트래픽 분석을 통한 악성코드 감염PC 및 APT 공격탐지 방안

국문 초록 (Abstract)

최근, 지능화된 공격기법을 통한 사이버테러가 지속적으로 발생하고 있으며 특히, 알려지지 않은 신종 악성코드를 사용하기에 탐지 및 대응이 매우 어렵다. 본 논문에서는 대용량 데이터 분석을 통해, 악성코드 침투단계 이후에, 좀비PC와 공격자와 통신을 사전탐지, 대응하는 알고리즘 개발 및 상용환경에서 검증하였다. 향후, 알고리즘의 고도화, 대용량 데이터 처리기술 적용을 통해, APT 공격의 탐지성능이 향상될 것으로 예상한다.

다국어 초록 (Multilingual Abstract)

Recently, cyber terror has been occurred frequently based on advanced persistent threat(APT) and it is very difficult to detect these attacks because of new malwares which cannot be detected by anti-virus softwares. This paper proposes and verifies the algorithms to detect the advanced persistent threat previously through real-time network monitoring and combinatorial analysis of big data log. In the future, APT attacks can be detected more easily by enhancing these algorithms and adapting big data platform.

목차 (Table of Contents)

• 요약
• ABSTRACT
• Ⅰ. 서론
• Ⅱ. 관련 연구
• Ⅲ. 이상 공격징후 탐지 방안
• Ⅳ. 시험결과
• Ⅴ. 결론
• References

참고문헌 (Reference)

1 X. Qin, "Statistical causality of infosec alert data" 2003

2 W.L. Xinzhou Qin, "Statistical causality analysis of infosec alert data" 2003

3 Suhyung Lee, "Security event processing for effective analysis" 22 (22): 2007

4 A.Valdes, "Probabilistic alert correlation" 2001

5 S. Cheung, "Modeling multistep cyber attacks for scenario recognition" 284-292, 2003

6 K. Julisch, "Mining alarm clusters to improve alarm handling efficiency" 2001

7 F. Cuppens, "Managing alerts in a multi-intrusion detection environment" 2001

8 B. Morin, "M2D2: A formal data model for IDS alert correlation" 115 (115): 115-137, 2002

9 Rishi Sinha, "Internet packet size distributions: some observations" USC/Information Sciences Institute 2007

10 A. Rao, "HBase-0.20.0 performance evaluation"

11 Munsun Shin, "Data mining based alarm data analysis implementation" 31 (31): 2004

12 C. Abad, "Correlation between netFlow system and network views for intrusion detection in workshop on link analysis" 2004

13 S. Noel, "Correlating intrusion events and building attack scenarios through attack graph distance" 2004

14 P. Ning, "Constructing attack scenarios through correlation of intrusion alerts" 245-254, 2002

15 O.Dain, "Building scenarios from a heterogeneous alert stream" 2001

16 P. Ning, "Analyzing intensive intrusion alerts via correlation" 74-94, 2002

17 Ning P, "An intrusion alert correlator based on prerequisites of intrusions" 2002

18 Elshoush, H. Tagelsir, "Alert correlation in collaborative intelligent intrusion detection systems - A survey" Applied Soft Computing In Press 2011

19 H. Debar, "Aggregation and correlation of intrusion detection alerts" 85-103, 2001

20 F. Xiao, "A novel data mining-based method for alert reduction and analysis" 5 (5): 88-97, 2010