다크넷 트래픽의 목적지 포트를 활용한 블랙 IP 탐지에 관한 연구
A Study on Detecting Black IPs for Using Destination Ports of Darknet Traffic
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
인터넷은 우리나라의 경제·사회를 움직이는 중요한 인프라 자원이며 일상생활의 편리성·효율성을 제공하고 있다. 하지만, 인터넷 인프라 자원의 취약점을 이용하여 사용자를 위협하는 경우가 발생한다. 최근에 지속적으로 지능적이고 고도화된 새로운 공격 패턴이나 악성 코드들이 늘어나고 있는 추세이다. 현재 신·변종 공격을 막기 위한 연구로 다크넷이라는 기술이 주목받고 있다. 다크넷은 미사용 중인 IP 주소들의 집합을 의미하며, 실제 시스템이 존재하지 않는 다크넷으로 유입된 패킷들은 신규 악성코드에 감염된 시스템이나 해커에 의한 공격행위로 간주 될 수 있다. 따라서 본 연구는다크넷에 수집된 트래픽의 포트 정보를 기반한 통계 데이터를 추출하고 알려지거나 알려지지 않은 블랙 IP를 찾기 위한알고리즘을 제시하였다. 국내 미사용 중인 IP 주소 8,192개(C클래스 32개) 다크넷 IP에서 3개월간(2016. 6 ~ 2016. 8) 총 827,254,121건의 패킷을 수집하였다. 수집된 데이터를 제시한 알고리즘 적용 결과, 블랙 IP는 6월 19 건, 7월 21건, 8월 17건이 탐지되었다. 본 연구의 분석을 통해 얻어진 결과는 기존 알려진 공격들의 블랙 IP 탐지 빈도를 알 수 있고 잠재적인 위협을 유발할 수 있는 새로운 블랙 IP를 찾아낼 수 있다.
Abstract
The internet is an important infra resource that it controls the economy and society of our country. Also, it is providing convenience and efficiency of the everyday life. But, a case of various are occurred through an using vulnerability of an internet infra resource. Recently various attacks of unknown to the user are an increasing trend. Also, currently system of security control is focussing on patterns for detecting attacks. However, internet threats are consistently increasing by intelligent and advanced various attacks. In recent, the darknet is received attention to research for detecting unknown attacks. Since the darknet means a set of unused IP addresses, no real systems connected to the darknet. In this paper, we proposed an algorithm for finding black IPs through collected the darknet traffic based on a statistics data of port information. The proposed method prepared 8,192 darknet space and collected the darknet traffic during 3 months. It collected total 827,254,121 during 3 months of 2016. Applied results of the proposed algorithm, black IPs are June 19, July 21, and August 17. In this paper, results by analysis identify to detect frequency of black IPs and find new black IPs of caused potential cyber threats.
참고문헌 (19)
- Eto, M., "nicter : A Large-Scale Network Incident Analysis System", Proc. of the First Workshop on Building Analysis Datasets and Gathering Experience Returns for Security(BADGERS ‘11), pp.37~45 (2011)
- Choi, S., "A Fusion Framework of IDS Alerts and Darknet Traffic for Effective Incident Monitoring and Response", Journal of Applied Mathematics & Information Science, pp.245~251 (2013)
- Bailey, M., "Data Reduction for the Scalable Automated Analysis of Distributed Darknet Traffic", Proc. of the 5th ACM SIGCOMM conference on Internet Measurement(IMC‘05), pp.239~252 (2005)
- Fachkha, C., "Darknet as a Source of Cyber Intelligence Survey, Taxonomy and Characterization", IEEE Communications Surveys&Tutorials, pp.1197~1227 (2015)
- Spitzner, L., "The Honeynet Project : trapping the hackers", Magazine of Security & Privacy, pp.15~23 (2003), IEEE
- Abbasi, F.H, "Experiences with a Generation III virtual Honeynet", Proc. of the Telecommunication Networks and Applications Conference(ATNAC‘09), pp.1~6 (2009)
- Abbasi, F. H, "Intrusion detection in Honeynets by compression and hashing", Proc. of the Telecommunication Networks and Application Conference(ATNAC‘10), pp.96~101 (2010)
- Park, J., "How to Design Practical Client Honeypots Based on Virtual Environment", Asia Joint Conference on Information Security(AsiaJCIS), pp.67~73 (2016)
- Kim, H., "A Methodology for Multipurpose DNS Sinkhole Analyzing Double Bounce Emails", Proc. on ICONIP 2013, LNCS 8226, pp.609~616 (2013)
- Lee, H., "Enhanced Sinkhole System by Improving Post-processing Mechanism", Proc. on FGIT 2010, LNCS 6485, pp.469~480 (2010)
- 김영백, "DNS 싱크홀에 기반한 새로운 악성봇 치료 기법", 정보보호학회논문지, 18(6), pp.107~114 (2008), 한국정보보호학회
- Egele, M., "A survey on automated dynamic malware-analysis techniques and tools", Journal of ACM Computing Surveys (CSUR), 44(2) (2012)
- Willenms, C., "Toward Automated Dynamic Malware Analysis Using CW Sandbox", Journal of IEEE Security and Privacy, 5(2) (2007)
- Qiu, H., "Static malware detection with Segmented Sandboxing", Proc. of 8th International Conference on the Malicious and Unwanted Software (MALWARE'13), pp.132~141 (2013)
- Liu, J., "Towards a Taxonomy of Darknet Traffic", International Wireless Communications and Mobile Computing Conference(IWCMC), pp.37~43 (2014)
- Ban, T., "A Study on Association Rule Mining of Darknet Big Data", International Joint Conference on Neural networks(IJCNN), pp.1~7 (2015)
- S, Mukkamala., "Detection of Virtual Environments and Low Interaction Honeypots", Information Assurance and Security Workshop (2007)
- Ayeni O. A, "Design and Implementation of a Medium Interaction Honeypot", International Journal of Computer Applications (2013)
- Supinder, K., "Client Honeypot Based Malware Program Detection Embedded Into Web Pages", Journal of Engineering Research and Applications, pp.849~854 (2013)