KR102679203B1 - Vulnerability diagnosis method provided by diagnosis server - Google Patents

Abstract

The present invention is a method of performing a dynamic vulnerability diagnosis procedure consisting of check items selected according to the client's past diagnosis results and a remote administrator, a method of performing a mock attack based on the diagnosis results, and a method of performing a simulated attack based on the diagnosis results, and accessing important system files during the vulnerability diagnosis procedure. By implementing and implementing a new method of vulnerability diagnosis technology by implementing an exception handling method to prevent anything from happening, we can increase the reliability of the diagnosis results when performing the vulnerability diagnosis procedure and reduce unnecessary load and costs in the diagnosis process. A plan is being proposed.

Description

Vulnerability diagnosis method provided by the diagnosis server {VULNERABILITY DIAGNOSIS METHOD PROVIDED BY DIAGNOSIS SERVER}

The present invention relates to technology for checking/diagnosing security vulnerabilities that may result in security vulnerabilities from malicious attacks.

The types of malware that perform malicious acts and carry out attacks are becoming more diverse, and with the increase in the number of Internet users, security incidents (hacking and infringement incidents) caused by these malicious attacks are also occurring frequently.

Accordingly, in order to create a safe computing environment, various types of malware diagnosis methods and security vulnerability inspection methods have emerged.

Security vulnerability inspection refers to checking for threats that may allow illegal user access to the information system or threats to leak, falsify, or delete important data managed in the system being inspected. This refers to analyzing the security level of the system being inspected after performing a check to see if security vulnerabilities exist in the target system.

The existing security vulnerability inspection method is to select a client to be inspected (e.g., PC, network equipment, etc.) and perform an inspection according to predetermined diagnostic criteria to check whether a security vulnerability exists in the client.

Such existing security vulnerability inspection methods only obtain inspection results for the presence or absence of security vulnerabilities by performing inspections according to diagnostic standards, but do not verify the reliability of the inspection results.

Accordingly, with the existing method, when security vulnerability inspection is conducted by a remote administrator, the accuracy and legitimacy of the inspection results may vary depending on the administrator, or simply a situation in which stronger accuracy is needed for inspection results based on diagnostic criteria. However, there are limitations that make it difficult to satisfy this.

In addition, with the existing method, if an important system file that should not be accessed is accessed during the security vulnerability check process, it cannot be treated as an exception, which not only lowers the reliability of the check results but also causes a fatal situation in the client's system. Problems may even arise.

In addition, with the existing method, security vulnerability checks are performed identically for the same client every time, so there may be limitations in unnecessary load and cost during the security vulnerability check process.

Accordingly, in the present invention, when performing security vulnerability checks on clients (e.g. PCs, network equipment, etc.), vulnerabilities are improved in a way that increases the reliability of the inspection results and further reduces unnecessary load and costs in the inspection process. We would like to propose inspection (diagnosis) technology.

The present invention was created in consideration of the above circumstances, and the problem to be solved by the present invention is to increase the reliability of the inspection results and further improve the reliability of the inspection results when performing security vulnerability checks on clients (e.g. PCs, network equipment, etc.). The goal is to provide a new type of vulnerability inspection (diagnosis) technology that can reduce unnecessary load and costs during the inspection process.

The vulnerability diagnosis method provided by the diagnosis server according to one aspect of the present invention to achieve the above purpose is to connect a remote administrator to a client requesting diagnosis using a web-based terminal emulator-based connection service (SSH). A connection step that makes it possible; An execution step of delivering a specific script by the manager to the client and executing the specific script on the client; A procedure performing step of performing a vulnerability diagnosis procedure on the client by executing the specific script; A storage step of processing the diagnosis result data generated according to the vulnerability diagnosis procedure into a form that can be displayed on the web and then storing it in a database (DB); And when the client connects to the diagnostic server through login, it includes a viewing step of allowing the client to view a vulnerability diagnosis report according to at least one diagnosis result data on the client's customer page based on the stored data in the DB. .

Specifically, the vulnerability diagnosis procedure includes a plurality of preset check items, and the procedure execution step includes, among the plurality of check items, the client's past diagnosis result data searched in the DB and the client's diagnosis request. A vulnerability diagnosis procedure consisting of check items selected according to at least one of the processing remote administrators may be performed.

Specifically, based on the diagnosis result according to the vulnerability diagnosis procedure, it further includes performing a preset mock attack in relation to a specific check item identified as a vulnerability in the client; In the storage step, the diagnostic result data stored in the DB and the mock attack execution result can be stored together, or the mock attack execution result can be reflected and processed in the diagnostic result data stored in the DB and then stored. .

Specifically, in the procedure execution step, an exception is processed for pre-specified important files so that they are not accessed during the vulnerability diagnosis procedure, and the specified important files are files confirmed from the data structure of the client's file system. It may be a file identified as being created at the time of creation of the root file system, based on at least one of creation time and file location.

Specifically, the specified important file is the smallest block and I-node number where the file data is stored first in the block and I-node bitmap, from a data structure that stores the file in blocks at a location identified as a node. Check the creation time of at least one of the block and I-node bitmaps, and check the file that has the same creation time as the confirmed creation time and a number smaller than at least one of the preset critical block and I-node numbers. , can be identified as a file created at the time of creation of the root file system.

According to embodiments of the present invention, a method of performing a vulnerability diagnosis procedure using the client's past diagnosis results and check items selected by the manager in the case of a remote manager, a method of performing a simulated attack based on the diagnosis result, and a vulnerability diagnosis procedure. We are implementing a new vulnerability diagnosis technology by implementing an exception handling method to prevent access to important system files.

As a result, according to the present invention, when diagnosing a security vulnerability, it is possible to increase the reliability of the diagnosis result and reduce unnecessary load and cost in the diagnosis process.

1 is a diagram showing the structure of a vulnerability diagnosis system according to an embodiment of the present invention.
Figure 2 is a flow chart showing the operation flow of the vulnerability diagnosis method according to an embodiment of the present invention.
Figures 3 and 4 are exemplary diagrams showing diagnosis result data (before/after processing) that can be obtained by the vulnerability diagnosis method of the present invention.

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all changes, equivalents, and substitutes included in the spirit and technical scope of the present invention. While describing each drawing, similar reference numerals are used for similar components.

When a component is said to be "connected" or "connected" to another component, it is understood that it may be directly connected to or connected to the other component, but that other components may exist in between. It should be. On the other hand, when it is mentioned that a component is “directly connected” or “directly connected” to another component, it should be understood that there are no other components in between.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that it does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the technical field to which the present invention pertains. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted in an ideal or excessively formal sense unless explicitly defined in the present application. No.

Hereinafter, the present invention will be described with reference to the attached drawings.

The present invention relates to technology for checking/diagnosing security vulnerabilities that may result in security vulnerabilities from malicious attacks.

The types of malware that perform malicious acts and carry out attacks are becoming more diverse, and with the increase in the number of Internet users, security incidents (hacking and infringement incidents) caused by these malicious attacks are also occurring frequently.

Accordingly, in order to create a safe computing environment, various types of malware diagnosis methods and security vulnerability inspection methods have emerged.

Security vulnerability inspection refers to checking for threats that may allow illegal user access to the information system or threats to leak, falsify, or delete important data managed in the system being inspected. This refers to analyzing the security level of the system being inspected after performing a check to see if security vulnerabilities exist in the target system.

The existing security vulnerability inspection method is to select a client to be inspected (e.g., PC, network equipment, etc.) and perform an inspection according to predetermined diagnostic criteria to check whether a security vulnerability exists in the client.

Such existing security vulnerability inspection methods only obtain inspection results for the presence or absence of security vulnerabilities by performing inspections according to diagnostic standards, but do not verify the reliability of the inspection results.

Accordingly, with the existing method, when security vulnerability inspection is conducted by a remote administrator, the accuracy and legitimacy of the inspection results may vary depending on the administrator, or simply a situation in which stronger accuracy is needed for inspection results based on diagnostic criteria. However, there are limitations that make it difficult to satisfy this.

In addition, with the existing method, if an important system file that should not be accessed is accessed during the security vulnerability check process, it cannot be treated as an exception, which not only lowers the reliability of the check results but also causes a fatal situation in the client's system. Problems may even arise.

In addition, with the existing method, security vulnerability checks are performed identically for the same client every time, so there may be limitations in unnecessary load and cost during the security vulnerability check process.

Accordingly, in the present invention, when performing security vulnerability checks on clients (e.g. PCs, network equipment, etc.), vulnerabilities are improved in a way that increases the reliability of the inspection results and further reduces unnecessary load and costs in the inspection process. We would like to propose inspection (diagnosis) technology.

To be more precise, in the present invention, when performing a security vulnerability check on a client (e.g., PC, network equipment, etc.), a concrete method is provided to increase the reliability of the check results and reduce unnecessary load and costs during the check process. By proposing/implementing a technical configuration, we aim to implement a new type of vulnerability diagnosis technology.

First, with reference to FIG. 1, the vulnerability diagnosis system proposed by the present invention will be described.

As shown in Figure 1, the vulnerability diagnosis system according to the present invention includes a user who can be a client (e.g., PC, network equipment, etc.) subject to inspection (diagnosis), and a user who can perform the vulnerability diagnosis procedure from a remote location. It may be configured to include an administrator, a diagnostic server 100 and a DB that manage the vulnerability diagnosis method of the present invention.

In other words, the vulnerability diagnosis system of the present invention performs vulnerability diagnosis on clients (e.g., PCs, network equipment, etc.) based on the organic communication and operation between each component shown in FIG. 1, and provides information on the diagnosis results. It is possible to realize a detailed technical configuration that can increase reliability and reduce unnecessary load and costs in the diagnostic process.

Below, with reference to FIG. 1, an example of a vulnerability diagnosis scenario by the vulnerability diagnosis system (vulnerability diagnosis method) of the present invention will be described in more detail.

In the present invention, the diagnostic server 100 is a server that manages vulnerability diagnosis methods, and can be referred to as an IR (Inform Relief) System.

In the present invention, after the user registers and logs in to the web page provided by the diagnostic server 100, the user can enter information about his or her PC (hereinafter referred to as client) and request vulnerability diagnosis ( One).

In this case, in the present invention, a remote administrator connects to the client using a terminal emulator-based connection service (Secure Shell, SSH) based on the user's information (hereinafter referred to as client information) (2) .

Afterwards, in the present invention, the remote administrator uses cmd to transfer a specific script (hereinafter referred to as IR.tar) on the desktop of the administrator's computer to the user's PC, that is, the diagnosis target client, using the scp command (2) .

In the present invention, on the user's PC, that is, the client to be diagnosed, the vulnerability diagnosis procedure can be started on the client by unzipping and executing a specific script, that is, IR.tar. In other words, the vulnerability diagnosis process is performed by executing IR.tar on the client.

And in the present invention, when the vulnerability diagnosis procedure is completed in the client, diagnosis result data according to the vulnerability diagnosis procedure is generated. For example, diagnostic result data can be created as a txt file containing all results in the form of date + IP address.txt.

In addition, because data must be processed into a form that users (customers) can view on the web, in the present invention, the client processes the diagnosis result data (e.g. date + IP address.txt file) generated through the vulnerability diagnosis procedure. Run the script called "./final_DB.sh" to process the diagnosis result data (e.g. date + IP address.txt file) into a format that can be displayed on the web, and then save it to the DB using the mysql command to complete the diagnosis. can be processed (3).

Thereafter, in the present invention, when the user (customer) logs in and accesses the diagnostic server 100, the user (customer) can view a vulnerability diagnosis report based on the diagnosis result data of the previously performed vulnerability diagnosis procedure on the user's (customer) My Page. There is (4).

As such, in the present invention, the vulnerability diagnosis procedure is carried out (started) by transmitting a command or script by a remote administrator (or manager) without installing a vulnerability diagnosis agent on the client (e.g. PC, network equipment, etc.) to be diagnosed. , performed, processed, completed) is the basic configuration.

That is, in the present invention, a user (customer) receives a vulnerability diagnosis report (e.g., from discovered vulnerabilities and detailed cause analysis to solutions) according to the vulnerability diagnosis conducted by the administrator through a web service (e.g., My Page). Make it available for viewing.

For this reason, according to the vulnerability diagnosis system of the present invention, security threats can be drastically reduced, and administrators can efficiently maintain the client system in a safe state. In addition, in the present invention, effects such as convenient usability through the additional graphic interface of the diagnostic server (100, IR System) and provision of diagnostic results that are easy for users to view can be expected.

In addition, when introducing the vulnerability diagnosis system of the present invention, especially the diagnosis server (100, IR System), compliance with legal security regulations related to vulnerability inspection/diagnosis of major infrastructure, financial infrastructure, etc. is satisfied, and periodic vulnerability inspection/diagnosis is performed. Prevention of security incidents can be strengthened through

Furthermore, in the present invention, when performing security vulnerability diagnosis for clients (e.g., PCs, network equipment, etc.) as described above, it is possible to increase the reliability of the diagnosis results and reduce unnecessary load and costs in the diagnosis process. It is characterized by realizing a concrete technical configuration.

In the following, the feature technology configuration realized in the present invention will be described with reference to FIG. 2.

As shown in FIG. 2, in the vulnerability diagnosis method according to an embodiment of the present invention, the user accesses and logs in to the diagnostic server 100 through his or her PC (hereinafter referred to as the client) and then logs in to the PC, that is, the client. You can input the information required for vulnerability diagnosis and request vulnerability diagnosis (S10).

In this case, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 is a client that requests vulnerability diagnosis as described above, and allows a remote administrator to connect using a connection service based on a web-based terminal emulator. Do it (S20).

In the present invention, specific embodiments are described based on the Linux operating system.

That is, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 uses a web-based terminal emulator (e.g., shell in a box) based on the information of the client that the connected and logged in administrator requests vulnerability diagnosis. If you launch it and attempt a connection based on the connection service (SSH) supported by the Linux OS, you can connect to the client.

Of course, in the present invention, in the case of an operating system other than Linux, such as a Windows OS, a remote administrator can connect to the client using a connection service (e.g., Xshell, PuTTY, iTerm, etc.) supported by the Windows OS. .

However, in the following description, for convenience of explanation, the embodiment will be described based on the Linux OS.

In the vulnerability diagnosis method according to an embodiment of the present invention, when a remote administrator connects to a client, the diagnostic server 100 delivers a specific script by the administrator to the client, allowing the client to execute the specific script. (S30).

That is, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnostic server 100 executes the scp command to execute a specific script (hereinafter referred to as IR.tar) on the desktop of a remote administrator (computer) connected to the client. When transmitted, a specific script, i.e. IR.tar, can be delivered to the client being diagnosed, that is, the client to which the administrator is connected.

Accordingly, in the present invention, the vulnerability diagnosis procedure can be started in the client by unzipping and executing a specific script, that is, IR.tar, in the client that has received the IR.tar (S40).

That is, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 performs a vulnerability diagnosis procedure by executing IR.tar on the client to check/diagnose whether a security vulnerability exists in the client. Do it (S50).

At this time, the present invention proposes the following technical configurations to improve the reliability of diagnosis results according to the vulnerability diagnosis procedure and minimize unnecessary load and cost.

To describe a specific embodiment, in the case of the present invention, the vulnerability diagnosis procedure is defined as including a number of preset check items.

According to a specific embodiment, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 performs a vulnerability diagnosis procedure on the client through IR.tar execution, using a number of preset vulnerability diagnosis procedures. Among the check items, a vulnerability diagnosis procedure consisting of check items selected according to at least one of the client's past diagnosis result data searched in the DB and the remote administrator processing the client's diagnosis request can be performed (S50 ).

For example, the entity that selects check items and performs a dynamic vulnerability diagnosis procedure consisting of the selected check items may be the administrator, a specific script (e.g. IR.tar) running on the client, or the diagnostic server (100). there is.

As a specific example, the diagnosis server 100 may select at least one check item from a plurality of check items preset in the vulnerability diagnosis procedure, based on past diagnosis result data of the client searched in the DB.

As previously explained, in the DB (see Figure 1), diagnosis result data (+ vulnerability diagnosis report) for the vulnerability diagnosis procedure previously performed for each client is stored/managed.

Accordingly, in the present invention, the diagnostic server 100 can search the client's past diagnostic result data in the DB at the time a specific script, that is, IR.tar, is delivered to the client by the administrator, and retrieve the searched past diagnostic result data. Based on this, a number of inspection items preset in the vulnerability diagnosis procedure are checked to determine that no vulnerability exists (e.g., "satisfactory" as a result of the diagnosis) over a certain period of time (e.g., N months, or N times from the past vulnerability diagnosis procedure). You can select the remaining inspection items to exclude from the items.

In other words, check items for which it was determined that a vulnerability does not exist (e.g., the diagnosis result is “satisfied”) during a certain period of time (e.g., N months, or N times of past vulnerability diagnosis procedures) are determined to be the vulnerability diagnosis procedure to be performed at the current time. Even if it is included in the list, there is a high possibility that it will be judged that the vulnerability does not exist (e.g., the diagnosis result is “satisfied”), so it is excluded from the inspection items for diagnosis.

In addition, the diagnosis server 100 can perform a vulnerability diagnosis procedure consisting of check items selected based on the client's past diagnosis result data.

In this case, in the present invention, unlike the existing method of performing the same security vulnerability diagnosis procedure for the same client every time, the inspection items are likely to determine that no vulnerability exists for the same client (e.g., the diagnosis result is “satisfied”). By performing a dynamic vulnerability diagnosis procedure selected/constructed with the remaining check items excluding , the effect of minimizing and reducing unnecessary load and costs in the security vulnerability diagnosis process can be expected.

As another example, the diagnostic server 100 may select at least one check item from a plurality of check items preset in the vulnerability diagnosis procedure based on the remote administrator processing the client's diagnosis request.

Specifically, in the present invention, the diagnostic server 100 can check the level, expertise score, or authority of the remote manager at the time when the remote manager attempts a connection service (SSH)-based connection to the client. To this end, according to a predefined policy, the vulnerability diagnosis procedures performed in the past are evaluated for each manager, and a level or expertise score or authority can be granted according to the evaluation.

Accordingly, the diagnostic server 100, based on the level or expertise score or authority confirmed for the administrator, allows step-by-step selection of inspection items with greater security issues as the level or expertise score or authority increases, At least one check item can be selected from a number of check items preset in the vulnerability diagnosis procedure.

In addition, the diagnostic server 100 can perform a vulnerability diagnosis procedure consisting of inspection items selected based on the administrator.

In this case, in the present invention, unlike the existing method of performing the same security vulnerability diagnosis procedure for the same client every time, by performing a dynamic vulnerability diagnosis procedure consisting of check items selected according to the administrator's level, expertise score, or authority, etc. , the effect of improving the reliability of the diagnosis results can be expected by satisfying the accuracy, legitimacy, and security issues of the diagnosis results, which can vary depending on the administrator.

Of course, the diagnosis server 100 combines the client's past diagnosis result data and a remote manager that processes the client's diagnosis request (if necessary, applies weight to each of the past diagnosis result data and the manager) and provides the combined result. As a basis, it is possible to select a check item among a number of check items preset in the vulnerability diagnosis procedure and perform a vulnerability diagnosis procedure consisting of the selected check items.

Meanwhile, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 performs a vulnerability diagnosis procedure on the client by executing IR.tar as described above, and detects the vulnerability for a previously specified important file. Handle exceptions to prevent access while performing diagnostic procedures (S50).

Here, the specified important file is described as a file identified as being created at the time of creation of the root file system, based on at least one of the file creation time and file location confirmed from the data structure of the client's file system. can do.

The vulnerability diagnosis process conducted for a safe computing environment may have different diagnostic items or different diagnostic methods, but the common point that ultimately has the most important impact on performance is obtaining highly reliable diagnostic results without affecting the system within the client. I would say it is.

In other words, if an important system file that should not be accessed is accessed during the vulnerability diagnosis process, a problem that causes a fatal situation in the client system may occur and the reliability of the inspection results will also be lowered.

Accordingly, important files (hereinafter referred to as important system files) that must be treated as exceptions without being accessed during the vulnerability diagnosis procedure must be identified/determined.

For example, in the case of Windows OS, important system files distributed by the OS manufacturer have the manufacturer's digital signature (or certificate), and the digital signature can be used to identify/determine whether they are important system files that must be treated as exceptions. We are making it possible.

Considering this, in the present invention, in the case of Windows OS, the diagnostic server 100 is identified through a digital signature (or certificate) in performing the vulnerability diagnosis procedure on the client through IR.tar execution as described above. For important system files, exceptions can be made to prevent them from being accessed during the vulnerability diagnosis process.

However, in the case of Linux OS, unlike Windows OS, it does not support digital signatures (or certificates), so it is difficult to identify/determine important system files that must be treated as exceptions.

Considering this, in the present invention, in the case of a Linux OS, the diagnostic server 100 performs a vulnerability diagnosis procedure on the client by executing IR.tar as described above, by checking the data structure of the client's file system. Based on at least one of the file creation time and file location, files identified as being created at the time of root file system creation are determined to be important system files, and these important system files are accessed during the vulnerability diagnosis procedure. You can handle exceptions to prevent this from happening.

For example, the entity that handles exceptions to prevent important system files from being accessed during identification and vulnerability diagnosis procedures may be a specific script (e.g., IR.tar) running on the client or the diagnostic server 100.

To be more specific, the basic data structure of the file system used in the Linux OS may consist of a boot block and several block groups (0, 1,...,n).

Each block group consists of a super block, group descriptor, block bitmap, I-node bitmap, and directory and data blocks.

This block group structure increases the intensity of key data and file data, thereby reducing fragmentation when saving files and providing an opportunity to reduce the response speed related to disk I/O.

In the present invention, block bitmap and I-node bitmap are particularly utilized in the data structure of this file system.

The block bitmap is located after the group descriptor in the block group structure. A block bitmap literally expresses the use (allocation) status of a block in bits. Each block within a block group corresponds to one bit in the block bitmap. Therefore, if a specific block is being used, the index of the corresponding block in the block bitmap indicates that it is allocated (used).

Here, the data structure of the block group has the characteristic of using (allocating) blocks in order starting from the lowest numbered blocks.

In the Ext filesystem, file data is stored in the I-node data structure. All files and directories are assigned one I-node each, and all I-nodes have a unique address (or index).

Therefore, the data structure of the basic file system used in the Linux OS can be said to be a data structure that stores files in block units at a location identified as an I-node.

The I-node bitmap, like the block bitmap, expresses the usage (allocation) status of all I-nodes managed by the corresponding block group in bits. In other words, each I-node within a block group corresponds to one bit in the I-node bitmap. Therefore, if a specific I-node is being used, the index of the corresponding I-node in the I-node bitmap indicates that it is allocated (used).

Here, the data structure of the block group has the characteristic of using (allocating) sequentially starting from the I-node with the lowest number.

To explain the method of identifying/determining important system files again, the diagnostic server 100 determines the smallest block in which file data is stored first in the block bitmap and I-node bitmap from the data structure of the client's file system. It is possible to check the creation time of at least one of the number and I-node number. The creation time at this time will mean the time of file creation.

And, the diagnosis server 100, from the block bitmap and the I-node bitmap, creates a file with a creation time equal to the confirmed creation time and a number smaller than at least one of the preset critical block number and the I-node number. Allows you to check. The number at this time will indicate the file location.

Here, the preset critical block number and I-node number are the maximum used block number and I-node when blocks and I-nodes are used (allocated) for all actual important system files of the file system within the client. It is desirable to preset the number to be the same as the number or to be a certain size larger.

Accordingly, the diagnosis server 100 determines the creation time of at least one of the smallest block number and I-node number in the block bitmap and the I-node bitmap, and a number smaller than at least one of the critical block number and the I-node number. By identifying files that are confirmed to have , as files created at the time the root file system is created, exceptions can be processed for these files, that is, important system files, to prevent them from being accessed during the vulnerability diagnosis process.

In this case, in the present invention, by performing a vulnerability diagnosis procedure that identifies important system files and handles exceptions to prevent access to important system files during the security vulnerability diagnosis process, it improves the reliability of the diagnosis results and prevents critical situations for the client system. The effect of avoiding problems that cause problems can be expected.

To continue the explanation, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 stores/manages the diagnosis result data generated according to the vulnerability diagnosis procedure performed in step S50 in the DB (see FIG. 1). make it possible

Specifically, in the present invention, when the vulnerability diagnosis procedure is completed in the client, diagnosis result data according to the vulnerability diagnosis procedure is generated. For example, diagnostic result data can be created as a txt file containing all results in the form of date + IP address.txt.

At this time, in the vulnerability diagnosis method according to an embodiment of the present invention, the generated diagnosis result data is processed into a form that can be displayed on the web and then stored in a DB (see FIG. 1).

In other words, the client executes a script called "./final_DB.sh" that will process the diagnostic result data (e.g. date + IP address.txt file) generated through the vulnerability diagnosis procedure to process the diagnostic result data (e.g. date + IP address.txt file) can be processed into a format that can be displayed on the web (S60) and then saved in the DB using the mysql command (S80).

For example, the entity that processes the diagnostic result data and stores it in the DB may be a specific script (e.g. IR.tar) running on the client or the diagnostic server 100.

Figure 3 shows an example of diagnosis result data that can be obtained by the vulnerability diagnosis method of the present invention.

And, Figure 4 is an example diagram showing the diagnostic result data of Figure 3 after it has been processed into a form that can be displayed on the web.

To continue the explanation, in the vulnerability diagnosis method according to an embodiment of the present invention, when a user (client) connects to the diagnosis server 100 by logging in, the diagnostic server 100 creates a customer page based on data stored in the DB. (My Page) allows you to view the vulnerability diagnosis report based on the diagnosis result data of the previously performed vulnerability diagnosis procedure (S90).

As can be seen in Figure 4, the vulnerability diagnosis report may include the user's membership information, diagnosis results, and detailed results. The detailed results include item code, importance, inspection status, diagnosis results, and action taken for each inspection item performed ( Solutions) are included, allowing users to check the vulnerabilities found on their PC (client), detailed cause analysis, and solutions through the vulnerability diagnosis report.

Meanwhile, to describe another embodiment to improve the reliability of the diagnosis result according to the vulnerability diagnosis procedure, in the vulnerability diagnosis method according to an embodiment of the present invention, the diagnosis server 100 is used at the point when the diagnosis result data is generated ( Before processing), based on this diagnosis result data, a preset mock attack can be performed in relation to specific check items identified as vulnerabilities in the relevant client (S70).

For example, if described with reference to FIG. 4, the diagnostic server 100 performs the corresponding inspection in relation to inspection items for which the diagnostic result is “partially satisfactory,” such as item codes U-01, U-04, and U-45. A pre-set mock attack can be performed for each item, or, in relation to a check item with an importance level of "High" and a diagnosis result of "Partially Satisfactory", a pre-set mock attack can be performed for each check item, and a pre-set mock attack can be performed for each check item with an importance level of "High" For all of the "normal" inspection items, a preset mock attack can be performed for each inspection item.

In addition, the diagnostic server 100 may allow the simulation attack performance results to be stored together when the current diagnosis result data for the client is stored in the DB, or may store the mock attack performance results in the current diagnosis result data stored in the DB. It can be saved after reflection and processing (S80).

In this case, in the present invention, the user (client) accesses the diagnostic server 100 through login and performs a vulnerability diagnosis procedure through the customer page (My Page) on the web, and furthermore, the results of performing a mock attack are obtained. By providing a way to view the vulnerability diagnosis report that reflects the results, it is possible to expect the effect of improving the reliability of vulnerability diagnosis by satisfying even situations that require stronger accuracy than simple diagnosis results.

As described above, according to embodiments of the present invention, a method of performing a dynamic vulnerability diagnosis procedure consisting of check items selected according to the client's past diagnosis results and a remote administrator, a method of performing a mock attack based on the diagnosis result, We are implementing a new type of vulnerability diagnosis technology by implementing an exception handling method to prevent access to important system files during the vulnerability diagnosis process.

Accordingly, according to the present invention, by performing vulnerability diagnosis through a new vulnerability diagnosis technology implemented as described above, it is possible to increase the reliability of the diagnosis result when performing the vulnerability diagnosis procedure and reduce unnecessary load and cost in the diagnosis process. possible effects can be derived.

The vulnerability diagnosis method according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described with specific details such as specific components and limited embodiments and drawings, but this is only provided to facilitate a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , those skilled in the art can make various modifications and variations from this description.

Accordingly, the spirit of the present invention should not be limited to the described embodiments, and the scope of the patent claims described later as well as all things that are equivalent or equivalent to the scope of this patent claim shall fall within the scope of the spirit of the present invention. .

100: Diagnostic server (IR System)

Claims (5)

In the vulnerability diagnosis method provided by the diagnosis server,
A connection step of allowing a remote administrator to connect to the client requesting diagnosis using a web-based terminal emulator-based connection service (SSH);
An execution step of delivering a specific script by the manager to the client and executing the specific script on the client;
Executing the specific script to perform a vulnerability diagnosis procedure on the client and processing an exception so that a pre-specified important file is not accessed during the vulnerability diagnosis procedure;
It includes a storage step of processing the diagnosis result data generated according to the vulnerability diagnosis procedure into a form that can be displayed on the web and then storing it in a database (DB);
The important files specified above are:
A file identified as being created at the time the root filesystem was created,
From a data structure that stores a file in blocks at a location identified as an I-node, generating at least one of the smallest block number and I-node number where the file data is stored first in the block bitmap and the I-node bitmap. check the time,
Vulnerability diagnosis, characterized in that the file is confirmed to have a creation time equal to the confirmed creation time and a number smaller than at least one of the preset critical block number and I-node number from the block bitmap and the I-node bitmap. method. According to claim 1,
The vulnerability diagnosis procedure includes a number of preset check items,
The steps for carrying out the above procedure are:
Among the plurality of check items, performing a vulnerability diagnosis procedure consisting of check items selected according to at least one of the client's past diagnosis result data searched in the DB and a remote administrator processing the client's diagnosis request. Featured vulnerability diagnosis method. According to claim 1,
Based on the diagnosis result according to the vulnerability diagnosis procedure, it further includes performing a preset mock attack in relation to a specific check item identified as a vulnerability in the client;
The storage step is,
A vulnerability diagnosis method characterized in that the diagnostic result data stored in the DB and the mock attack execution results are stored together, or the diagnostic result data stored in the DB reflects and processes the mock attack execution results and then stores them. . According to claim 1,
When the client connects to the diagnostic server through login, it further includes a viewing step of allowing the client to view a vulnerability diagnosis report according to at least one diagnosis result data on the customer page of the client based on the stored data in the DB. A vulnerability diagnosis method characterized by: delete

Images