Method for detecting cyber threats to a network using an access switch and a network controller using the same

Abstract

A method for detecting cyber threats posed by hosts on a network is provided by utilizing an access switch to which the hosts on the network are connected. [Solution] In a cyber threat detection system 1000, a network controller 100 detects cyber threat events against active hosts AH_1_1 to AH_m_1 connected to the switching ports of access switches 200_1 to 200_m that enable communication with each other within the network, uses a dynamic time window having a predetermined time size and that moves over time to refer to a specific type of cyber threat event for each active host that is located within a specific dynamic time window at a specific time, generates a cyber threat level score for each active host, and detects cyber threats against each active host using the generated cyber threat level scores.

Description

[Technical field]

[0001] The present invention relates to a method for detecting cyber threats to a network, and more particularly to a method for detecting cyber threats from hosts on a network by utilizing an access switch to which the hosts of the network are connected. [Background technology]

[0002] A cyber threat is a malicious and deliberate attempt by an individual or organization to compromise the security of the information systems of another individual or organization, usually with the attacker seeking to disrupt the victim's network in order to gain some kind of benefit.

[0003] Such cyber threats come in a variety of forms, including malware, phishing, man-in-the-middle (MitM) attacks, Denial of Service (DoS) attacks, and zero-day exploits.

[0004] To prevent such cyber threats, network-based security devices such as firewalls, IPS, UTM, and web firewalls separate external and internal networks and analyze and protect traffic flowing from the external network to the internal network and traffic flowing from the internal network to the outside, thereby protecting the entire network.

[0005] Meanwhile, in order to ensure the reliability of network communications by blocking harmful traffic that can infect hosts on the internal network with viruses or other infections and cause performance degradation and failures in network core devices, and to prevent the secondary spread of infection to other hosts, there has been growing interest in security switches that analyze the traffic generated on the internal network and block the traffic at the switch level if it is determined to be harmful traffic or a cyber threat.

[0006] In such security switches, the typical way to judge cyber threats is to detect an action of one host searching for multiple hosts, or an action of multiple hosts transmitting a large amount of traffic to one host.

[0007] However, there are clear limitations to the application of such security switches in a network environment where various devices and operating environments are intricately intertwined.

[0008] In addition, responding to cyber threats using such security switches has the limitation that it is necessary to distinguish between positive detection and situations in which a threat is actually detected, and it cannot respond to the various changes in the form of cyber attacks.

[0009] In addition, low CPU performance and insufficient memory limit the ability to monitor all traffic occurring on the network.

[0010] Therefore, the present applicant aims to propose a method for overcoming low CPU performance and memory shortage, detecting various forms of threatening behavior occurring in a network, reducing the probability of undetection and false detection, and improving the correct detection rate. Summary of the Invention [Problem to be solved by the invention]

[0011] An object of the present invention is to solve all of the problems of the prior art mentioned above.

[0012] Another object of the present invention is to enable detection of cyber threats posed by hosts on a network by utilizing an access switch to which the hosts of the network are connected.

[0013] Another object of the present invention is to overcome the low CPU performance and memory shortage of access switches, detect various types of threatening behavior occurring in a network, reduce the probability of undetection and false detection, and improve the correct detection rate.

[0014] Another object of the present invention is to monitor the cyber threat level of a host using a cyber threat event detected through an access switch, thereby enabling immediate response to a cyber threat in a network.

[0015] It is yet another object of the present invention to make it possible to pose a cyber threat to a virtual host created in an access switch, thereby enabling the host posing a cyber threat to be blocked from the network.

[0016] It is yet another object of the present invention to detect cyber threats to a host using an access switch, thereby enabling efficient response to changes in the form of cyber attacks. [Means for solving the problem]

[0017] In order to achieve the above object of the present invention, the typical features of the present invention are as follows:

[0018] According to one embodiment of the present invention, a method for detecting a cyber threat to a network using an access switch is provided, the method including: (a) a network controller detecting, through at least a portion of the access switch, at least one first type cyber threat event to at least one kth type cyber threat event (wherein the k is an integer equal to or greater than 1) for a first active host to an nth active host (wherein the n is an integer equal to or greater than 1) connected to a switching port of the access switch that enables hosts to communicate with each other in the network; and (b) the network controller generating first to nth cyber threat level scores for each of the first active host to the nth active host by referring to at least one specific type cyber threat event for each of the first active host to the nth active host that is located within a specific dynamic time window at at least one specific time among the first type cyber threat events to the kth type cyber threat events, using a dynamic time window having a preset time size and moving over time, and detecting a cyber threat to the first active host to the nth active host by using the first to nth cyber threat level scores, respectively.

[0019] In one example, the first type cyber threat event through the kth type cyber threat event include at least some of a malware infection event detecting a state in which each of the first active host through the nth active host is infected with malware, a C&C server connection event detecting a state in which each of the first active host through the nth active host connects to a C&C (Command & Control) server, a network scanning event detecting a state in which each of the first active host through the nth active host scans at least one other active host or at least one virtual host generated on the network, a malware spreading event detecting a state in which each of the first active host through the nth active host attempts to infect the at least one other active host or the at least one virtual host with malware, and a cyber attack event detecting a state in which each of the first active host through the nth active host performs a cyber attack on at least one other active host.

[0020] In one example, the first type cyber threat event through the kth type cyber threat event include at least a portion of a network scanning event that detects a state in which at least one of the first active host through the nth active host is scanning at least one virtual host generated on the network, and a malware spreading event that detects a state in which at least one of the first active host through the nth active host is attempting to infect the at least one virtual host with malware.

[0021] In one example, before the step (a), (a01) the network controller creates at least one first virtual host IP (Internet Protocol (IP)) by using an unused host address not used by the first active host to the nth active host among all host addresses of the network. and (a02) the network controller transmitting each of the first virtual host IP address, the first virtual host MAC address, and the mth virtual host IP address to each of the first access switch to the mth access switch, so as to cause each of the first access switch to generate, in each of the first security engine set inside the first access switch to the mth security engine set inside the mth access switch, at least one first virtual host referencing the first virtual host IP address and the first virtual host MAC address through at least one mth virtual host referencing the mth virtual host IP address and the mth virtual host MAC address.

[0022] In one example, in step (b), the network controller may execute at least one of the following processes: (i) using at least one of the first security engine of the first access switch through the m security engine of the m access switch to scan at least one of the first virtual host through the m virtual host IP addresses, and then blocking from the network a specific active host that transmits a data packet for attempting to infect at least one of the first virtual host through the m virtual host with malware; and (ii) after the network scanning event of scanning at least one of the first virtual host through the m virtual host IP addresses using at least one of the first virtual host through the m virtual host IP addresses is detected, blocking from the network a specific active host in which the malware spreading event is detected that transmits a data packet for attempting to infect at least one of the first virtual host through the m virtual host with malware.

[0023] In one example, the network controller generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns for already confirmed malware, transmits the malware profile for the confirmed malware to each of the first security engine through the mth security engine, and registers the malware profile for the confirmed malware with each of the first security engine through the mth security engine. In the step (b), the network controller uses a specific security engine corresponding to a specific virtual host that received the data packet to analyze a data code of the data packet and checks an analyzed operation pattern obtained by analyzing the operation pattern of the data code, and (i) if the analyzed operation pattern matches a specific registered operation pattern among registered operation patterns corresponding to each of the previously registered malware profiles, registers the malware profile for the confirmed malware with each of the first security engine through the mth security engine. and (ii) determining that the data code is a specific malware corresponding to the specific registered behavior pattern and blocking the specific active host from the network through at least one of the first access switch to the mth access switch; (ii) if the analyzed behavior pattern does not match each of the registered behavior patterns, determining that the data code is an unidentified malware, (ii-1) blocking the specific active host from the network through at least one of the first access switch to the mth access switch, and then sending an alarm to the network controller; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in deciding whether to block the specific active host from the network.

[0024] In one example, the method further includes the step of (c) when the network controller receives a host scan packet corresponding to the unconfirmed malware and the data packet from the specific security engine, updating the malware database by referring to a result of analyzing the unconfirmed malware, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmitting the unconfirmed malware profile to each of the first security engine through the mth security engine, thereby updating the pre-registered malware profile by each of the first security engine through the mth security engine.

[0025] In one example, (d) when a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware are received from the specific security engine, the network controller classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

[0026] In one example, in step (a01), when the number of virtual hosts to be generated on the network is p (where p is an integer greater than or equal to m), the network controller may group all of the host addresses into a first group through a p-th group, generate a first available virtual host IP address that references one unused host address in the first group through a p-th available virtual host IP address that references one unused host address in the p-th group, and group the first available virtual host IP address through the p-th available virtual host IP address into m groups to generate the first through m virtual host IP addresses.

[0027] In one example, in step (b), when the preset time size of the dynamic time window is s, the network controller generates the first cyber threat score through the nth cyber threat score, respectively, by adding up at least one specific standard score corresponding to the at least one specific type of cyber threat event that occurred between time (ts) and time t for each of the first active host through the nth active host at the current time t, and may set first weights through kth weights, respectively, for the first standard score corresponding to the first type of cyber threat event through the kth standard score corresponding to the kth type of cyber threat event.

[0028] In one example, the method further includes: (e) when the network controller obtains cyber threat level status request information for a specific active host, which is at least one of the first active host to the nth active host, displaying each of the at least one specific type of cyber threat event detected at the specific active host among the first type of cyber threat event to the kth type of cyber threat event on a time axis, and generating and displaying each specific cyber threat level score by referring to the at least one specific type of cyber threat event located within the dynamic time window at each detection time when each of the at least one specific type of cyber threat event was detected.

[0029] According to another embodiment of the present invention, a network controller for detecting a cyber threat to a network using an access switch includes: a memory storing instructions for detecting a cyber threat to a network using an access switch; and a processor executing an operation for detecting the cyber threat to the network using the access switch according to the instructions; wherein the processor is configured to: (I) detect at least one first type cyber threat event through at least one k-th type cyber threat event (wherein k is an integer greater than or equal to 1) for a first active host through an n-th active host (wherein n is an integer greater than or equal to 1) connected to a switching port of the access switch that enables hosts to communicate with each other in the network; and (II) a process of detecting cyber threats to the first active host through a dynamic time window having a predetermined time size and moving over time, by referring to at least one specific type of cyber threat event for each of the first active host through the nth active host that is located within a specific dynamic time window at at least one specific time among the first type through the kth type of cyber threat events, using a dynamic time window having a predetermined time size and moving over time, to generate first cyber threat level scores through nth cyber threat level scores for each of the first active host through the nth active host, and detecting cyber threats to the first active host through the nth active host using the first cyber threat level scores through nth cyber threat level scores, respectively.

[0030] In one example, the first type cyber threat event through the kth type cyber threat event include at least some of a malware infection event detecting a state in which each of the first active host through the nth active host is infected with malware, a C&C server connection event detecting a state in which each of the first active host through the nth active host connects to a C&C (Command & Control) server, a network scanning event detecting a state in which each of the first active host through the nth active host scans at least one other active host or at least one virtual host generated on the network, a malware spreading event detecting a state in which each of the first active host through the nth active host attempts to infect the at least one other active host or the at least one virtual host with malware, and a cyber attack event detecting a state in which each of the first active host through the nth active host performs a cyber attack on at least one other active host.

[0031] In one example, the first type cyber threat event through the kth type cyber threat event include at least a portion of a network scanning event that detects a state in which at least one of the first active host through the nth active host is scanning at least one virtual host generated on the network, and a malware spreading event that detects a state in which at least one of the first active host through the nth active host is attempting to infect the at least one virtual host with malware.

[0032] In one example, before the process (I), the processor (I01) generates at least one first virtual host IP (Internet Protocol (IP)) by using an unused host address not used by the first active host to the nth active host among all host addresses of the network. and (I02) a process of transmitting each of the first virtual host IP address and the first virtual host MAC address through the mth virtual host IP address and the mth virtual host MAC address to a first access switch through the mth access switch, respectively, to generate, by each of the first access switch through the mth access switch, at least one first virtual host referring to the first virtual host IP address and the first virtual host MAC address through at least one mth virtual host referring to the mth virtual host IP address and the mth virtual host MAC address in a first security engine through an mth security engine set inside the first access switch, respectively.

[0033] In one example, the processor may execute at least one of the following processes in the process (II): (i) a process of scanning at least one of the first virtual host through the mth virtual host IP address using at least one of the first security engine of the first access switch through the mth security engine of the mth access switch, and then blocking from the network a specific active host that transmits a data packet for attempting to infect at least one of the first virtual host through the mth virtual host with malware; and (ii) a process of blocking from the network a specific active host in which the malware spreading event is detected that transmits a data packet for attempting to infect at least one of the first virtual host through the mth virtual host with malware after the network scanning event is detected in which the network scanning event is detected in which the malware spreading event is detected that transmits a data packet for attempting to infect at least one of the first virtual host through the mth virtual host IP address.

[0034] In one example, the processor generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns for already confirmed malware, transmits the malware profile for the confirmed malware to each of the first security engine through the mth security engine, and registers the malware profile for the confirmed malware with each of the first security engine through the mth security engine. In the (II) process, the processor checks, with a specific security engine corresponding to a specific virtual host that received the data packet, an analyzed operation pattern obtained by analyzing a data code of the data packet and analyzing the operation pattern of the data code, and (i) if the analyzed operation pattern matches a specific registered operation pattern among registered operation patterns corresponding to each of the previously registered malware profiles, the data code is registered as a malware profile for the specific security engine that receives the data packet. and (ii) determining that the data code is a specific malware corresponding to a specific registered operation pattern and blocking the specific active host from the network through at least one of the first access switch to the mth access switch; if the analyzed operation pattern does not match each of the registered operation patterns, determining that the data code is unidentified malware, (ii-1) blocking the specific active host from the network through at least one of the first access switch to the mth access switch, and then sending an alarm to the network controller; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in deciding whether to block the specific active host from the network.

[0035] In one example, the processor may further execute a process of (III) updating the malware database by referring to a result of analyzing the unconfirmed malware when a host scan packet and the data packet corresponding to the unconfirmed malware are received from the specific security engine, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, transmitting the unconfirmed malware profile to each of the first security engine through the mth security engine, and updating the pre-registered malware profile by each of the first security engine through the mth security engine.

[0036] In one example, the processor can further execute a process in which (IV) when a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware are received from the specific security engine, the network controller classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

[0037] In one example, in the (I01) process, when the number of virtual hosts to be generated on the network is p (where p is an integer greater than or equal to m), the processor can group all of the host addresses into a first group through a p-th group, generate a first available virtual host IP address that references one unused host address in the first group through a p-th available virtual host IP address that references one unused host address in the p-th group, and group the first available virtual host IP address through the p-th available virtual host IP address into m groups to generate the first virtual host IP address through the m-th virtual host IP address.

[0038] In one example, in the (II) process, when the preset time size of the dynamic time window is s, the processor generates the first cyber threat score through the nth cyber threat score, respectively, by adding up at least one specific reference score corresponding to the at least one specific type of cyber threat event that occurred in each of the first active host through the nth active host between the time (ts) and the time t at the current time t, and can set first weights through kth weights, respectively, to the first reference score corresponding to the first type of cyber threat event through the kth reference score corresponding to the kth type of cyber threat event.

[0039] In one example, the processor may further execute a process of (V) displaying each of at least one specific type of cyber threat event detected at the specific active host among the first type of cyber threat event to the kth type of cyber threat event on a time axis when cyber threat level status request information for a specific active host, which is at least one of the first active host to the nth active host, is obtained, and generating and displaying each specific cyber threat level score by referring to the at least one specific type of cyber threat event located within the dynamic time window at each detection time at which each of the at least one specific type of cyber threat event was detected.

[0040] Additionally, there is further provided a computer readable recording medium for recording a computer program for performing the method of the present invention. Effect of the Invention

[0041] According to the present invention, it becomes possible to detect cyber threats posed by hosts on a network by utilizing an access switch to which the hosts of the network are connected.

[0042] In addition, the present invention overcomes the low CPU performance and memory shortage of access switches, detects various types of threatening behavior occurring in a network, reduces the probability of undetection and false detection, and improves the correct detection rate.

[0043] In addition, according to the present invention, it is possible to monitor the cyber threat level of a host using a cyber threat event detected through an access switch, thereby enabling an immediate response to a cyber threat in a network.

[0044] Furthermore, according to the present invention, it is possible to block hosts posing cyber threats from the network by making the virtual hosts created in the access switch pose cyber threats.

[0045] In addition, according to the present invention, it is possible to detect cyber threats to a host using an access switch, thereby making it possible to efficiently respond to changes in the form of cyber attacks. [Brief description of the drawings]

[0046] The following drawings, attached for use in explaining the embodiments of the present invention, are only a part of the embodiments of the present invention, and a person having ordinary knowledge in the technical field to which the present invention pertains (hereinafter, "ordinary engineers") can derive other drawings based on these drawings without performing inventive work.

[0047] [Figure 1] FIG. 1 is a schematic diagram illustrating a cyber threat detection system for detecting cyber threats to a network using an access switch according to one embodiment of the present invention. [Diagram 2] FIG. 2 is a schematic diagram illustrating a network controller for detecting cyber threats to a network using an access switch according to one embodiment of the present invention. [Diagram 3] FIG. 2 is a schematic diagram illustrating the configuration of an access switch for detecting various types of cyber threat events occurring on an active host according to one embodiment of the present invention. [Figure 4] 1 is a diagram illustrating a process of detecting cyber threats to a network using a virtual host according to one embodiment of the present invention. [Diagram 5] 2 is a schematic diagram illustrating a malware profile update to an access switch according to one embodiment of the present invention. FIG. [Figure 6] FIG. 2 is a schematic diagram illustrating a state in which a cyber threat to a network is detected using an access switch according to one embodiment of the present invention. [Figure 7] 1 is a diagram illustrating a state in which a cyber threat is detected against a specific access host using an access switch according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0048] The following detailed description of the present invention refers to the accompanying drawings, which show, by way of example, specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable one of ordinary skill in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different from one another, but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein can be implemented from one embodiment to another without departing from the spirit and scope of the present invention. It should also be understood that the location or arrangement of individual components within each embodiment can be changed without departing from the spirit and scope of the present invention. Therefore, the following detailed description should not be taken in a limiting sense, and the scope of the present invention should be understood to encompass the scope of the claims and all equivalents thereto. In the drawings, like reference numerals refer to the same or similar components throughout the various aspects.

[0049] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily carry out the present invention.

[0050] FIG. 1 is a schematic diagram of a cyber threat detection system for detecting cyber threats to a network using an access switch according to one embodiment of the present invention, and the cyber threat detection system 1000 may include a network controller 100 and at least one access switch 200_1 to 200_m.

[0051] First, the network controller 100 sets network security for network management and detects cyber threats to the network using the access switches 200_1 to 200_m. It can detect various types of cyber threat events against active hosts AH_*_* connected to the switching ports of the access switches 200_1 to 200_m through the access switches 200_1 to 200_m, generate a cyber threat level score for the active hosts AH_*_* using a dynamic time window, and detect cyber threats against the active hosts AH_*_*.

[0052] In this regard, referring to FIG. 2, the network controller 100 may include a memory 110 storing instructions for detecting cyber threats to the network using an access switch, and a processor 120 that performs operations for detecting cyber threats to the network using the access switch in accordance with the instructions stored in the memory.

[0053] In particular, network controller 100 may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include a computer processor, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, and the like; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0054] The processor 120 of the network controller 100 may include hardware components such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, a data bus, etc. The network controller 100 may further include a software component such as an operating system and an application that executes a specific purpose.

[0055] However, this does not exclude the case where the network controller 100 includes an integrated processor in which a medium, a processor, and a memory for implementing the present invention are integrated.

[0056] Meanwhile, the processor 120 of the network controller 100 can execute a process in accordance with instructions stored in the memory 110 to detect at least one cyber threat event of a first type through at least one cyber threat event of a kth type against the first active host through the nth active host AH_*_*, which are at least one host connected to the switching ports of the access switches 200_1 through 200_m that enable hosts to communicate with each other in the network, through at least some of the access switches 200_1 through 200_m. Then, the processor 120 of the network controller 100, in accordance with the instructions stored in the memory 110, can use a dynamic time window having a predetermined time size and moving over time to reference at least one specific type of cyber threat event for each of the first active host through the nth active host AH_*_* that is located within a specific dynamic time window at at least one specific time among the first type of cyber threat event through the kth type of cyber threat event, to generate a first cyber threat level score through an nth cyber threat level score for each of the first active host through the nth active host AH_*_*, and can execute a process of detecting cyber threats against the first active host through the nth active host AH_*_* using each of the first cyber threat level scores through the nth cyber threat level scores.

[0057] Next, referring back to FIG. 1, each of the first access switch 200_1 through the mth access switch 200_m enables active hosts and virtual hosts to communicate with each other within the network, and may include a memory storing instructions for detecting various types of cyber threat events occurring in the first active host through the nth active host AH_*_*, and a processor that performs operations for detecting various types of cyber threat events occurring in the first active host through the nth active host AH_*_* in accordance with the instructions stored in the memory.

[0058] Specifically, each of the first access switch 200_1 through the mth access switch 200_m may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include a computer processor, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0059] Furthermore, each processor of the first access switch 200_1 to the m-th access switch 200_m may include hardware configurations such as an MPU (Micro Processing Unit) or a CPU (Central Processing Unit), a cache memory, a data bus, etc. Furthermore, each of the first access switch 200_1 to the m-th access switch 200_m may further include a software configuration of an operating system and an application that executes a specific purpose.

[0060] However, this does not exclude the case where each of the first access switch 200_1 to the m-th access switch 200_m includes an integrated processor in which a medium for implementing the present invention, a processor, and a memory are integrated.

[0061] In addition, each of the first access switch 200_1 to the mth access switch 200_m can be configured not only as a physical module that performs an L2 switch function, but also as a logical module such as a virtual switch that performs an L2 switch function in a cloud environment such as OVS (Open vSwitch).

[0062] The configuration state of an access switch according to an embodiment of the present invention will be described below with reference to FIG.

[0063] The access switch 200 according to one embodiment of the present invention may include switch hardware 210 , a communication packet processing module 220 , a network stack 230 , and a security engine 240 .

[0064] Specifically, the switch hardware 210 performs switching operations to forward communication packets received via the network to a destination host, and a virtual host MAC switch may be registered to forward communication packets destined for a virtual host.

[0065] The communication packet processing module 220 analyzes a communication packet received through a network to determine a destination host, and refers to the determined destination host to forward the communication packet to the destination host via the switch hardware 210. The communication packet processing module 220 can analyze a communication packet transmitted from an active host to detect various types of cyber threat events. If the communication packet is for a virtual host, the communication packet processing module 220 transmits the communication packet to the security engine 240, and if the communication packet is for broadcast, the communication packet processing module 220 can execute a process of broadcasting the communication packet to other active hosts via the network stack 230 and a process of duplicating the communication packet and transmitting it to the security engine 240. In addition, the communication packet processing module 220 can forward a communication packet generated by a virtual host, i.e., the security engine 240, to a destination host via the switch hardware 210.

[0066] Furthermore, the network stack 230 can forward communication packets addressed to hosts connected to other access switches to the other access switches via the switch hardware 210.

[0067] Meanwhile, when at least one virtual host VH is generated, the security engine 240 analyzes a host scan packet transmitted to the virtual host, identifies a specific host scan method used in the host scan packet from among pre-defined host scan methods, and generates and transmits a response packet. When a data packet is transmitted to the virtual host in response to the response packet, the security engine 240 can determine that the data packet is malware and block the specific active host that transmitted the data packet from the network to the virtual host through at least one of the access switches.

[0068] In addition, in the above, the access switch 200 is described as being configured with physical modules as an example, but the present invention is not limited to this, and the access switch 200 may also be configured with logical modules that perform L2 switch functions through a virtual switch such as OVS. A method for detecting cyber threats to a network using an access switch through a cyber threat detection system according to an embodiment of the present invention configured as described above will be described below with reference to Figures 1 and 3.

[0069] The network controller 100 can detect at least one cyber threat event of a first type through at least one cyber threat event of a kth type through the first access switch 200_1 through the mth access switch 200_m, which enable hosts to communicate with each other in the network, through the first active host through the nth active host AH_*_* connected to the switching ports of the first access switch 200_1 through the mth access switch 200_m.

[0070] In this case, the first type cyber threat event to the kth type cyber threat event may include at least some of a malware infection event detecting a state in which each of the first active host through the nth active host AH_*_* is infected with malware, a C&C server connection event detecting a state in which each of the first active host through the nth active host AH_*_* is connecting to a C&C (Command & Control) server, a network scanning event detecting a state in which each of the first active host through the nth active host AH_*_* is scanning at least one other active host or at least one virtual host VH_*_* generated on the network, a malware spreading event detecting a state in which each of the first active host through the nth active host AH_*_* attempts to infect at least one other active host or at least one virtual host VH_*_* with malware, and a cyber attack event detecting a state in which each of the first active host through the nth active host AH_*_* is performing a cyber attack on at least one other active host.

[0071] First, the process in which the network controller 100 detects a malware infection event, which is any one of the first type cyber threat event to the kth type cyber threat event, through an access switch 200, which is any one of the first access switch 200_1 to the mth access switch 200_m, will be described as follows.

[0072] A specific active host, which is any one of the first active host through the n-th active host AH_*_* on the network, may be infected with malware due to user negligence, such as using an unauthorized Universal Serial Bus (USB) device, connecting to a site infected with malware, downloading incorrect software, opening an email containing malware, etc., and the malware that has infected the specific active host can be detected and blocked by an antivirus solution operated on the specific active host. The antivirus solution of the specific active host can then transmit a malware infection event including a specific active MAC address to the network controller 100 through the access switch 200.

[0073] The network controller 100 can then detect that a specific active host has been infected with malware through the specific active host MAC address included in the malware infection event, and in response, the network controller 100 can cause at least one of the first access switch 200_1 through the mth access switch 200_m to block the specific active host corresponding to the specific active host MAC address from the network.

[0074] Next, the process in which the network controller 100 detects a C&C server connection event, which is any one of the first type cyber threat event to the kth type cyber threat event, through an access switch 200, which is any one of the first access switch 200_1 to the mth access switch 200_m, will be described as follows.

[0075] Among the first active host through the nth active host AH_*_* on the network, a specific active host infected with malware can be connected to and operated by an external C&C server in order to infect other active hosts and attack specific targets.

[0076] Therefore, the access switch 200 samples communication packets transmitted from the first active host through the nth active host AH_*_* through the sampling flow function, checks the destination IP address of the sampled communication packet, and if the destination IP address is an external IP address, transmits C&C server connection event information to the network controller 100, including a specific active host MAC address corresponding to the specific active host that transmitted the sampled communication packet and the external IP address of the sampled communication packet.

[0077] Then, the network controller 100 can check whether the external IP address included in the C&C server connection event matches at least one of the threat site IP addresses registered in a Cyber ​​Threat Intelligence (CTI) database.

[0078] Furthermore, when the external IP address included in the C&C server connection event matches at least one of the threat site IP addresses registered in the CTI database, the network controller 100 can block a specific active host corresponding to a specific active host MAC address included in the C&C server connection event from the network using at least one of the first access switch 200_1 through the mth access switch 200_m.

[0079] At this time, the network controller 100 can minimize non-detection and false detection in cyber threat detection and increase the correct detection rate by linking the C&C server connection event with the above-described malware infection event. As an example, in a state where an antivirus solution operated on a specific active host cannot accurately detect whether abnormal software installed on the specific active host is malware, if a C&C server connection event is detected within a preset time after a malware infection event is detected, it becomes possible to correctly detect whether the abnormal software installed on the specific active host is malware.

[0080] Next, the process in which the network controller 100 detects a network scanning event or a cyber attack event, which is any one of the first type cyber threat event to the kth type cyber threat event, through an access switch 200, which is any one of the first access switch 200_1 to the mth access switch 200_m, will be described as follows.

[0081] Among the first active host through the nth active host AH_*_* on the network, a specific active host infected with malware may scan other active hosts within the network to spread the malware, or a large number of active hosts infected with malware may attack a specific target, for example a specific server.

[0082] Therefore, the access switch 200 monitors communication packets transmitted between the first active host through the n-th active host AH_*_*, checks how many times a communication between the active hosts occurs within a preset time, and if the confirmed number of occurrences is equal to or exceeds a preset threshold, detects that a network scanning event or a cyber attack event has occurred and blocks the active host from the network. As an example, it can detect a network scanning event in which a communication packet in which a specific active host scans other active hosts occurs a number of times equal to or exceeds a threshold within a preset time, or a cyber attack event in which a communication packet in which a specific active host transmits to a specific target occurs a number of times equal to or exceeds a threshold within a preset time, or a communication packet in which multiple active hosts transmit to a specific target occurs a number of times equal to or exceeds a threshold within a preset time.

[0083] At this time, the access switch 200 cannot monitor the communication flow between active hosts for a long time due to the limitations of the CPU and memory. Therefore, the access switch 200 can transmit information on the detected network scanning event or cyber attack event to the network controller 100, and the network controller 100 can monitor the network scanning event or cyber attack event received from the access switch 200 for a long time to improve the correct detection rate of cyber threats.

[0084] Next, a process in which the network controller 100 detects a malware spreading event, which is one of the first type cyber threat events through the kth type cyber threat events, through the access switch 200, which is one of the first access switch 200_1 through the mth access switch 200_m, will be described as follows. At this time, the malware spreading event is detected using a virtual host generated in the access switch.

[0085] Each of the first access switch 200_1 through the mth access switch 200_m installed in the network can monitor ARP (Address Resolution Protocol) communication of active hosts connected to the network, collect the IP addresses and MAC addresses of the active hosts AH_*_* connected to the network, and then transmit them to the network controller 100.

[0086] The network controller 100 then refers to the IP addresses and MAC addresses of the active hosts AH_*_* connected to the network and performs active host management in real time.

[0087] Then, the network controller 100 can refer to the active host lists obtained from the first access switch 200_1 through the mth access switch 200_m to identify unused IP addresses, and generate virtual hosts VH_*_* using the unused IP addresses.

[0088] That is, the network controller 100 generates at least one first virtual host IP address through at least one m-th virtual host IP address, and generates at least one first virtual host MAC address through at least one m-th virtual host MAC address corresponding to the first virtual host IP address through at least one m-th virtual host MAC address corresponding to the m-th virtual host IP address, by using unused host addresses not used by the active host AH_*_* among all host addresses of the network. Then, the network controller 100 can transmit each of the first virtual host IP address and the first virtual host MAC address through the m-th virtual host IP address and the m-th virtual host MAC address to each of the first access switch 200_1 through the m-th access switch 200_m. Then, each of the first access switch 200_1 through the mth access switch 200_m can generate at least one first virtual host VH_1_* through at least one mth virtual host VH_m_* that references the first virtual host IP address and the first virtual host MAC address and that references the mth virtual host MAC address, in each of the first security engine through the mth security engine set inside the first access switch. At this time, each of the first access switch 200_1 through the mth access switch 200_m can register the first virtual host MAC switch through the mth virtual host MAC switch corresponding to the first virtual host VH_1_* through the mth virtual host VH_n_*, respectively, in the respective switch hardware, so that communication packets addressed to each of the first virtual hosts VH_1_* through the mth virtual host VH_m_* are transmitted to each of the first security engine through the mth security engine.

[0089] As an example, when the number of at least one virtual host to be generated on the network is p, the network controller 100 can group all host addresses into a first group through a pth group, generate a first available virtual host IP address that references one unused host address in the first group through a pth available virtual host IP address that references one unused host address in the pth group, and group the first available virtual host IP address through the pth available virtual host IP address into m groups to generate the first through mth virtual host IP addresses.

[0090] As an example, take a network that uses class C 192.168.0.255 and has two access switches, and you want to generate five virtual hosts on the network. The host addresses are the last octet from 0 to 255, and the IP address 192.168.0.0 corresponding to "0" is used as the network address, and the IP address 192.168.0.255 corresponding to "255" is used to broadcast messages to all hosts in the network. Therefore, the first and last IP addresses cannot be assigned to individual hosts. Therefore, the IP addresses that can actually be assigned to individual hosts are IP addresses from 192.168.0.1 to 192.168.0.254, so these are divided into five groups: the first group "192.168.0.1 to 192.168.0.50", the second group "192.168.0.51 to 192.168.0.100", the third group "192.168.0.101 to 192.168.0.150", the fourth group "192.168.0.101 to 192.168.0.150", the fifth group "192.168.0.101 to 192.168.0.150", the sixth group "192.168.0.101 to 192.168.0.150", the seventh ... After grouping the IP addresses into a fourth group of "192.168.0.151 to 192.168.0.200" and a fifth group of "192.168.0.201 to 192.168.0.254," one unused IP address each from the first group, the second group, the third group, the fourth group, and the fifth group can be generated as the first available virtual host IP address to the fifth available virtual host IP address. Then, three available virtual host IP addresses from the first available virtual host IP address to the fifth available virtual host IP address can be used to generate three virtual hosts in the first access switch, and the remaining two available virtual host IP addresses can be used to generate two virtual hosts in the second access switch.

[0091] As another example, the network controller 100 may group unused host addresses into a first group through an m-th group, and generate at least one first virtual host IP address referring to the unused host addresses of the first group through at least one m-th virtual host IP address referring to the unused host addresses of the m-th group. In this case, the network controller 100 may change a part of the IP addresses used by the active host AH_*_* so that the virtual host IP addresses are distributed uniformly among all the host addresses. In addition, the network controller 100 may distribute the virtual host IP addresses uniformly among all the host addresses, but may distribute them more intensively among some of the host addresses in the first half, the middle half, and the latter half. As a result, in a situation where a general cyber threat is made from a low host address to a high address host, from a high host address to a low address host, or from an address in a specific location to a low address host, or to a high address host, it is possible to quickly detect the cyber threat and stably maintain the network from the cyber threat.

[0092] As another example, the network controller 100 may group all host addresses into a first group through an m-th group, and generate at least one first virtual host IP address by referring to unused host addresses among all host addresses in the first group through at least one m-th virtual host IP address by referring to unused host addresses among all host addresses in the m-th group. In this case, the network controller 100 may change a part of the IP address used by the active host AH_*_* so that the virtual host IP addresses are distributed evenly among all host addresses. In addition, the network controller 100 may distribute the virtual host IP addresses evenly among all host addresses, but may distribute them more intensively among some of the host addresses in the first half, the middle half, and the latter half. This makes it possible to quickly detect cyber threats and maintain the network stable against cyber threats in situations where common cyber threats are made in a manner that starts with a low host address and then goes to a high address host, or starts with a high host address and then goes to a low address host, or starts with an address at a specific location and then goes to a high address host.

[0093] For reference, in FIG. 1, a first_1 active host AH_1_1 having an IP address of 192.168.0.10 and a first_2 active host AH_1_2 having an IP address of 192.168.0.11 are connected to the first access switch 200_1, and a first_1 virtual host VH_1_1 having a virtual host IP address of 192.168.0.2 is generated. A second access switch 200_2 has a second_1 active host AH_2_1 having an IP address of 192.168.0.22 and a second_2 active host AH_2_2 having an IP address of 192.168.0.23. The example shows a state in which a 2_2-th active host AH_2_2 having an IP address of 192.168.0.50 and a 2_1-th virtual host VH_2_1 having a virtual host IP address of 192.168.0.100 are generated, and an m_1-th active host AH_m_1 having an IP address of 192.168.0.32 is connected to the m-th access switch 200_m, and an m_1-th virtual host VH_m_1 having a virtual host IP address of 192.168.0.200 is generated.

[0094] With the above-mentioned method, when the virtual hosts VH_*_* are generated in the access switches 200_1 to 200_m of the network, the process of the access switches 200_1 to 200_m detecting a malware spreading event using the virtual hosts will be described below with further reference to FIG. 4 in addition to FIG. 1 and FIG. 3. For reference, it is assumed that the specific active host that poses a cyber threat through malware spreading in FIG. 4 is the 1_1th active host AH_1_1 in FIG. 1, and the specific access switch 200 in FIG. 4 is any one of the 1st access switch 200_1 to the mth access switch 200_m in FIG. 1, and it is assumed that one virtual host VH is generated.

[0095] A specific active host AH_1_1 infected with malware can transmit a host scan packet to search for hosts connected to the network through the first access switch 200_1 to active hosts and virtual hosts in the network (S100) in order to infect other hosts connected to the network.

[0096] Then, the host scan packet transmitted from a specific active host AH_1_1 can be received by a specific access switch 200, which is any one of the first access switch 200_1 to the mth access switch 200_m installed in the network, and the specific access switch 200 that receives the host scan packet can check whether the destination IP address of the host scan packet corresponds to at least one pre-configured virtual host IP address.

[0097] Then, as a result of checking whether the destination IP address of the host scan packet corresponds to the specific virtual host IP address, if it is confirmed that the destination IP address of the host scan packet corresponds to the specific virtual host IP address, the specific access switch 200 can transmit the host scan packet to the specific virtual host VH by referring to the specific virtual host MAC address that matches the specific virtual host IP address. The specific access switch 200 can also transmit the result of detecting a network scanning event by the host scan packet to the network controller 100.

[0098] In this case, the destination IP address of the host scan packet may be a specific IP address for scanning a specific host, or a broadcast IP address for scanning all hosts in the network.

[0099] Therefore, a particular access switch 200 can check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a particular virtual host IP address, transmit the host scan packet to a particular virtual host VH.

[0100] Alternatively, a particular access switch 200 may check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a broadcast IP address, the particular access switch 200 may perform a process of broadcasting the host scan packet to active hosts on the network via the network stack, and a process of duplicating the host scan packet and transmitting it to a particular virtual host VH.

[0101] Through the above-described operations, when a host scan packet is transmitted to a specific virtual host VH, i.e., when a specific access switch 200 transmits the host scan packet to the security engine in which the specific virtual host VH was generated, the security engine can generate a response packet that corresponds to the specific host scan method used in the host scan packet and includes the specific virtual host MAC address.

[0102] In this case, the security engine may store a pre-defined host scan method for checking a specific host scan method of the host scan packet, and the pre-defined host scan method may include scan methods used in common networks, such as Internet Control Message Protocol (ICMP) scan and Transmission Control Protocol (TCP) scan, scan methods used by confirmed malware, such as Server Message Block (SMB) scan, NetBIOS scan, NetBIOS Name Service (NBNS) scan, and all scan methods used by confirmed malware as well as common networks, such as ARP scan.

[0103] Then, the specific access switch 200 can transmit the response packet generated by the security engine to the specific active host AH_1_1 (S200). That is, the specific access switch 200 can respond to the specific virtual host VH scan performed by the specific active host AH_1_1 and execute a virtual host response so that the specific active host AH_1_1 can recognize the specific virtual host VH as a host that can be infected.

[0104] Thereafter, the specific active host AH_1_1 that has received the response packet may determine that the virtual host VH is an infectable host, generate a data packet that includes malware for infecting the virtual host VH, and has the specific virtual host IP address as a destination IP address and the specific virtual host MAC address as a destination MAC address, and then transmit the data packet (S300) to the specific access switch 200 (here, the data packet may be directly transmitted to the specific access switch 200, or may be transmitted to the specific access switch 200 via another access switch). In other words, the concept of the specific active host AH_1_1 generating a data packet and then transmitting it to the specific access switch 200 may be understood as an attempt to infect the virtual host VH.

[0105] Then, the specific access switch 200 can transmit a data packet, whose destination IP address and destination MAC address are the specific virtual host IP address and the specific virtual host MAC address, transmitted from the specific active host AH_1_1 to the specific virtual host VH.

[0106] Then, when the data packet is transmitted to the virtual host VH, that is, when the specific access switch 200 transmits the data packet to the security engine in which the specific virtual host VH is generated, the security engine can determine that the data packet is malware and block the specific active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_m installed in the network. That is, the specific access switch 200 can block the specific active host AH_1_1 that attempts to infect the specific virtual host, thereby protecting the network from cyber threats. This is based on the fact that an attempt to scan and access a virtual host, not an active host that is actually in operation, is not a normal operation, and after recognizing the virtual host generated in the access switch stage as a host that can be infected, the specific active host that attempts a cyber threat to the virtual host is blocked from the network, thereby effectively blocking the cyber threat before it attempts a cyber threat to other active hosts. In addition, the specific access switch 200 can transmit to the network controller 100 information on the malware spreading event including the specific active host MAC address corresponding to the specific active host AH_1_1 that spread the malware to the virtual host VH.

[0107] Meanwhile, the security engine of a particular access switch 200 can analyze the data code of the data packet and check the analyzed behavior pattern of the data code.

[0108] Then, when the analysis operation pattern for the data packet matches a specific registered operation pattern among the registered operation patterns corresponding to each of the pre-registered malware profiles, the security engine of a specific access switch 200 can determine that the data code is specific malware corresponding to the specific registered operation pattern, and can block the specific active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_m.

[0109] Alternatively, if the analyzed behavior pattern does not match each of the registered behavior patterns, the security engine of the particular access switch 200 may determine that the data code is unidentified malware and may block the particular active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_m, and then send an alarm to the network controller 100 that manages the network, or may send an alarm to the network controller 100 without blocking the particular active host AH_1_1 from the network, so that the network controller 100 may decide whether or not to block the particular active host AH_1_1 from the network.

[0110] At this time, the network controller 100, while storing the behavior patterns for the already confirmed malware in the malware database, generates a malware profile including the behavior patterns of the confirmed malware from the malware database, and transmits the malware profile for the confirmed malware to each of the first security engine of the first access switch 200_1 through the mth security engine of the mth access switch 200_m, so as to register the malware profile for the confirmed malware with each of the first security engine through the mth security engine.

[0111] As an example, the malware database may be shown in Table 1 below, and the malware database may store information regarding behavior patterns such as host scanning methods, protocols, and approach methods for confirmed malware. However, the present invention is not limited thereto, and may include various information for confirming malware behavior patterns.

[0112] [Table 1]

[0113] Additionally, the security engine of a particular access switch 200 may transmit host scan packets and data packets corresponding to unidentified malware to the network controller 100.

[0114] The network controller 100 can then add information about the unconfirmed malware to the malware database, as shown in Table 2 below.

[0115] [Table 2]

[0116] The network controller 100 can then analyze the behavior patterns of the unconfirmed malware and update the malware database by referring to the results of the analysis of the unconfirmed malware.

[0117] Thereafter, as shown in FIG. 5, the network controller 100 generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware updated in the malware database, and transmits the malware profile for the unconfirmed malware to each of the first security engine of the first access switch 200_1 through the mth security engine of the mth access switch 200_m, thereby updating the pre-registered malware profile using each of the first security engine through the mth security engine.

[0118] Additionally, the security engine of a particular access switch 200 may transmit host scan packets and data packets corresponding to particular malware or host scan packets and data packets corresponding to unidentified malware to the network controller 100.

[0119] The network controller 100 can then classify the data packets and host scan packets into either data packets and host scan packets corresponding to specific malware, or host scan packets and data packets corresponding to unidentified malware, and store and manage them as back data for subsequent analysis.

[0120] When at least one first type cyber threat event to at least one kth type cyber threat event for the first active host through the nth active host AH_*_* is detected through the access switches 200_1 to 200_m by the above-mentioned method, the network controller 100 uses a dynamic time window having a preset time size and moving over time to refer to at least one specific type cyber threat event for each of the first active host through the nth active host AH_*_* that is located within a specific dynamic time window at at least one specific time among the first type cyber threat events to the kth type cyber threat events, to generate first cyber threat level scores to nth cyber threat level scores for each of the first active host through the nth active host AH_*_*, and can detect a cyber threat against the first active host through the nth active host AH_*_* by using each of the first cyber threat level scores to nth cyber threat level scores.

[0121] In this case, when the preset time size of the dynamic time window is s, the network controller 100 generates the first cyber threat level score through the nth cyber threat level score by summing at least one specific reference score corresponding to at least one specific type of cyber threat event occurring between the time (ts) and the time t in each of the first active host through the nth active host AH_*_* at the current time t, and the first weight through the kth weight can be set for each of the first reference score corresponding to the first type of cyber threat event through the kth reference score corresponding to the kth type of cyber threat event. In addition, the time at which the cyber threat level score is calculated using the dynamic time window may be the current time or the time at which the most recent cyber threat event was detected at the current time. In addition, the preset time size s of the dynamic time window may be an integer greater than 0, and may be variable over time or according to the number / frequency / importance of the most recently detected cyber threat events.

[0122] As an example, referring to FIG. 6, a first standard score through a kth standard score can be set for each of the first type cyber threat events through the kth type cyber threat events. Also, a first weight through a kth weight can be set for each of the first standard score through the kth standard score. Here, the first weight through the kth weight may be different values, but are not limited thereto. For reference, FIG. 6 illustrates an example in which a first standard score of "10" is set for the first type cyber threat event, a second standard score of "5" is set for the second type cyber threat event, a third standard score of "5" is set for the third type cyber threat event, and a kth standard score of "5" is set for the kth type cyber threat event.

[0123] Then, the network controller 100 can check the cyber threat events and the types of cyber threat events for each active host located within the dynamic time window at a specific time, and then add up the respective reference scores for each type to calculate a cyber threat level score for each active host. At this time, the network controller 100 can also calculate a cyber threat level score for each active host by weighting each type of cyber threat event. For reference, in FIG. 6, in the active host having an IP address of "192.160.201.100", a first type cyber threat event and a second type cyber threat event are detected within the dynamic time window at a specific time, in the active host having an IP address of "192.168.201.101", a third type cyber threat event is detected within the dynamic time window at a specific time, in the active host having an IP address of "192.168.201.102", a k-th type cyber threat event is detected within the dynamic time window at a specific time, and in the active host having an IP address of "192.168.201.103", a k-th type cyber threat event is detected within the dynamic time window at a specific time. The diagram illustrates a state in which an active host having an IP address of "192.168.201.103" has a third type cyber threat event detected within the dynamic time window at a specific time, an active host having an IP address of "192.168.201.104" has a second type cyber threat event and a third type cyber threat event detected within the dynamic time window at a specific time, and an active host having an IP address of "192.168.201.105" has a third type cyber threat event and a kth type cyber threat event detected within the dynamic time window at a specific time.

[0124] Thus, the network controller 100 can minimize non-detection and false detection that may occur in individual cyber threat events by referring to the cyber threat level scores for all active hosts in the network. In addition, the network controller 100 can check whether the cyber threat level score for an active host is equal to or higher than a preset threshold, and can block the active host whose cyber threat level score is equal to or higher than the preset threshold from the network, thereby safely protecting the network from cyber threats.

[0125] In addition, the network controller 100 can check the amount of change in the cyber threat score for an active host, and if the cyber threat score increases rapidly, block the active host from the network.

[0126] In addition, when cyber threat level status request information for a specific active host is obtained, the network controller 100 can display each of the detected cyber threat events detected in the specific active host, among the first type cyber threat events to the kth type cyber threat events, on a time axis, and generate and display each specific cyber threat level score by referring to at least one specific type of cyber threat event located within each dynamic time window corresponding to each detection time at which each of the detected cyber threat events was detected.

[0127] As an example, referring to FIG. 7, assuming that a first type of cyber threat event is detected at a particular active host in chronological order at time t1, a second type of cyber threat event is detected at time t2, a fourth type of cyber threat event is detected at time t3, a third type of cyber threat event is detected at time t4, a fourth type of cyber threat event is detected at time t5, a first type of cyber threat event is detected at time t6, and a fifth type of cyber threat event is detected at time t7, the network controller 100 can output a first standard score of "10" corresponding to the first type of cyber threat event as the cyber threat level score at time t1 for the particular active host, since only the first type of cyber threat event is located in the dynamic time window w1 at time t1. Then, since the first type cyber threat event and the second type cyber threat event are located in the dynamic time window w2 at time t2, the network controller 100 can output "15" obtained by adding up the first reference score "10" corresponding to the first cyber threat event and the second reference score "5" corresponding to the second cyber threat event as the cyber threat level score of the specific active host at time t2. Also, since the first type cyber threat event, the second type cyber threat event, and the fourth type cyber threat event are located in the dynamic time window w3 at time t3, the network controller 100 can output "25" obtained by adding up the first reference value "10" corresponding to the first type cyber threat event, the second reference value "5" corresponding to the second type cyber threat event, and the fourth reference value "10" corresponding to the fourth type cyber threat event as the cyber threat level score of the specific active host at time t3. In the same manner, the network controller 100 can output the cyber threat scores of a particular active host at times t4, t5, t6, and t7.In this case, the network controller 100 can set the time size of the dynamic time window at each time to be different from each other. That is, the time size can be made smaller when the detection frequency of cyber threat events is high, and the time size can be made larger when the detection frequency of cyber threat events is low, so that the transformed cyber threat can be detected more accurately.

[0128] The above-described embodiments of the present invention may be realized in the form of program instructions that can be executed by various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention, or may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROMs, RAMs, flash memories, and the like. Examples of program instructions include not only machine code, such as produced by a compiler, but also high-level language code that may be executed by a computer using an interpreter, and the like. The hardware devices may be configured to operate as one or more software modules to perform the processes according to the present invention, and vice versa.

[0129] Although the present invention has been described above by using specific details such as concrete components and limited examples and drawings, this is merely provided to facilitate a more comprehensive understanding of the present invention, and the present invention is not limited to the above examples. Those skilled in the art will appreciate that various modifications and variations can be made from such descriptions.

[0130] Therefore, the spirit of the present invention should not be limited to the embodiments described above, and all modifications equivalent to or equivalent to the scope of the claims below, as well as the scope of the spirit of the present invention, are intended to fall within the scope of the spirit of the present invention. [Explanation of symbols]

[0131] 1000 Cyber ​​Threat Detection System 100 Network Controller 110 Memory 120 processors 200_1 to 200_n Access Switch AH_*_* Active host VH_*_* Virtual host

Claims

1. 1. A method for detecting cyber threats to a network using an access switch, (a) detecting, by a network controller, at least one cyber threat event of a first type through at least one cyber threat event of a k-th type (wherein k is an integer greater than or equal to 1) for a first active host through an n-th active host (wherein n is an integer greater than or equal to 1) connected to switching ports of access switches that enable hosts to communicate with each other in a network, through at least some of the access switches; (b) the network controller uses a dynamic time window having a preset time size and moving over time to generate first to nth cyber threat level scores for each of the first to nth active hosts by referring to at least one specific type of cyber threat event for each of the first to nth active hosts that is located within a specific dynamic time window at at least one specific time among the first to kth type cyber threat events, and detects cyber threats to the first to nth active hosts using the first to nth cyber threat level scores, respectively; Including, The first type cyber threat event through the kth type cyber threat event include at least a portion of a malware infection event detecting a state in which each of the first active host through the nth active host is infected with malware, a C&C server connection event detecting a state in which each of the first active host through the nth active host connects to a C&C (Command & Control) server, a network scanning event detecting a state in which each of the first active host through the nth active host scans at least one other active host or at least one virtual host generated on the network, a malware spreading event detecting a state in which each of the first active host through the nth active host attempts to infect the at least one other active host or the at least one virtual host with malware, and a cyber attack event detecting a state in which each of the first active host through the nth active host performs a cyber attack on at least one other active host.

2. A method for detecting cyber threats to a network using an access switch, comprising: (a) detecting, by a network controller, at least one cyber threat event of a first type through at least one cyber threat event of a k-th type (wherein k is an integer greater than or equal to 1) for a first active host through an n-th active host (wherein n is an integer greater than or equal to 1) connected to switching ports of access switches that enable hosts to communicate with each other in a network, through at least some of the access switches; (b) the network controller uses a dynamic time window having a preset time size and moving over time to generate first to nth cyber threat level scores for each of the first to nth active hosts by referring to at least one specific type of cyber threat event for each of the first to nth active hosts that is located within a specific dynamic time window at at least one specific time among the first to kth type cyber threat events, and detects cyber threats to the first to nth active hosts using the first to nth cyber threat level scores, respectively; Including, A method in which the first type cyber threat event through the kth type cyber threat event include at least a portion of a network scanning event that detects a state in which at least one of the first active host through the nth active host scans at least one virtual host generated on the network, and a malware spreading event that detects a state in which at least one of the first active host through the nth active host attempts to infect the at least one virtual host with malware.

3. Prior to the step (a), (a01) The network controller generates at least one first virtual host IP (Internet Protocol) address through at least one m-th virtual host IP address (where m is an integer of 1 or more) by using unused host addresses not used by the first active host through the n-th active host among all host addresses of the network, and generates a virtual host IP address for the first virtual host IP address. generating at least one mth virtual host MAC address corresponding to at least one first virtual host MAC address through the mth virtual host IP address; (a02) the network controller transmits the first virtual host IP address and the first through m virtual host MAC addresses and the m virtual host MAC address to the first through m access switches, respectively, to generate, by the first through m access switches, at least one first virtual host referencing the first virtual host IP address and the first virtual host MAC address through at least one m virtual host referencing the m virtual host IP address and the m virtual host MAC address in a first security engine set inside the first access switch through an m security engine set inside the m access switch, respectively; The method of claim 2 , further comprising:

4. In the step (b), 4. The method of claim 3, wherein the network controller executes at least one of the following processes: (i) using at least one of the first security engine of the first access switch through the m security engine of the m access switch to scan at least one of the first virtual host through the m virtual host IP addresses, and then blocking from the network a specific active host that transmits a data packet for attempting to infect at least one of the first virtual host through the m virtual host with malware; and (ii) after the network scanning event of scanning at least one of the first virtual host through the m virtual host IP addresses is detected, blocking from the network a specific active host in which the malware spreading event is detected that transmits a data packet for attempting to infect at least one of the first virtual host through the m virtual host with malware.

5. the network controller generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns of the confirmed malware, and transmits the malware profile for the confirmed malware to each of the first security engine through the mth security engine, thereby registering the malware profile for the confirmed malware with each of the first security engine through the mth security engine; In the step (b), The network controller, using a specific security engine corresponding to a specific virtual host that received the data packet, analyzes the data code of the data packet, and checks an analysis behavior pattern obtained by analyzing the behavior pattern of the data code, and (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determines that the data code is specific malware corresponding to the specific registered behavior pattern, and blocks the specific active host from the network through at least one of the first access switch to the mth access switch, and (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determines that the data code is unconfirmed malware, and (ii-1) blocks the specific active host from the network through at least one of the first access switch to the mth access switch. and (ii-2) sending the alarm to the network controller in a state in which the particular active host is not blocked from the network, thereby assisting the network controller in determining whether to block the particular active host from the network.

6. (c) when the network controller receives a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, updating the malware database with reference to a result of analyzing the unconfirmed malware, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, transmitting the unconfirmed malware profile to each of the first security engine through the mth security engine, and updating the preregistered malware profile by each of the first security engine through the mth security engine. The method of claim 5 further comprising:

7. (d) when a host scan packet and the data packet corresponding to the specific malware or a host scan packet and the data packet corresponding to the unconfirmed malware are received from the specific security engine, the network controller classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis. The method of claim 5 further comprising:

8. In the step (a01), 4. The method of claim 3, wherein, when the number of virtual hosts to be generated on the network is p (where p is an integer greater than or equal to m), the network controller groups all of the host addresses into a first group through a p-th group, generates a first available virtual host IP address that references one unused host address in the first group through a p-th available virtual host IP address that references one unused host address in the p-th group, and groups the first available virtual host IP address through the p available virtual host IP address into m groups to generate the first virtual host IP address through the m virtual host IP address.

9. In the step (b), When the preset time size of the dynamic time window is s, the network controller determines whether the first active host to the nth active host are issued between the (t-s)th time and the tth time at the current time t.

3. The method of claim 1 or 2, wherein at least one specific criteria score corresponding to the at least one specific type of cyber threat event occurring is summed to generate the first cyber threat level score through the nth cyber threat level score, respectively, and a first weight through a kth weight are set for each of the first criteria score corresponding to the first type of cyber threat event through the kth criteria score corresponding to the kth type of cyber threat event.

10. (e) detecting a cyber threat against a specific active host, which is at least one of the first active host to the nth active host, When the threat status request information is acquired, displaying each of at least one specific type of cyber threat event detected on the specific active host among the first type cyber threat event to the k type cyber threat event on a time axis, and generating and displaying each specific cyber threat score by referring to the at least one specific type of cyber threat event located within the dynamic time window at each detection time when each of the at least one specific type of cyber threat events was detected. The method of claim 1 or claim 2, further comprising:

11. A network controller that uses an access switch to detect cyber threats to a network, a memory storing instructions for detecting cyber threats to a network using the access switch; a processor that performs operations in accordance with the instructions to detect the cyber threat to the network using the access switch; Including, The processor executes the following processes: (I) detecting at least one first type cyber threat event through at least one k-th type cyber threat event (wherein the k is an integer equal to or greater than 1) for a first active host through an n-th active host connected to a switching port of an access switch that enables hosts to communicate with each other in the network, through at least a portion of the access switch; and (II) using a dynamic time window having a preset time size and moving over time, by referring to at least one specific type cyber threat event for each of the first active host through the n-th active host that is located within a specific dynamic time window at at least one specific time among the first type cyber threat events through the k-th type cyber threat events, to generate a first cyber threat level score through an n-th cyber threat level score for each of the first active host through the n-th active host, and detecting a cyber threat for the first active host through the n-th active host using the first cyber threat level score through the n-th cyber threat level score, respectively. The first type cyber threat event through the k type cyber threat event include at least a portion of a malware infection event detecting a state in which each of the first active host through the nth active host is infected with malware, a C&C server connection event detecting a state in which each of the first active host through the nth active host connects to a C&C server, a network scanning event detecting a state in which each of the first active host through the nth active host scans at least one other active host or at least one virtual host generated on the network, a malware spreading event detecting a state in which each of the first active host through the nth active host attempts to infect the at least one other active host or the at least one virtual host with malware, and a cyber attack event detecting a state in which each of the first active host through the nth active host performs a cyber attack on at least one other active host.

12. A network controller that uses an access switch to detect cyber threats to a network, a memory storing instructions for detecting cyber threats to a network using the access switch; a processor that performs operations in accordance with the instructions to detect the cyber threat to the network using the access switch; Including, The processor executes the following processes: (I) detecting at least one first type cyber threat event through at least one k-th type cyber threat event (wherein the k is an integer equal to or greater than 1) for a first active host through an n-th active host connected to a switching port of an access switch that enables hosts to communicate with each other in the network, through at least a portion of the access switch; and (II) using a dynamic time window having a preset time size and moving over time, by referring to at least one specific type cyber threat event for each of the first active host through the n-th active host that is located within a specific dynamic time window at at least one specific time among the first type cyber threat events through the k-th type cyber threat events, to generate a first cyber threat level score through an n-th cyber threat level score for each of the first active host through the n-th active host, and detecting a cyber threat for the first active host through the n-th active host using the first cyber threat level score through the n-th cyber threat level score, respectively. The first type cyber threat event through the k type cyber threat event detect a state in which at least one of the first active host through the nth active host scans at least one virtual host generated on the network. and a malware spreading event in which at least one of the first active host through the nth active host is detected attempting to infect the at least one virtual host with malware.

13. The processor, Before the process (I), (I01) generate at least one first virtual host IP (Internet 13. The network controller of claim 12, further executing a process of (I02) generating at least one first virtual host MAC address corresponding to the first virtual host IP address through at least one mth virtual host MAC address corresponding to the mth virtual host IP address, and a process of transmitting the first virtual host IP address and the first virtual host MAC address through the mth virtual host IP address to each of a first access switch through an mth access switch, so as to cause each of the first access switch through the mth access switch to generate at least one first virtual host referring to the first virtual host IP address and the first virtual host MAC address through at least one mth virtual host referring to the mth virtual host IP address and the mth virtual host MAC address in each of a first security engine through an mth security engine set inside the first access switch.

14. The processor, 14. The network controller of claim 13, wherein in the process (II), at least one of the following processes is executed: (i) a process of scanning at least one of the first virtual host through the mth virtual host IP address using at least one of the first security engine of the first access switch through the mth security engine of the mth access switch, and then blocking from the network a specific active host that transmits a data packet for attempting to infect at least one of the first virtual host through the mth virtual host with malware; and (ii) a process of blocking from the network a specific active host in which the malware spreading event is detected that transmits a data packet for attempting to infect at least one of the first virtual host through the mth virtual host with malware after the network scanning event of scanning at least one of the first virtual host through the mth virtual host IP address is detected.

15. The processor generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns of the confirmed malware, and transmits the malware profile for the confirmed malware to each of the first security engine through the mth security engine, thereby registering the malware profile for the confirmed malware with each of the first security engine through the mth security engine; In the process (II), the processor analyzes the data code of the data packet using a specific security engine corresponding to a specific virtual host that has received the data packet, and checks an analysis behavior pattern obtained by analyzing an behavior pattern of the data code, and (i) checks whether the analysis behavior pattern corresponds to each of the malware profiles registered in advance. and (ii) when the analyzed operation pattern does not match any of the registered operation patterns, determining that the data code is unconfirmed malware, and (ii-1) sending an alarm to the network controller after blocking the specific active host from the network through at least one of the first access switch to the mth access switch, and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

16. The processor, 16. The network controller of claim 15, further comprising: (III) a process for updating the malware database by referring to a result of analyzing the unconfirmed malware when the host scan packet corresponding to the unconfirmed malware and the data packet are received from the specific security engine, generating an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, transmitting the unconfirmed malware profile to each of the first security engine through the mth security engine, and updating the pre-registered malware profile by each of the first security engine through the mth security engine.

17. The processor, (IV) When a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware are received from the specific security engine, the network controller further executes a process of classifying the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware or the host scan packet and the data packet corresponding to the unconfirmed malware, and storing and managing the data as back data for subsequent analysis.

18. The processor, 14. The network controller according to claim 13, wherein in the process (I01), when the number of virtual hosts to be generated on the network is p (where p is an integer equal to or greater than m), all of the host addresses are grouped into a first group through a p-th group, a first available virtual host IP address that references one unused host address in the first group through a p-th available virtual host IP address that references one unused host address in the p-th group are generated, and the first available virtual host IP address through the p available virtual host IP address are grouped into m groups to generate the first virtual host IP address through the m virtual host IP address.

19. The processor, In the process (II), when the preset time size of the dynamic time window is s, at the current time t, at least one cyber threat event corresponding to the at least one specific type of cyber threat event occurring between the (t-s)th time and the tth time in each of the first active host to the nth active host is detected.

13. The network controller according to claim 11 or 12, wherein three specific reference scores are summed to generate the first cyber threat level score through the nth cyber threat level score, respectively, and a first weight through a kth weight are set for the first reference score corresponding to the first type of cyber threat event through the kth reference score corresponding to the kth type of cyber threat event, respectively.

20. The network controller of claim 11 or 12, wherein the processor further executes a process of (V) displaying each of at least one specific type of cyber threat event detected at the specific active host among the first type of cyber threat event to the kth type of cyber threat event on a time axis when cyber threat level status request information for a specific active host, which is at least one of the first active host to the nth active host, is acquired, and generating and displaying each specific cyber threat level score by referring to the at least one specific type of cyber threat event located within the dynamic time window at each detection time when each of the at least one specific type of cyber threat event was detected.

Images