KR101596603B1 - Apparatus and method for creating signature using network packet flow sequence - Google Patents

Abstract

An apparatus and method for generating a signature using network packet flow sequence information are disclosed. The signature generator can quickly generate a signature using the acquired packet flow sequence and the domain name using the header information of the protocol that can be quickly and easily extracted from the program packet.

Description

[0001] APPARATUS AND METHOD FOR CREATING SIGNATURE USING NETWORK PACKET FLOW SEQUENCE USING NETWORK PACKET FLOW SEQUENCE INFORMATION [0002]

The present invention relates to an apparatus and method for generating a signature using network packet flow sequence information, and more particularly, to a method for generating a signature of a program, the method comprising: generating a signature using a packet flow sequence and a domain name, To a signature generation apparatus and method.

Currently, many malicious codes are growing rapidly. To cope with these malicious codes, various methods for identifying malicious codes are suggested. One such method is network-based signature generation.

This method is a method for comparing specific data in a payload of a packet generated in a program with a packet of a malicious code as a signature as used in a general PC. However, it can be difficult to distinguish malicious code from normal programs with certain data. This is because the packet data of the malicious code and the normal program may be the same.

To solve this problem, the only data in the payload should be used as a signature. However, it is expensive to analyze the data to select it. Also, there is a disadvantage that it is difficult to cope with malicious codes because the program signatures can not be generated quickly.

The present invention relates to an apparatus and method for generating a signature using network packet flow sequence information. In order to overcome the disadvantages, a packet flow sequence and a domain name It is possible to respond to a malicious code by generating a signature quickly.

In an apparatus and method for generating a signature using network packet flow sequence information according to an embodiment of the present invention, the signature generation apparatus includes a step of analyzing a received packet, a step of confirming a packet flow and a domain name using the analyzed packet, Determining a packet flow sequence using the identified packet flow, generating a signature using the determined packet flow sequence and the identified domain name, and classifying and storing the generated signature according to the presence or absence of a malicious code Step < / RTI >

Wherein the analyzing comprises extracting a protocol including a protocol number and a domain name including the sequence number in the received packet, and confirming information of a protocol including a protocol and a domain name including the extracted sequence number . ≪ / RTI >

The verifying step may include generating a packet flow using a sequence number of a protocol including a sequence number, and extracting a domain name using a protocol including a domain name.

Wherein the determining comprises mapping the size of each packet corresponding to the identified packet flow to a corresponding packet flow, encoding the size of the mapped packet, and arranging the coded size in the ascertained packet flow order Step < / RTI >

The generating may include generating a signature using an IP address corresponding to the packet flow sequence and an IP address held by the domain name.

An apparatus and method for generating signature using network packet flow sequence information according to an embodiment of the present invention includes a step of receiving a packet of a program, loading a signature classified as a malicious code, Generating a signature using a packet of the program, comparing the signature of the program with the loaded signature, and determining whether the signature of the program is similar to the signature classified as the malicious code according to the compared result Step < / RTI >

The signature of the program may be generated based on the packet flow and the domain name generated according to the packet of the program.

In an apparatus and method for generating a signature using network packet flow sequence information according to an embodiment of the present invention, the signature generation apparatus includes a communication modem for receiving a packet, an analysis unit for analyzing the received packet, A determination unit for determining a flow name and a domain name, a determination unit for determining a packet flow sequence using the identified packet flow, a generation unit for generating a signature using the determined packet flow sequence and the identified domain name, And a database for classifying and storing the signatures according to the presence or absence of the malicious code.

An apparatus and method for generating a signature using network packet flow sequence information according to an embodiment of the present invention includes a communication modem for receiving a packet of a program, a load unit for loading a signature classified as a malicious code, A comparison unit for comparing the signature of the generated program with the loaded signature, and a comparison unit for comparing the signature of the program and the signature classified as the malicious code according to the comparison result, May be similar to each other.

The signature of the program may be generated based on the packet flow and the domain name generated according to the packet of the program.

According to an embodiment of the present invention, it is possible to cope with a malicious code by quickly generating a signature using a packet flow sequence and a domain name obtained by using header information of a protocol that can be quickly and easily extracted from a program packet.

1 is a block diagram illustrating a signature generation apparatus according to an exemplary embodiment of the present invention.
2 is a block diagram illustrating a signature similarity determination apparatus according to an exemplary embodiment of the present invention.
FIG. 3 illustrates an overall process of generating a signature according to an exemplary embodiment.
FIG. 4 illustrates a process of analyzing a program packet according to an exemplary embodiment of the present invention.
FIG. 5 illustrates a method of generating a domain name list according to an exemplary embodiment of the present invention.
FIG. 6 illustrates a process of generating a packet flow sequence according to an embodiment.
FIG. 7 illustrates a method of mapping a size of each packet corresponding to a packet flow to a corresponding packet flow according to an exemplary embodiment.
8 illustrates an exemplary generation of a packet flow sequence according to one embodiment.
9 illustrates a method of generating a signature using a packet flow sequence and a domain name according to an exemplary embodiment of the present invention.
FIG. 10 illustrates a process of determining signature similarity according to an exemplary embodiment of the present invention.
FIG. 11 illustrates an example of a method for determining a malicious code according to an embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a signature generation apparatus according to an exemplary embodiment of the present invention.

The signature generating apparatus 110 according to an embodiment may be configured with a communication modem 120 and a signature generating system 130. [ The communication modem 120 may receive the program packet. For example, when a program is transmitted from one place to another, it can be divided into packets and transmitted by the TCP / IP protocol. Partitioned packets can be transmitted over the Internet with separate numbers and destination addresses. Packets arriving at the destination can be reassembled into the original program at the receiver of the TCP layer to receive the program.

The signature generation system 130 may include an analysis unit 131, an identification unit 132, a determination unit 133, a generation unit 134, and a storage unit 135. The analysis unit 131 may analyze a program packet generated by executing the program received through the communication modem 120. [ Program packets can be transmitted over various protocols. A protocol including a sequence number and a protocol including a domain name may be extracted to analyze information of a program packet transmitted by the protocols. At this time, the information of the program packet analyzed through the analysis unit 131 may be a sequence number and a domain name of the packet.

The confirmation unit 132 can confirm the packet flow and the domain name list using the analyzed information of the program packet through the analysis unit 131. [ The domain name list can be extracted from the DNS record information of the protocol including the domain name. At this time, the verification unit can extract the IP address corresponding to the domain name. It can own multiple IP addresses per domain name and can be configured with a 1: N relationship per domain name.

The packet flow can be generated using a protocol that includes a sequence number. For example, the sequence number of each packet may be embedded in the header information of the packet transmitted through the TCP protocol. One flow can be created by concatenating the built-in sequence numbers starting from the smallest one to the last one. This generated one flow can be a packet flow.

The determination unit 133 can determine the packet flow sequence using the generated packet flow. First, the determination unit 133 may map the size of each packet corresponding to the generated packet flow to a corresponding packet flow. The determination unit 133 can determine the packet flow sequence by encoding the sizes of the mapped packets and arranging them in the order of the generated packet flows. The determined packet flow sequence may be used to generate a signature later.

One packet flow sequence can not create signatures that can identify malicious code. This is because the same packet flow sequence may exist in various malicious codes.

Therefore, the generating unit 134 can generate a signature using the packet flow sequence and the domain name list. The generation unit 134 can hold the IP address of the communication object for each packet flow sequence. In addition, the generating unit 134 may have an IP address corresponding to the domain name extracted by the identifying unit 132. The generating unit 134 may combine the packet flow sequence and the domain name list by matching the IP address corresponding to the packet flow sequence and the IP address held by the domain name. The result of this combined packet flow sequence and domain name list can be generated as a signature of the program.

The storage unit 135 may classify the signature of the generated program according to whether the malicious code is stored in the database. That is, when a signature of a program not classified as a signature of a malicious code is generated, the storage unit 135 may store the signature as a malicious code when the generated signature of the program generates a packet through a malicious action .

2 is a block diagram illustrating a signature similarity determination apparatus according to an exemplary embodiment of the present invention.

The signature similarity determination device 210 may be configured of a communication modem 120 and a signature similarity determination system 220. The communication modem 120 may receive the packets of the program. For example, when a program is transmitted from one place to another, it can be divided into packets and transmitted by the TCP / IP protocol. Partitioned packets can be transmitted over the Internet with separate numbers and destination addresses. Packets arriving at the destination can be reassembled into the original program at the receiver of the TCP layer to receive the program.

The signature similarity determination system 220 may include a load unit 221, a generation unit 222, a comparison unit 223, and a determination unit 224. The load unit 221 can be classified as malicious code and can recall the signature stored in the database.

The generation unit 222 may generate a signature using a packet generated by executing a program received through the communication modem 120. [ Specifically, a packet of a program may be analyzed to identify a packet flow and a domain name, and the packet flow sequence may be determined using the confirmed packet flow. The generating unit 222 may combine the packet flow sequence and the domain name list by matching the IP address held by the domain name with the IP address corresponding to the packet flow sequence. The combined result may be generated as a signature of the program.

The comparing unit 223 can compare the signature classified by the malicious code retrieved from the database with the signature of the program generated by the generating unit 222. [ According to an embodiment of the present invention, the comparison unit 223 compares the domain name with the signatures of the malicious code and the signature of the generated program, and then compares the coded values of the packet size in order.

The determination unit 224 can determine the presence or absence of a malicious code in the program using the result of comparing the signature of the generated program with the signature classified as the malicious code in the comparison unit 223. [ The criterion for determining whether the signature of the program generated by the generating unit 222 is similar to the signature of the malicious code may be received from a separate server (not shown) or may be set by the user.

FIG. 3 illustrates an overall process of generating a signature according to an exemplary embodiment.

In step 310, the signature generation apparatus 110 may analyze a packet generated by executing a program received through the communication modem 120. [ The signature generation device 110 may analyze the packet to extract the sequence number and the domain name of the packet.

In step 320, the signature generation device 110 may generate a packet flow using the sequence number of the extracted packet. For example, the sequence number of each packet may be embedded in the header information of the packet transmitted through the TCP protocol. One flow can be created by concatenating the built-in sequence numbers starting from the smallest one to the last one. This generated one flow can be a packet flow.

In addition, the domain name extracted by the signature generation device 110 may have a plurality of IP addresses in one domain name, so that the IP address per domain name may be configured in a 1: N relationship. The signature generation device 110 can generate a domain name list using the relation of IP addresses that can be held per one domain name.

In step 330, the signature generation device 110 may determine the packet flow sequence using the packet flow. The signature generation device 110 can determine the packet flow sequence by mapping the size of each packet corresponding to the packet flow to the corresponding packet flow, and encoding the size of the mapped packet and arranging the size in the order of the packet flow.

In step 340, the signature generation device 110 may generate the signature of the program using the extracted domain name list by analyzing the packet flow sequence and the packet. The signature generation device 110 can generate a signature of the program by combining the IP flow address with the IP address held by the domain name and combining the packet flow sequence and the domain name list.

In step 350, the signature generation device 110 may classify the signature of the generated program according to whether it is malicious code or not and store the classified signature in the database.

FIG. 4 illustrates a process of analyzing a program packet according to an exemplary embodiment of the present invention.

In step 410, the signature generation device 110 may convert a packet to be analyzed into a PCAP (Packet Capture) file. PCAP can capture packets that float on the network in the area of computer network management. The PCAP file includes header information of the captured packet and data of the packet. The signature generation device 110 can extract the sequence number and the domain name of the packet using the information included in the header of the packet .

FIG. 5 illustrates a method of generating a domain name according to an embodiment.

The domain name list can be extracted from the DNS record information of the DNS protocol packet. At this time, the DNS record information may include a domain name and an IP address associated with the domain name. There are three methods for obtaining the IP address. The first is to use iterative transformations. For example, if a client enters naver.com in a web browser, it first queries the root name server and returns the com server address. The client then sends a naver.com conversion request back to the com server address. In this way, it is an iterative conversion method that continues to request and respond until the client returns the final IP address.

The second is a recursive transformation method. In the iterative transformation method, the client must continue to request and respond until a final response is received. However, when recursive conversion is used, the client makes a request to the root server, and the root server checks that naver.com is registered on its server. If it is not registered, it makes a request to com server and com server checks whether naver.com is registered on its server. Thus, recursive conversion is a method in which a request is moved to a server having a real domain name to obtain an IP address.

In order for the client to get the final IP address with this recursive transformation, all intermediate name servers must allow recursive conversion.

Finally, there is a common DNS name translation method. A common DNS name translation method can use the recursive conversion method and the iterative conversion method together to obtain a final IP address. Such a general DNS name conversion method can increase the efficiency by using the recursive conversion method and the iterative conversion method together.

In this manner, the IP address for the domain name that can be extracted from the DNS record information of the DNS protocol packet may be a plurality of IP addresses. As shown in FIG. 5, the domain name list may include a plurality of IP addresses corresponding to the domain names.

FIG. 6 illustrates a process of generating a packet flow sequence according to an embodiment.

The signature generation device 110 can generate a packet flow sequence using the packet flow. In step 610, the signature generation device 110 may map the size of each packet corresponding to the packet flow to the corresponding packet flow. A method of mapping the size of a packet to a corresponding packet flow is well illustrated in FIG. The result of mapping the size of the packet to the packet flow according to the above method can be confirmed in the drawing of FIG. 8 (a).

In step 620, the signature generation device 110 can encode the size of the packet after mapping the size of the packet to the corresponding packet flow as shown in FIG. 8A, (B) of Fig.

In step 630, when the signature generation apparatus 110 lists the packets in the order of packet flow in FIG. 8B, a packet flow sequence is generated. The result is shown in FIG. 8C. That is, the packet flow sequence may include a value obtained by encoding the IP address and the packet size.

9 illustrates a method of generating a signature using a packet flow sequence and a domain name according to an exemplary embodiment of the present invention.

The signature generation device 110 can generate the signature of the program using the packet flow sequence and the domain name list. The packet flow sequence can hold the IP address of the object that communicated with each packet flow sequence. Also, the domain name list may have a plurality of IP addresses per domain name. The signature generation apparatus 110 can generate a signature by combining the IP address of the packet flow sequence with the IP address held by the domain name and combining the packet flow sequence and the domain name list. The signature of the program generated by the signature generating apparatus 110 can be generated as shown in FIG.

FIG. 10 illustrates a process of determining signature similarity according to an exemplary embodiment of the present invention.

The signature similarity determining device 210 can fetch the signature classified as malicious code from the database in step 1010. [

In step 1020, the signature similarity determination apparatus 210 may generate a signature using the packet of the program. Specifically, a packet of a program may be analyzed to identify a packet flow and a domain name, and the packet flow sequence may be determined using the confirmed packet flow. The signature similarity determining device 210 can combine the packet flow sequence and the domain name list by matching the IP address held by the domain name with the IP address corresponding to the packet flow sequence. The combined result may be generated as a signature of the program.

In step 1030, the signature similarity determination apparatus 210 may compare signatures generated by analyzing packets classified into malicious codes and program packets that are retrieved from the database. In one embodiment, the signature similarity determination device 210 may compare domain names in the signature of the generated program with the signatures classified in the malicious code, and then compare the encoded values of the packet size in order.

In step 1040, the signature similarity determination apparatus 210 can determine whether or not a malicious code is present in the program using the result of comparing the signature of the generated program with the signature classified as the malicious code. The criterion for determining whether the signature of the generated program is similar to the signature of the malicious code can be received from a separate server (not shown) or can be set by the user.

FIG. 11 illustrates an example of a method for determining a malicious code according to an embodiment.

The signature similarity determination unit 210 can compare the signature stored in the database with the signature of the program generated using the packet of the program by judging that the signature is previously determined to be malicious code. The signature-similar-word determination apparatus 210 can determine whether or not a malicious code exists in the program executed by the malicious code determination criterion.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced. Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

110: Signature Generator
120: Communication modem
130: Signature Generation System
210: Signature similarity judging device
220: Signature Similarity Judging System

Claims (8)

Analyzing the received packet;
Confirming a packet flow and a domain name using the analyzed packet;
Determining a packet flow sequence using the identified packet flow;
Generating a signature by matching an IP address corresponding to the determined packet flow sequence and an IP address held by the identified domain name; And
Classifying and storing the generated signature according to whether the malicious code is detected
Lt; / RTI >
The packet flow sequence is determined by mapping the size of each packet corresponding to the confirmed packet flow to a corresponding packet flow, encoding the size of the mapped packet,
Wherein the signature comprises information on the domain name and the size of a packet mapped to the packet flow,
And comparing the coded value of the packet size based on a result of comparing the domain name included in the signature when determining whether the received packet is malicious code. The method of claim 1,
Wherein the analyzing comprises:
Extracting a protocol including a protocol number and a domain name including the sequence number in the received packet; And
Confirming information of a protocol including the extracted sequence number and a protocol including a domain name
/ RTI > The method of claim 1,
Wherein the verifying step comprises:
Generating a packet flow using a sequence number of a protocol including a sequence number; And
Extracting a domain name using a protocol including a domain name
/ RTI > The method according to claim 1,
Wherein the determining comprises:
Mapping the size of each packet corresponding to the identified packet flow to a corresponding packet flow;
Encoding the size of the mapped packet; And
Listing the coded sizes in the ascertained packet flow order
/ RTI > delete Receiving a packet of a program;
Loading a signature classified as malicious code;
Generating a signature using a packet of the received program;
Comparing the signature of the program with the loaded signature; And
Determining whether the signature of the program is similar to the signature classified as the malicious code according to the comparison result
Lt; / RTI >
Wherein the signature of the program comprises:
An IP address corresponding to a packet flow sequence generated according to a packet of the program, and an IP address held by the domain name,
The packet flow sequence is determined by mapping the size of each packet corresponding to the packet flow to a corresponding packet flow and encoding the size of the mapped packet,
Wherein the determining step comprises:
And comparing the coded value of the packet size based on a result of comparing the domain names included in the signature. A communication modem for receiving a packet;
An analysis unit for analyzing the received packet;
A confirmation unit for verifying the packet flow and the domain name using the analyzed packet;
A determining unit for determining a packet flow sequence using the confirmed packet flow;
A generating unit for generating a signature by matching an IP address corresponding to the determined packet flow sequence and an IP address held by the identified domain name; And
A database for classifying and storing the generated signatures according to the presence or absence of a malicious code
Lt; / RTI >
The packet flow sequence is determined by mapping the size of each packet corresponding to the confirmed packet flow to a corresponding packet flow, encoding the size of the mapped packet,
Wherein the signature comprises information on the domain name and the size of a packet mapped to the packet flow,
And comparing the coded value of the packet size based on a result of comparing the domain name included in the signature when determining whether the received packet is malicious code. A communication modem for receiving a packet of a program;
A load unit for loading a signature classified as a malicious code;
A generating unit for generating a signature using the packet of the received program;
A comparing unit comparing the signature of the generated program with the loaded signature; And
Determining whether the signature of the program is similar to the signature classified as the malicious code according to the comparison result;
Lt; / RTI >
Wherein the signature of the program comprises:
An IP address corresponding to a packet flow sequence generated according to a packet of the program, and an IP address held by the domain name,
The packet flow sequence is determined by mapping the size of each packet corresponding to the packet flow to a corresponding packet flow and encoding the size of the mapped packet,
Wherein,
And compares the coded value of the packet size based on a result of comparing the domain names included in the signature.

Images