Method for providing a cybersecurity service to detect cyberthreats to a network using a virtual host and a cybersecurity service providing server using the same

Abstract

To provide a method and a server for providing cyber security services that overcome low CPU performance and memory shortages, detect various types of threat behavior occurring on a network, reduce the probability of undetection, and improve the correct detection rate. [Solution] In a cybersecurity service providing system 1000, a cybersecurity service providing server 100 acquires and registers subscription request information for a cybersecurity service from any network administrator terminal 210 that manages each of multiple networks 200, and by referring to the subscription information, generates multiple virtual host IPs and virtual host MAC addresses corresponding to the IP addresses of the virtual hosts VH using unused host addresses of the active hosts connected to the switching port of the access switch AS so that the active hosts can communicate, and transmits these to each access switch.

Description

[Technical field]

[0001] The present invention relates to a method for providing a cybersecurity service for a network, and more particularly to a method for providing a cybersecurity service for detecting cyber threats in a network by generating a virtual host in an access switch to which a host in the network is connected and inducing the virtual host to attempt a network attack. [Background technology]

[0002] A cyber threat is a malicious and deliberate attempt by an individual or organization to compromise the security of the information systems of another individual or organization, usually with the attacker seeking to disrupt the victim's network in order to gain some kind of benefit.

[0003] Such cyber threats come in a variety of forms, including malware, phishing, man-in-the-middle (MitM) attacks, Denial of Service (DoS) attacks, and zero-day exploits.

[0004] To prevent such cyber threats, network-based security devices such as firewalls, IPS, UTM, and web firewalls separate external and internal networks and analyze and protect traffic flowing from the external network to the internal network and traffic flowing from the internal network to the outside, thereby protecting the entire network.

[0005] Meanwhile, in order to ensure the reliability of network communications by blocking harmful traffic that can infect hosts on the internal network with viruses or other infections and cause performance degradation and failures in network core devices, and to prevent the secondary spread of infection to other hosts, there has been growing interest in security switches that analyze the traffic generated on the internal network and block the traffic at the switch level if it is determined to be harmful traffic or a cyber threat.

[0006] In such security switches, the typical way to judge cyber threats is to detect an action of one host searching for multiple hosts, or an action of multiple hosts transmitting a large amount of traffic to one host.

[0007] However, there are clear limitations to the application of such security switches in a network environment where various devices and operating environments are intricately intertwined.

[0008] In addition, responding to cyber threats using such security switches has the limitation that it is necessary to distinguish between positive detection and situations in which a threat is actually detected, and it is not possible to respond to changes in the form of various cyber attacks.

[0009] In addition, low CPU performance and insufficient memory limit the ability to monitor all traffic occurring on the network.

[0010] Therefore, the present applicant aims to propose a method for overcoming low CPU performance and memory shortage, detecting various forms of threatening behavior occurring in a network, reducing the probability of undetection, and improving the correct detection rate. Summary of the Invention [Problem to be solved by the invention]

[0011] An object of the present invention is to solve all of the problems of the prior art mentioned above.

[0012] Another object of the present invention is to provide a cyber security service that overcomes the low CPU performance and memory shortage of access switches and effectively detects cyber threats occurring in a network.

[0013] It is yet another object of the present invention to provide a cyber security service that generates a virtual host in an access switch and detects cyber threats.

[0014] It is yet another object of the present invention to provide a cyber security service that blocks hosts posing cyber threats from the network by making the virtual hosts created in the access switch pose cyber threats.

[0015] It is yet another object of the present invention to provide a cyber security service that efficiently responds to changes in the form of cyber attacks by using a virtual host. [Means for solving the problem]

[0016] In order to achieve the above object of the present invention, the typical features of the present invention are as follows:

[0017] According to one embodiment of the present invention, in a method for providing a cybersecurity service for detecting cyberthreats against a network using a virtual host, (a) when subscription request information for a cybersecurity service is obtained from a specific network administrator terminal, which is at least one of a first network administrator terminal to an nth network administrator terminal that manages each of a first network to an nth network (where n is an integer equal to or greater than 1) constituting an independent network, a cybersecurity service providing server refers to the subscription request information and registers subscription information for a specific cybersecurity service for a specific network corresponding to the specific network administrator terminal; and (b) the cybersecurity service providing server refers to the subscription information for the specific cybersecurity service, and uses a specific network controller that manages the specific network to (i) register a subscription request information for a specific network belonging to the specific network within the specific network. (ii) generating at least one specific first virtual host IP address through at least one specific m-th virtual host IP address using a specific unused host address not used by a specific active host, which is a host connected to a switching port of a specific first access switch through a specific m-th access switch (where m is an integer equal to or greater than 1) that allows a host currently being used by the specific active host to communicate, and generating at least one specific first virtual host MAC address corresponding to the specific first virtual host IP address through at least one specific m-th virtual host MAC address corresponding to the specific m-th virtual host IP address; and (ii) transmitting each of the specific first virtual host IP address and the specific first virtual host MAC address through the specific first access switch through the specific m-th access switch,a step of generating at least one specific first virtual host through the specific m-th virtual host IP address corresponding to the specific first virtual host IP address and the specific first virtual host MAC address in each of the specific first security engine through the specific m-th access switch, and determining a specific active host that performs a function of scanning at least one of the specific first virtual host through the specific m-th virtual host IP address and a function of transmitting a data packet to at least one of the specific first virtual host through the specific m-th virtual host MAC address by using at least one of the specific first virtual host IP address through the specific m-th virtual host IP address via at least one of the specific first security engine through the specific m-th security engine, and blocking the specific active host from the specific network.

[0018] In one example, before step (b), the cybersecurity service providing server generates a malware profile including an operation pattern of the pre-confirmed malware from a malware database storing operation patterns of the pre-confirmed malware, and transmits the malware profile for the pre-confirmed malware to the specific network controller, or transmits the malware profile to the specific network controller via the specific network administrator terminal, so that the malware profile for the pre-confirmed malware is registered in the specific first security engine to the specific m-th security engine by the specific network controller, and in step (b), the cybersecurity service providing server registers the data packet using any one of the specific first security engine to the specific m-th security engine. a process for analyzing a data code of a packet to confirm an analyzed behavior pattern obtained by analyzing a behavior pattern of the data code, (i) determining that the data code is a specific malware corresponding to the specific registered behavior pattern when a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles matches the analyzed behavior pattern, and blocking the specific active host from the specific network through at least one of the specific first access switch to the specific m-th access switch, (ii) determining that the data code is an unconfirmed malware when each of the registered behavior patterns does not match the analyzed behavior pattern, and (ii-1) transmitting an alarm to the specific network controller after blocking the specific active host from the specific network through at least one of the specific first access switch to the specific m-th access switch;and (ii-2) sending the alarm to the specific network controller while the specific active host is not blocked from the specific network.

[0019] In one example, (c) when the cybersecurity service providing server acquires a security log corresponding to the unconfirmed malware from the specific network controller or the specific network administrator terminal (the security log includes a host scan packet corresponding to the unconfirmed malware and at least a portion of the data packet), the cybersecurity service providing server updates the malware database by referring to a result of analyzing the unconfirmed malware, generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmits malware profile update notification information to the specific network administrator terminal; and (d) acquires malware profile update request information from the specific network administrator terminal in response to the malware profile update notification information. When the specific network is confirmed to have the authority to update the malware profile by referring to subscription information of the specific cybersecurity service, the cybersecurity service providing server checks whether the specific network has the authority to update the malware profile, and if it is confirmed that the specific network has the authority to update the malware profile, transmits the unconfirmed malware profile to the specific network controller or transmits the unconfirmed malware profile to the specific network controller via the specific network administrator terminal, and uses the specific network controller to update the pre-registered malware profile of the specific first security engine through the specific mth security engine.

[0020] In one example, in step (d), if it is confirmed that the specific network does not have the authority to update the malware profile, the cybersecurity service providing server requests an additional subscription for updating the malware profile from the specific network administrator terminal, and when additional subscription request information for updating the malware profile is obtained from the specific network administrator terminal, the cybersecurity service providing server updates the subscription information of the specific cybersecurity service by referring to the additional subscription request information, and transmits the unconfirmed malware profile to the specific network controller, or transmits it to the specific network controller via the specific network administrator terminal, so that the specific network controller uses the unconfirmed malware profile to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine.

[0021] In one example, in step (d), when the cybersecurity service providing server determines that the unconfirmed malware profile is to be transmitted to the specific network controller through the specific network administrator terminal, the cybersecurity service providing server may transmit the unconfirmed malware profile to the specific network administrator terminal via at least one of SMS, a messaging app, and email corresponding to the specific network administrator terminal.

[0022] In one example, the method further includes the step of (e) transmitting malware profile update history information to the specific network administrator terminal when the cybersecurity service providing server completes updating the pre-registered malware profile.

[0023] In one example, the cybersecurity service providing server may transmit update history information of the malware profile to the specific network administrator terminal at a predetermined time period or at a specific time based on subscription information of the specific cybersecurity service.

[0024] In one example, in step (b), the cybersecurity service providing server can use the specific network controller to group the specific unused host addresses into groups 1_1 through 1_n, and generate the specific first virtual host IP address by referencing the specific unused host addresses of the 1_1 group through the specific mth virtual host IP address by referencing the specific unused host addresses of the 1_n group.

[0025] In one example, in step (b), the cybersecurity service providing server can use the specific network controller to group all specific host addresses of the specific network into 2_1 group through 2_n group, and generate the specific 1st virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_1 group through the specific mth virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_n group.

[0026] In one example, in step (b), when the number of specific virtual hosts to be generated on the specific network using the specific network controller is k (where k is an integer greater than or equal to m), the network controller can group all specific host addresses of the specific network into 3_1 groups through 3_m groups, generate a specific 3_1 virtual host IP address that references one specific unused host address in the 3_1 group through a specific 3_k virtual host IP address that references one specific unused host address in the 3_m group, and group the specific 3_1 virtual host IP addresses through the specific 3_k virtual host IP addresses into m groups to generate the specific 1 virtual host IP address through the specific m-th virtual host IP address.

[0027] According to another embodiment of the present invention, a cybersecurity service providing server for providing a cybersecurity service for detecting cyberthreats to a network using a virtual host includes: a memory storing instructions for providing a cybersecurity service for detecting cyberthreats to a network using a virtual host; and a processor for executing an operation for providing a cybersecurity service for detecting cyberthreats to the network using the virtual host according to the instructions stored in the memory; wherein the processor is configured to: (I) provide a first network through an nth network (where n is an integer equal to or greater than 1) that constitute an independent network; a process of registering subscription information for a specific cybersecurity service for a specific network corresponding to the specific network administrator terminal by referring to the subscription request information when subscription request information for a cybersecurity service is obtained from a specific network administrator terminal which is at least one of the first network administrator terminal through the nth network administrator terminal managing each of the above-mentioned networks; and (II) a process of using a specific network controller managing the specific network by referring to the subscription information for the specific cybersecurity service to (i) generate at least one specific first virtual host IP address through at least one specific mth virtual host IP address by using a specific unused host address that is not used by a specific active host that is a host connected to a switching port of a specific first access switch through a specific mth access switch (where m is an integer equal to or greater than 1) that enables a host belonging to the specific network to communicate within the specific network, and generate at least one specific first virtual host MAC address corresponding to the specific first virtual host IP address through at least one specific mth virtual host MAC address corresponding to the specific mth virtual host IP address;(ii) transmitting the specific first virtual host IP address and the specific first virtual host MAC address through the specific m-th virtual host IP address and the specific m-th virtual host MAC address to the specific first access switch through the specific m-th access switch, respectively, and transmitting at least one specific first virtual host through the specific m-th virtual host IP address corresponding to the specific first virtual host IP address and the specific first virtual host MAC address to a specific first security engine set inside the specific first access switch through a specific m-th security engine set inside the specific m-th access switch through the specific first access switch through the specific m-th access switch. and generating at least one specific m-th virtual host corresponding to the specific m-th virtual host MAC address and the specific m-th virtual host MAC address, and determining a specific active host that performs a function of scanning at least one of the specific first virtual host through the specific m-th virtual host using at least one of the specific first virtual host IP address through the specific m-th virtual host IP address and a function of transmitting a data packet to at least one of the specific first virtual host through the specific m-th virtual host via at least one of the specific first security engine through the specific m-th security engine, and blocking the specific active host from the specific network.

[0028] In one example, the processor, prior to the (II) process, generates a malware profile including an operation pattern of the pre-confirmed malware from a malware database storing operation patterns for the pre-confirmed malware, and transmits the malware profile for the pre-confirmed malware to the specific network controller, or transmits the malware profile to the specific network controller via the specific network administrator terminal, so that the specific network controller registers the malware profile for the pre-confirmed malware in the specific first security engine to the specific m-th security engine, and in the (II) process, checks an analyzed operation pattern obtained by analyzing a data code of the data packet and analyzing the operation pattern of the data code, using any one of the specific first security engine to the specific m-th security engine that received the data packet, (i) the pre-registered malware profile and (ii) when a specific registered operation pattern among the registered operation patterns corresponding to each of the above matches with the analyzed operation pattern, the data code is determined to be specific malware corresponding to the specific registered operation pattern, and the specific active host is blocked from the specific network through at least one of the specific first access switch to the specific mth access switch; and (ii) when each of the registered operation patterns does not match with the analyzed operation pattern, the data code is determined to be unidentified malware, and the method can execute any one of the following processes: (ii-1) a process of blocking the specific active host from the specific network through at least one of the specific first access switch to the specific mth access switch, and then sending an alarm to the specific network controller; and (ii-2) a process of sending the alarm to the specific network controller while the specific active host is not blocked from the specific network.

[0029] In one example, the processor includes: (III) a process of updating the malware database by referring to a result of analyzing the unconfirmed malware when a security log corresponding to the unconfirmed malware (the security log includes at least a portion of the host scan packet and the data packet corresponding to the unconfirmed malware) is obtained from the specific network controller or the specific network administrator terminal, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmitting malware profile update notification information to the specific network administrator terminal; and (IV) a process of receiving malware profile update request information from the specific network administrator terminal in response to the malware profile update notification information. Once the malware profile update authority is obtained, the process may further include referring to subscription information of the specific cybersecurity service to determine whether the specific network has malware profile update authority for updating a malware profile, and if it is determined that the specific network has malware profile update authority, transmitting the unconfirmed malware profile to the specific network controller or transmitting the unconfirmed malware profile to the specific network controller via the specific network administrator terminal, thereby causing the specific network controller to update the pre-registered malware profiles of the specific first security engine through the specific mth security engine using the unconfirmed malware profile.

[0030] In one example, when it is confirmed in the (IV) process that the specific network does not have the authority to update the malware profile, the processor requests an additional subscription for the malware profile update from the specific network administrator terminal, and when additional subscription request information for the malware profile update is obtained from the specific network administrator terminal, the processor updates the subscription information of the specific cybersecurity service by referring to the additional subscription request information, and transmits the unconfirmed malware profile to the specific network controller, or transmits it to the specific network controller via the specific network administrator terminal, so that the specific network controller uses the unconfirmed malware profile to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine.

[0031] In one example, when the processor, in the (IV) process, causes the unconfirmed malware profile to be transmitted to the specific network controller through the specific network administrator terminal, the processor may transmit the unconfirmed malware profile to the specific network administrator terminal via at least one of an SMS, a messaging app, and an email corresponding to the specific network administrator terminal.

[0032] In one example, the processor may further execute a process of (V) transmitting malware profile update history information to the specific network administrator terminal when updating of the pre-registered malware profile is completed.

[0033] In one example, the processor may transmit update history information of the malware profile to the specific network administrator terminal at a preset time period or at a specific time based on subscription information of the specific cybersecurity service.

[0034] In one example, in the (II) process, the processor can use the specific network controller to group the specific unused host addresses into groups 1_1 through 1_n, and generate the specific first virtual host IP address by referencing the specific unused host addresses of the 1_1 group through the specific mth virtual host IP address by referencing the specific unused host addresses of the 1_n group.

[0035] In one example, in the (II) process, the processor can use the specific network controller to group all specific host addresses of the specific network into 2_1 group through 2_n group, and generate the specific first virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_1 group through the specific mth virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_n group.

[0036] In one example, in the (II) process, when the number of specific virtual hosts to be generated on the specific network is k (where k is an integer greater than or equal to m), the processor can use the specific network controller to group all specific host addresses of the specific network into 3_1 group through 3_m group, generate a specific 3_1 virtual host IP address that references one specific unused host address in the 3_1 group through a specific 3_k virtual host IP address that references one specific unused host address in the 3_m group, and group the specific 3_1 virtual host IP addresses through the specific 3_k virtual host IP addresses into m groups to generate the specific 1 virtual host IP address through the specific mth virtual host IP address.

[0037] Additionally, there is further provided a computer readable recording medium for recording a computer program for performing the method of the present invention. Effect of the Invention

[0038] According to the present invention, it is possible to overcome the low CPU performance and memory shortage of an access switch and provide a cyber security service that effectively detects cyber threats occurring in a network.

[0039] Furthermore, according to the present invention, it is possible to provide a cybersecurity service that generates a virtual host in an access switch and detects cyber threats.

[0040] Furthermore, according to the present invention, it is possible to provide a cybersecurity service that blocks hosts that pose cyber threats from the network by making the virtual hosts created in the access switch pose cyber threats.

[0041] Furthermore, according to the present invention, it is possible to provide a cybersecurity service that utilizes a virtual host to efficiently respond to changes in the form of cyber attacks. [Brief description of the drawings]

[0042] The following drawings, attached for use in explaining the embodiments of the present invention, are only a part of the embodiments of the present invention, and a person having ordinary knowledge in the technical field to which the present invention pertains (hereinafter, "ordinary engineers") can derive other drawings based on these drawings without performing inventive work.

[0043] [Figure 1] FIG. 1 is a schematic diagram illustrating a system for providing cybersecurity services that detect cyber threats to a network using virtual hosts according to one embodiment of the present invention. [Diagram 2] FIG. 1 is a schematic diagram illustrating an access switch that uses virtual hosts to detect cyber threats to a network in accordance with one embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram illustrating a method for providing a cybersecurity service for detecting cyber threats to a network using a virtual host according to one embodiment of the present invention. [Figure 4] 1 is a diagram illustrating a process in which an access switch detects cyber threats to a network using a virtual host according to one embodiment of the present invention. [Diagram 5] 2 is a schematic diagram illustrating a malware profile update to an access switch according to one embodiment of the present invention. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0044] The following detailed description of the present invention refers to the accompanying drawings, which show, by way of example, specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable one of ordinary skill in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different from one another, but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein can be implemented from one embodiment to another without departing from the spirit and scope of the present invention. It should also be understood that the location or arrangement of individual components within each embodiment can be changed without departing from the spirit and scope of the present invention. Therefore, the following detailed description should not be taken in a limiting sense, and the scope of the present invention should be understood to encompass the scope of the claims and all equivalents thereto. In the drawings, like reference numerals refer to the same or similar components throughout the various aspects.

[0045] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily carry out the present invention.

[0046] FIG. 1 is a schematic diagram of a system for providing cybersecurity services to detect cyber threats to a network using a virtual host according to one embodiment of the present invention, and the overall system 1000 may include a cybersecurity service providing server 100 and at least one network 200_1 to 200_n.

[0047] First, the cybersecurity service providing server 100 provides a cybersecurity service to at least one network 200_1 to 200_n that has subscribed to a cybersecurity service, and may include a memory 110 storing instructions for providing a cybersecurity service that detects cyber threats to the network using a virtual host, and a processor 120 that performs operations for providing a cybersecurity service that detects cyber threats to the network using a virtual host in accordance with the instructions stored in the memory 110.

[0048] Specifically, the cybersecurity service provider server 100 may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include a computer processor, memory, storage, input devices and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0049] Furthermore, the processor of the cybersecurity service providing server 100 may include hardware components such as a micro processing unit (MPU) or central processing unit (CPU), a cache memory, a data bus, etc. Furthermore, the cybersecurity service providing server 100 may further include a software component such as an operating system and an application that performs a specific purpose.

[0050] However, this does not exclude the case where the cybersecurity service providing server 100 includes an integrated processor in which a medium, a processor, and a memory for implementing the present invention are integrated.

[0051] Next, each of the first network 200_1 to the nth network 200_n constitutes a different independent network, and detects and defends against cyber threats occurring within each network by subscribing to a cybersecurity service using a virtual host, and each of the first network 200_1 to the nth network 200_n may include a network management terminal, a network administrator terminal, and at least one access switch. In this case, the number of access switches in each of the first network 200_1 to the nth network 200_n may be configured to be different from each other depending on the respective network environments.

[0052] As an example, a first network 200_1, which is a specific network among multiple networks, may include a first network administrator terminal 210_1, a first network controller 220_1, and at least one access switch, ie, a first access switch AS_1 to an m-th access switch AS_m.

[0053] The first network manager terminal 210_1 is a terminal used by a first network manager who manages a first network, and can perform operations related to the subscription of a cybersecurity service. In this case, the first network manager terminal 210_1 can include various computing devices that perform wired and wireless communication, such as a personal computer (PC), a laptop computer, and a mobile terminal.

[0054] The first network controller 220_1 sets network security for managing the first network, stores at least one security log for cyber threats detected in the first network, and transmits the log to the cybersecurity service providing server 100. In this case, the first network controller 220_1 may include a memory in which instructions for managing the first network are stored, and a processor that executes operations for managing the first network according to the instructions stored in the memory. Specifically, the first network controller 220_1 may achieve desired system performance using, but is not limited to, a combination of a computing device (e.g., a device that may include a computer processor, memory, storage, input devices, and output devices, as well as other components of a conventional computing device; electronic communication devices such as routers, switches, and the like; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner). The processor of the first network controller 220_1 may include hardware components such as an MPU (Micro Processing Unit) or a CPU (Central Processing Unit), a cache memory, and a data bus. The first network controller 220_1 may further include a software component of an operating system and an application for executing a specific purpose. However, this does not exclude the case where the first network controller 220_1 includes an integrated processor in which a medium for implementing the present invention, a processor, and a memory are integrated.

[0055] In addition, each of the first access switch AS_1 through the mth access switch AS_m enables the first active host AH_*_* and the first virtual host VH_*_* to communicate with each other within the first network, and may include a memory for detecting cyber threats to the first network using the virtual host VH_*_*, and a processor for performing operations for detecting cyber threats to the first network using the virtual host VH_*_* in accordance with instructions stored in the memory.

[0056] Specifically, each of the first access switch AS_1 through the mth access switch AS_m may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include computer processors, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0057] Furthermore, each processor of the first access switch AS_1 to the m-th access switch AS_m may include hardware configurations such as an MPU (Micro Processing Unit) or a CPU (Central Processing Unit), a cache memory, a data bus, etc. Furthermore, each of the first access switch AS_1 to the m-th access switch AS_m may further include a software configuration of an operating system and an application that executes a specific purpose.

[0058] However, this does not exclude the case where each of the first access switch AS_1 to the m-th access switch AS_m includes an integrated processor in which a medium for implementing the present invention, a processor, and a memory are integrated.

[0059] In addition, each of the first access switch AS_1 to the mth access switch AS_m can be configured not only as a physical module that performs an L2 switch function, but also as a logical module such as a virtual switch that performs an L2 switch function in a cloud environment such as OVS (Open vSwitch).

[0060] The configuration state of an access switch according to an embodiment of the present invention will be described below with reference to FIG.

[0061] The access switch AS according to an embodiment of the present invention may include switch hardware 10 , a communication packet processing module 20 , a network stack 30 , and a security engine 40 .

[0062] Specifically, the switch hardware 10 performs switching operations to forward communication packets received via the network to a destination host, and a virtual host MAC switch may be registered to forward communication packets destined for a virtual host.

[0063] The communication packet processing module 20 analyzes a communication packet received via the network to determine a destination host, and by referring to the determined destination host, causes the communication packet to be forwarded to the destination host via the switch hardware 10. If the communication packet is for a virtual host, the communication packet is transmitted to the security engine 40, and if the communication packet is for broadcast, the communication packet can be broadcast to other active hosts via the network stack 30, and the communication packet can be replicated and transmitted to the security engine 40. In addition, the communication packet processing module 20 can forward a virtual host, i.e., a communication packet generated by the security engine 40, to the destination host via the switch hardware 10.

[0064] Furthermore, the network stack 30 can forward communication packets addressed to a host connected to another access switch to the other access switch via the switch hardware 10.

[0065] Meanwhile, when at least one virtual host VH is generated, the security engine 40 analyzes a host scan packet transmitted to the virtual host, identifies a specific host scan method used in the host scan packet from among pre-defined host scan methods, and generates and transmits a response packet. When a data packet is transmitted to the virtual host in response to the response packet, the security engine 40 can determine that the data packet is malware and block the specific active host that transmitted the data packet from the network to the virtual host through at least one of the access switches.

[0066] In addition, in the above, an example has been described in which the access switch AS is configured with a physical module, but the present invention is not limited to this, and the access switch AS can also be configured with a logical module that performs an L2 switch function through a virtual switch such as an OVS.

[0067] Referring to the system according to one embodiment of the present invention configured as above, a method for providing a cybersecurity service for detecting cyber threats to a network using a virtual host will be described below with reference to Figures 1 to 3.

[0068] First, the cybersecurity service providing server 100 can acquire subscription request information for a cybersecurity service from a specific network administrator terminal 210_1 which is at least one of the first network administrator terminals 210_1 through the n-th network administrator terminals 210_n which manage the first network 200_1 through the n-th network 200_n which respectively constitute independent networks. For reference, the specific network administrator terminal is assumed to be the first network administrator terminal 210_1, and in the following description, it is assumed that the specific network is the first network 200_1.

[0069] The cybersecurity service providing server 100 can then refer to subscription request information for a cybersecurity service obtained from a specific network administrator terminal 210_1 and register subscription information for a specific cybersecurity service for a specific network 200_1, thereby allowing a subscription for a cybersecurity service for the specific network 200_1 to be registered (S100).

[0070] In this case, the subscription information for a specific cybersecurity service may include various information for providing cybersecurity services, such as information on the specific network 200_1, information on the specific network administrator terminal 210_1, information on the specific network administrator, information on the scope of use of the cybersecurity service by the specific network 200_1, payment information, and information on terms and conditions related to the specific cybersecurity service provided to the specific network 200_1.

[0071] Thereafter, the cybersecurity service providing server 100 can provide a cybersecurity service that detects cyber threats using the virtual host to the specific network 200_1 (S200).

[0072] Specifically, the cybersecurity service providing server 100 has a specific network controller 220_1 that manages a specific network 200_1 by referring to subscription information for a specific cybersecurity service, and can be configured to generate at least one specific first virtual host IP address or at least one specific mth virtual host IP address using a specific unused host address not used by a specific active host AH_*_*, which is a host connected to the switching port of a specific first access switch AS_1 or a specific mth access switch AS_m that enables hosts belonging to the specific network 200_1 to communicate within the specific network 200_1, and to generate at least one specific first virtual host MAC address corresponding to the specific first virtual host IP address or at least one specific mth virtual host MAC address corresponding to the specific mth virtual host IP address. The cybersecurity service providing server 100 can then use a specific network controller 220_1 to transmit each of the specific first virtual host IP address and the specific first virtual host MAC address through the specific mth virtual host IP address and the specific mth virtual host MAC address to each of the specific first access switches AS_1 through the specific mth access switches AS_m, and generate at least one specific first virtual host VH_1_* corresponding to the specific first virtual host IP address and the specific first virtual host MAC address through the specific first access switch AS_1 through the specific mth access switch AS_m, in each of the specific first security engine set inside the specific first access switch AS_1 through the specific mth access switch AS_m.As a result, the cybersecurity service providing server 100 can determine a specific active host VH_1_1 that performs the function of scanning at least one of the specific first virtual hosts VH_1_* through the specific mth virtual hosts VH_m_* using at least one of the specific first virtual host IP address through the specific mth virtual host IP address, and the function of transmitting data packets to at least one of the specific first virtual hosts VH_1_* through the specific mth virtual hosts VH_m_* through at least one of the specific first security engine through the specific mth security engine, and block it from a specific network 200_1.

[0073] In other words, the cybersecurity service providing server 100 can refer to subscription information for a specific cybersecurity service, and use a specific network controller 220_1 that manages a specific network 200_1 to build a cyber threat detection system in the specific network 200_1 for detecting cyber threats using virtual hosts.

[0074] At this time, a process in which a specific network controller 220_1 constructs a cyber threat detection system for detecting cyber threats using a virtual host in a specific network 200_1 will be described in more detail below.

[0075] Each of a specific first access switch AS_1 through a specific mth access switch AS_m installed in a specific network 200_1 can monitor ARP (Address Resolution Protocol) communication of a specific active host AH_*_* connected to the specific network 200_1, collect the IP address and MAC address of the specific active host AH_*_* connected to the specific network 200_1, and then transmit them to a specific network controller 220_1.

[0076] Then, the specific network controller 220_1 refers to the IP address and MAC address of the specific active host AH_*_* connected to the specific network 200_1, and performs active host management in real time.

[0077] Then, a specific network controller 220_1 can refer to the active host list obtained from a specific first access switch AS_1 to a specific mth access switch AS_m to identify unused IP addresses, and generate a specific virtual host VH_*_* using the unused IP addresses.

[0078] That is, the specific network controller 220_1 generates at least one specific first virtual host IP address through at least one specific m-th virtual host IP address by using unused host addresses not used by the specific active host AH_*_* among all host addresses of the specific network 200_1, and generates at least one specific first virtual host MAC address through at least one specific m-th virtual host MAC address corresponding to the specific first virtual host IP address. Then, the specific network controller 220_1 can transmit each of the specific first virtual host IP address and the specific first virtual host MAC address through the specific m-th virtual host IP address and the specific m-th virtual host MAC address to each of the specific first access switch AS_1 through the specific m-th access switch AS_m. Then, each of the specific first access switch AS_1 through the specific m-th access switch AS_m can generate at least one specific first virtual host VH_1_* that references the specific first virtual host IP address and the specific first virtual host MAC address, or at least one specific m-th virtual host VH_m_* that references the specific m-th virtual host IP address and the specific m-th virtual host MAC address, in each of the specific first security engine set inside the specific first access switch AS_1 through the specific m-th access switch. At this time, each of the specific first access switch AS_1 through the specific m-th access switch AS_m can register the specific first virtual host MAC switch through the specific m-th virtual host MAC switch corresponding to the specific first virtual host VH_1_* through the specific m-th virtual host VH_m_*, respectively, in the respective switch hardware, so that communication packets destined for each of the specific first virtual host VH_1_* through the specific m-th virtual host VH_m_* can be transmitted to each of the specific first security engine through the specific n-th security engine.

[0079] As an example, the specific network controller 220_1 may group unused host addresses into 1_1 group through 1_m group, and generate at least one specific 1st virtual host IP address referring to the unused host addresses of the 1_1 group through at least one specific mth virtual host IP address referring to the unused host addresses of the specific 1_m group. In this case, the specific network controller 220_1 may change a part of the IP address used by the specific active host AH_*_* so that the specific virtual host IP address is distributed uniformly among all the specific host addresses. In addition, the specific network controller 220_1 may distribute the specific virtual host IP address uniformly among all the specific host addresses, but may distribute the specific virtual host IP address more intensively among some of the host addresses in the first half, the host addresses in the middle, and the host addresses in the second half. This makes it possible to quickly detect cyber threats in situations where typical cyber threats are made from low host addresses to high host addresses, or from high host addresses to low host addresses, or from an address at a specific location to low host addresses or high host addresses, and to stably maintain a specific network 200_1 against cyber threats.

[0080] As another example, the specific network controller 220_1 may group all the specific host addresses into a 2_1 group through a 2_m group, and generate at least one specific 1st virtual host IP address by referring to an unused host address among all the specific host addresses of the 2_1 group through at least one specific mth virtual host IP address by referring to an unused host address among all the specific host addresses of the 2_m group. In this case, the specific network controller 220_1 may change a part of the IP address used by the specific active host AH_*_* so that the specific virtual host IP address is distributed uniformly among all the specific host addresses. In addition, the specific network controller 220_1 may distribute the specific virtual host IP address uniformly among all the specific host addresses, but may distribute the specific virtual host IP address more intensively among some of the host addresses in the first half, the middle half, and the second half. This makes it possible to quickly detect cyber threats in situations where typical cyber threats are made from low host addresses to high host addresses, or from high host addresses to low host addresses, or from an address at a specific location to low host addresses or high host addresses, and to stably maintain a specific network 200_1 against cyber threats.

[0081] As yet another example, when the number of at least one specific virtual host to be generated on the specific network 200_1 is k, the specific network controller 220_1 can group all the specific host addresses into 3_1 group through 3_k group, generate a specific 3_1 virtual host IP address by referencing one unused host address in the 3_1 group through a specific 3_k virtual host IP address by referencing one unused host address in the 3_k group, and group the specific 3_1 virtual host IP addresses through the specific 3_k virtual host IP addresses into m groups to generate a specific 1 virtual host IP address through a specific m-th virtual host IP address.

[0082] As an example, take a network that uses class C, 192.168.0.255, and there are two access switches, and five virtual hosts are generated on the network. The host addresses are the last octet, from 0 to 255. Among them, the IP address 192.168.0.0 corresponding to "0" is used as the network address, and the IP address 192.168.0.255 corresponding to "255" is used to broadcast messages to all hosts in the network, so the first IP address and the last IP address cannot be assigned to individual hosts. Therefore, the IP addresses that can actually be assigned to individual hosts are IP addresses from 192.168.0.1 to 192.168.0.254, so these are divided into five groups: group 3_1, "192.168.0.1 to 192.168.0.50," group 3_2, "192.168.0.51 to 192.168.0.100," group 3_3, "192.168.0.101 to 192.168.0.150," group 3_4, "192.168.0.1 to 192.168.0.160," group 3_5, "192.168.0.1 to 192.168.0.170," group 3_6, "192.168.0.1 to 192.168.0.190," group 3_7, "192.168.0.1 to 192.168.0.200," group 3_8, "192.168.0.1 to 192.168.0.210," group 3_9, "192.168.0.1 to 192.168.0.220," group 3_10, "192.168.0.1 to 192.168.0.230," group 3_11, "192.168.0.1 to 192.168.0.240," group 3_12, "192.168.0.1 to 192.168.0.250," group 3_13, "192.168.0.1 to 192.168.0.260," group 3_14, "19 After grouping the IP addresses into a 3_4 group of "192.168.0.151 to 192.168.0.200" and a 3_5 group of "192.168.0.201 to 192.168.0.254", one unused IP address each from the 3_1 group, the 3_2 group, the 3_3 group, the 3_4 group, and the 3_5 group can be generated as the first virtual host IP address to the fifth virtual host IP address. Then, three virtual host IP addresses from the first virtual host IP address to the fifth virtual host IP address can be used to generate three virtual hosts in the first access switch, and two virtual hosts can be generated in the second access switch using the remaining two virtual host IP addresses.

[0083] For reference, in a specific network 200_1 which is the first network in FIG. 1, a specific first_1 active host AH_1_1 having an IP address of 192.168.0.10 and a specific first_2 active host AH_1_2 having an IP address of 192.168.0.11 are connected to a specific first access switch AS_1, a specific first_1 virtual host VH_1_1 having a specific virtual host IP address of 192.168.0.2 is generated, and a specific second access switch AS_2 has a specific second_1 active host AH_2_1 having an IP address of 192.168.0.21 and a specific second_2 active host AH_2_2 having an IP address of 192.168.0.22 and a specific second_3 active host AH_3_3 having an IP address of 192.168.0.31 and a specific second_4 active host AH_4_4 having an IP address of 192.168.0.41 and a specific second_5 active host AH_5_5 having an IP address of 192.168.0.51 and a specific second_6 active host AH_6_6 having an IP address of 192.168.0.62 and a specific second_7 active host AH_7_7 having an IP address of 192.168.0.73 and a specific second_8 active host AH_8_8 having an IP address of 192.168.0.84 and a specific second_9 active host AH_9_9 having an IP address of 192.168.0.96 and a specific second_10 virtual host VH_9_1 having an IP address of 192.168.0.97 and a specific second_11 virtual host VH_9_1 having an IP address of 192.168.0.99 and a specific second_12 virtual host VH_9 1 shows an example of a state in which a specific 2_2 active host AH_2_2 having an IP address of 192.168.0.2 is connected to a specific 2_1 virtual host VH_2_1 having a specific virtual host IP address of 192.168.0.50 and a specific 2_2 virtual host VH_2_2 having a specific virtual host IP address of 192.168.0.100 are generated, and a specific m_1 active host AH_m_1 having an IP address of 192.168.0.32 is connected to a specific m_1 access switch AS_m, and a specific m_1 virtual host VH_m_1 having a specific virtual host IP address of 192.168.0.200 is generated.

[0084] With a specific virtual host VH_*_* generated in a specific access switch AS_1 to AS_m of a specific network 200_1 by the above-mentioned method, the process in which the specific access switch AS_1 to AS_m detects a cyber threat using the virtual host will be described below with reference to Figures 1 and 4. For reference, the specific active host posing a cyber threat in Figure 4 is assumed to be the 1_1st active host AH_1_1 in Figure 1, and the specific access switch AS in Figure 4 is assumed to be any one of the specific 1st access switch AS_1 to mth access switch AS_m in Figure 1, and it is assumed that one specific virtual host VH has been generated.

[0085] A specific active host AH_1_1 infected with malware can transmit (S210) a host scan packet to search for hosts connected to the specific network 200_1 through a specific first access switch AS_1 to a specific active host AH_*_* and a specific virtual host VH_*_* of the specific network 200_1 in order to infect other hosts connected to the specific network 200_1.

[0086] Then, the host scan packet transmitted from a specific active host AH_1_1 can be received by a specific access switch 200, which is any one of the specific first access switch AS_1 to the specific mth access switch AS_m installed in a specific network 200_1, and the specific access switch 200 that receives the host scan packet can check whether the destination IP address of the host scan packet corresponds to at least one specific virtual host IP address that has been previously set up.

[0087] Then, after checking whether the destination IP address of the host scan packet corresponds to a specific virtual host IP address, if it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, the specific access switch 200 can transmit the host scan packet to the specific virtual host VH by referring to the specific virtual host MAC address that matches the specific virtual host IP address.

[0088] In this case, the destination IP address of the host scan packet may be a specific IP address for scanning a specific host, or a broadcast IP address for scanning all hosts in the network.

[0089] Therefore, a particular access switch 200 can check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a particular virtual host IP address, transmit the host scan packet to a particular virtual host VH.

[0090] Alternatively, a particular access switch 200 may check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a broadcast IP address, the particular access switch 200 may perform a process of broadcasting the host scan packet to active hosts on a particular network 200_1 via the network stack, and a process of duplicating the host scan packet and transmitting it to a particular virtual host VH.

[0091] Through the above-described operations, when a host scan packet is transmitted to a specific virtual host VH, i.e., when a specific access switch 200 transmits the host scan packet to a specific security engine in which the specific virtual host VH was generated, the specific security engine can generate a response packet that corresponds to the specific host scan method used in the host scan packet and includes the MAC address of the specific virtual host.

[0092] In this case, a specific security engine may store a pre-defined host scan method for checking a specific host scan method of a host scan packet, and the pre-defined host scan method may include scan methods used in common networks, such as Internet Control Message Protocol (ICMP) scan and Transmission Control Protocol (TCP) scan, scan methods used by confirmed malware, such as Server Message Block (SMB) scan, NetBIOS scan, NetBIOS Name Service (NBNS) scan, and all scan methods used by confirmed malware as well as common networks, such as ARP scan.

[0093] Then, the specific access switch 200 can transmit the response packet generated by the specific security engine to the specific active host AH_1_1 (S220). That is, the specific access switch 200 can respond to the specific virtual host VH scan performed by the specific active host AH_1_1 and execute a virtual host response to enable the specific active host AH_1_1 to recognize the specific virtual host VH as a host that can be infected.

[0094] Thereafter, the specific active host AH_1_1 that has received the response packet may determine that the specific virtual host VH is an infectable host, generate a data packet that includes malware for infecting the specific virtual host VH, has the specific virtual host IP address as a destination IP address and the specific virtual host MAC address as a destination MAC address, and then transmits the data packet to the specific access switch 200 (S230) (here, the data packet may be directly transmitted to the specific access switch 200, or may be transmitted to the specific access switch 200 via another access switch). In other words, the concept of the specific active host AH_1_1 generating a data packet and then transmitting it to the specific access switch 200 may be understood as an attempt to infect the specific virtual host VH.

[0095] Then, the specific access switch 200 can transmit a data packet, whose destination IP address and destination MAC address are transmitted from the specific active host AH_1_1 and correspond to the specific virtual host IP address and the specific virtual host MAC address, to the specific virtual host VH.

[0096] Then, when the data packet is transmitted to the specific virtual host VH, that is, when the specific access switch 200 transmits the data packet to the specific security engine in which the specific virtual host VH is generated, the specific security engine can determine that the data packet is malware and block the specific active host AH_1_1 from the specific network 200_1 through at least one of the specific access switches AS_1 to AS_m installed in the specific network 200_1. That is, the specific access switch 200 can block the specific active host AH_1_1 that attempts to infect the specific virtual host, thereby protecting the specific network 200_1 from cyber threats. This is based on the fact that an attempt to scan and access a virtual host, not an active host that is actually in operation, is not a normal operation, and after recognizing the virtual host generated in the access switch stage as a host that can be infected, the specific active host that attempts a cyber threat to the virtual host is blocked from the specific network, thereby effectively blocking the cyber threat before attempting a cyber threat to other active hosts.

[0097] Meanwhile, a specific security engine of a specific access switch 200 can analyze the data code of the data packet and confirm the analyzed behavior pattern of the data code.

[0098] Then, when the analysis operation pattern for the data packet matches a specific registered operation pattern among the registered operation patterns corresponding to each of the pre-registered malware profiles, a specific security engine of a specific access switch 200 can determine that the data code is specific malware corresponding to the specific registered operation pattern, and can block the specific active host AH_1_1 from the specific network 200_1 through at least one of the specific access switches AS_1 to AS_m.

[0099] Alternatively, if the analyzed behavior pattern does not match each of the registered behavior patterns, a specific security engine of a specific access switch 200 may determine that the data code is unidentified malware, and may block the specific active host AH_1_1 from the specific network 200_1 through at least one of the specific access switches AS_1 to AS_m, and then send an alarm to a specific network controller 220_1 managing the specific network 200_1, or may send an alarm to the specific network controller 220_1 while not blocking the specific active host AH_1_1 from the specific network 200_1, so that the specific network controller 220_1 may decide whether to block the specific active host AH_1_1 from the specific network 200_1.

[0100] At this time, the cybersecurity service providing server 100 generates a malware profile including the behavior pattern of the confirmed malware from the malware database while storing the behavior pattern of the already confirmed malware in the malware database, and transmits the malware profile for the confirmed malware to a specific network controller 220_1, or transmits it to a specific network controller 220_1 via a specific network administrator terminal 210_1, so that the malware profile for the confirmed malware can be registered in each of the specific first security engine of the specific first access switch AS_1 through the specific mth security engine of the specific mth access switch AS_m by the specific network controller 220_1.

[0101] As an example, the malware database may be shown in Table 1 below, and the malware database may store information regarding behavior patterns such as host scanning methods, protocols, and approach methods for confirmed malware. However, the present invention is not limited thereto, and may include various information for confirming malware behavior patterns.

[0102] [Table 1]

[0103] Additionally, a specific security engine of a specific access switch 200 may transmit a security log including at least one of the host scan packets and the data packets corresponding to the unidentified malware to a specific network controller 220_1.

[0104] Referring again to Figures 1 to 3, the cybersecurity service providing server 100 can collect (S300) security logs including at least a portion of host scan packets and data packets corresponding to unidentified malware from at least one network that subscribes to a cybersecurity service.

[0105] In other words, the cybersecurity service providing server 100 can obtain a security log including at least a portion of the host scan packets and data packets corresponding to the unconfirmed malware from a specific network controller 220_1 in a specific network 200_1 in which the unconfirmed malware was detected, or can obtain a security log including at least a portion of the host scan packets and data packets corresponding to the unconfirmed malware from a specific network administrator terminal 210_1 corresponding to the specific network 200_1.

[0106] The cybersecurity service providing server 100 can then add information about the unconfirmed malware to the malware database, as shown in Table 2 below.

[0107] [Table 2]

[0108] The cybersecurity service providing server 100 can then analyze the behavior patterns of unconfirmed malware and update the malware database by referring to the results of the analysis of the unconfirmed malware.

[0109] In addition, the cybersecurity service providing server 100 can generate an unconfirmed malware profile for the unconfirmed malware, which includes an operation pattern for the unconfirmed malware (S400).

[0110] Thereafter, the cybersecurity service providing server 100 can transmit malware profile update notification information to a specific network administrator terminal 210_1, and can obtain malware profile update request information from the specific network administrator terminal 210_1 in response to the malware profile update notification information (S500).

[0111] Then, the cybersecurity service providing server 100 can confirm (S600) the malware profile update authority information for the specific network 200_1 based on the subscription information of a specific cybersecurity service for the specific network 200_1 that requested the malware profile update.

[0112] At this time, by referring to the subscription information of a specific cybersecurity service for the specific network 200_1, it is confirmed whether the specific network 200_1 has the authority to update the malware profile for updating the malware profile. If the specific network 200_1 has the authority to update the malware profile, the cybersecurity service providing server 100 can update the malware profile for the specific network 200_1 (S700).

[0113] As an example, referring to FIG. 5, the cybersecurity service providing server 100 can transmit an unconfirmed malware profile for unconfirmed malware to a specific network controller 220_1, or have it transmitted to a specific network controller 220_1 via a specific network administrator terminal 210_1, so that the specific network controller 220_1 can use the unconfirmed malware profile to update pre-registered malware profiles of a specific first security engine of a specific first access switch AS_1 through a specific mth security engine of a specific mth access switch AS_m.

[0114] On the other hand, when it is determined by referring to the subscription information of a specific cybersecurity service for a specific network 200_1 whether the specific network 200_1 has malware profile update authority for updating the malware profile and it is determined that the specific network 200_1 does not have malware profile update authority, the cybersecurity service providing server 100 invites an additional subscription for the malware profile update to the specific network administrator terminal 210_1 (S800), and when additional subscription request information for the malware profile update is obtained from the specific network administrator terminal 210_1, it updates the subscription information of the specific cybersecurity service by referring to the additional subscription request information, and transmits the unconfirmed malware profile to the specific network controller 220_1 or transmits it to the specific network controller 220_1 through the specific network administrator terminal 210_1, so that the specific network controller 220_1 can use the unconfirmed malware profile to update the pre-registered malware profile of the specific first security engine of the specific first access switch AS_1 to the specific mth security engine of the specific mth access switch AS_m (S700).

[0115] At this time, the cybersecurity service providing server 100 may refer to subscription information for a specific cybersecurity service for a specific network 200_1, and if there is a remaining valid update period for which a payment has been made in relation to the malware profile update, the cybersecurity service providing server 100 may perform a malware update operation for the specific network 200_1 without sending malware profile update notification information to the specific network administrator terminal 210_1.

[0116] In addition, the cybersecurity service providing server 100 can refer to subscription information for a specific cybersecurity service for a specific network 200_1, and perform a malware update operation for a specific network 200_1 without sending malware profile update notification information to a specific network administrator terminal 210_1, even if post-paid payment information is registered in connection with the malware profile update.

[0117] Furthermore, when the cybersecurity service providing server 100 determines that an unconfirmed malware profile is to be transmitted to a specific network controller 220_1 through a specific network administrator terminal 210_1, it can transmit the unconfirmed malware profile to the specific network administrator terminal 210_1 through at least one of SMS, a messaging app, and an email corresponding to the specific network administrator terminal 210_1.

[0118] Thereafter, when the cybersecurity service providing server 100 completes updating of the pre-registered malware profile in the specific network 200_1, it can transmit update history information of the malware profile to the specific network administrator terminal 210_1.

[0119] In this case, the cybersecurity service providing server 100 can transmit update history information of the malware profile to a specific network administrator terminal 210_1 at a preset time period or at a specific time based on subscription information of a specific cybersecurity service.

[0120] Meanwhile, the cybersecurity service providing server 100 collects security logs corresponding to specific malware including at least a portion of the host scan packets and data packets corresponding to specific malware, or security logs for unconfirmed malware including at least a portion of the host scan packets and data packets corresponding to unconfirmed malware, classifies the security logs including at least a portion of the data packets and host scan packets as either security logs corresponding to specific malware or security logs corresponding to unconfirmed malware, and stores and manages the security logs as back data for subsequent analysis.

[0121] The above-described embodiments of the present invention may be realized in the form of program instructions that can be executed by various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention, or may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROMs, RAMs, and flash memories. Examples of program instructions include not only machine code, such as produced by a compiler, but also high-level language code that may be executed by a computer using an interpreter, etc. The hardware devices may be configured to operate as one or more software modules to perform the processes according to the present invention, and vice versa.

[0122] Although the present invention has been described above by using specific details such as concrete components and limited examples and drawings, this is merely provided to facilitate a more comprehensive understanding of the present invention, and the present invention is not limited to the above examples. Those skilled in the art will appreciate that various modifications and variations can be made from such descriptions.

[0123] Therefore, the spirit of the present invention should not be limited to the embodiments described above, and all modifications equivalent to or equivalent to the scope of the claims below, as well as the scope of the spirit of the present invention, are intended to fall within the scope of the spirit of the present invention. [Explanation of symbols]

[0124] 1000 Cybersecurity Service Provision System 100 Cybersecurity service provider servers 200_1 to 200_n 1st network to nth network 210_1 to 210_n: first network manager terminal to n-th network manager terminal 220_1 to 220_n First network controller to nth network controller

Claims

1. 1. A method for providing a cybersecurity service for detecting cyber threats to a network by using a virtual host, (a) when subscription request information for a cybersecurity service is acquired from a specific network administrator terminal which is at least one of the first network administrator terminal through the nth network administrator terminal that manages each of the first network through the nth network (where n is an integer equal to or greater than 1) that constitute an independent network, a cybersecurity service providing server refers to the subscription request information and registers subscription information for a specific cybersecurity service for a specific network corresponding to the specific network administrator terminal; (b) the cybersecurity service providing server, by referring to subscription information of the specific cybersecurity service, causes a specific network controller that manages the specific network to (i) generate at least one specific first virtual host IP address or at least one specific m-th virtual host IP address by using a specific unused host address that is not used by a specific active host that is a host connected to a switching port of a specific first access switch or a specific m-th access switch (where m is an integer equal to or greater than 1) that enables a host belonging to the specific network to communicate within the specific network, and generates at least one specific first virtual host MAC address corresponding to the specific first virtual host IP address or at least one specific m-th virtual host MAC address corresponding to the specific m-th virtual host IP address; and (ii) generates at least one specific first virtual host MAC address corresponding to the specific m-th virtual host IP address by using a specific unused host address that is not used by a specific active host that is a host connected to a switching port of a specific first access switch or a specific m-th access switch (where m is an integer equal to or greater than 1) that enables a host belonging to the specific network to communicate within the specific network, and transmitting each of the specific first virtual host IP address through the specific m-th virtual host MAC address to the specific first access switch through the specific m-th access switch, respectively, and generating at least one specific first virtual host through the specific m-th virtual host IP address corresponding to the specific first virtual host IP address and at least one specific m-th virtual host corresponding to the specific m-th virtual host MAC address in each of the specific first security engine set inside the specific first access switch through the specific m-th access switch, respectively, using at least one of the specific first virtual host IP address through the specific m-th virtual host IP address,determining a specific active host that performs a function of scanning at least one of the specific first virtual host through the specific m-th virtual host and a function of transmitting a data packet to at least one of the specific first virtual host through the specific m-th virtual host via at least one of the specific first security engine through the specific m-th security engine, and blocking the specific active host from the specific network; The method includes:

2. Before the step (b), the cybersecurity service providing server generates a malware profile including an operation pattern of the pre-confirmed malware from a malware database storing the operation pattern of the pre-confirmed malware, and transmits the malware profile for the pre-confirmed malware to the specific network controller, or transmits the malware profile to the specific network controller via the specific network administrator terminal, so that the malware profile for the pre-confirmed malware is registered in the specific first security engine through the specific m-th security engine by the specific network controller; In the step (b), The cyber security service providing server analyzes the data code of the data packet using any one of the specific first security engine through the specific m-th security engine, and checks an analysis behavior pattern obtained by analyzing a behavior pattern of the data code, and (i) determines that the data code is a specific malware corresponding to the specific registered behavior pattern when a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles matches the analysis behavior pattern, and transmits the specific active malware to at least one of the specific first access switch through the specific m-th access switch. The method of claim 1, further comprising: (i) determining that the data code is unidentified malware if each of the registered behavior patterns does not match the analyzed behavior pattern; and (ii-1) sending an alarm to the specific network controller after the specific active host is blocked from the specific network through at least one of the specific first access switch through the specific mth access switch; and (ii-2) sending the alarm to the specific network controller without blocking the specific active host from the specific network.

3. (c) when the cybersecurity service providing server acquires a security log corresponding to the unconfirmed malware from the specific network controller or the specific network administrator terminal (the security log includes a host scan packet corresponding to the unconfirmed malware and at least a portion of the data packet), the cybersecurity service providing server updates the malware database by referring to a result of analyzing the unconfirmed malware, generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmits malware profile update notification information to the specific network administrator terminal; (d) when malware profile update request information is acquired from the specific network administrator terminal in response to the malware profile update notification information, the cybersecurity service providing server refers to subscription information of the specific cybersecurity service to confirm whether the specific network has malware profile update authority for updating the malware profile, and if it is confirmed that the specific network has malware profile update authority, transmits the unconfirmed malware profile to the specific network controller, or transmits it to the specific network controller via the specific network administrator terminal, and uses the unconfirmed malware profile to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine using the unconfirmed malware profile; The method of claim 2 , further comprising:

4. In the step (d), The method of claim 3, wherein when it is confirmed that the specific network does not have the authority to update the malware profile, the cybersecurity service providing server requests an additional subscription for updating the malware profile from the specific network administrator terminal, and when additional subscription request information for updating the malware profile is obtained from the specific network administrator terminal, the cybersecurity service providing server updates the subscription information of the specific cybersecurity service by referring to the additional subscription request information, and transmits the unconfirmed malware profile to the specific network controller, or transmits it to the specific network controller via the specific network administrator terminal, and uses the unconfirmed malware profile to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine using the unconfirmed malware profile.

5. In the step (d), The method of claim 3, wherein when the cybersecurity service providing server transmits the unconfirmed malware profile to the specific network controller through the specific network administrator terminal, the cybersecurity service providing server transmits the unconfirmed malware profile to the specific network administrator terminal via at least one of SMS, a messaging app, and an email corresponding to the specific network administrator terminal.

6. (e) when the cybersecurity service providing server completes updating the pre-registered malware profile, transmitting malware profile update history information to the specific network administrator terminal. The method of claim 3 further comprising:

7. The method of claim 6, wherein the cybersecurity service providing server transmits update history information of the malware profile to the specific network administrator terminal at a predetermined time period or at a specific time based on subscription information of the specific cybersecurity service.

8. In the step (b), The method of claim 1, wherein the cybersecurity service providing server uses the specific network controller to group the specific unused host addresses into 1_1 group through 1_n group, and generates the specific 1st virtual host IP address by referencing the specific unused host addresses of the 1_1 group through the specific mth virtual host IP address by referencing the specific unused host addresses of the 1_n group.

9. In the step (b), The method of claim 1, wherein the cybersecurity service providing server uses the specific network controller to group all specific host addresses of the specific network into a 2_1 group through a 2_n group, and generates the specific first virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_1 group through the specific mth virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_n group.

10. In the step (b), 2. The method of claim 1, wherein, when the number of specific virtual hosts to be generated on the specific network by the specific network controller is k (where k is an integer equal to or greater than m), the network controller groups all specific host addresses of the specific network into 3_1 group through 3_m group, generates a specific 3_1 virtual host IP address referencing one specific unused host address in the 3_1 group through a specific 3_k virtual host IP address referencing one specific unused host address in the 3_m group, and groups the specific 3_1 virtual host IP addresses through the specific 3_k virtual host IP addresses into m groups to generate the specific 1 virtual host IP address through the specific m-th virtual host IP address.

11. A cybersecurity service providing server that uses a virtual host to provide a cybersecurity service that detects cyberthreats to a network, A memory storing instructions for providing a cybersecurity service that detects cyber threats to a network using a virtual host; a processor that performs operations according to the instructions stored in the memory to provide a cybersecurity service utilizing the virtual host to detect cyber threats to the network; Including, The processor includes: (I) a process of registering subscription information for a specific cybersecurity service for a specific network corresponding to a specific network administrator terminal by referring to the subscription request information when subscription request information for a cybersecurity service is acquired from a specific network administrator terminal which is at least one of a first network administrator terminal through an n-th network administrator terminal that manages each of the first network through an n-th network (where n is an integer equal to or greater than 1) constituting an independent network; and (II) a process of registering subscription information for a specific cybersecurity service for a specific network corresponding to the specific network administrator terminal by referring to the subscription information for the specific cybersecurity service, using a specific network controller that manages the specific network by referring to the subscription information for the specific cybersecurity service, (i) using a specific unused host address that is not used by a specific active host that is a host connected to a switching port of a specific first access switch through a specific m-th access switch (where m is an integer equal to or greater than 1) that enables a host belonging to the specific network to communicate within the specific network, (ii) generating at least one specific first virtual host IP address through at least one specific m-th virtual host IP address, and generating at least one specific first virtual host MAC address corresponding to the specific first virtual host IP address through at least one specific m-th virtual host MAC address corresponding to the specific m-th virtual host IP address; and (ii) transmitting each of the specific first virtual host IP address and the specific first virtual host MAC address through the specific m-th access switch to each of the specific first access switch through the specific m-th access switch, to a specific first security engine through a specific m-th security engine configured inside the specific first access switch,A cybersecurity service providing server that executes a process of generating at least one specific first virtual host corresponding to the specific first virtual host IP address and the specific first virtual host MAC address through the specific m-th virtual host IP address and at least one specific m-th virtual host corresponding to the specific m-th virtual host MAC address, determining a specific active host that performs a function of scanning at least one of the specific first virtual host through the specific m-th virtual host using at least one of the specific first virtual host IP address through the specific m-th virtual host IP address and a function of transmitting a data packet to at least one of the specific first virtual host through the specific m-th virtual host via at least one of the specific first security engine through the specific m-th security engine, and blocking the specific active host from the specific network.

12. The processor, prior to the (II) process, generates a malware profile including an operation pattern of the pre-confirmed malware from a malware database storing operation patterns of the pre-confirmed malware, and transmits the malware profile for the pre-confirmed malware to the specific network controller, or transmits the malware profile to the specific network controller via the specific network administrator terminal, so that the malware profile for the pre-confirmed malware is registered in the specific first security engine through the specific m-th security engine by the specific network controller; In the process (II), a specific security engine among the specific first security engine through the specific m-th security engine that receives the data packet is used to analyze a data code of the data packet and confirm an analysis behavior pattern obtained by analyzing a behavior pattern of the data code, and (i) when a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles matches the analysis behavior pattern, the data code is determined to be a specific malware corresponding to the specific registered behavior pattern, and the specific active host is connected to the specific network through at least one of the specific first access switch through the specific m-th access switch. (ii) determining that the data code is unconfirmed malware if each of the registered operation patterns does not match the analyzed operation pattern; and (ii-1) executing one of the following processes: a process of blocking the specific active host from the specific network through at least one of the specific first access switch through the specific mth access switch, and then sending an alarm to the specific network controller; and (ii-2) a process of sending the alarm to the specific network controller while the specific active host is not blocked from the specific network.

13. The processor further includes: (III) a process for updating the malware database by referring to a result of analyzing the unconfirmed malware when a security log corresponding to the unconfirmed malware (the security log includes at least a portion of the host scan packet and the data packet corresponding to the unconfirmed malware) is acquired from the specific network controller or the specific network administrator terminal, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmitting malware profile update notification information to the specific network administrator terminal; and (IV) a process for updating the malware database by referring to a result of analyzing the unconfirmed malware when a security log corresponding to the unconfirmed malware is acquired from the specific network controller or the specific network administrator terminal in response to the malware profile update notification information, The cybersecurity service providing server of claim 12, further comprising a process of: referring to subscription information of a security service to check whether the specific network has malware profile update authority for updating a malware profile; and if it is confirmed that the specific network has malware profile update authority, transmitting the unconfirmed malware profile to the specific network controller or transmitting the unconfirmed malware profile to the specific network controller via the specific network administrator terminal, and using the specific network controller to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine.

14. The cybersecurity service providing server of claim 13, wherein when it is confirmed in process (IV) that the specific network does not have the authority to update the malware profile, the processor requests an additional subscription for the update of the malware profile from the specific network administrator terminal, and when additional subscription request information for the update of the malware profile is obtained from the specific network administrator terminal, the processor updates the subscription information of the specific cybersecurity service by referring to the additional subscription request information, and transmits the unconfirmed malware profile to the specific network controller or transmits it to the specific network controller via the specific network administrator terminal, thereby using the unconfirmed malware profile to update the pre-registered malware profiles of the specific first security engine to the specific mth security engine using the specific network controller.

15. The cybersecurity service providing server of claim 13, wherein in the (IV) process, when the processor is to transmit the unconfirmed malware profile to the specific network controller through the specific network administrator terminal, the processor transmits the unconfirmed malware profile to the specific network administrator terminal via at least one of SMS, a messaging app, and email corresponding to the specific network administrator terminal.

16. The cybersecurity service providing server of claim 13 , wherein the processor further executes a process of (V) transmitting malware profile update history information to the specific network administrator terminal when the update of the pre-registered malware profile is completed.

17. The cybersecurity service providing server of claim 16, wherein the processor transmits update history information of the malware profile to the specific network administrator terminal at a predetermined time period or at a specific time based on subscription information of the specific cybersecurity service.

18. The cybersecurity service providing server of claim 11, wherein in the (II) process, the processor uses the specific network controller to group the specific unused host addresses into groups 1_1 through 1_n, and generates the specific first virtual host IP address that references the specific unused host addresses of the 1_1 group through the specific mth virtual host IP address that references the specific unused host addresses of the 1_n group.

19. The cybersecurity service providing server of claim 11, wherein in the process (II), the processor uses the specific network controller to group all specific host addresses of the specific network into a 2_1 group through a 2_n group, and generates the specific first virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_1 group through the specific mth virtual host IP address by referencing a specific unused host address among all specific host addresses of the 2_n group.

20. 12. The cybersecurity service providing server of claim 11, wherein in the process (II), when the number of specific virtual hosts to be generated on the specific network using the specific network controller is k (where k is an integer equal to or greater than m), the processor groups all specific host addresses of the specific network into a 3_1 group through a 3_m group, generates a specific 3_1 virtual host IP address that references one specific unused host address in the 3_1 group through a specific 3_k virtual host IP address that references one specific unused host address in the 3_m group, and groups the specific 3_1 virtual host IP addresses through the specific 3_k virtual host IP addresses into m addresses to generate the specific 1 virtual host IP address through the specific m-th virtual host IP address.

Images