±¸¼º ȯ°æ ¹× ½Ã½ºÅÛ Á¤º¸
-. ³×Æ®¿÷ ±â¹Ý Çϵå¿þ¾î ÀÏüÇüÀ¸·Î ÀζóÀÎ ¹æ½Ä ¿î¿µ
-. ¸ÖƼ ±â°¡ºñÆ® ȯ°æÀ» À§ÇÑ ³×Æ®¿öÅ© ÇÁ·Î¼¼¼(NP) ±â¹Ý ÇÁ·Î¼¼½º ·Îµå¹ß¶õ½Ì
- ¼ÒÇÁÆ®¿þ¾îÀû °áÇÔ, Àü¿ø ÀÌ»ó(Çϵå¿þ¾î °áÇÔ)½Ã LAN Bypass ±â´ÉÀ¸·Î ³×Æ®¿öÅ© ½Å·Ú¼º À¯Áö
ICS Technology
- Simple analyzer¿Í Complex analyzer ·Î ±¸¼ºµÈ ´Ù´Ü°è ŽÁø¿£ÁøÀº ¿ÀŽÀ²À»
¿¹¹æÇϸç, º¯ Çü °ø°ÝÀ̳ª ¿À¿ë°ø°Ý µîÀÇ ½Ç½Ã°£ Â÷´Ü¹æ¾î
- ÀλçÀ̵å Ä¿³Î ¾ÆÅ°ÅØó¿¡ µû¸¥ µ¶Ã¢ÀûÀÎ ½Ì±Û ij½Ã ¾ÆÅ°ÅØÃÄ(Session Map and Detection
Map in kernel) ±¸ÇöÀ¸·Î ¼º´É Çâ»ó°ú ³·Àº Áö¿¬¼Óµµ º¸Áõ
- ½Ç½Ã°£ ħÀÔ°ø°Ý ŽÁö ÈÄ Áï°¢ÀûÀÎ ÅëÁ¦(Self Detection and Self Control)
- ±ÔÄ¢±â¹ÝÀÇ Å½Áö ¹× ÅëÁ¦ Á¤Ã¥(Rule-based detection and control policy)
ÆÐÅÏ°ü¸® ¹× ¾÷µ¥ÀÌÆ®
- Á¤ÇüÈµÈ Å½Áö±ÔÄ¢(Well-formed RIVA-Signature) À¸·Î ¿ÀŽÀ²(False positive)À» ÃÖ¼ÒÈÇϸç
ÆÐÅÏÀÇ ±¹Á¦ Ç¥ÁØ Áؼö·Î ½Å·Ú¼º È®º¸
** RIVA : Raptus Incident Vulnerabilities Advisory
- °ø°ÝÆÐÅÏ ¹× Ãë¾à¼º DB(Vulnerability)¿¡ ´ëÇÑ »ó¼¼ÇÑ ÇÑ±Û µµ¿ò¸» ³»Àå
À¯ÇØ(Anomaly) Æ®·¡ÇÈ Á¦¾î ¹× Á¤±ÔÈ(Normalization)
- ´Ù¾çÇÑ °ø°ÝÀ¯Çü (Special°ø°Ý, Á¤º¸¼öÁý°ø°Ý, Ãë¾à¼º°ø°Ý, ÄÁÅÙÃ÷°ø°Ý, ¼ºñ½º°ÅºÎ°ø°Ý,
¹éµµ¾î °ø°Ý,»ç¿ëÀÚ Á¤ÀÇ µî)¿¡ ´ëÇÑ ½Ç½Ã°£ Â÷´Ü¹æ¾î
- °ø°Ý ¼¼¼Ç¿¡ ´ëÇÑ ¾îÇø®ÄÉÀÌ¼Ç °èÃþ ÆÐŶ¼öÁØ Å½Áö ¹× Â÷´Ü¹æ¾î
- Á¤»ó ¹× ºñÁ¤»ó Æ®·¡ÇÈ¿¡ ´ëÇÑ zero-Day °ø°Ý¹æ¾î(Traffic and Protocol anomaly Detection)
- ºñ¾÷¹«(P2P ¹× ¸Þ½Ã¡) Æ®·¡ÇÈ¿¡ ´ëÇÑ ÀûÀýÇÑ °ü¸®
- ¾Ç¼ºÆ®·¡ÇÈÀ̳ª ºñÀΰ¡ Æ®·¡ÇÈÀ» Àû±ØÀûÀ¸·Î Â÷´ÜÇÏ¸é¼ Àΰ¡ Æ®·¡ÇÈ º¸È£
¸ð´ÏÅ͸µ ¹× ºÐ¼®
- ½Ç½Ã°£ ½Ã½ºÅÛ ºÎÇÏ·®, ½Ç½Ã°£ ÅëÁ¦Á¤º¸, ½Ç½Ã°£ ¼¼¼ÇÁ¤º¸ ¸ð´ÏÅ͸µ
- °ø°ÝÀ¯Çü, °ø°Ý IP, ¼ºñ½º, Æ÷Æ®µîÀÇ °ø°ÝÇöȲÀ» ½Ç½Ã°£À¸·Î È®ÀÎ, ÀúÀå ¹× °Ë»ö
Åë°è ¹× º¸°í¼
- ½ºÄÉÁÙ¸µ ¸®Æ÷ÆÃ, Á¶°Ç°Ë»ö¿¡ ÀÇÇÑ ¸®Æ÷ÆÃ, ±×·ìº° ¸®Æ÷Æà µî ´Ù¾çÇÑ Åë°è º¸°í¼ Áö¿ø
- ½Ã°£,ÀÏ°£,ÁÖ°£,¿ù°£, °ø°ÝÀ¯Çü, ¼Ò½ºIP, ¼Ò½ºÆ÷Æ®, °ø°Ý´ë»ó IP, °ø°Ý´ë»óÆ÷Æ®,
ŽÁö±â°£º° »ó¼¼ ¸®Æ÷Æà °¡´É
½Ã½ºÅÛ °ü¸®
- IP °ø°ÝÀ̳ª ³»ºÎ ARP(MAC Address)°ø°ÝÀ¸·Î ºÎÅÍ ½Ã½ºÅÛ ÀÚü ¹æ¾î¸¦ À§ÇÑ
½ºÅÚ½º(Stealth) º¸È£±â´É
- À̺¥Æ® ¹ß»ý½Ã ÀÚµ¿ ÅëÁö (¾Ë¶÷,e-mail,´Â, syslog, SNMP) ±â´É
- SSLÀ» ÀÌ¿ëÇÑ ¾ÈÀüÇÑ ¿ø°Ý Á¦¾î °ü¸®(SSH,HTTPS)
- ³»ÀåµÈ À¥ºê¶ó¿ìÀú¸¦ ÅëÇÑ ¿ø°Ý Á¦¾î °ü¸®