, and the standby bloom filter is switched to the active state.

(1)

(m: number of bits of Bloom filter, n: number of flow signatures, and?: expected false positive probability)

In addition, the intrusion prevention execution module is characterized in that a signature is left in both the active bloom filter and the atmospheric bloom filter when n satisfies the condition of (Equation (2)).

(2)

(β: expected false positive coefficient)

In addition, the intrusion prevention execution module requests the intrusion prevention determination module to inquire the table when the flow (f) is input, transmits a complete matching entry for the flow through the SDN message, and transmits the feedback flow (f ' (F ') is input and a rule clone is performed from a signature match entry to a perfectly match match entry by determining whether to register in the match table.

In addition, the intrusion prevention execution module may delete the signature of the Bloom filter and change the processing rule of the reverse flow (f ^-1 ) recorded in another matching table.

According to another aspect of the present invention, there is provided a network intrusion prevention method comprising the steps of: (a) detecting an intrusion by an intrusion detection module and transmitting threat information to an intrusion prevention determination module; (b) requesting the intrusion prevention execution module to inquire a flow table for the inputted packet; (c) determining whether to allow or deny access according to a security policy set by the intrusion prevention determining module; (d) installing operation instructions in the intrusion prevention execution module by reflecting the determined result in the flow entry; (e) the intrusion prevention execution module processes the flow according to the operation instructions; .

In this case, the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated and interoperate by SDN (Software Defined Networking).

Conventional intrusion prevention systems have been developed for the purpose of enhancing security in general-purpose networks that have e-mail, groupware, and web applications as main applications. Therefore, they deteriorate performance when transmitting large amounts of data. The present invention alleviates the problem of performance degradation by separating the monitoring channel and the data channel and enables information sharing with existing security systems by interworking with the SDN so that various security threat information is centrally maintained It is possible to effectively deal with security threats, thereby eliminating performance bottlenecks due to the use of state-based firewalls.

In addition, the conventional intrusion prevention systems have a disadvantage in that the functions of intrusion detection, prevention determination, and intrusion prevention are integrated into one security device, which leads to high development and purchase cost of the device. However, It is easy to apply various firewall functions and can easily and flexibly interoperate with open source intrusion detection programs. Therefore, it is expected to reduce the construction cost and improve the extensibility of the intrusion prevention system.

In addition, since a large number of intrusion prevention systems can be centrally controlled, there is an effect of reducing operational cost caused by frequent setting change of a security system.

1 and 2 are block diagrams illustrating a network intrusion prevention system according to an embodiment of the present invention.
3 and 4 are flowcharts illustrating a method of operating a network intrusion prevention system according to an embodiment of the present invention.
5 is an exemplary diagram illustrating a process of using a bloom filter and rule copy for local processing of a packet flow according to an exemplary embodiment of the present invention.
FIG. 6 is a diagram illustrating attack crossing rates according to the number of victim servers in a network intrusion prevention system according to an exemplary embodiment of the present invention.
FIG. 7 is a chart showing a Bloom filter hit ratio of a network intrusion prevention system according to an embodiment of the present invention.
8 is a flowchart illustrating a network intrusion prevention method according to an embodiment of the present invention.

Hereinafter, a 'network intrusion prevention system' according to the present invention will be described in detail with reference to the accompanying drawings. The present invention is not limited to the above-described embodiments, and various changes and modifications may be made without departing from the scope of the present invention. In addition, the matters described in the attached drawings may be different from those actually implemented by the schematic drawings to easily describe the embodiments of the present invention.

In the meantime, each constituent unit described below is only an example for implementing the present invention. Thus, in other implementations of the present invention, other components may be used without departing from the spirit and scope of the present invention. In addition, each component may be implemented solely by hardware or software configuration, but may be implemented by a combination of various hardware and software configurations performing the same function. Also, two or more components may be implemented together by one hardware or software.

Also, the expression " comprising " is intended to merely denote that such elements are present as an expression of " open ", and should not be understood to exclude additional elements.

Also, the expressions such as 'first, second', etc. are used only to distinguish between plural configurations, and do not limit the order or other features among the configurations.

Meanwhile, the 'network intrusion prevention system' according to an embodiment of the present invention described above may include substantially the same technical features as the 'network intrusion prevention method' according to an embodiment of the present invention, although the categories are different .

Accordingly, although not described in detail in order to prevent redundant description, the above-described features related to the 'network intrusion prevention system' can be analogously applied to the 'network intrusion prevention method' according to an embodiment. Conversely, the above-described features related to the 'network intrusion prevention method' can be analogously applied to the 'network intrusion prevention system' as well.

1 and 2 are block diagrams illustrating a network intrusion prevention system according to an embodiment of the present invention.

1, the network intrusion prevention system 110 includes an intrusion detection module 110, an intrusion prevention determination module 120, and an intrusion prevention execution module 130. The intrusion detection module includes a threat analysis unit 111, The threat reporting unit 112 and the intrusion prevention determining module may include an intrusion prevention determining unit 121, a system interlocking unit 122, an access control unit 123, and a database 124.

The intrusion detection module 110 is a software agent. The intrusion detection module 110 includes a threat analysis unit 111 for analyzing security threats of the internal network in real time in cooperation with an intrusion detection program such as logwatch and OSSEC (Open Source Security) And a threat reporting unit 112 for reporting to the module. In this case, the threat analysis unit collects security threats of the internal network and system using rsyslog, classifies security threats according to the security policy of the intrusion prevention system, recategorizes security threats in stages, to Network message and then reports to the intrusion prevention determination module.

When the intrusion prevention module provides the threat information and the intrusion prevention execution module requests the packet flow table inquiry, the intrusion prevention determination module 120 determines access permission or denial according to the set security policy, and reflects the result in the flow entry It is installed in the Intrusion Prevention Execution Module and the packet flow is processed according to the operation instructions.

In this case, the intrusion prevention determining module 121 includes an intrusion prevention determining unit 121 for determining access permission or denial of access to the internal network in accordance with security rules, and an intrusion prevention determining module 121 for setting an inter- An access control unit 123 for performing access control based on an IP address to block access to the intrusion prevention determination module by the unauthorized intrusion prevention execution module and the unauthorized intrusion detection module, And a security threat database 124 in which threat information confirmed by the security threat database is stored.

The system interworking unit may automatically set an inter-network environment through a network address changing method by simulating an operating environment of an intrusion detection program or a firewall. The system interworking unit collects and analyzes security threat information including an attacker's IP address, Open or shared to cooperatively prevent attacks against multiple servers.

The intrusion prevention execution module 130 executes the intrusion prevention according to the operation instructions of the installed flow entry. The system software of the intrusion prevention execution module allocates a temporary flow entry to the FORWARD packet to the CPU port, installs the temporary flow entry on the data plane, and requests the intrusion prevention determination module to inquire the table. That is, the Intrusion Prevention Execution Module performs a 'forward lookup' after a packet to solve a problem. Then, the intrusion prevention determination module sets the flow processing procedure to the intrusion prevention execution module at initial connection establishment.

Meanwhile, the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated and interoperate by SDN (Software Defined Networking).

SDN is a networking approach that separates network control and forwarding functions and interworks with control and forwarding functions through an open API (Application Programming Interface) such as open flow. The centralized controller allows control of packet flows and configuration of the network infrastructure, so it can respond to changes in the network situation in a nimble manner. In addition, network operation can be automated by SDN programming of processes such as setting, managing, protecting, and optimizing network resources.

The output port search procedure for packet flow in SDN is as follows. When a packet arrives, the network switch queries the flow entry in the local flow table and processes the packet according to the specified action. If the flow entry does not exist, the received packet is encapsulated and transmitted to the controller to perform a kind of flow table lookup process. The SDN program of the controller decides the operation instructions of the received packet and installs the flow entry to the network switch through the open API.

The intrusion detection module 110 operates in conjunction with the intrusion detection program, analyzes the security threat, and transmits the threat information to the intrusion prevention determination module when the intrusion is detected. The intrusion prevention determination module 120 determines an intrusion prevention for a packet flow and has an access control function for the intrusion detection module and the intrusion prevention execution module. The intrusion prevention execution module 130 performs an intrusion prevention function for the internal network and is controlled by the intrusion prevention determination module by SDN technology. The above-mentioned network intrusion prevention system determines whether or not access is permitted when an intrusion is attempted from an external network to an internal network.

In this case, the internal network may be characterized by using Science DMZ in particular. Science DMZ is a kind of subnetwork with proprietary transmission equipment, network configuration and security policy, and is installed in the middle of the network such as the intranet of enterprise and accelerates the data transmission performance. In order to improve the transmission rate of large-capacity scientific data, the state-based firewall is not used and a dedicated data transmission node (DTN) is used to accelerate the transmission performance in the wide area data transmission. If the DTN is installed at the WAN and LAN interfaces and the data is received by separating the transmission interval, the packet loss occurring in the LAN interval does not affect the WAN interval, so that indirect improvement of the TCP performance can be expected.

On the other hand, by physically separating each module from the SDN, a head-of-flow delay (HOF) problem and a lookup bottleneck in a flow table occur. The HOF problem is caused by the round-trip time and the processing time of the SDN message, which is performed while the SDN switch performs the flow table inquiry for the first packet belonging to the flow. The flow table inquiry bottleneck is caused by the request bottleneck occurring in the network switch, SDN message processing bottleneck. The above HOF and lookup bottleneck problems negatively affect TCP's RTO (retransmission timeout), which may lead to TCP performance degradation.

Accordingly, the network intrusion prevention system of the present invention alleviates the HOF problem and the inquiry bottleneck by dynamically storing the signature of the authorized packet in the intrusion prevention execution module and then delegating the processing of the packet to the intrusion prevention execution module. In addition, a Bloom filter is applied to localize the signature-based packet processing, and a detailed description of the Bloom filter will be given with reference to FIG.

3 and 4 are flowcharts illustrating a method of operating a network intrusion prevention system according to an embodiment of the present invention.

Referring to FIG. 3, the network intrusion prevention system includes an intrusion detection module, an intrusion prevention determination module, and an intrusion prevention execution module. First, the intrusion detection module detects the intrusion and transmits the threat information to the intrusion prevention determination module. Then, the intrusion prevention execution module requests a flow table inquiry for the inputted packet, and the intrusion prevention determination module determines access permission or denial according to the security policy set. The intrusion prevention determination module reflects the determined result in the flow entry, installs the operation instructions in the intrusion prevention execution module, and processes the flow according to the operation instructions.

In this case, each module constituting the network intrusion prevention system is a cost-effective intrusion prevention framework that interoperates with SDN technology in a physically separated state. The intrusion prevention execution module can simplify the function by transferring the prevention decision function to the intrusion prevention decision module. Simplification of function is effective in lowering the equipment cost and solving the performance bottleneck problem, To quickly and dynamically respond to detected security threats. In addition, it can effectively respond to distributed service attacks such as DDoS by concentrating the detected attacker information and sharing it with related controllers, IPS, and firewalls.

On the other hand, the network intrusion prevention system solves the degradation of module performance caused by performing complex functions such as DPI (Deep Packet Inspection) by separating the detection function. In addition, Snort, OSSEC, Modsecurity, and other intrusion detection programs and firewalls can be easily connected to reduce initial deployment costs, improve system scalability, and can be used for host IDS (HIDS), network IDS (NIDS) IDS (Hybrid IDS) and various types of IDS (Intrusion Detection System) can be combined and used for intrusion detection, so that the weak points of each IDS can be offset.

5 is an exemplary diagram illustrating a process of using a bloom filter and rule copy for local processing of a packet flow according to an exemplary embodiment of the present invention.

Referring to FIG. 5, when a packet is received, the intrusion prevention execution module searches the flow entry according to the priority of the matching table and processes the packet according to the assigned operation instructions. In this case, the priorities of the matching are, in the order of exact match, signiture match, and wildcard match, when the packet is received, the intrusion prevention execution module sets the priority of each match table It searches the flow entry and processes the packet according to the assigned operation instructions.

In addition, the intrusion prevention executable module may store a signature of a packet in advance and use a Bloom filter for localizing the signature-based packet processing.

Bloom filters 133 and 134 are probabilistic data structures that have a conflict between false positives and space-efficiency. At this time, a flow entry for signature matching is constructed by alternately using two bloom filters including an active bloom filter and an atmospheric bloom filter in order to solve the problem of false positives. This is equivalent to leaving n or fewer flow signatures in the Bloom filter to keep the false positive probability below the expected false positive probability.

When more than t flows are recorded in the active bloom filter, the filter is initialized and then the standby filter is activated, and the standby bloom filter is activated.

(수학식 1)

(1)

(m: number of bits of Bloom filter, n: number of flow signatures, and?: expected false positive probability)

In order to solve the problem of deleting the signature information of a flow in which rule copying has not been performed, the intrusion prevention execution module sets an active bloom filter and an atmospheric bloom filter, when n, which is the number of flow signatures, satisfies the condition of (Equation 2) By leaving a signature on all of them, you can solve the problem caused by the filter initialization.

(수학식 2)

(2)

(β: expected false positive coefficient)

At this time, it is preferable that the probability? = 0.001 and the coefficient? = 1.

Then, when the flow f is inputted from the external network, the intrusion prevention execution module requests the intrusion prevention determination module to inquire the table, and transmits the completely matching entry for the flow through the SDN message, and transmits the feedback flow f ' It is determined whether to register in the matching table. At this time, the SDN message is piggybacked and delivered together.

When the feedback flow (f ') is inputted, signature matching is performed. In the signature matching entry, a rule clone is performed from the matching entry to the matching entry. Thus, limited hardware resources can be used cost-effectively through rule copying. For example, assuming a single communication session consists of a data flow and a feedback flow, applying a Bloom filter and rule copy reduces the number of table lookups from N to N by 50% for N communication sessions, Since it decreases from 4N to 2N, it can reduce the bottleneck problem and message load. One table lookup generates an SDN message twice (request and response).

On the other hand, the use of Bloom filters can cause consistency problems with networking conditions.

First, the Bloom filter does not support signature deletion, so when the state of the flow is required to change, there may be a problem that the filter can not delete the signature. This is because if the signature of the Bloom filter is deleted, The processing rule of the reverse flow (f-1) recorded in the matching table is changed and deleted to solve the problem.

Second, the network intrusion prevention system initializes the bloom filter to mitigate the false positives problem, and the bloom filter is locally initialized, so that the consistency problem may occur in the flow table maintained by the intrusion prevention determination module. This is because the flow of signature matching by the Bloom filter is regularly copied and finally stored in the complete match table, and the network intrusion prevention system is consistent with the method of timeout for the flow permitted to access among the flow entries stored in the complete match table I can solve the problem.

FIG. 6 is a diagram illustrating attack crossing rates according to the number of victim servers in a network intrusion prevention system according to an exemplary embodiment of the present invention.

In the performance evaluation of the present invention, when a total of seven victim servers constructed on the same subnet transmit log information to the OSSEC server, the intrusion detection module extracts the attacker IP address that attempted a brute force attack Intrusion Prevention Decision Module. The attacker information in FIG. 6 was collected for about 50 days, and the total number of attackers (IP addresses) per server observed during the collection period was 158 on average. However, the number of attackers does not mean the number of attacks or the number of successful attacks.

The Attack Crossover rate defines the rate at which an attack on any victim server attacks one or more of the other victim servers. In FIG. 6, it can be seen that as the number of victim servers increases, the attack crossing rate also increases. Therefore, it is possible to effectively respond to security threats with a high cross rate by sharing attack information and protecting them at the perimeter. In other words, the network intrusion prevention system can effectively defend the servers included in the internal network from attacks with high cross rates.

FIG. 7 is a chart showing a Bloom filter hit ratio of a network intrusion prevention system according to an embodiment of the present invention.

In the performance evaluation of the present invention, a high hit ratio of the Bloom filter applied to treat packets locally means a relatively low hit bottleneck and network bandwidth consumption. In order to measure the hit ratio, the web flow (HTTP flow) generated in the victim server is analyzed in the intrusion prevention determination module, and the intrusion prevention determination module registers the reverse flow information of the flow permitted to the external access in the bloom filter of the intrusion prevention execution module do. A flow table inquiry is required to obtain the operation instructions of a flow that has not been locally processed by the Bloom filter.

Referring to FIG. 7, a Bloom filter hit ratio of 94% or more was obtained from four measurements. In other words, in an application scenario of a network intrusion prevention system, using a signature match entry reduces the message generation count by at least 46.9% over using a full match entry. In the application scenario of the introduced network intrusion prevention system, the maximum performance gain for the message generation frequency and bandwidth consumption is 50%. Assuming that the sizes of the flow table lookup request message and the response message are the same, the network bandwidth consumption also decreases at the same rate.

The reason for the flow of missed flows in the Bloom filter is that the reverse flow arrives at the intrusion prevention execution module before the reverse flow information is registered in the Bloom filter and the round trip delay of the victim server and the requested web server If the time is shorter than the flow table lookup time, a non-hit pull-down occurs.

8 is a flowchart illustrating a network intrusion prevention method according to an embodiment of the present invention.

Referring to FIG. 8, a network intrusion prevention method according to an embodiment of the present invention includes: (a) detecting an intrusion by an intrusion detection module and transmitting threat information to an intrusion prevention determination module; (b) requesting the intrusion prevention execution module to inquire a flow table for the inputted packet; (c) determining whether to allow or deny access according to a security policy set by the intrusion prevention determining module; (d) installing operation instructions in the intrusion prevention execution module by reflecting the determined result in the flow entry; (e) the intrusion prevention execution module processes the flow according to the operation instructions; .

In this case, the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated and interoperate by SDN (Software Defined Networking).

The embodiments of the present invention described above are disclosed for the purpose of illustration, and the present invention is not limited thereto. It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention.

100: Network intrusion prevention system
110: intrusion detection module
111: Threat Analyzer
112: Threat Report Unit
120: Intrusion prevention determination module
121: Intrusion prevention determination unit
122: system interlocking part
123: Access control unit
124: Database
130: Intrusion Prevention Execution Module
131: Fully matched table
132: signature matching table
133: Active Bloom Filter
134: Atmospheric bloom filter

Claims (19)

An intrusion detection module that operates in conjunction with an intrusion detection program and analyzes security threats and delivers threat information to an intrusion prevention determination module when an intrusion is detected;
An intrusion prevention determination module that performs access control to the intrusion detection module and the intrusion prevention execution module and determines intrusion prevention for the packet flow;
An intrusion prevention execution module interworking with the intrusion prevention determination module through software defined networking (SDN), and performing an intrusion prevention operation on the internal network according to the access permission determined by the intrusion prevention determination module;
/ RTI >
The intrusion prevention execution module includes:
A signature of a packet is stored in advance, a Bloom filter for localizing a signature-based packet processing is used,
When the flow (f) is inputted, the table inquiry is requested to the intrusion prevention determination module, and a complete match entry for the flow is transmitted through the SDN message, and it is determined whether to register the feedback flow (f ') in the signature matching table, And a rule clone is performed from the signature match entry to the perfectly matched match entry when the flow f 'is input.
The method according to claim 1,
Wherein the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated from each other and are interlocked by SDN.
The method according to claim 1,
The intrusion detection module includes:
A threat analysis unit for analyzing security threats of the internal network in real time in connection with an intrusion detection program;
A threat reporting unit reporting the analysis result to the intrusion prevention determination module;
The network intrusion prevention system comprising:
The method of claim 3,
The threat analysis unit,
Collects security threats of the internal network and system, classifies security threats according to the security policy of the intrusion prevention system, recategorizes security threats in stages,
The threat reporting unit,
And configures an E2N (End to Network) message and reports the result to the intrusion prevention determination module.
The method according to claim 1,
The intrusion prevention determination module includes:
When the intrusion prevention module provides the threat information and the intrusion prevention execution module requests the packet flow table inquiry, it determines access permission or denial according to the set security policy, reflects the result in the flow entry, Wherein the network intrusion prevention system is configured to process the flow according to operation instructions.
The method according to claim 1,
The intrusion prevention determination module includes:
An intrusion prevention determination unit for determining access permission or denial of access to the internal network in accordance with security rules;
A system interworking part for setting an inter-network environment when an intrusion detection module and an intrusion prevention execution module are directly connected;
An access control unit for performing access control based on an IP address to block an unauthorized intrusion prevention execution module and an unauthorized intrusion detection module from accessing the intrusion prevention determination module;
A security threat database storing threat information confirmed by the intrusion detection module;
The network intrusion prevention system comprising:
The method according to claim 6,
Wherein the system interlocking unit comprises:
Wherein the network intrusion prevention system changes the network address and the port address of the IP packet and encapsulates and encapsulates the IP packet using the system command.
8. The method of claim 7,
The system command includes:
FORWARD, DROP, SET_FIELD, and SET_TUNNEL commands.
The method according to claim 6,
Wherein the system interlocking unit comprises:
The network intrusion prevention system automatically sets an inter-network environment through a network address change method by simulating an operation environment of an intrusion detection program or a firewall.
The method according to claim 6,
Wherein the system interlocking unit comprises:
And collectively opening or sharing security threat information including an IP address of an attacker to cooperatively prevent an attack on a plurality of servers.
The method according to claim 1,
The intrusion prevention execution module includes:
And when the packet is received, searches the flow entry according to the priority of the matching table, and processes the packet according to the assigned operation instruction.
12. The method of claim 11,
The matching table includes:
Wherein the network intrusion prevention system is a priority order of an exact match, a signature match, and a wildcard match.
delete The method according to claim 1,
The intrusion prevention execution module includes:
The flow entry includes an active bloom filter and an atmospheric bloom filter. If at least t flows are recorded in the active bloom filter according to Equation (1), the filter is initialized and then switched to a standby state. Is switched to an active state.
(1)

(m: number of bits of Bloom filter, n: number of flow signatures, and?: expected false positive probability)
The method according to claim 1,
The intrusion prevention execution module includes:
n leaves the signature in both the active bloom filter and the atmospheric bloom filter when the condition of (Equation (2)) is met.
(2)

(β: expected false positive coefficient)
delete The method according to claim 1,
The intrusion prevention execution module includes:
And deletes the signature of the Bloom filter by changing the processing rule of the reverse flow (f- ¹ ) recorded in another matching table.
(a) detecting an intrusion by an intrusion detection module and transmitting threat information to an intrusion prevention determination module;
(b) requesting the intrusion prevention execution module to inquire a flow table for the inputted packet;
(c) determining whether to allow or deny access according to a security policy set by the intrusion prevention determining module;
(d) installing operation instructions in the intrusion prevention execution module by reflecting the determined result in the flow entry;
(e) the intrusion prevention execution module processes the flow according to the operation instructions;
Lt; / RTI >
The intrusion prevention execution module includes:
A signature of a packet is stored in advance, a Bloom filter for localizing a signature-based packet processing is used,
When the flow (f) is inputted, the table inquiry is requested to the intrusion prevention determination module, and a complete match entry for the flow is transmitted through the SDN message, and it is determined whether to register the feedback flow (f ') in the signature matching table, Wherein a signature is matched when a flow f 'is input, and a rule clone is performed from a signature match entry to a perfectly matched match entry.
19. The method of claim 18,
Wherein the intrusion detection module, the intrusion prevention determination module, and the intrusion prevention execution module are physically separated and interworked by SDN (Software Defined Networking).

Images