Multilayer deception defense system for cyber threat detection and response

Abstract

Disclosed is a multilayer deception defense system for cyber threat detection and response. The disclosed multilayer deception defense system according to an embodiment comprises: a real network; a deception network corresponding to the real network; and a monitoring and response system for monitoring and responding to a cyber attack on one of the real network or the deception network. The real network includes a firewall, an intrusion prevention system, an intrusion detection system, and a real system. The real system includes a deception token, a honey credential, an application layer, an application log, a database, and a web server. The deception network includes a honey pot, an intrusion prevention system, an intrusion detection system, and a honey pot system. The honey pot system includes a deception token, a honey credential, an application layer, an application log, a database, and a web server.

Description

A multi-layered deception defense system for cyber threat detection and response.

[0001] An embodiment of the present invention relates to a multi-layer deception defense system for detecting and responding to cyber threats.

[0002] A honey pot is a technology used in computer security. It is a technology that places vulnerable virtual or physical systems and applications in a computing environment to lure hackers, and analyzes and traces the attacker's attack techniques and patterns.

[0003] Representative honeypot technologies include traps, honeynets, and decoys. Traps are systems intentionally installed to detect abnormal access, while honeynets are networks containing these traps. In other words, traps and honeynets are technologies that intentionally expose a system to attack, luring attackers into carrying out attacks and thereby uncovering attacker information and attack patterns. Decoys include information such as the addresses and accounts of attacker-luring services installed within traps, aimed at luring attackers into attacking and extracting information.

[0004] Because cyber threats are constantly changing and evolving, defense strategies need to be continually reviewed, updated, and managed accordingly.

[0005] An embodiment of the present invention provides a multi-layer deception defense system for cyber threat detection and response by creating a virtual environment that is realistic and complex enough to make an attacker believe it is a real system.

[0006] A multilayer deception defense system according to one embodiment disclosed comprises: a real network; a deception network corresponding to the real network; and a monitoring and response system for monitoring and responding to cyberattacks against either the real network or the deception network, wherein the real network comprises a firewall, an intrusion prevention system, an intrusion detection system, and a real system, wherein the real system comprises a deception token, a honey credential, an application layer, an application log, a database, and a web server, and wherein the deception network comprises a honeypot, an intrusion prevention system, an intrusion detection system, and a honeypot system, wherein the honeypot system comprises a deception token, a honey credential, an application layer, an application log, a database, and a web server.

[0007] When an attacker attempts to infiltrate the actual network or the deceptive network, the intrusion attempt can be detected through the intrusion prevention system and the intrusion detection system of the actual network and the deceptive network, and the deceptive elements of the actual system and the deceptive elements of the honeypot system can be used to deceive the attacker.

[0008] The above deception element includes a deception token and a honey credential, and when an attacker accesses the deception element, the intrusion prevention system and the intrusion detection system detect it and generate an alert, and the monitoring and response system can monitor all activities of the attacker and collect logs.

[0009] The above application layer performs application log detection, database detection, and web server detection, wherein the application log detection analyzes the application's activity log to detect abnormal access attempts, the database detection monitors database queries and accesses to detect intrusion attempts, and the web server detection monitors web server logs and activities to detect abnormal access attempts.

[0010] The above monitoring and response system can monitor one or more of network traffic, user activity logs, and system event logs in real time, transmit data collected through real-time monitoring to a central log server, analyze the collected log data to detect known threat patterns, and generate and deliver an alert to a user when a threat pattern is detected.

[0011] The above monitoring and response system can block threats as an initial response after the above threat pattern is detected, and perform one or more response actions among system updates, setting changes, security policy reinforcement, and user education based on the results of in-depth analysis, and perform a post-analysis of the attack after the response actions are performed to derive improvements to prevent similar threats.

[0012] According to the disclosed embodiments, attackers can be induced to access virtual environments or fake resources before targeting actual network resources. Furthermore, this can provide a foundation for developing customized response strategies for various types of attacks. Furthermore, monitoring attacker activity in virtual environments can aid in developing strategies for attackers' behavioral patterns, tools, and attack techniques. Furthermore, if attackers mistake virtual environments for real ones and attempt attacks, this wastes time and resources. Furthermore, if the distinction between real and virtual environments becomes blurred, attackers may mistakenly believe their attacks are successful, reducing attacks on real resources.

[0013] FIG. 1 is a drawing showing a multi-layer deception defense system according to one embodiment of the present invention.

[0014] FIG. 2 is a diagram illustrating a method for detecting a cyber attack in a multi-layer deception defense system according to one embodiment of the present invention.

[0015] Figure 3 is a diagram showing cyber attack detection of the application layer in one embodiment of the present invention.

[0016] Figure 4 is a flowchart showing a cyber attack monitoring and response method in one embodiment of the present invention.

[0017] Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to facilitate a comprehensive understanding of the methods, devices, and / or systems described herein. However, these are merely examples and the present invention is not limited thereto.

[0018] In describing embodiments of the present invention, if a detailed description of a known technology related to the present invention is judged to unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described below are terms defined in consideration of their functions in the present invention, and this may vary depending on the intention or custom of the user or operator. Therefore, the definitions should be made based on the contents throughout this specification. The terminology used in the detailed description is only for the purpose of describing embodiments of the present invention and should not be limited in any way. Unless clearly used otherwise, the singular form includes the plural form. In this description, expressions such as "comprises" or "having" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, and should not be construed to exclude the presence or possibility of one or more other features, numbers, steps, operations, elements, parts or combinations thereof other than those described.

[0019] In the following description, the terms "transmission," "communication," "sending," "receiving," and other similar terms for signals or information include not only the direct transmission of signals or information from one component to another, but also transmission via another component. In particular, "transmitting" or "sending" a signal or information to one component indicates the final destination of the signal or information, and does not mean the direct destination. The same applies to "receiving" a signal or information. In addition, in this specification, the "relationship" of two or more pieces of data or information means that when one piece of data (or information) is acquired, at least a portion of the other piece of data (or information) can be acquired based on it.

[0020] FIG. 1 is a drawing showing a multi-layer deception defense system according to one embodiment of the present invention.

[0021] Referring to FIG. 1, a multi-layer deception defense system may include an attacker (100), an actual network (200), a deception network (300), and a monitoring response system (400). Each component may include an intrusion prevention system (IPS), an intrusion detection system (IDS), a honeypot, honey credentials, and an application layer (application log, database, web server).

[0022] An attacker (100) attempts to infiltrate either the actual network (200) or the deceptive network (300).

[0023] The actual network (200) can be protected against network attacks by a firewall (210), an intrusion prevention system (220), and an intrusion detection system (230). The actual network (200) includes an actual system (240). The actual system (240) can include a deception token (241), a honey credential (242), an application layer (243), an application log (243_1), a database (243_2), and a web server (243_3).

[0024] The deception network (300) can be protected against network attacks by a honeypot (310), an intrusion prevention system (320), and an intrusion detection system (330). The deception network (300) includes a honeypot system (340). The honeypot system (340) can include a deception token (341), a honey credential (342), an application layer (343), an application log (343_1), a database (343_2), and a web server (343_3).

[0025] Here, when an attacker (100) attempts to infiltrate the actual network (200) or the deceptive network (300), the intrusion prevention system (220, 320) and the intrusion detection system (230, 330) detect this, respectively. Both the actual system (240) and the honeypot system (340) use deceptive elements (deceptive tokens (241, 341), honey credentials (242, 342)) to deceive the attacker. When the attacker (100) comes into contact with the deceptive elements, the system detects this and generates an alert.

[0026] A real-time monitoring system (410) and a log collection server (420) monitor all activities in real time and collect logs. Detected intrusion attempts are analyzed and appropriate countermeasures are taken. Users (110) can monitor system status and intrusion attempts in real time through the monitoring and response system.

[0027] The disclosed embodiment provides a multi-layer deception defense system that effectively detects and responds to attacks on networks and systems. This system operates both a real network and a deceptive network simultaneously, allowing attackers to be deceived by deceptive elements and abandon attempts to infiltrate the real system, or to analyze attack patterns and take countermeasures through a honeypot system.

[0028] Figure 2 is a diagram illustrating a method for detecting cyberattacks in a multi-layer deception defense system according to one embodiment of the present invention. It presents a monitoring and response flowchart illustrating the process from attacker access to response. The multi-layer deception defense system detects an attacker's access attempt, utilizes deception elements to induce an attack, generates an alert, and collects and analyzes logs.

[0029] Specifically, during the attacker access process, the attacker (100) attempts to access the actual network (200) and the deceptive network (300).

[0030] In addition, during the process of detecting a deception element, when an attacker (100) accesses a deception network (300), the attacker (100) comes into contact with a deception token (341). Then, when the attacker (100) attempts to use a honey credential (342), which is a deception element, the intrusion detection system (330) recognizes this. The attacker (100) attempts to access the application layer (343) within the deception network, and this is also detected by the intrusion detection system (330).

[0031] During the response process, if an attack is detected from a deceptive element, the system generates an alert, and all detected activities are stored on a log collection server and analyzed by a real-time monitoring system to take appropriate response measures.

[0032] Figure 3 is a diagram illustrating cyberattack detection at the application layer in one embodiment of the present invention. As shown in the diagram, the application layer consists of three main elements: log detection, database detection, and web server detection.

[0033] Application log detection analyzes application activity logs to detect unusual access attempts. For example, it monitors log files for frequent login attempts, access at unusual times, and access from unexpected IP addresses.

[0034] Database detection monitors database queries and access to detect intrusion attempts. For example, it detects unusual query patterns, attempts to extract large amounts of data, and unauthorized database access.

[0035] Web server detection monitors web server logs and activity to detect unusual access attempts. For example, it can detect unusual URL accesses, XSS attack attempts, and SQL injection attempts.

[0036] Figure 4 is a flowchart illustrating a cyberattack monitoring and response method according to one embodiment of the present invention. While the illustrated flowchart divides the method into multiple steps, at least some of the steps may be performed in a different order, combined with other steps, omitted, divided into substeps, or performed with one or more additional steps not depicted.

[0037] Referring to Figure 4, in the real-time monitoring stage, network traffic, user activity logs, and system event logs are monitored in real time.

[0038] During the log collection phase, data collected through real-time monitoring is transmitted to a central log server for storage. Log data is regularly backed up and stored in a secure database.

[0039] The threat detection phase analyzes collected log data to detect known threat patterns. If no threats are detected, monitoring continues.

[0040] In the alert generation phase, an alert is generated immediately when a threat is detected. This alert is delivered to users in real time, and a notification message is sent via the notification system.

[0041] In the initial response phase, we quickly block threats and minimize damage. For example, we block specific IP addresses, modify firewall rules, and isolate network segments. If we identify suspicious user accounts, we suspend them.

[0042] In the response phase, system updates, setting changes, security policy enhancements, and user education are implemented based on the results of the in-depth analysis.

[0043] The post-mortem phase involves conducting a post-event analysis of the attack after all response measures have been completed. Improvements are identified to prevent similar threats in the future and security policies are updated.

[0044] While representative embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications to the above-described embodiments are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims set forth below but also by equivalents thereof.

Claims

1. Actual network; A deceptive network corresponding to the above actual network; and A monitoring and response system for monitoring and responding to cyber attacks on either the actual network or the deceptive network, The above actual network includes a firewall, an intrusion prevention system, an intrusion detection system, and an actual system, The above actual system includes a deceptive token, honey credentials, an application layer, an application log, a database, and a web server. The above deception network includes a honeypot, an intrusion prevention system, an intrusion detection system, and a honeypot system, The above honeypot system is a multi-layered deception defense system including a deception token, honey credentials, application layer, application log, database, and web server.

2. In claim 1, A multi-layer deception defense system that detects an intrusion attempt through an intrusion prevention system and an intrusion detection system of the actual network and the deceptive network when an attacker attempts to infiltrate the actual network or the deceptive network, and deceives the attacker by using deceptive elements of the actual system and deceptive elements of the honeypot system.

3. In claim 2, The above deception elements include deception tokens and honey credentials, When an attacker accesses the above deception element, the intrusion prevention system and intrusion detection system detect it and generate an alert. A multi-layered deception defense system in which the above monitoring and response system monitors all activities of the above attacker and collects logs.

4. In claim 1, The above application layer performs application log detection, database detection, and web server detection. The above application log detection analyzes the application's activity log to detect abnormal access attempts, The above database detection detects intrusion attempts by monitoring database queries and accesses. The above web server detection is a multi-layered deception defense system that monitors web server logs and activities to detect abnormal access attempts.

5. In claim 1, The above monitoring and response system is, A multi-layered deception defense system that monitors one or more of network traffic, user activity logs, and system event logs in real time, transmits data collected through real-time monitoring to a central log server, analyzes the collected log data to detect known threat patterns, and generates and delivers an alert to the user when a threat pattern is detected.

6. In claim 5, The above monitoring and response system is, A multi-layered deception defense system that blocks threats as an initial response after the above threat pattern is detected, performs one or more response actions among system updates, setting changes, security policy enhancements, and user education based on the results of in-depth analysis, and performs a post-attack analysis of the attack after the response actions are taken to derive improvements to prevent similar threats.

Images