CN1909488A - Virus detection and invasion detection combined method and system - Google Patents

Abstract

The invention relates to a method for combining virus check and network invade check, and a relative system, wherein said method leads in virus check function in the network invade check system, to check and alarm the network impact and invade, and check the virus on the data stream carried by FTP, HTTP, SMTP, POP3, and IMAP protocols, via IDS data stream rearrangement and application protocol analysis. The invention can improve the virus check ability of NIDS system; and the system comprises five working modules and system modules: 1, stream rearranging and application protocol analyzing unit; 2, traditional IDS application protocol checking unit; 3, network virus checking unit; 4, alarm display unit, 5, system manage unit.

Description

The viral detection of a kind of combination and intrusion method for testing and system

Technical field

The present invention relates to computer network security field, is a kind of in conjunction with the method and system of virus detection with intrusion detection.The inventive method has realized the combination of IDS attack detecting technology and internet worm detection technique, detects at not appreciable impact IDS under the situation of engine performance, significantly improves the viral detectability of IDS system.

Background technology

Network Intrusion Detection System (Network-based Intrusion Detection System, abbreviate NIDS as) be an important component part of network security defense system, its basic function is exactly to insert to detect in the network with bypass mode the packet in the network is caught, by characteristic matching or anomaly analysis, thereby detect behavior or the attack that whether has breach of security strategy in the network.Because characteristic matching has the high characteristic of accuracy, be the most practical at present detection method, anomaly analysis is usually as auxiliary detection method.And the matching rule base that pre-defines on the detection efficiency of characteristic matching and the IDS engine is directly proportional relation, that is to say that the regular number that pre-defines is exactly the maximum different event number that IDS can quote.Too much regular number also directly has influence on the treatment effeciency of NIDS engine simultaneously.

ICP/IP protocol is one four a layer protocol system, application layer protocol is in the superiors of protocol system, directly provide service for application program, wherein agreements such as FTP, HTTP, SMTP, POP3, IMAP provide file transfer services. and we can be divided into this quasi-protocol communication channel control channel and data channel, control channel mainly carries out the transmission of control command and echo reply thereof, and data channel mainly is the transmission of carrying out data such as file.More typically be exactly File Transfer Protocol, its 21 port is exactly a control channel, and 20 ports then are data channels.For agreements such as POP3, SMTP, HTTP, its control channel is connected with the multiplexing same TCP of data channel, needs to adopt the application protocol analytic technique to implement to separate.

NIDS mainly be by network packet catch, data flow reorganization, application protocol resolve attack knowledge storehouse coupling, analyze the current network behavioural characteristic with technology such as abnormality detection and whether have aggressiveness, its more attention is the control channel of communications protocol, and ignored detection to various typical application protocol data channels, so traditional NIDS can only detect the attack that network worm viroid, wooden horse etc. have the rogue program of network behavior feature, and just powerless for each viroid (as: macrovirus etc.) of carrying in the application protocol data channel data stream.At present, there is a big chunk to have aggressive virus (such as bot program) by the application protocol data dissemination channel; Obviously, the virus of ignoring this class application protocol data channel detects and will bring potential safety hazard to protected network.And, increasing along with aggressive Virus, traditional NIDS lacks will become to the problem of using protocol data channel virus detectability and becomes increasingly conspicuous, and also is difficult to satisfy demand for security day by day.

The present invention has solved the problems referred to above effectively by introduce the virus detection techniques at typical application protocol data channel in existing NIDS.The inventive method has realized the combination of IDS attack detecting technology and internet worm detection technique, detects at not appreciable impact IDS under the situation of engine performance, significantly improves the viral detectability of IDS system.

Summary of the invention

The invention provides the viral detection of a kind of combination and intrusion method for testing and system, under with situation about the IDS engine performance not being affected greatly, significantly improve the viral detectability (number and the accuracy that comprise detection) of nids system.

What the present invention relates to detects the method that combines with intrusion detection in conjunction with virus, may further comprise the steps:

(1): be used for reorganization and application protocol parsing are caught, flowed to network packet according to the condition of setting, typical application protocol is decomposed into control channel and data channel, then communication data in the control channel is submitted to IDS and detected engine, data flow in the data channel is submitted to stream reorganization and the application protocol analyzing step that internet worm detects engine;

(2): be used to receive the flow automatically reorganization and the application protocol control channel data of application protocol resolution unit, misapply detection based on IDS application protocol attack rule base, the IDS application protocol that further adopts protocol anomaly to detect the anomalous event that takes place in the recognition network communication detects step;

(3): be used to receive the flow automatically reorganization and the application protocol data channel data stream of application protocol resolution unit, viral knowledge base Network Based is carried out the internet worm detection step that virus detects;

(4): be used for attack or the Virus Name that reports to user's display engine, the alarm indication step of be correlated with IP, risk class;

(5): be used for the operating state of using protocol detection engine and internet worm detection engine is managed, controls and inquires about, engine issued rule base and virus characteristic storehouse, the system management step of system's online upgrading.

A kind of combination virus detects and intrusion method for testing, introduces virus detection techniques in Network Intrusion Detection System, by strengthening reorganization of NIDS data flow and application protocol analytic ability, the data flow that typical application protocol carries is carried out virus detection and alarm; Its concrete course of work is as follows: at first, the data message of catching is flowed reorganization and application protocol parsing, application protocol is decomposed into control channel and data channel; Misapply detection based on the attack knowledge storehouse to using agreement control channel communication data then, further can adopt the abnormal behaviour that takes place in the abnormality detection technology identification current network; At last, virus base Network Based carries out the virus detection to data flow in the application protocol data channel.

The present invention has designed a cover can realize above-mentioned system (VIDS) in conjunction with virus detection and intrusion detection method, and it not only can be reported to the police to the intrusion behavior in the network, and can report to the police to transmission in the network and the virus of propagating.Native system comprises:

(1) stream reorganization and application protocol resolution unit: reorganization and application protocol parsing are caught, flowed to network packet according to the condition of setting, typical application protocol is decomposed into control channel and data channel, then communication data in the control channel is submitted to IDS and detected engine, data flow in the data channel is submitted to internet worm detect engine.

(2) IDS application protocol detecting unit: receive the application protocol control channel data of flow automatically reorganization and application protocol resolution unit, misapply detection, further carry out protocol anomaly simultaneously and detect based on IDS application protocol attack rule base;

(3) network virus checking unit: receive the application protocol data channel data stream of flow automatically reorganization and application protocol resolution unit, viral knowledge base Network Based is carried out virus and is detected;

(4) alarm indication unit: attack that reports to user's display engine or Virus Name, relevant IP, risk class;

(5) System Management Unit (control centre): user oriented provides the usefulness of administration configuration.Control centre is a high performance management system, and it can control the activity of a plurality of network detection engines that are positioned at Local or Remote, concentrates and formulates and collocation strategy, and unified data management is provided.Management control center can be set to main, minor structure, main management control centre can receive, transmit the warning information of sub-control centre in real time, the log information of sub-control centre is extracted in classification, issues various configuration files, strategy is configured its belonging network detection engine for the son control.

Virus detection that the present invention relates to and intrusion detection associated methods and system have the following advantages:

1, NIDS Intrusion Detection Technique and virus detection techniques are organically combined, what solved effectively that existing NIDS can't realize carries out the problem that virus detects to typical application protocol data channel.

2, detect under the situation of engine performance at not appreciable impact IDS, significantly improve the viral detectability of IDS system.

Description of drawings

Fig. 1 is the implementation framework figure of VIDS system;

Fig. 2 is the realization flow figure of VIDS system;

Fig. 3 is a VIDS virus detection sub-module frame diagram.

Embodiment

Below in conjunction with accompanying drawing the intrusion detection that the present invention relates to and the concrete implementation step of method for detecting virus are further specified:

As shown in Figure 1, the VIDS system that the present invention relates to comprises with lower module and realizes;

1. original message is caught the bag module in real time, supports raw-sock and network interface card to drive and catches the bag dual mode;

2. the MAC layer of original message, IP layer protocol are resolved and the fragment recombination module;

3. transport layer protocol is resolved and the stream recombination module, promptly based on (source IP, order IP, source port, eye end mouth, transport layer protocol) five-tuple original message is flowed reorganization;

4. the application protocol parsing module promptly carries out application protocol to representative network agreement (FTP, HTTP, SMTP, POP3, IMAP etc.) and resolves, and isolates agreement control channel and data channel;

5.IDS detection module, promptly the isolated control channel data of protocol analysis module are misapplied detection or protocol anomaly detects to using;

6. the virus characteristic detection module promptly carries out the scanning of virus characteristic coupling to using the isolated data channel signal of protocol analysis module;

7. the reporting events module promptly receives the alert data from IDS detection module and virus characteristic detection module, reports control desk then;

8. management control center promptly receives and the affair alarm of presented event reporting module; Be responsible for editing and issuing the management strategy of whole system simultaneously.

As shown in Figure 2, VIDS workflow involved in the present invention comprises the steps;

1, the VIDS engine is caught the bag module by message and is caught data flow in the network;

2, call the network data that MAC protocol analysis subprogram is resolved mac-layer protocol;

3, the ARP/RARP agreement is then called ARP/RARP protocol analysis subprogram and was resolved and directly enter the 6th step in this way; Otherwise call IP protocol analysis and ip fragmentation reorganization program;

4 if ICMP or IGMP agreement are then called ICMP respectively and the 6th step was resolved and directly entered to IGMP protocol analysis subprogram; Transport layer protocol is resolved and stream recon program otherwise call;

5, call application layer protocol parsing subprogram protocol data is reduced, isolate control channel and data channel for typical application protocol;

6, based on attack signature library call rule match subprogram the control channel data are carried out pattern matching, if the match is successful then the incident of calling produces subprogram and the reporting events subprogram reports the VIDS incident; Carry out abnormality detection simultaneously, exist abnormal behaviour then to report this anomalous event in the communication as finding.

7, detect subprogram based on virus characteristic library call virus and carry out virus and detect, if the match is successful then call incident generation subprogram and the reporting events subprogram reports the VIDS incident to using the protocol data channel data.

As shown in Figure 3, the virus in the VIDS of the present invention system detects engine and comprises following submodule:

1, virus characteristic library module, it has comprised all virus signatures among the VIDS, and sets up index based on quick Hash table;

2, preliminary treatment submodule is responsible for data stream is carried out preliminary treatment before the virus scan, comprises that data flow decompresses, decoding and grand extraction operation;

3, fast the multi-mode matching module, be responsible for pretreated data flow is carried out quick multi-mode coupling, thereby identify common virus with obvious virus signature;

4, virtual machine Executive Module is responsible for the suspicious instruction stream from executable file is carried out virtual execution, observes its real behavior, thereby identifies various variant virus.

Claims (3)

1. a combination virus detects and intrusion method for testing, it is characterized in that:

(1): be used for reorganization and application protocol parsing are caught, flowed to network packet according to the condition of setting, typical application protocol is decomposed into control channel and data channel, then communication data in the control channel is submitted to IDS and detected engine, data flow in the data channel is submitted to stream reorganization and the application protocol analyzing step that internet worm detects engine;

(2): be used to receive the flow automatically reorganization and the application protocol control channel data of application protocol resolution unit, misapply detection based on IDS application protocol attack rule base, the IDS application protocol that further adopts protocol anomaly to detect the anomalous event that takes place in the recognition network communication detects step;

(3): be used to receive the flow automatically reorganization and the application protocol data channel data stream of application protocol resolution unit, viral knowledge base Network Based is carried out the internet worm detection step that virus detects;

(4): be used for attack or the Virus Name that reports to user's display engine, the alarm indication step of be correlated with IP, risk class;

(5): be used for the operating state of using protocol detection engine and internet worm detection engine is managed, controls and inquires about, engine issued rule base and virus characteristic storehouse, the system management step of system's online upgrading.

2. a combination virus detects and intrusion method for testing, it is characterized in that: in Network Intrusion Detection System, introduce virus detection techniques, by strengthening reorganization of NIDS data flow and application protocol analytic ability, the data flow that typical application protocol carries is carried out virus detection and alarm; Its concrete course of work is as follows: at first, the data message of catching is flowed reorganization and application protocol parsing, application protocol is decomposed into control channel and data channel; Misapply detection based on the attack knowledge storehouse to using agreement control channel communication data then, further can adopt the abnormal behaviour that takes place in the abnormality detection technology identification current network; At last, virus base Network Based carries out the virus detection to data flow in the application protocol data channel.

3. one kind is detected system with intrusion detection in conjunction with virus, and it is characterized in that: this system comprises plurality of units:

(1) according to the condition of setting reorganization and application protocol parsing are caught, flowed to network packet, typical application protocol is decomposed into control channel and data channel, then communication data in the control channel is submitted to IDS and detected engine, data flow in the data channel is submitted to stream reorganization and the application protocol resolution unit that internet worm detects engine;

(2) receive the application protocol control channel data of flow automatically reorganization and application protocol resolution unit, misapply detection based on IDS application protocol attack rule base, further adopt protocol anomaly to detect the IDS application protocol detecting unit of the anomalous event that takes place in the recognition network communication;

(3): receive the application protocol data channel data stream of flow automatically reorganization and application protocol resolution unit, viral knowledge base Network Based is carried out the network virus checking unit that virus detects;

(4) the alarm indication unit of attack or the Virus Name that reports to user's display engine, be correlated with IP, risk class;

(5) operating state of using protocol detection engine and internet worm detection engine is managed, controls and inquires about, engine is issued rule base and virus characteristic storehouse, the System Management Unit of system's online upgrading.

Images