Abstract:
A network correction security system. The network correction security system connected between a network node and a security-related external system, detects attacks on the network node, corrects weak parts of the performance of the network node, collects information for improving the security performance of the network node from a security-related external system, analyzes the information, monitors principal resources of the network node to detect a fault, and removes the fault according to a measure corresponding to a grade of the fault. The network correction security system carries out a recovery process when the fault has not been corrected, and recovers the functions of the network node according to a recovery mechanism when the fault has not been removed after the recovery process.

Description:
CROSS REFERENCE TO RELATED APPLICATION  
       [0001]     This application claims priority to and the benefit of Korea Patent Application No. 2003-70398 filed on Oct. 9, 2003 in the Korean Intellectual Property Office, the entire content of which is incorporated herein by reference.  
       BACKGROUND OF THE INVENTION  
       [0002]     (a) Field of the Invention  
         [0003]     The present invention relates to a network correction security system and method, and more particularly, to a network correction security system and method for preventing network attacks and correcting attacks that occur to carry out security performance.  
         [0004]     (b) Description of the Related Art  
         [0005]     Recently, intrusions to or attacks on networks have been rapidly evolved with the popularization of computers and the Internet. The attacks paralyze the networks to result in a severe economical loss caused by, for instance, suspension of electronic commercial transactions and social chaos due to the interruption of providing Internet service.  
         [0006]     Accordingly, an intrusion detection system (IDS), one of security systems, has been proposed in order to cope with attacks from hackers. The intrusion detection system requires an improved structure in terms of software and hardware since the attacks from the hackers become more sophisticated and a network bandwidth is rapidly increasing.  
         [0007]     A conventional IDS is classified into a host IDS and a network IDS. The host IDS protects a single terminal system such as a server or a personal computer and a network application using an auditing system or even logs. The network IDS monitors network traffic to detect attacks or intrusions of hackers and blocks the attacks or intrusions. The development of the network IDS is concentrated on signature detection, anomaly detection, and detection of denial of service.  
         [0008]     However, a conventional security system such as a Firewall and an intrusion prevention system as well as the host IDS and network IDS requires a considerably long period of time to recover a fault generated in a system and normally operate the system. This is because the conventional security system lacks a technique of continuing services the system has been providing by utilizing restricted resources while the system is having a fault or recovering functions of the system.  
         [0009]     Furthermore, the conventional security system needs a technique that dynamically improves the system having a fault in cooperation with an external system to prevent the generation of the fault in advance and prevent the same failure from being repeated.  
         [0010]     Therefore, there are required a system and method for correctly detecting the type of a network intrusion, which varies rapidly, to recover the performance of a corresponding system having a fault within a short period of time and preventing the same failure from being repeated in the system.  
       SUMMARY OF THE INVENTION  
       [0011]     It is an advantage of the present invention to provide a network correction security system and method for preventing a fault from being generated in a system due to an external attack or intrusion, or a vulnerability of the corresponding system in advance, and when a fault is generated in the system, continuously maintaining the performance of the system using restricted resources while the failure is being recovered.  
         [0012]     Furthermore, the present invention provides a network correction security system and method for preventing the same failure from being repeatedly generated through a function of continuously improving the performance of the system.  
         [0013]     In one aspect of the present invention, a network correction security system that is connected between a network node and a security-related external system, detects an external attack on the network node, and corrects a weak part of the performance of the network node, comprises a correction agent that removes a fault generated in the network node according to a measure corresponding to a level of the fault to correct the fault, and when it is confirmed that the fault has not been completely corrected, repeats a recovery process of reallocating and dividing resources of the network node; and a correction manager hat continuously collects information required for improving the security performance of the network node from the security-related external system and analyzes the collected information to control the improvement of the security performance of the network node.  
         [0014]     The correction manager recovers functions of the network node according to a mechanism that recovers a part of the network node or the entire network node when it is confirmed that the fault has not been completely corrected even after the recovery process has been carried out.  
         [0015]     In another aspect of the present invention, a network correction security method that detects an external attack on a network node and corrects a weak part of the performance of the network node comprises a step (a) of removing a fault generated in the network node according to a measure corresponding to a grade of the fault to correct the fault; a step (b) of repeating a recovery process that reallocates and divides resources of the network node when the fault has not been completely corrected in the step (a); a step (c) of recovering functions of the network node according to a mechanism of recovering a part or the entirety of the security performance of the network node when the fault has not been completely corrected even after the recovery process of the step (b); and a step (d) of continuously collecting information required for improving the security performance of the network node from a security-related external system and analyzing the collected information to improve the security performance of the network node.  
         [0016]     In another aspect of the present invention, a recording medium including a network correction security method that detects an external attack on a network node and corrects a weak part of the performance of the network node comprises a function of removing a fault generated in the network node according to a measure corresponding to a grade of the fault to correct the fault; a function of repeating a recovery process that reallocates and divides resources of the network node when the fault has not been completely corrected; a function of recovering functions of the network node according to a mechanism of recovering a part or the entirety of the security performance of the network node when the fault has not been completely corrected even after the recovery process; and a function of continuously collecting information required for improving the security performance of the network node from a security-related external system and analyzing the collected information to improve the security performance of the network node. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0017]     The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate an embodiment of the invention, and, together with the description, serve to explain the principles of the invention:  
         [0018]      FIG. 1  shows a detailed construction of a network correction security system according an embodiment of the present invention;  
         [0019]      FIG. 2  is a flow chart showing the operation procedure of the network correction security system shown in  FIG. 1 ;  
         [0020]      FIG. 3  shows the construction of an ISP network to which the network correction security system of  FIG. 1  is applied; and  
         [0021]      FIG. 4  is a graph showing the result of execution of the security performance of the network correction security system of  FIG. 1 . 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0022]     The present invention will now be described more fully with reference to the accompanying drawings, in which exemplary embodiments of the invention are shown. The invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the invention to those skilled in the art. Throughout the drawings, like reference numerals refer to like elements.  
         [0023]      FIG. 1  shows the construction of a network correction security system according to an embodiment of the present invention. Referring to  FIG. 1 , the network correction security system  100  includes a single correction manager  110  and at least one correction agent  120 . The network correction security system  100  includes a recovery region and an improvement region in terms of function.  
         [0024]     The correction agent  120  recovers and improves principal functions of a network node  200 , such as a router, a security system, and various security servers, through data transmission/reception to/from the network node  200 . The correction agent  120  can be included in a specific device of the network node  200 . Otherwise, the correction agent  120  can be constructed as a separate system.  
         [0025]     The correction manager  110  includes a network resource controller  111 , a recovery data manager  112 , an improvement manager  113 , and a function creator  114 . The correction agent  120  includes a resource/fault monitor  121 , a resource controller  122 , a fault assessor  123 , a fault remover  124 , a dynamic updater  125 , and a dynamic platform  126 .  
         [0026]     The components of the network correction system  100  and network recovery and improvement functions thereof will now be explained.  
         [0027]     The correction manager  110  has both the recovery and improvement functions. The correction manager  110  manages at least one correction agent  120  and controls the entire correction operation.  
         [0028]     The network resource manager  111  of the correction manager  110  manages resources of a corresponding system (hereinafter referred to as “security system”). The network resource manager  111  reallocates the resources of the security system when normal services cannot be provided according to resource allocation in the security system.  
         [0029]     Specifically, when it is confirmed that a fault in the security system has not been completely eliminated though the fault has been removed when it was first generated in the security system, the network resource manager  111  grasps the state of resources of another correction agent  120  and performs a secondary fault removal measure (for example, additional resource allocation) according to the grasped state of the resources.  
         [0030]     The recovery data manager  112  carries out rapid function recovery through a recovery mechanism (for example, re-booting the security system using stored data or resetting functions of the security system) for a part of the security system or the entire security system when the secondary fault removal measure has not been successfully performed.  
         [0031]     The improvement manager  113  receives information about the improvement of the performance of a network from an external system  300  (a network resource system), and executes data mining and correlation analysis for the received information (for example, information about vulnerability of the network) to decide whether the security system is improved.  
         [0032]     When the improvement manager  113  judges that the security system requires improvement, the improvement manager  113  provides items to be improved to the correction agent  120  in real time in order to remove causes of a fault before the fault is generated in the security system to prevent the generation of the fault in advance or to prevent the fault from being repeatedly generated.  
         [0033]     The function creator  114  creates a new function when it judges that the new function is needed for improving the performance of the security system and provides the created new function to the correction agent  120  which dynamically executes the new function.  
         [0034]     The correction agent  120  recovers and improves principal functions of the security system. The resource/fault monitor  121  of the correction agent  120  monitors faults in the security system and availability of principal resources in close relation to the functions of the security system. When a fault is generated in the security system, the resource/fault monitor  121  informs the fault assessor  123  of the generation of the fault.  
         [0035]     The resource controller  122  carries out a recovery process including reallocation or division of remaining resources, to secure availability of main components of the security system when the generated fault has not been completely removed though the first recovery measure has been executed after confirmation of the fault.  
         [0036]     The fault assessor  123  assesses a grade of the generated fault. The fault remover  124  removes the fault according to a measure corresponding to the assessed grade. In addition, the fault remover  124  prevents the fault from being repeatedly generated.  
         [0037]     The fault assessor  123  can request the function creator  114  of the correction manager  110  to create a new function corresponding to the generated fault.  
         [0038]     The dynamic updater  125  improves a weak part of the performance of the security system in real time according to the information about the improvement of the performance of the security system, received from the improvement manager  113  of the correction manager  110 .  
         [0039]     The dynamic platform  126  supports the correction agent  120  to smoothly perform the recovery and improvement functions using at least one new function received from the function creator  114  of the correction manager  110 .  
         [0040]     The operation of the network correction security system having the aforementioned construction will now be explained with reference to  FIG. 2 .  
         [0041]      FIG. 2  is a flow chart showing the operation procedure of the network correction security system shown in  FIG. 1 . Referring to  FIG. 2 , the network correction security system  100  executes network correction security of the security system through a fault prevention step, a fault permission step, a function recovery step, and a fault recurrence prevention step.  
         [0042]     First, in the fault prevention step, the improvement manager  113  of the correction manager  110  receives information required for improving the performance of the security system from the external system  300  in step  210 . Then, the improvement manager  113  carries out data mining and correlation analysis for the received information (such as information about vulnerability of a network) in step S 211 , and then decides whether the performance of the security system needs improvement in step S 212 .  
         [0043]     When it is decided that the performance of the security system needs improvement, the improvement manager  133  transmits the information required for improving the performance of the security system to the dynamic updater  125 . The dynamic updater  125  improves a weak part of the performance of the security system in real time as instructed by the improvement manager  113  in step S 213 .  
         [0044]     In the meantime, the resource/fault monitor  121  of the correction agent  120  monitors the performance of the security system when there is a problem in the performance of the security system due to a fault that was not removed in advance, in step S 220 , and confirms whether the performance of the security system is deteriorated in step S 221 . When it is confirmed that the performance of the security system is deteriorated, the resource/fault monitor  121  immediately informs the fault assessor  123  thereof. Then, the fault assessor  123  assesses a grade of the fault in step S 223 , and the fault remover  124  removes the fault in step S 224 .  
         [0045]     When it is confirmed that the fault has not been completely removed after the aforementioned first fault removal measure, in step S 225 , the resource controller  122  reallocates and divides internal resources of the security system in step S 226 , thereby maintaining the normal performance of the security system.  
         [0046]     When the performance of the security system is determined not to be recovered even through the secondary measure, in step S 227 , the network resource manager  111  grasps the state of the resources of the correction agent  120  and performs a third network-based fault removing measure (for example, additional resource allocation) according to the grasped resources, in step S 228 .  
         [0047]     In the function recovery step, when the security system is not properly operated even when the aforementioned measures has been executed, the recovery data manager  112  rapidly recovers functions of the security system by executing a recovery algorithm (for example, rebooting the system or storing data required for resetting the functions of the system) in step S 230 .  
         [0048]     Next, in the fault recurrence prevention step, the improvement manager  113  of the correction manager  110  analyzes at least one fault that was generated in the security system, in step S 240 . When it is judged that the security system requires improvement from the analysis result, the improvement manager  113  transmits information about the improvement of the security system to the dynamic updater  125  to improve a weak part of the performance of the security system in real time, in step S 242 .  
         [0049]     As described above, the network correction security system and method of the present invention prevents the generation of a fault due to an external attack on or intrusion to the security system, or a vulnerability of the security system, in advance. Furthermore, the present invention continuously maintains the performance of the security system using restricted resources while the fault generated in the security system is being recovered.  
         [0050]     Moreover, the present invention prevents the same fault from being repeatedly generated in the security system through a function of continuously improving the performance of the security system.  
         [0051]     Next, an Internet service provider (ISP) network, one of communication networks to which the network correction security system is applied, is explained with reference to  FIG. 3 .  FIG. 3  shows the construction of the ISP network to which the network correction security system shown in  FIG. 1  is applied.  
         [0052]     Referring to  FIG. 3 , the correction manager  110  is located on a management/control network and cooperates with a vulnerability analysis system, a network management system, and an integrated security system. At least one correction agent  120  is located in each router, or if required, exists in the form of a dedicated agent.  
         [0053]     If a DDoS (Distributed Denial of Service) attack that menaces the security of the network to paralyze the network is generated, the improvement manager  113  of the correction manager  110  receives an indication of the DDoS attack from the vulnerability analysis system, network management system, and integrated security management system, and then transmits the information about the indication to the dynamic updater  125  of the correction agent  120 . Then, the dynamic updater  125  dynamically operates a function of discarding a DDoS packet to prevent the generation of a fault in advance.  
         [0054]     However, when a router passes the fault prevention step and is exposed to causes of a fault, the capacity of a memory that is an important resource required for processing of the router is consumed so that the processing performance of the router may be deteriorated. The resource/fault monitor  121  informs the fault assessor  123  of information about a generated fault. The fault assessor  123  assesses a grade of the fault, and the fault remover  124  carries out the fault permission step through a fault removal function of discarding the DDoS packet that is a cause of the fault.  
         [0055]     When the router does not normally operate although the aforementioned fault removal process has been carried out, the resource controller  122  reallocates a memory capacity required for executing the processing in the router. Furthermore, the network resource manager  111  changes a path of some packets to a neighboring router to control a router processing load.  
         [0056]     When a fault is generated in the router so that the router does not normally operate although the above-described fault permission step has been executed, the recovery data manager  112  executes a recovery mechanism (for example, rebooting the system or storing data required for resetting functions of the system) using optimum setting information of the router to rapidly recover functions of the system.  
         [0057]     The improvement manager  113  transmits information about the improvement of the system to the dynamic updater  125  to improve a weak part of the performance of the system in real time.  
         [0058]      FIG. 4  is a graph showing the correction result of the network correction security system shown in  FIG. 1 .  
         [0059]     From  FIG. 4 , it can be known that the network correction security system of the present invention (indicated by a solid line) has performed function recovery within a short period of time, compared to a conventional security system (represented by a dotted line).  
         [0060]     Moreover, the present invention can continuously provide normal services through networks even in unfavorable conditions having external attacks or intrusions.  
         [0061]     While this invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.  
         [0062]     The network correction security system and method according to the present invention can prevent the generation of a fault due to an external attack or intrusion, or a vulnerability of a corresponding system. Furthermore, the present invention can continuously maintain the performance of the corresponding system using restricted resources while the fault generated in the system is being recovered. Moreover, the present invention prevents the same fault from being repeatedly generated through a function of continuously improving the performance of the system.