SECURITY SYSTEM OF MANAGING IRC AND HTTP BOTNETS, AND METHOD THEREFOR

• US 20100162350A1
• Filed: 08/20/2009
• Published: 06/24/2010
• Est. Priority Date: 12/24/2008
• Status: Abandoned Application

• Current Assignee: Korea Information Security Agency
• Original Assignee: Korea Information Security Agency
• Inventors: JEONG, Hyun Cheol, JI, Seung Goo, OH, Joo Hyung, NOH, Sang Kyun, IM, Chae Tae
• Application Number:
  US12/544,569
• Publication Number:
  US 20100162350A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

The present invention relates to a security system of managing IRC and HTTP botnets and a method therefor. More specifically, the present invention relates to a system and a method that detects a botnet in an Internet service provider network to store information related to the detected botnet in a database and performs security management of IRC and HTTP botnets, including a botnet management security management (BMSM) system, configured to visualize the information related to the detected botnet and establish an against policy related to the detected botnet. Accordingly, the present invention provides a security system of managing IRC and HTTP botnets that can efficiently performs the security management of IRC and HTTP botnets by using the BMSM system

Claims

1. A system that detects a botnet in an Internet service provider network to store information related to the detected botnet in a database and performs security management of IRC and HTTP botnets, the system comprising

a botnet management security management (BMSM) system, configured to visualize the information related to the detected botnet and establish an against policy related to the detected botnet.

2. The system of claim 1, further comprising:

a plurality of traffic information collecting sensors, placed in a plurality of Internet network provider networks to transfer traffic information to the BMBS system; and

a managing system, configured to manage the traffic information collecting sensors and setting and state information of a botnet detection system.

3. The system of claim 1, wherein the BMSM system comprises:

a security event collector module, configured to receive a security event from the botnet detection system and deal with the received security event;

an anomaly organization log analysis log, configured to analyze a similarity with the botnet of the security event;

an unclassified behavior log analysis module, configured to receive and classify unclassified behavior logs in the security event;

a botnet against technology module, configured to establish the against policy related to the detected botnet;

a detection log management module, configured to manage the information related to the detected botnet, botnet malicious behavior information, policy information and botnet against policy information;

a policy management module, configured to set a policy of the BMSM system;

a system management module, configured to register the botnet detection system, the traffic information collecting sensor, a domain name system sink hole server, a BGP router, a domain name system server, and a web firewall to the BMSM system;

a statistic reporting management module, configured to create statistics data based on the information related to the detected botnet and the malicious behavior information; and

a botnet monitoring module, configured to monitor a malicious behavior and an organization of the detected botnet.

4. The system of claim 3, wherein the security event collector module comprises:

a security event collection classification module, configured to classify the collected security events;

an against policy checking module, configured to transmit an against policy request message for blocking botnets according to the policy established by the policy management module;

a collection/classification/policy generation management module for the security event; and

an abnormal organization log buffer, configured to store an abnormal organization log in the collected security event.

5. The system of claim 3, wherein the anomaly organization log analysis log comprises:

an abnormal organization log search/classification module, configured to periodically read an abnormal organization log buffer in the security event and write an organization log, which is generated in a same time slot, in a matrix per organization;

a botnet C&

C comparison module, configured to compare botnet C&

C information in a present time slot with botnet C&

C information in a previous time slot;

a C&

C analyzing and detecting module, configured to analyze a similarity with source IPs of botnet C&

C of the present and previous time slot;

a C&

C extracting module, configured to receive a botnet traffic detected from the C&

C analyzing and detecting module and extracts C&

C per protocol to store the analysis result in a log; and

an against policy setting module generates a requiring message for setting a black list generation against policy related to a newly detected botnet C&

C in the BMSM system.

6. The system of claim 5, wherein the botnet against technology module sets a botnet against policy including black list sharing, domain name system sink hole, HTTP botnet C&

C URL access blocking, and BGP feeding.

7. The system of claim 3, wherein the detection log management module comprises:

a connection pool module, configured to manage a connection with the database;

an enquiry/inserting/deleting/correcting module, configured to deal with requests of enquiry, inserting, deleting, and correcting for the database;

a query classifying module, configured to classify request messages to the detection log management module and transfer the classified request messages to the enquiry/inserting/deleting/correcting module;

a duplicate checking module, configured to check whether there is any duplicate of an inserting request to the database and a correcting request in the enquiry/inserting/deleting/correcting module;

a SQLP generating/transmitting module, configured to receive request messages and generate corresponding SQL to transfer the SQL; and

a result transmitting module, configured to returns the acknowledged result after the generated SQL is transferred.

8. The system of claim 3, wherein the system management module

receives and deals with state information transmitted from the plurality of traffic information collecting sensors that collect botnet information in the Internet service provider network or the botnet detection systems that detect the botnets based on the traffic collected by the traffic information collecting sensors and

deals with a state information enquiry request from a management consol graphic user interface through which a user is able to manipulate the BMSM system displayed on a web.

9. A method that detects a botnet in an Internet service provider network to store information related to the detected botnet in a database and performs security management of IRC and HTTP botnets, the method comprising:

detecting a botnet in the Internet service provider network; and

establishing an against policy of the botnet.

10. The method of claim 9, wherein the detecting of the botnet in the Internet service provider network comprises:

collecting a traffic in the Internet service provider network;

classifying logs based on the collected traffic; and

dealing with the logs.

11. The method of claim 10, wherein the logs include detection logs, classification behavior logs, abnormal organization logs, and non-classification behavior logs.

12. The method of claim 11, wherein the dealing with the logs comprises:

dealing with the detection logs;

dealing with the classification behavior logs;

dealing with the abnormal organization logs; and

dealing with non-classification behavior logs.

13. The method of claim 10, further comprising creating statistics data for the information related to the detected botnet.