IP 주소 기반 사이버공격 실시간 및 통계적 가시화 방법
A Real-Time and Statistical Visualization Methodology of Cyber Threats Based on IP Addresses
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
국내·외 기업 및 기관들은 사이버위협으로부터 자신들의 IT 인프라를 안전하게 보호하기 위해 24시간/365일 모니터링 및 대응할 수 있는 보안관제센터를 활용하고 있다. 하지만, 현재 대부분의 보안관제센터는 전문 인력에 의한수동분석과 텍스트 기반의 보안관제체계에 의존하는 태생적인 한계점을 안고 있다. 이러한 보안관제체계의 문제점들을 극복하기 위해 가시화 기술을 활용한 사이버위협 탐지·분석 연구가 활발하게 진행되고 있지만 이들 연구의 대부분은 보안관제 분야에 최적화되어 있지 않고, 많은 경우에 개별 기관에서만 활용할 수 있다는 제한이 따랐다. 따라서 본 논문에서는 보안관제 분야의 최종 목표인 실제 공격자 IP를 탐지할 수 있을 뿐만 아니라, 보안관제센터에서도활용할 수 있는 새로운 가시화 방법론을 제안한다. 본 논문에서 제안하는 가시화 방법론의 핵심은 보안이벤트를 발생시킨 공격자(IP)의 행위정보를 실시간 및 추적(통계) 분석을 가능하게 하는 것이다. 제안된 가시화 방법론을 기반으로 개발된 시스템을 실제 보안관제센터에 성공적으로 적용하였으며, 실제 운영을 통해 다양한 공격자 IP를 탐지및 분석하는데 성공함으로써 본 논문에서 제안한 가시화 방법론의 실용성 및 유효성을 검증했다.
Abstract
Regardless of the domestic and foreign governments/companies, SOC (Security Operation Center) has operated 24 hours aday for the entire year to ensure the security for their IT infrastructures. However, almost all SOCs have a critical limitationby nature, caused from heavily depending on the manual analysis of human agents with the text-based monitoringarchitecture. Even though, in order to overcome the drawback, technologies for a comprehensive visualization againstcomplex cyber threats have been studying, most of them are inappropriate for the security monitoring in large-scalenetworks. In this paper, to solve the problem, we propose a novel visual approach for intuitive threats monitoring by detecting suspicious IP address, which is an ultimate challenge in cyber security monitoring. The approach particularly makesit possible to detect, trace and analysis of suspicious IPs statistically in real-time manner. As a result, the systemimplemented by the proposed method is suitably applied and utilized to the real-would environment. Moreover, the usabilityof the approach is verified by successful detecting and analyzing various attack IPs.
참고문헌 (21)
- Annual report for 2019: Survey for information security industry in korea, "Korea Information Security Industry Association", ~ (2019)
- The First Annual report for 2019: Industry trend of information security report, "Korea Information Security Industry Association", ~ (2019)
- Quarterly Threat Report for 2016: McAfee labs threats report, "McAfee Labs", ~ (2016)
- Analyst Research Report for 2019: Improving the effectiveness of the SOC, "Ponemon Institute Research", ~ (2019)
- Research Report for 2019:Challenges of managing and securing the network, "Endance", ~ (2019)
- Survey for 2108: 27 Percent of IT professionals receive more than 1 million security alerts daily, "Imperva", ~ (2018)
- The second annual state of incident response report for 2018: The state of SOAR report, "Demisto", ~ (2018)
- White Paper for 2017:InfoBrief: a day in the life of a cyber security pro, "Enterprise Management Associates", ~ (2017)
- 이동건, "RGB Palette를 이용한 보안 로그 시각화 및보안 위협 인식", 정보보호학회논문지, 25(1), pp.61~73 (2015), 한국정보보호학회[DOI]
- 박재범, "대규모 네트워크의 효과적 보안상황 인지를 위한 벌집 구조 시각화 시스템의 설계 및 구현", 정보보호학회논문지, 24(6), pp.1197~1213 (2014), 한국정보보호학회[DOI]
- Koo Bon-Hyun, "Real-time web attack detection visualization tool design and implementation using HTTP header information", Proceedings of the Korea Institutes of Information Security and Cryptology Conference, pp.637~640 (2006)
- Girardin, Luc, "An eye on network intruder-administrator shootouts", Proceedings of the Workshop on Intrusion Detection and Network Monitoring, pp.19~28 (1999)
- K. Nyarko, "Network intrusion visualization with NIVA, an intrusion detection visual analyzer with haptic integration", Proceedings 10th Symposium on Haptic Interfaces for Virtual Environment and Teleoperator Systems. HAPTICS 2002, pp.277~284 (2002)
- Y. Zhao, "IDSRadar: a real-time visualization framework for IDS alerts", Science China Information Sciences, 56(8), pp.1~12 (2013)
- Roesch, Martin, "Snort: Lightweight intrusion detection for networks", Proceedings of the 13th USENIX conference on System administration (LISA ’99), 99(1), pp.229~238 (1999)
- Koike, Hideki, "SnortView: visualization system of snort logs", Proceedings of the 2004ACM workshop on Visualization and data mining for computer security, pp.143~147 (2004)
- K. Abdullah, "IDS rainStorm: visualizing IDS alarms", IEEE Workshop on Visualization for Computer Security, 2005. (VizSEC 05), pp.1~10 (2005)
- Shiravi, "IDS alert visualization and monitoring through heuristic host selection", Proceedings of the 12th International Conference on Information and Communications Security, pp.445~458 (2010)
- F. Fischer, "BANKSAFE: A visual situational awareness tool for large-scale computer networks: VAST 2012 challenge award: Outstanding comprehensive submission, including multiple vizes", 2012 IEEE Conference on Visual Analytics Science and Technology (VAST), pp.257~258 (2012)
- T. Itoh, "Hierarchical visualization of network intrusion detection data", IEEE Computer Graphics and Applications, 26(2), pp.40~47 (2006)
- D. Inoue, "DAEDALUS-VIZ: novel real-time 3D visualization for darknet monitoring-based alert system", Proceedings of the ninth international symposium on visualization for cyber security, pp.72~79 (2012)