Method for detecting cyber threats to a network using a virtual host, and access switch and network controller using the same

Abstract

A method for detecting cyber threats to a network using virtual hosts is provided. [Solution] In a cyber threat detection system 1000, when a specific access switch, which is one of the access switches 200 that enable hosts to communicate with each other within a network, receives a host scan packet from a specific active host AH among active hosts, which are hosts connected to the switching port of the access switch, the network controller 100 checks whether the destination IP (Internet Protocol) address of the host scan packet corresponds to at least one pre-configured virtual host (VH) IP address, and if it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, it refers to a specific virtual host MAC address matched to the specific virtual host IP address.

Description

[Technical field]

[0001] The present invention relates to a method for detecting cyber threats to a network, and more particularly to a method for detecting cyber threats in a network by generating a virtual host in an access switch to which a host in the network is connected and inducing the virtual host to attempt a network attack. [Background technology]

[0002] A cyber threat is a malicious and deliberate attempt by an individual or organization to compromise the security of the information systems of another individual or organization, usually with the attacker seeking to disrupt the victim's network in order to gain some kind of benefit.

[0003] Such cyber threats come in a variety of forms, including malware, phishing, man-in-the-middle (MitM) attacks, Denial of Service (DoS) attacks, and zero-day exploits.

[0004] To prevent such cyber threats, network-based security devices such as firewalls, IPS, UTM, and web firewalls separate external and internal networks and analyze and protect traffic flowing from the external network to the internal network and traffic flowing from the internal network to the outside, thereby protecting the entire network.

[0005] Meanwhile, in order to ensure the reliability of network communications by blocking harmful traffic that can infect hosts on the internal network with viruses or other infections and cause performance degradation and failures in network core devices, and to prevent the secondary spread of infection to other hosts, there has been growing interest in security switches that analyze the traffic generated on the internal network and block the traffic at the switch level if it is determined to be harmful traffic or a cyber threat.

[0006] In such security switches, the typical way to judge cyber threats is to detect an action of one host searching for multiple hosts, or an action of multiple hosts transmitting a large amount of traffic to one host.

[0007] However, there are clear limitations to the application of such security switches in a network environment where various devices and operating environments are intricately intertwined.

[0008] In addition, responding to cyber threats using such security switches has the limitation that it is necessary to distinguish between positive detection and situations in which a threat is actually detected, and it is not possible to respond to changes in the form of various cyber attacks.

[0009] In addition, low CPU performance and insufficient memory limit the ability to monitor all traffic occurring on the network.

[0010] Therefore, the present applicant aims to propose a method for overcoming low CPU performance and memory shortage, detecting various forms of threatening behavior occurring in a network, reducing the probability of undetection, and improving the correct detection rate. Summary of the Invention [Problem to be solved by the invention]

[0011] An object of the present invention is to solve all of the problems of the prior art mentioned above.

[0012] Another object of the present invention is to overcome the low CPU performance and memory shortage of access switches and to effectively detect cyber threats occurring in a network.

[0013] It is yet another object of the present invention to enable detection of cyber threats by generating virtual hosts in access switches.

[0014] It is yet another object of the present invention to make it possible to pose a cyber threat to a virtual host created in an access switch, thereby enabling the host posing a cyber threat to be blocked from the network.

[0015] It is yet another object of the present invention to enable efficient response to changes in the form of cyber attacks by using virtual hosts. [Means for solving the problem]

[0016] In order to achieve the above object of the present invention, the typical features of the present invention are as follows:

[0017] According to an embodiment of the present invention, in a method for detecting cyber threats to a network using a virtual host, (a) a specific access switch, which is one of access switches that enable hosts to communicate with each other in a network, receives a host scan packet from a specific active host among active hosts (the active host is a host connected to a switching port of the access switch), and detects a destination IP address (Internet and (b) checking whether a destination IP address of the host scan packet corresponds to at least one virtual host IP address set in advance, and when it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, referring to a specific virtual host MAC address matching the specific virtual host IP address, transmitting the host scan packet to a specific virtual host corresponding to the specific virtual host MAC address (the specific virtual host is generated in a security engine set in the specific access switch), thereby causing the security engine corresponding to the specific virtual host to generate a response packet corresponding to the specific host scan method used in the host scan packet and including the specific virtual host MAC address, and transmitting the response packet generated by the security engine to the specific active host; and (b) when a data packet is received from the specific active host, the specific access switch transmits the data packet to the specific virtual host, thereby causing the security engine corresponding to the specific virtual host to determine that the data packet is malware and block the specific active host from the network through at least one of the access switches.

[0018] In one example, in step (b), the specific access switch transmits the data packet to the specific virtual host, and uses the security engine corresponding to the specific virtual host to analyze a data code of the data packet to check an analysis behavior pattern obtained by analyzing a behavior pattern of the data code, and (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determines that the data code is specific malware corresponding to the specific registered behavior pattern and blocks the specific active host from the network through at least one of the access switches, and (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determines that the data code is unconfirmed malware, and (ii-1) blocks the specific active host from the network through at least one of the access switches, and then sends an alarm to a network controller that manages the network, and (ii-2) sends the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

[0019] In one example, the specific access switch uses the security engine corresponding to the specific virtual host to transmit the host scan packet and the data packet corresponding to the unconfirmed malware to the network controller, and the network controller updates the malware database stored in the network controller by referring to the results of analyzing the unconfirmed malware, and when a profile corresponding to the unconfirmed malware including an operation pattern for the unconfirmed malware is received from the network controller, the pre-registered malware profile can be updated.

[0020] In one example, the specific access switch can use the security engine to transmit a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware, to the network controller, and the network controller can classify the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and store and manage the data as back data for subsequent analysis.

[0021] In one example, in step (a), the specific access switch can check the destination IP address of the host scan packet, and (i) if the destination IP address of the host scan packet is the specific virtual host IP address, transmit the host scan packet to the virtual host, and (ii) if the destination IP address of the host scan packet is a broadcast IP address, perform a process of broadcasting the host scan packet to the active hosts on the network via a network stack, and a process of duplicating the host scan packet and transmitting it to the specific virtual host.

[0022] In one example, the specific virtual host IP address and the specific virtual host MAC address are set by a network controller that manages the network, and the network controller can generate the specific virtual host IP address using an unused host address not used by the active host among all host addresses of the network, and generate the specific virtual host MAC address that matches the specific virtual host IP address and corresponds to the security engine.

[0023] In one example, in step (a), the specific access switch transmits the host scan packet to the specific virtual host, and uses the security engine corresponding to the specific virtual host to identify the specific host scan method used in the host scan packet from among pre-configured host scan methods to generate the response packet, where the pre-configured host scan method may include a scan method used in a general network and a scan method for a confirmed malware.

[0024] According to another embodiment of the present invention, a method for detecting cyber threats to a network using a virtual host includes the steps of: (a) a network controller managing a network generates at least one first virtual host IP address through at least one n-th virtual host IP address using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) that enable hosts to communicate with each other within the network, among all host addresses of the network; and (b) the network controller generates at least one first virtual host MAC address corresponding to the first virtual host IP address through at least one n-th virtual host MAC address corresponding to the n-th virtual host IP address; and and (i) generating at least one first virtual host through the nth virtual host IP address referring to the first virtual host IP address and at least one nth virtual host referring to the nth virtual host MAC address in each of the first through nth security engines set inside the first access switch through the nth access switch, respectively; and (ii) scanning at least one of the first through nth virtual hosts using at least one of the first through nth virtual host IP addresses, and then determining a specific active host transmitting a data packet to at least one of the first through nth virtual hosts via at least one of the first through nth security engines, and blocking the specific active host from the network.

[0025] In one example, the network controller generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns for already confirmed malware, transmits the malware profile for the confirmed malware to each of the first security engine through the nth security engine, and registers the malware profile for the confirmed malware with each of the first security engine through the nth security engine. In the step (b), the network controller uses a specific security engine corresponding to a specific virtual host that received the data packet to analyze a data code of the data packet and checks an analyzed operation pattern obtained by analyzing the operation pattern of the data code, and (i) if the analyzed operation pattern matches a specific registered operation pattern among registered operation patterns corresponding to each of the previously registered malware profiles, registers the malware profile for the confirmed malware with each of the first security engine through the nth security engine. and (ii) determining that the data code is a specific malware corresponding to the specific registered operation pattern and blocking the specific active host from the network through at least one of the first access switch to the nth access switch; (ii) if the analyzed operation pattern does not match each of the registered operation patterns, determining that the data code is an unidentified malware, (ii-1) blocking the specific active host from the network through at least one of the first access switch to the nth access switch, and then sending an alarm to the network controller; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in deciding whether to block the specific active host from the network.

[0026] In one example, in step (b), when the network controller receives a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, it updates the malware database by referring to the results of analyzing the unconfirmed malware, generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, and transmits the unconfirmed malware profile to each of the first security engine through the nth security engine, thereby updating the pre-registered malware profile by each of the first security engine through the nth security engine.

[0027] In one example, in step (b), when the network controller receives a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, the network controller can classify the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and store and manage the data as back data for subsequent analysis.

[0028] In one example, in step (a), the network controller can group the unused host addresses into groups 1_1 through 1_n, and generate the first virtual host IP address by referencing the unused host addresses in the 1_1 group through the nth virtual host IP address by referencing the unused host addresses in the 1_n group.

[0029] In one example, in step (a), the network controller can group all the host addresses into groups 2_1 through 2_n, and generate the first virtual host IP address by referencing an unused host address among all the host addresses of the 2_1 group through the nth virtual host IP address by referencing an unused host address among all the host addresses of the 2_n group.

[0030] In one example, in step (a), when the number of virtual hosts to be generated on the network is m (where m is an integer greater than or equal to n), the network controller can group all of the host addresses into 3_1 groups through 3_m groups, generate a 3_1 virtual host IP address that references one unused host address in the 3_1 group through a 3_m virtual host IP address that references one unused host address in the 3_m group, and group the 3_1 virtual host IP addresses through the 3_m virtual host IP addresses into n groups to generate the 1st virtual host IP address through the nth virtual host IP address.

[0031] According to another embodiment of the present invention, an access switch for detecting cyber threats against a network using a virtual host includes: a memory storing instructions for detecting cyber threats against the network using a virtual host; and a processor that performs an operation for detecting cyber threats against the network using the virtual host according to the instructions stored in the memory;(I) when a host scan packet is received from a specific active host among active hosts connected to a switching port of an access switch that enables hosts to communicate with each other in the network, the processor and (II) a process of checking whether a destination IP address of the host scan packet corresponds to at least one virtual host IP address set in advance, and when it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, referring to a specific virtual host MAC address matching the specific virtual host IP address, transmitting the host scan packet to a specific virtual host corresponding to the specific virtual host MAC address (the specific virtual host is generated in a security engine set in the specific access switch), thereby causing the security engine corresponding to the specific virtual host to generate a response packet corresponding to the specific host scan method used in the host scan packet and including the specific virtual host MAC address, and transmitting the response packet generated by the security engine to the specific active host; and (II) a process of transmitting the data packet to the specific virtual host when a data packet is received from the specific active host, the data packet having a destination IP address that is the specific virtual host IP address and a destination MAC address that is the specific virtual host MAC address, and causing the security engine corresponding to the specific virtual host to determine that the data packet is malware, and blocking the specific active host from the network through at least one of the access switches.

[0032] In one example, in the process (II), the processor may execute any one of the following processes: transmitting the data packet to the specific virtual host, and using the security engine corresponding to the specific virtual host to analyze a data code of the data packet and check an analysis behavior pattern obtained by analyzing an behavior pattern of the data code; (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determining that the data code is specific malware corresponding to the specific registered behavior pattern, and blocking the specific active host from the network through at least one of the access switches; (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determining that the data code is unconfirmed malware; (ii-1) blocking the specific active host from the network through at least one of the access switches, and then sending an alarm to a network controller that manages the network; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in deciding whether to block the specific active host from the network.

[0033] In one example, the processor uses the security engine corresponding to the specific virtual host to transmit the host scan packet and the data packet corresponding to the unconfirmed malware to the network controller, and updates the malware database stored in the network controller by referring to the results of the network controller's analysis of the unconfirmed malware, and when a profile corresponding to the unconfirmed malware including an operation pattern for the unconfirmed malware is received from the network controller, the processor can update the pre-registered malware profile.

[0034] In one example, the processor can use the security engine to transmit the host scan packet and the data packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, to the network controller, and the network controller can classify the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware or the host scan packet and the data packet corresponding to the unconfirmed malware, and store and manage the data as back data for subsequent analysis.

[0035] In one example, the processor may execute, in the (I) process, a process of checking the destination IP address of the host scan packet, (i) transmitting the host scan packet to the specific virtual host if the destination IP address of the host scan packet is the specific virtual host IP address, and (ii) broadcasting the host scan packet to the active hosts on the network via a network stack if the destination IP address of the host scan packet is a broadcast IP address, and a process of duplicating the host scan packet and transmitting it to the specific virtual host.

[0036] In one example, the specific virtual host IP address and the specific virtual host MAC address are set by a network controller that manages the network, and the network controller can generate the specific virtual host IP address using an unused host address not used by the active host among all host addresses of the network, and generate the specific virtual host MAC address that matches the specific virtual host IP address and corresponds to the security engine.

[0037] In one example, in the (I) process, the processor transmits the host scan packet to the specific virtual host, and generates the response packet by using the security engine corresponding to the specific virtual host to confirm the specific host scan method used in the host scan packet from among pre-configured host scan methods, where the pre-configured host scan method may include a scan method used in a general network and a scan method for confirmed malware.

[0038] According to another embodiment of the present invention, a network controller for detecting cyber threats against a network using a virtual host includes: a memory storing instructions for detecting cyber threats against the network using a virtual host; and a processor that performs operations for detecting cyber threats against the network using the virtual host according to the instructions stored in the memory;the processor includes a process of (I) generating at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1), among all host addresses of the network, and generating at least one first virtual host MAC address through at least one n-th virtual host MAC address corresponding to the first virtual host IP address, and (II) transmitting the first virtual host IP address and the first virtual host MAC address through the n-th virtual host IP address to each of the first access switch through the n-th access switch, and generating at least one n-th virtual host MAC address corresponding to the first virtual host IP address and the n-th virtual host MAC address to each of the first access switch through the n-th access switch. With each of the above, a network controller is provided that executes a process of (i) generating at least one first virtual host through the nth virtual host IP address, which refers to the first virtual host IP address and the first virtual host MAC address, and at least one nth virtual host, which refers to the nth virtual host MAC address, in each of the first security engine through the nth security engine that is set inside the first access switch through the nth access switch, and (ii) scanning at least one of the first virtual host through the nth virtual host IP addresses using at least one of the first virtual host IP address through the nth virtual host IP address, and then determining a specific active host that transmits a data packet to at least one of the first virtual host through the nth virtual host via at least one of the first security engine through the nth security engine, and blocking the specific active host from the network.

[0039] In one example, the processor generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns for already confirmed malware, transmits the malware profile for the confirmed malware to each of the first security engine through the nth security engine, and registers the malware profile for the confirmed malware with each of the first security engine through the nth security engine. In the (II) process, a specific security engine corresponding to a specific virtual host that received the data packet analyzes a data code of the data packet to check an analysis operation pattern obtained by analyzing the operation pattern of the data code, and (i) if the analysis operation pattern matches a specific registered operation pattern among registered operation patterns corresponding to each of the malware profiles previously registered, the data code is registered as a malware profile for the specific registered operation pattern. and (ii) determining that the data code is a specific malware corresponding to the analyzed operation pattern, and blocking the specific active host from the network through at least one of the first access switch to the nth access switch; (ii) if the analyzed operation pattern does not match each of the registered operation patterns, determining that the data code is unidentified malware, (ii-1) blocking the specific active host from the network through at least one of the first access switch to the nth access switch, and then sending an alarm to the network controller; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in deciding whether to block the specific active host from the network.

[0040] In one example, in the (II) process, when the processor receives a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, it updates the malware database by referring to the results of analyzing the unconfirmed malware, generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, transmits the unconfirmed malware profile to each of the first security engine through the nth security engine, and updates the pre-registered malware profile by each of the first security engine through the nth security engine.

[0041] In one example, in the (II) process, when the processor receives a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, the processor classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

[0042] In one example, in the (I) process, the processor can group the unused host addresses into groups 1_1 through 1_n, and generate the first virtual host IP address that references the unused host addresses in the 1_1 group through the nth virtual host IP address that references the unused host addresses in the 1_n group.

[0043] In one example, in the (I) process, the processor can group all the host addresses into a 2_1 group through a 2_n group, and generate the first virtual host IP address by referencing an unused host address among all the host addresses of the 2_1 group through the nth virtual host IP address by referencing an unused host address among all the host addresses of the 2_n group.

[0044] In one example, in the (I) process, when the number of virtual hosts to be generated on the network is m (where m is an integer greater than or equal to n), the processor can group all of the host addresses into 3_1 group through 3_m group, generate a 3_1 virtual host IP address that references one unused host address in the 3_1 group through a 3_m virtual host IP address that references one unused host address in the 3_m group, and group the 3_1 virtual host IP addresses through the 3_m virtual host IP addresses into n groups to generate the 1st virtual host IP address through the nth virtual host IP address.

[0045] Additionally, there is further provided a computer readable recording medium for recording a computer program for performing the method of the present invention. Effect of the Invention

[0046] According to the present invention, it is possible to overcome the low CPU performance and memory shortage of an access switch and effectively detect cyber threats occurring in a network.

[0047] Furthermore, according to the present invention, it becomes possible to generate virtual hosts in the access switch to detect cyber threats.

[0048] Furthermore, according to the present invention, it is possible to block hosts posing cyber threats from the network by making the virtual hosts created in the access switch pose cyber threats.

[0049] Furthermore, according to the present invention, it becomes possible to efficiently respond to changes in the form of cyber attacks by utilizing virtual hosts. [Brief description of the drawings]

[0050] The following drawings, attached for use in explaining the embodiments of the present invention, are only a part of the embodiments of the present invention, and a person having ordinary knowledge in the technical field to which the present invention pertains (hereinafter, "ordinary engineers") can derive other drawings based on these drawings without performing inventive work.

[0051] [Figure 1] FIG. 1 is a diagram illustrating a cyber threat detection system for detecting cyber threats to a network using a virtual host according to one embodiment of the present invention. [Diagram 2] FIG. 2 is a schematic diagram illustrating an access switch that uses virtual hosts to detect cyber threats to a network according to one embodiment of the present invention. [Diagram 3] 1 is a diagram illustrating a process of detecting cyber threats to a network using a virtual host according to one embodiment of the present invention. [Figure 4] 2 is a schematic diagram illustrating a malware profile update to an access switch according to one embodiment of the present invention. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0052] The following detailed description of the present invention refers to the accompanying drawings, which show, by way of example, specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable one of ordinary skill in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different from one another, but are not necessarily mutually exclusive. For example, specific shapes, structures and characteristics described herein can be implemented from one embodiment to another without departing from the spirit and scope of the present invention. It should also be understood that the location or arrangement of individual components within each embodiment can be changed without departing from the spirit and scope of the present invention. Therefore, the following detailed description should not be taken in a limiting sense, and the scope of the present invention should be understood to encompass the scope of the claims and all equivalents thereto. In the drawings, like reference numerals refer to the same or similar components throughout the various aspects.

[0053] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those skilled in the art to easily carry out the present invention.

[0054] FIG. 1 is a schematic diagram of a cyber threat detection system for detecting cyber threats to a network using a virtual host according to one embodiment of the present invention, and the cyber threat detection system 1000 may include a network controller 100 and at least one access switch 200_1 to 200_n.

[0055] First, the network controller 100 sets up network security for network management, and may include a memory storing instructions for detecting cyber threats to the network using virtual hosts, and a processor that performs operations for detecting cyber threats to the network using virtual hosts in accordance with the instructions stored in the memory.

[0056] In particular, network controller 100 may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include a computer processor, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, and the like; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0057] The processor of the network controller 100 may include hardware components such as an MPU (Micro Processing Unit) or a CPU (Central Processing Unit), a cache memory, a data bus, etc. The network controller 100 may further include a software component such as an operating system and an application that executes a specific purpose.

[0058] However, this does not exclude the case where the network controller 100 includes an integrated processor in which a medium, a processor, and a memory for implementing the present invention are integrated.

[0059] Meanwhile, the processor of the network controller 100 can execute a process, in accordance with instructions stored in the memory, to generate at least one first virtual host IP (Internet Protocol) address through at least one nth virtual host IP address using unused host addresses not used by active hosts AH_*_*, which are hosts connected to switching ports of at least one of the first access switch 200_1 through the nth access switch 200_n that enable hosts to communicate with each other within the network, among all host addresses of the network, and to generate at least one first virtual host MAC address corresponding to the first virtual host IP address through at least one nth virtual host MAC address corresponding to the nth virtual host IP address. Then, the processor of the network controller 100 transmits the first virtual host IP address and the first virtual host MAC address through the n-th virtual host IP address and the n-th virtual host MAC address to the first access switch 200_1 through the n-th access switch 200_n, respectively, and transmits at least one first virtual host IP address that references the first virtual host IP address and the first virtual host MAC address to the first security engine set inside the first access switch 200_1 through the n-th security engine set inside the n-th access switch 200_n, respectively, by using the first access switch 200_1 through the n-th access switch 200_n. At least one nth virtual host VH_n_* is generated by referencing the IP address and MAC address of the nth virtual host of the first virtual host VH_1_* through the nth virtual host, and at least one of the first virtual host VH_1_* through the nth virtual host VH_n_* is scanned using at least one of the first virtual host IP address through the nth virtual host IP address. Then, a specific active host that transmits data packets to at least one of the first virtual host VH_1_* through the nth virtual host VH_n_* is determined via at least one of the first security engine through the nth security engine, and is blocked from the network.

[0060] Next, each of the first access switch 200_1 through the nth access switch 200_n enables active hosts and virtual hosts to communicate with each other within the network, and may include a memory storing instructions for detecting cyber threats to the network using the virtual hosts, and a processor that performs operations for detecting cyber threats to the network using the virtual hosts in accordance with the instructions stored in the memory.

[0061] Specifically, each of the first access switch 200_1 through the nth access switch 200_n may typically utilize, but is not limited to, a combination of computing devices (e.g., devices that may include a computer processor, memory, storage, input and output devices, and other conventional computing device components; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that cause a computing device to function in a particular manner) to achieve the desired system performance.

[0062] Furthermore, each processor of the first access switch 200_1 to the nth access switch 200_n may include hardware configurations such as an MPU (Micro Processing Unit) or a CPU (Central Processing Unit), a cache memory, a data bus, etc. Furthermore, each of the first access switch 200_1 to the nth access switch 200_n may further include a software configuration of an operating system and an application that executes a specific purpose.

[0063] However, this does not exclude the case where each of the first access switch 200_1 to the n-th access switch 200_n includes an integrated processor in which a medium, a processor, and a memory for implementing the present invention are integrated.

[0064] In addition, each of the first access switch 200_1 to the nth access switch 200_n can be configured not only as a physical module that performs an L2 switch function, but also as a logical module such as a virtual switch that performs an L2 switch function in a cloud environment such as OVS (Open vSwitch).

[0065] Meanwhile, when a host scan packet is received from a specific active host among the active hosts, each of the processors of the first access switch 200_1 through the nth access switch 200_n checks whether the destination IP address of the host scan packet corresponds to at least one pre-set virtual host IP address, and if it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, it refers to a specific virtual host MAC address matching the specific virtual host IP address and transmits the host scan packet to a specific virtual host corresponding to the specific virtual host MAC address, thereby causing a security engine corresponding to the specific virtual host to generate a response packet corresponding to the specific host scan method used in the host scan packet and including the specific virtual host MAC address, and can execute a process of transmitting the response packet generated by the security engine to the specific active host. Then, when a data packet having a destination IP address that is a specific virtual host IP address and a destination MAC address that is a specific virtual host MAC address is received from a specific active host, each of the processors of the first access switch 200_1 through the nth access switch 200_n can execute a process of transmitting the data packet to the specific virtual host, thereby determining that the data packet is malware using a security engine corresponding to the specific virtual host, and blocking the specific active host from the network through at least one of the access switches.

[0066] The configuration state of an access switch according to an embodiment of the present invention will be described below with reference to FIG.

[0067] The access switch 200 according to one embodiment of the present invention may include switch hardware 210 , a communication packet processing module 220 , a network stack 230 , and a security engine 240 .

[0068] Specifically, the switch hardware 210 performs switching operations to forward communication packets received via the network to a destination host, and a virtual host MAC switch may be registered to forward communication packets destined for a virtual host.

[0069] The communication packet processing module 220 analyzes a communication packet received via the network to determine a destination host, and refers to the determined destination host to cause the communication packet to be forwarded to the destination host via the switch hardware 210. If the communication packet is for a virtual host, the communication packet processing module 220 transmits the communication packet to the security engine 240, and if the communication packet is for broadcast, the communication packet processing module 220 can execute a process of broadcasting the communication packet to other active hosts via the network stack 230 and a process of duplicating the communication packet and transmitting it to the security engine 240. In addition, the communication packet processing module 220 can forward a communication packet generated by a virtual host, i.e., the security engine 240, to the destination host via the switch hardware 210.

[0070] Furthermore, the network stack 230 can forward communication packets addressed to hosts connected to other access switches to the other access switches via the switch hardware 210.

[0071] Meanwhile, when at least one virtual host VH is generated, the security engine 240 analyzes a host scan packet transmitted to the virtual host, identifies a specific host scan method used in the host scan packet from among pre-defined host scan methods, and generates and transmits a response packet. When a data packet is transmitted to the virtual host in response to the response packet, the security engine 240 can determine that the data packet is malware and block the specific active host that transmitted the data packet from the network to the virtual host through at least one of the access switches.

[0072] In addition, in the above, the access switch 200 is described as being configured with physical modules as an example, but the present invention is not limited to this, and the access switch 200 may also be configured with logical modules that perform L2 switch functions through a virtual switch such as OVS.

[0073] A method for detecting cyber threats to a network using a virtual host through a cyber threat detection system and access switch according to one embodiment of the present invention configured as described above will be described below with reference to Figures 1 and 2.

[0074] First, each of the first access switch 200_1 through the nth access switch 200_n installed in the network can monitor ARP (Address Resolution Protocol) communication of active hosts connected to the network, collect the IP addresses and MAC addresses of the active hosts AH_*_* connected to the network, and then transmit them to the network controller 100.

[0075] The network controller 100 then refers to the IP addresses and MAC addresses of the active hosts AH_*_* connected to the network and performs active host management in real time.

[0076] Then, the network controller 100 can refer to the active host lists obtained from the first access switch 200_1 through the nth access switch 200_n to identify unused IP addresses, and generate virtual hosts VH_*_* using the unused IP addresses.

[0077] That is, the network controller 100 generates at least one first virtual host IP address through at least one n-th virtual host IP address, and generates at least one first virtual host MAC address through at least one n-th virtual host MAC address corresponding to the first virtual host IP address through the n-th virtual host IP address, by using unused host addresses not used by the active host AH_*_* among all host addresses in the network. Then, the network controller 100 can transmit each of the first virtual host IP address, the first virtual host MAC address through the n-th virtual host IP address, and the n-th virtual host MAC address to each of the first access switch 200_1 through the n-th access switch 200_n. Then, each of the first access switch 200_1 through the nth access switch 200_n can generate at least one first virtual host VH_1_* through at least one nth virtual host VH_n_* that references the first virtual host IP address and the first virtual host MAC address and that references the nth virtual host MAC address, in each of the first security engine through the nth security engine set inside the first access switch. At this time, each of the first access switch 200_1 through the nth access switch 200_n can register the first virtual host MAC switch through the nth virtual host MAC switch corresponding to the first virtual host VH_1_* through the nth virtual host VH_n_*, respectively, in the respective switch hardware, so that communication packets addressed to each of the first virtual hosts VH_1_* through the nth virtual host VH_n_* are transmitted to each of the first security engine through the nth security engine.

[0078] As an example, the network controller 100 may group unused host addresses into a 1_1 group through a 1_n group, and generate at least one first virtual host IP address by referring to the unused host addresses of the 1_1 group through at least one n-th virtual host IP address by referring to the unused host addresses of the 1_n group. In this case, the network controller 100 may change a part of the IP address used by the active host AH_*_* so that the virtual host IP addresses are distributed evenly among all the host addresses. In addition, the network controller 100 may distribute the virtual host IP addresses evenly among all the host addresses, but may distribute them more intensively among some of the host addresses in the first half, the middle half, and the second half.

[0079] This makes it possible to quickly detect cyber threats and maintain the network stable against cyber threats in situations where common cyber threats are made in a manner that starts with a low host address and then goes to a high address host, or starts with a high host address and then goes to a low address host, or starts with an address at a specific location and then goes to a high address host.

[0080] As another example, the network controller 100 may group all host addresses into a 2_1 group through a 2_n group, and generate at least one first virtual host IP address by referring to an unused host address among all host addresses in the 2_1 group through at least one n-th virtual host IP address by referring to an unused host address among all host addresses in the 2_n group. In this case, the network controller 100 may change a part of the IP address used by the active host AH_*_* so that the virtual host IP addresses are distributed uniformly among all host addresses. In addition, the network controller 100 may distribute the virtual host IP addresses uniformly among all host addresses, but may distribute them more intensively among some of the host addresses in the first half, the middle half, and the second half. This makes it possible to quickly detect cyber threats and maintain the network stable against cyber threats in situations where common cyber threats are made in a manner that starts with a low host address and then goes to a high address host, or starts with a high host address and then goes to a low address host, or starts with an address at a specific location and then goes to a high address host.

[0081] As yet another example, when the number of at least one virtual host to be generated on the network is m, the network controller 100 can group all host addresses into 3_1 group through 3_m group, generate a 3_1 virtual host IP address by referencing one unused host address in the 3_1 group through a 3_m virtual host IP address by referencing one unused host address in the 3_m group, and group the 3_1 virtual host IP addresses through the 3_m virtual host IP addresses into n groups to generate the 1st virtual host IP address through the nth virtual host IP address.

[0082] As an example, take a network that uses class C 192.168.0.255 and has two access switches, and you want to generate five virtual hosts on the network. The host addresses are the last octet from 0 to 255, and the IP address 192.168.0.0 corresponding to "0" is used as the network address, and the IP address 192.168.0.255 corresponding to "255" is used to broadcast messages to all hosts in the network. Therefore, the first and last IP addresses cannot be assigned to individual hosts. Therefore, the IP addresses that can actually be assigned to individual hosts are IP addresses from 192.168.0.1 to 192.168.0.254, so these are divided into five groups: group 3_1, "192.168.0.1 to 192.168.0.50," group 3_2, "192.168.0.51 to 192.168.0.100," group 3_3, "192.168.0.101 to 192.168.0.150," group 3_4, "192.168.0.1 to 192.168.0.160," group 3_5, "192.168.0.1 to 192.168.0.170," group 3_6, "192.168.0.1 to 192.168.0.190," group 3_7, "192.168.0.1 to 192.168.0.200," group 3_8, "192.168.0.1 to 192.168.0.210," group 3_9, "192.168.0.1 to 192.168.0.220," group 3_10, "192.168.0.1 to 192.168.0.230," group 3_11, "192.168.0.1 to 192.168.0.240," group 3_12, "192.168.0.1 to 192.168.0.250," group 3_13, "192.168.0.1 to 192.168.0.260," group 3_14, "19 After grouping the IP addresses into a 3_4 group of "192.168.0.151 to 192.168.0.200" and a 3_5 group of "192.168.0.201 to 192.168.0.254", one unused IP address each from the 3_1 group, the 3_2 group, the 3_3 group, the 3_4 group, and the 3_5 group can be generated as the first virtual host IP address to the fifth virtual host IP address. Then, three virtual host IP addresses from the first virtual host IP address to the fifth virtual host IP address can be used to generate three virtual hosts in the first access switch, and two virtual hosts can be generated in the second access switch using the remaining two virtual host IP addresses.

[0083] For reference, in FIG. 1, a first_1 active host AH_1_1 having an IP address of 192.168.0.10 and a first_2 active host AH_1_2 having an IP address of 192.168.0.11 are connected to the first access switch 200_1, and a first_1 virtual host VH_1_1 having a virtual host IP address of 192.168.0.2 is generated. A second access switch 200_2 has a second_1 active host AH_2_1 having an IP address of 192.168.0.22 and a second_2 active host AH_2_2 having an IP address of 192.168.0.23. The example shows a state in which a 2_2 active host AH_2_2 having an IP address of 192.168.0.50 and a 2_1 virtual host VH_2_1 having a virtual host IP address of 192.168.0.100 are generated, and an n_1 active host AH_n_1 having an IP address of 192.168.0.32 is connected to the n-th access switch 200_n, and an n_1 virtual host VH_n_1 having a virtual host IP address of 192.168.0.200 is generated.

[0084] With the above-mentioned method, when the virtual hosts VH_*_* are generated in the access switches 200_1 to 200_n of the network, the process in which the access switches 200_1 to 200_n detect cyber threats using the virtual hosts will be described below with reference to Figures 1 and 3. For reference, it is assumed that the specific active host posing a cyber threat in Figure 3 is the 1_1th active host AH_1_1 in Figure 1, and the specific access switch 200 in Figure 3 is any one of the 1st access switch 200_1 to the nth access switch 200_n in Figure 1, and it is assumed that one virtual host VH has been generated.

[0085] A specific active host AH_1_1 infected with malware can transmit a host scan packet to search for hosts connected to the network through the first access switch 200_1 to active hosts and virtual hosts in the network (S100) in order to infect other hosts connected to the network.

[0086] Then, the host scan packet transmitted from a specific active host AH_1_1 can be received by a specific access switch 200, which is any one of the first access switch 200_1 to the nth access switch 200_n installed in the network, and the specific access switch 200 that receives the host scan packet can check whether the destination IP address of the host scan packet corresponds to at least one pre-configured virtual host IP address.

[0087] Then, after checking whether the destination IP address of the host scan packet corresponds to a specific virtual host IP address, if it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, the specific access switch 200 can transmit the host scan packet to the specific virtual host VH by referring to the specific virtual host MAC address that matches the specific virtual host IP address.

[0088] In this case, the destination IP address of the host scan packet may be a specific IP address for scanning a specific host, or a broadcast IP address for scanning all hosts in the network.

[0089] Therefore, a particular access switch 200 can check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a particular virtual host IP address, transmit the host scan packet to a particular virtual host VH.

[0090] Alternatively, a particular access switch 200 may check the destination IP address of a host scan packet received from a particular active host AH_1_1, and if the destination IP address of the host scan packet is a broadcast IP address, the particular access switch 200 may perform a process of broadcasting the host scan packet to active hosts on the network via the network stack, and a process of duplicating the host scan packet and transmitting it to a particular virtual host VH.

[0091] Through the above-described operations, when a host scan packet is transmitted to a specific virtual host VH, i.e., when a specific access switch 200 transmits the host scan packet to the security engine in which the specific virtual host VH was generated, the security engine can generate a response packet that corresponds to the specific host scan method used in the host scan packet and includes the MAC address of the specific virtual host.

[0092] In this case, the security engine may store a pre-defined host scan method for checking a specific host scan method of the host scan packet. The pre-defined host scan method may include scan methods used in common networks, such as Internet Control Message Protocol (ICMP) scan and Transmission Control Protocol (TCP) scan, scan methods used by confirmed malware, such as Server Message Block (SMB) scan, NetBIOS scan, NetBIOS Name Service (NBNS) scan, and all scan methods used by confirmed malware as well as common networks, such as ARP scan.

[0093] Then, the specific access switch 200 can transmit the response packet generated by the security engine to the specific active host AH_1_1 (S200). That is, the specific access switch 200 can respond to the specific virtual host VH scan performed by the specific active host AH_1_1 and execute a virtual host response so that the specific active host AH_1_1 can recognize the specific virtual host VH as a host that can be infected.

[0094] Thereafter, the specific active host AH_1_1 that has received the response packet can determine that the virtual host VH is an infectable host, generate a data packet that includes malware for infecting the virtual host VH, and has the specific virtual host IP address as a destination IP address and the specific virtual host MAC address as a destination MAC address, and then transmit (S300) the data packet to the specific access switch 200 (here, the data packet may be transmitted directly to the specific access switch 200, or may be transmitted to the specific access switch 200 via another access switch). In other words, the concept of the specific active host AH_1_1 generating a data packet and then transmitting it to the specific access switch 200 can be understood as an attempt to infect the virtual host VH.

[0095] Then, the specific access switch 200 can transmit a data packet, whose destination IP address and destination MAC address are the specific virtual host IP address and the specific virtual host MAC address, transmitted from the specific active host AH_1_1 to the specific virtual host VH.

[0096] Then, when the data packet is transmitted to the virtual host VH, that is, when the specific access switch 200 transmits the data packet to the security engine in which the specific virtual host VH is generated, the security engine can determine that the data packet is malware and block the specific active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_n installed in the network. That is, the specific access switch 200 can block the specific active host AH_1_1 that attempts to infect the specific virtual host, thereby protecting the network from cyber threats. This is based on the fact that an attempt to scan and access a virtual host, rather than an active host that is actually in operation, is not a normal operation, and after recognizing the virtual host generated in the access switch stage as a host that can be infected, the specific active host that attempts a cyber threat to the virtual host is blocked from the network, thereby effectively blocking the cyber threat before it attempts a cyber threat to other active hosts.

[0097] Meanwhile, the security engine of a particular access switch 200 can analyze the data code of the data packet and check the analyzed behavior pattern of the data code.

[0098] Then, when the analysis operation pattern for the data packet matches a specific registered operation pattern among the registered operation patterns corresponding to each of the pre-registered malware profiles, the security engine of a specific access switch 200 can determine that the data code is specific malware corresponding to the specific registered operation pattern, and can block the specific active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_n.

[0099] Alternatively, if the analyzed behavior pattern does not match each of the registered behavior patterns, the security engine of the particular access switch 200 may determine that the data code is unidentified malware and may block the particular active host AH_1_1 from the network through at least one of the access switches 200_1 to 200_n, and then send an alarm to the network controller 100 that manages the network, or may send an alarm to the network controller 100 without blocking the particular active host AH_1_1 from the network, so that the network controller 100 may decide whether or not to block the particular active host AH_1_1 from the network.

[0100] At this time, the network controller 100, while storing the behavior patterns for the already confirmed malware in the malware database, generates a malware profile including the behavior patterns of the confirmed malware from the malware database, and transmits the malware profile for the confirmed malware to each of the first security engine of the first access switch 200_1 through the nth security engine of the nth access switch 200_n, so as to register the malware profile for the confirmed malware with each of the first security engine through the nth security engine.

[0101] As an example, the malware database may be shown in Table 1 below, and the malware database may store information regarding behavior patterns such as host scanning methods, protocols, and approach methods for confirmed malware. However, the present invention is not limited thereto, and may include various information for confirming malware behavior patterns.

[0102] [Table 1]

[0103] Additionally, the security engine of a particular access switch 200 may transmit host scan packets and data packets corresponding to unidentified malware to the network controller 100.

[0104] The network controller 100 can then add information about the unconfirmed malware to the malware database, as shown in Table 2 below.

[0105] [Table 2]

[0106] The network controller 100 can then analyze the behavior patterns of the unconfirmed malware and update the malware database by referring to the results of the analysis of the unconfirmed malware.

[0107] Thereafter, as shown in FIG. 4, the network controller 100 generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware updated in the malware database, and transmits the malware profile for the unconfirmed malware to each of the first security engine of the first access switch 200_1 through the nth security engine of the nth access switch 200_n, thereby causing each of the first security engine through the nth security engine to update the malware profile registered in advance.

[0108] Additionally, the security engine of a particular access switch 200 may transmit host scan packets and data packets corresponding to particular malware or host scan packets and data packets corresponding to unidentified malware to the network controller 100.

[0109] The network controller 100 can then classify the data packets and host scan packets into either data packets and host scan packets corresponding to specific malware, or host scan packets and data packets corresponding to unidentified malware, and store and manage them as back data for subsequent analysis.

[0110] The above-described embodiments of the present invention may be realized in the form of program instructions that can be executed by various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention, or may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROMs, RAMs, flash memories, and the like. Examples of program instructions include not only machine language code, such as produced by a compiler, but also high-level language code that may be executed by a computer using an interpreter, and the like. The hardware devices may be configured to operate as one or more software modules to perform the processes according to the present invention, and vice versa.

[0111] Although the present invention has been described above by using specific details such as concrete components and limited examples and drawings, this is merely provided to facilitate a more comprehensive understanding of the present invention, and the present invention is not limited to the above examples. Those skilled in the art will appreciate that various modifications and variations can be made from such descriptions.

[0112] Therefore, the spirit of the present invention should not be limited to the embodiments described above, and all modifications equivalent to or equivalent to the scope of the claims below, as well as the scope of the spirit of the present invention, are intended to fall within the scope of the spirit of the present invention. [Explanation of symbols]

[0113] 1000 Cyber ​​Threat Detection System 100 Network Controller 200_1 to 200_n Access Switch AH_*_* Active host VH_*_* Virtual host

Claims

1. A method for detecting cyber threats to a network using a virtual host, (a) when a specific access switch, which is one of access switches that allows hosts to communicate with each other in a network, receives a host scan packet from a specific active host among active hosts (the active host is a host connected to a switching port of the access switch), confirms whether a destination IP (Internet Protocol) address of the host scan packet corresponds to at least one virtual host IP address that has been set in advance, and when it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, refers to a specific virtual host MAC address that matches the specific virtual host IP address, and transmits the host scan packet to a specific virtual host (the specific virtual host is generated in a security engine set in the specific access switch) that corresponds to the specific virtual host MAC address, thereby generating a response packet including the specific virtual host MAC address in accordance with a specific host scan method used in the host scan packet using the security engine that corresponds to the specific virtual host, and transmits the response packet generated by the security engine to the specific active host; (b) when a data packet is received from the specific active host, the destination IP address of which is the specific virtual host IP address and the destination MAC address of which is the specific virtual host MAC address, the specific access switch transmits the data packet to the specific virtual host, thereby causing the security engine corresponding to the specific virtual host to determine that the data packet is malware and block the specific active host from the network through at least one of the access switches; Including, In the step (a), The particular access switch checks the destination IP address of the host scan packet, and (i) if the destination IP address of the host scan packet is the particular virtual host IP address, transmits the host scan packet to the virtual host, and (ii) if the destination IP address of the host scan packet is a broadcast IP address, performs a process of broadcasting the host scan packet via a network stack to the active hosts on the network, and a process of duplicating and transmitting the host scan packet to the particular virtual host.

2. In the step (b), 2. The method of claim 1, wherein the specific access switch transmits the data packet to the specific virtual host, and checks an analysis behavior pattern obtained by analyzing a data code of the data packet using the security engine corresponding to the specific virtual host to analyze a behavior pattern of the data code, and (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determines that the data code is specific malware corresponding to the specific registered behavior pattern and blocks the specific active host from the network through at least one of the access switches, and (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determines that the data code is unconfirmed malware, and executes any one of the following processes: (ii-1) blocking the specific active host from the network through at least one of the access switches and then sending an alarm to a network controller that manages the network, and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

3. The method of claim 2, wherein the specific access switch transmits the host scan packet and the data packet corresponding to the unconfirmed malware to the network controller using the security engine corresponding to the specific virtual host, and the network controller updates a malware database stored in the network controller by referring to a result of analyzing the unconfirmed malware, and when a profile corresponding to the unconfirmed malware including an operation pattern for the unconfirmed malware is received from the network controller, the pre-registered malware profile is updated.

4. 3. The method of claim 2, wherein the specific access switch transmits, using the security engine, the host scan packet and the data packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, to the network controller, and the network controller classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

5. 2. The method of claim 1, wherein the specific virtual host IP address and the specific virtual host MAC address are set by a network controller that manages the network, and the network controller generates the specific virtual host IP address by using an unused host address that is not used by the active host among all host addresses of the network, and generates the specific virtual host MAC address that matches the specific virtual host IP address and corresponds to the security engine.

6. In the step (a), The method of claim 1, wherein the specific access switch transmits the host scan packet to the specific virtual host, and generates the response packet by using the security engine corresponding to the specific virtual host to confirm the specific host scan method used in the host scan packet from among pre-configured host scan methods, the pre-configured host scan methods including a scan method used in a general network and a scan method of a confirmed malware.

7. A method for detecting cyber threats to a network using a virtual host, (a) a network controller managing a network generates at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) that enable hosts to communicate with each other within the network, among all host addresses of the network, and generates at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; (b) the network controller transmits each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one nth virtual host IP address and the at least one nth virtual host MAC address to each of the first access switch through the nth access switch, and (i) transmits at least one first virtual host through the nth security engine set inside the first access switch through the nth security engine set inside the nth access switch to a first security engine set inside the first access switch through the nth security engine set inside the nth access switch, generating at least one nth virtual host by referring to the at least one nth virtual host IP address and the at least one nth virtual host MAC address; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine, and blocking the specific active host from the network; Including, In the step (a), The method includes: the network controller groups the unused host addresses into a 1_1 group through a 1_n group; and generating the at least one first virtual host IP address that references the unused host addresses of the 1_1 group through the at least one nth virtual host IP address that references the unused host addresses of the 1_n group.

8. the network controller generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns of the confirmed malware, and transmits the malware profile for the confirmed malware to each of the first security engine through the nth security engine, thereby registering the malware profile for the confirmed malware with each of the first security engine through the nth security engine; In the step (b), 8. The method of claim 7, wherein the network controller, using a specific security engine corresponding to a specific virtual host that received the data packet, analyzes a data code of the data packet to check an analysis behavior pattern obtained by analyzing a behavior pattern of the data code, and (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determines that the data code is specific malware corresponding to the specific registered behavior pattern and blocks the specific active host from the network through at least one of the first access switch to the nth access switch, and (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determines that the data code is unconfirmed malware, and executes any one of the following processes: (ii-1) a process of blocking the specific active host from the network through at least one of the first access switch to the nth access switch, and then sending an alarm to the network controller; and (ii-2) a process of sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

9. In the step (b), 9. The method of claim 8, wherein when the network controller receives a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, the network controller updates the malware database by referring to a result of analyzing the unconfirmed malware, generates an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware, transmits the unconfirmed malware profile to each of the first security engine through the nth security engine, and updates the pre-registered malware profile by each of the first security engine through the nth security engine.

10. In the step (b), 9. The method of claim 8, wherein when the network controller receives a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware from the specific security engine, the network controller classifies the data packet and the host scan packet into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

11. A method for detecting cyber threats to a network using a virtual host, comprising: (a) a network controller managing a network generates at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) that enable hosts to communicate with each other within the network, among all host addresses of the network, and generates at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; (b) the network controller transmits each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one nth virtual host IP address and the at least one nth virtual host MAC address to each of the first access switch through the nth access switch, and (i) transmits at least one first virtual host through the nth security engine set inside the first access switch through the nth security engine set inside the nth access switch to a first security engine set inside the first access switch through the nth security engine set inside the nth access switch, generating at least one nth virtual host by referring to the at least one nth virtual host IP address and the at least one nth virtual host MAC address; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine, and blocking the specific active host from the network; Including, In the step (a), The method includes the network controller grouping all of the host addresses into a 2_1 group through a 2_n group, and generating the at least one first virtual host IP address that references an unused host address among all of the host addresses in the 2_1 group through the at least one nth virtual host IP address that references an unused host address among all of the host addresses in the 2_n group.

12. A method for detecting cyber threats to a network using a virtual host, comprising: (a) a network controller managing a network generates at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) that enable hosts to communicate with each other within the network, among all host addresses of the network, and generates at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; (b) the network controller transmits each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one nth virtual host IP address and the at least one nth virtual host MAC address to each of the first access switch through the nth access switch, and (i) transmits at least one first virtual host through the nth security engine set inside the first access switch through the nth security engine set inside the nth access switch to a first security engine set inside the first access switch through the nth security engine set inside the nth access switch, generating at least one nth virtual host by referring to the at least one nth virtual host IP address and the at least one nth virtual host MAC address; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine, and blocking the specific active host from the network; Including, In the step (a), The method, when the number of virtual hosts to be generated on the network is m (m is an integer greater than or equal to n), the network controller groups all of the host addresses into 3_1 group through 3_m group, generates a 3_1 virtual host IP address by referencing an unused host address in the 3_1 group through a 3_m virtual host IP address by referencing an unused host address in the 3_m group, and groups the 3_1 virtual host IP addresses through the 3_m virtual host IP addresses into n groups to generate the at least one 1st virtual host IP address through the at least one nth virtual host IP address.

13. In an access switch that uses virtual hosts to detect cyber threats to a network, a memory storing instructions for detecting cyber threats to a network using a virtual host; a processor that performs operations according to the instructions stored in the memory to detect cyber threats to the network using the virtual hosts; Including, The processor (I) receives a host scan packet from a specific active host among active hosts connected to a switching port of an access switch that enables hosts to communicate with each other in the network, and then reads the destination IP address (IP address) of the host scan packet from the specific active host. and (II) performing a process of checking whether a destination IP address of the host scan packet corresponds to at least one virtual host IP address set in advance, and when it is confirmed that the destination IP address of the host scan packet corresponds to a specific virtual host IP address, referring to a specific virtual host MAC address matching the specific virtual host IP address, transmitting the host scan packet to a specific virtual host corresponding to the specific virtual host MAC address (the specific virtual host is generated in a security engine set in a specific access switch), thereby causing the security engine corresponding to the specific virtual host to generate a response packet including the specific virtual host MAC address corresponding to the specific host scan method used in the host scan packet, and transmitting the response packet generated by the security engine to the specific active host; and (II) performing a process of transmitting the data packet to the specific virtual host when a data packet having a destination IP address that is the specific virtual host IP address and a destination MAC address that is the specific virtual host MAC address is received from the specific active host, thereby causing the security engine corresponding to the specific virtual host to determine that the data packet is malware, and blocking the specific active host from the network through at least one of the access switches, The processor, In the process (I), the access switch checks the destination IP address of the host scan packet, and (i) if the destination IP address of the host scan packet is the specific virtual host IP address, transmits the host scan packet to the specific virtual host, and (ii) if the destination IP address of the host scan packet is a broadcast IP address, executes a process of broadcasting the host scan packet to the active hosts on the network via a network stack, and a process of duplicating the host scan packet and transmitting it to the specific virtual host.

14. The processor, 14. The access switch according to claim 13, wherein in the process (II), the access switch executes any one of the following processes: transmitting the data packet to the specific virtual host, and using the security engine corresponding to the specific virtual host to analyze a data code of the data packet and check an analysis behavior pattern obtained by analyzing a behavior pattern of the data code; (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determining that the data code is specific malware corresponding to the specific registered behavior pattern, and blocking the specific active host from the network through at least one of the access switches; (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determining that the data code is unconfirmed malware; (ii-1) blocking the specific active host from the network through at least one of the access switches and then sending an alarm to a network controller that manages the network; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

15. The access switch of claim 14, wherein the processor causes the security engine corresponding to the specific virtual host to transmit the host scan packet and the data packet corresponding to the unconfirmed malware to the network controller, and causes the network controller to update a malware database stored in the network controller by referring to a result of analyzing the unconfirmed malware, and when a profile corresponding to the unconfirmed malware including an operation pattern for the unconfirmed malware is received from the network controller, the processor updates the pre-registered malware profile.

16. The access switch of claim 14, wherein the processor transmits the host scan packet and the data packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, to the network controller, and the network controller classifies the data packet and the host scan packet into one of the data packet and the host scan packet corresponding to the specific malware and the host scan packet and the data packet corresponding to the unconfirmed malware, and stores and manages the data as back data for subsequent analysis.

17. The access switch according to claim 13, wherein the specific virtual host IP address and the specific virtual host MAC address are set by a network controller that manages the network, and the network controller generates the specific virtual host IP address by using an unused host address not used by the active host among all host addresses of the network, and generates the specific virtual host MAC address that matches the specific virtual host IP address and corresponds to the security engine.

18. The processor, The access switch of claim 13, wherein in the process (I), the host scan packet is transmitted to the specific virtual host, and the security engine corresponding to the specific virtual host is caused to confirm the specific host scan method used in the host scan packet among pre-configured host scan methods, thereby generating the response packet, and the pre-configured host scan method includes a scan method used in a general network and a scan method of a confirmed malware.

19. A network controller that uses a virtual host to detect cyber threats to a network, a memory storing instructions for detecting cyber threats to a network using a virtual host; a processor that performs operations according to the instructions stored in the memory to detect cyber threats to the network using the virtual hosts; Including, The processor includes: (I) a process of generating at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) among all host addresses of the network, and generating at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; and (II) a process of transmitting each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one n-th virtual host IP address to each of the first access switch through the n-th access switch to generate a virtual host MAC address corresponding to the at least one first virtual host MAC address. and (i) generating at least one first virtual host through at least one nth virtual host IP address referring to the at least one first virtual host IP address and the at least one nth virtual host MAC address in each of a first security engine through an nth security engine set in the first access switch through the nth access switch, respectively; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host IP address using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and then determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine,executing a process for disconnecting the network; The processor, In the process (I), a network controller groups the unused host addresses into a 1_1 group through a 1_n group, and generates the at least one first virtual host IP address that references the unused host addresses of the 1_1 group through the at least one nth virtual host IP address that references the unused host addresses of the 1_n group.

20. The processor generates a malware profile including an operation pattern of the confirmed malware from a malware database storing operation patterns of the confirmed malware, and transmits the malware profile for the confirmed malware to each of the first security engine through the nth security engine, thereby registering the malware profile for the confirmed malware with each of the first security engine through the nth security engine; 20. The network controller according to claim 19, wherein in the process (II), the network controller executes any one of the following processes: a process of using a specific security engine corresponding to a specific virtual host that has received the data packet to analyze a data code of the data packet and confirming an analysis behavior pattern obtained by analyzing a behavior pattern of the data code, and (i) if the analysis behavior pattern matches a specific registered behavior pattern among registered behavior patterns corresponding to each of pre-registered malware profiles, determining that the data code is specific malware corresponding to the specific registered behavior pattern, and blocking the specific active host from the network through at least one of the first access switch to the nth access switch; and (ii) if the analysis behavior pattern does not match each of the registered behavior patterns, determining that the data code is unconfirmed malware, and (ii-1) blocking the specific active host from the network through at least one of the first access switch to the nth access switch, and then sending an alarm to the network controller; and (ii-2) sending the alarm to the network controller while the specific active host is not blocked from the network, thereby assisting the network controller in determining whether to block the specific active host from the network.

21. The processor, 21. The network controller of claim 20, wherein in the process (II), when a host scan packet corresponding to the unconfirmed malware and the data packet are received from the specific security engine, the malware database is updated by referring to a result of analyzing the unconfirmed malware, an unconfirmed malware profile for the unconfirmed malware including an operation pattern for the unconfirmed malware is generated, and the unconfirmed malware profile is transmitted to each of the first security engine through the nth security engine, so that the first security engine through the nth security engine update the pre-registered malware profile.

22. The processor, 21. The network controller of claim 20, wherein in the process (II), when a host scan packet and the data packet corresponding to the specific malware, or a host scan packet and the data packet corresponding to the unconfirmed malware, are received from the specific security engine, the data packet and the host scan packet are classified into either the data packet and the host scan packet corresponding to the specific malware, or the host scan packet and the data packet corresponding to the unconfirmed malware, and the classified data packet and the host scan packet are stored and managed as data for back data for subsequent analysis.

23. A network controller for detecting cyber threats to a network using a virtual host, comprising: a memory storing instructions for detecting cyber threats to a network using a virtual host; a processor that performs operations according to the instructions stored in the memory to detect cyber threats to the network using the virtual hosts; Including, The processor includes: (I) a process of generating at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) among all host addresses of the network, and generating at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; and (II) a process of transmitting each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one n-th virtual host IP address to each of the first access switch through the n-th access switch to generate a virtual host MAC address corresponding to the at least one first virtual host MAC address. and (i) generating at least one first virtual host through at least one nth virtual host IP address referring to the at least one first virtual host IP address and the at least one nth virtual host MAC address in each of a first security engine through an nth security engine set in the first access switch through the nth access switch, respectively; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host IP address using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and then determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine,executing a process for disconnecting the network; The processor, In the process (I), a network controller groups all of the host addresses into a 2_1 group through a 2_n group, and generates the at least one first virtual host IP address that references an unused host address among all of the host addresses in the 2_1 group through the at least one nth virtual host IP address that references an unused host address among all of the host addresses in the 2_n group.

24. A network controller for detecting cyber threats to a network using a virtual host, comprising: a memory storing instructions for detecting cyber threats to a network using a virtual host; a processor that performs operations according to the instructions stored in the memory to detect cyber threats to the network using the virtual hosts; Including, The processor includes: (I) a process of generating at least one first virtual host IP address through at least one n-th virtual host IP address by using unused host addresses not used by active hosts, which are hosts connected to switching ports of a first access switch through an n-th access switch (where n is an integer equal to or greater than 1) among all host addresses of the network, and generating at least one first virtual host MAC address corresponding to the at least one first virtual host IP address through at least one n-th virtual host MAC address corresponding to the at least one n-th virtual host IP address; and (II) a process of transmitting each of the at least one first virtual host IP address and the at least one first virtual host MAC address through the at least one n-th virtual host IP address to each of the first access switch through the n-th access switch to generate a virtual host MAC address corresponding to the at least one first virtual host MAC address. and (i) generating at least one first virtual host through at least one nth virtual host IP address referring to the at least one first virtual host IP address and the at least one nth virtual host MAC address in each of a first security engine through an nth security engine set in the first access switch through the nth access switch, respectively; (ii) scanning at least one of the at least one first virtual host through the at least one nth virtual host IP address using at least one of the at least one first virtual host IP address through the at least one nth virtual host IP address, and then determining a specific active host that transmits a data packet to at least one of the at least one first virtual host through the at least one nth virtual host via at least one of the first security engine through the nth security engine,executing a process for disconnecting the network; The processor, In the process (I), when the number of virtual hosts to be generated on the network is m (m is an integer equal to or greater than n), a network controller groups all of the host addresses into a 3_1 group through a 3_m group, generates a 3_1 virtual host IP address by referencing an unused host address in the 3_1 group through a 3_m virtual host IP address by referencing an unused host address in the 3_m group, and groups the 3_1 virtual host IP addresses through the 3_m virtual host IP addresses into n groups to generate the at least one first virtual host IP address through the at least one nth virtual host IP address.

Images