Network-based attack tracing system and method using distributed agent and manager system

• US 20030159069A1
• Filed: 10/18/2002
• Published: 08/21/2003
• Est. Priority Date: 02/19/2002
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kang, Dong Ho, Choi, Byeong Cheol, Sohn, Sung Won, Seo, Dong Il, Park, Chee Hang, Choi, Yang Seo
• Application Number:
  US10/273,139
• Publication Number:
  US 20030159069A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Disclosed is a network-based attack tracing system and method using a distributed attack detection agent and manager system that can detect and trace an attack path of a hacker in real time on the whole network using distributed network-based attack detection agent, request manager, and reply manager. The agent detects an attack using a network-based intrusion detection system (NIDS), analyzes an alarm log that is judged to be the attack, changes the analyzed alarm log into attack information, and transmits the attack information to the request manager. The request manager performs a search of an attack IP based on the attack information received from the agent, stores a result of search in a tree structure, and if a final search is completed, extracts a hacking path using a binary search tree (BST) algorithm. The reply manager searches an alarm log DB located in the agent of its own network in response to the attack information search request from the request manager, and transmits a result of search to the request manager. The system and method can use the detection function of the existing NIDS at maximum, control unnecessary tracing requests during the process of judging many alarm logs as the attack logs, and broaden its application range in case of the authenticated network.

Claims

1. A network-based attack tracing system using a distributed attack detection agent and manager system, the system comprising:

an agent for detecting an external attack, storing a result of detection in an alarm log DB, and performing a log analysis through a real-time monitoring of the alarm log DB, the agent changing analyzed log information to attack information, storing the attack information in an attack log DB, and then transmitting the attack information through a UDP communication;

a request manager for performing a search request of IP information included in the attack information received from the agent; and

a reply manager for searching an attack IP from the alarm log DB of an agent of a sub network to which the corresponding attack IP of its own network in accordance with the IP search request from the request manager, and transmitting a result of search to the request manager;

wherein if there is another passing IP, the request manager continuously requests the attack information search to a reply manager of another network, and if the above process is completed, the request manager stores a result of tracing a hacking path in a tracing result DB.

2. A network-based attack tracing method using a distributed attack detection agent, request manager, and reply manager system, the method comprising the steps of:

an agent detecting an attack using a network-based intrusion detection system (NIDS), analyzing an alarm log that is judged to be the attack, changing the analyzed alarm log into attack information, and transmitting the attack information to the request manager;

a request manager performing a search of an attack IP based on the attack information received from the agent, storing a result of search in a tree structure, and if a final search is completed, extracting a hacking path using a binary search tree (BST) algorithm; and

a reply manager searching an alarm log DB located in the agent of its own network in response to the attack information search request from the request manager, and transmitting a result of search to the request manager.

3. The network-based attack tracing method of claim 2, wherein the step of analyzing the alarm log, changing the alarm log to the attack information, and transmitting the attack information to the request manager comprises the steps of:

detecting the attack by the NIDS, storing the detected attack in the alarm log DB, and monitoring the alarm log DB in real time;

when the alarm log DB is updated by new information, applying an attack log rule for judging the information as the attack information;

finally judging the updated information as the attack by applying a threshold value according to an attack method to the detection frequency of IPs and signatures for being judged as the attack information after the attack log rule is applied; and

reporting to the request manager and storing the finally judged attack information.

4. The network-based attack tracing method of claim 2, wherein the step of performing the search of the attack IP based on the attack information received from the agent, storing the result of search in the tree structure, and extracting the hacking path using the BST algorithm comprises the steps of:

receiving the attack information from the agent, and selecting the manager to which the attack IP belongs;

requesting the search of the attack IP to the reply manager of the selected network, and receiving a result of search from the reply manager;

storing the result of search from the reply manager in a memory of the tree structure, and after the search is finally completed, using the BST algorithm for extracting the tracing path; and

storing the extracted hacking path in a tracing result DB.

5. The network-based attack tracing method of claim 2, wherein the step of searching the alarm log DB in the agent of its own network in accordance with the attack information search request from the request manager, and transmitting a result of search to the request manager comprises the steps of:

starting a search process by generating a child process in response to the attack IP search request from the request manager;

authenticating the network corresponding to the IP subject to the search request;

searching the alarm log DB of the agent managed by itself with respect to an authenticated search request packet, extracting and storing a result of search; and

transmitting the extracted search result to the request manager.