N grouping of traffic and pattern-free internet worm response system and method using N grouping of traffic

• US 7,779,467 B2
• Filed: 10/02/2006
• Issued: 08/17/2010
• Est. Priority Date: 12/22/2005
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Choi, Daesik, Lee, Cheolwon, Kim, Dongsu, Park, Eungki, Kim, Woonyon
• Primary Examiner(s): Simitoski; Michael J
• Application Number:
  US11/542,320
• Publication Number:
  US 20070150958A1
• Time in Patent Office: 1,415 Days
• Field of Search: 726 22- 25, 713/188
• US Class Current: 726/22
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Provided are N grouping of traffic and pattern-free Internet worm response system and method. According to the method, traffic factors generated by respective worms are grouped into N groups so that a great quantity of Information may be effectively understood and a worm generated afterward is involved with characteristics of a relevant group. Damages of a network or a system predictable through already classified N traffic characteristics are defined so that corresponding step-by-step measures are taken. Characteristics of the grouped worms are quantitatively analyzed so that a danger degree of a new worm is predicted when the new worm appears afterward and forecasting and alarming through the prediction are performed. Easiness with which a controlling operator instantly understands an accident using a visualization method having an approximate real-time characteristic is increased, so that detection efficiency for most worms not detected using a conventional rule is increased.

Claims

1. A computerized method for N grouping of traffic and a pattern-free Internet worm response method using the N grouping of traffic, the computerized method comprising:

grouping various worms into N groups by a processor where similar traffic factors generated by the worms are grouped;

involving a worm appearing afterward with a traffic characteristic of a corresponding group defined in advance to allow a network or a system to control a forecast/alarm and a countermeasure for a danger of the network or system (here, N is a natural number equal to or greater than

     2); and

wherein determining of the traffic characteristic of the corresponding group defined in advance comprises;

executing various worms and collecting generated traffic data to perform grouping on traffic factors that generate similar results;

creating N groups using the grouping results;

inserting data of a real network as noises with consideration of a circumstance where noises and worms of various communication networks are generated simultaneously in a bundle;

applying a neural network algorithm to the inserted data and performing the grouping of various worms to allow the group to converge;

quantitatively analyzing the groups;

dividing a damage influence of the quantitatively analyzed group into a plurality of hierarchies; and

matching a countermeasure with each hierarchy.

2. The computerized method of claim 1, wherein the controlling of the forecast/alarm and the countermeasure of the danger comprises:

collecting newly generated worm traffic using the traffic characteristic of the corresponding group defined in advance;

comparing similarity of each grouped pattern with that of the newly generated worm traffic on the basis of the traffic characteristic of the corresponding group;

selecting a group most similar to the grouped pattern; and

performing a forecast/alarm and a countermeasure according to a countermeasure scheme that corresponds to the hierarchy of the group.

3. The computerized method of claim 2, wherein the comparing of similarity is performed using a data mining technique.

4. The computerized method of claim 3, wherein visualization of all operations is performed to allow a controlling operator to easily make an immediate judgment of a correlation between the grouped pattern and a newly generated worm traffic.

5. N grouping of traffic and a pattern-free Internet worm response system using the N grouping of traffic, the system comprising:

a traffic classification unit on a processor executing various worms, collecting generated traffic data to put together the worms having the same traffic data as collected, creating N groups where traffic factors that generate similar results are grouped, dividing a damage influence of the group into a plurality of hierarchies, and matching a countermeasure with each hierarchy and thus defining a traffic characteristic, wherein the traffic classification unit comprises;

a primitive grouping element executing various worms, collecting generated traffic data, and creating N groups using a neural network for final classification of a worm that generates a similar result;

a processing grouping element inserting data of a real network as noises with consideration of a circumstance where noises and worms of various communication networks are generated simultaneously in a bundle, and applying a new neural network algorithm to allow the worms to converge to N groups;

a group quantitative analysis element quantitatively analyzing the groups;

a hierarchy dividing element dividing a damage influence of the quantitatively analyzed group into a plurality of hierarchies; and

a countermeasure matching element matching a countermeasure for a damage for each hierarchy;

a traffic collection unit on a processor collecting newly generated worm traffic using the traffic characteristic of a relevant group that is defined by the traffic classification unit; and

a forecast/alarm and countermeasure unit on a processor comparing similarity of each group with that of the newly generated worm traffic with reference to the traffic classification unit and making a forecast/alarm and a countermeasure according to a countermeasure scheme for each hierarchy of a most similar group (here, N is a natural number equal to or greater than

     2).

6. The system of claim 5, wherein the forecast/alarm and countermeasure unit comprises:

a detector/comparator calculating similarities of the worm with respect to respective groups and outputting a group having greatest similarity among the calculated similarities;

a seriousness judgment part monitoring a seriousness degree of the group output from the detector/comparator, calculating a degree of similarity of the relevant group, and mapping the group to hierarchy defined in advance to output a corresponding countermeasure; and

a countermeasure/alarming part providing a forecast/alarm and a countermeasure according to damage and countermeasure guides defined in advance with reference to the countermeasure output from the seriousness judgment part.