DE102016107647B4 - Method and storage medium for securing / monitoring a network - Google Patents

Abstract

Method for securing / monitoring a network (200), characterized by:
Receiving a plurality of log entries (7, 7 ') from at least one network device (30, 30', 30 "), each log entry (7, 7 ') having access (6, 6') in the network (200) of a source address to a destination address documented;
Assigning a selection of source addresses and / or destination addresses to at least one address group, wherein an address group defines at least one interval for at least one source address or destination address;
- generating (53) at least one access rule (24, 92) using the address group;
Applying (55) the access rule (24, 92) in the network (200), the access rule (24, 92) causing at least one network device (30, 30 ', 30 ") to access (6, 6'), which are not covered by the access rule (24, 92), to mark and / or to prevent
characterized in that
a plurality of source or destination addresses of the log entries (7, 7 ') associated with the address group, in which associated log entries (7, 7 ') have the same
- origin and / or destination address and / or
- Service specification and / or
- Information via interfaces
exhibit.

Description

The invention relates to a method for securing / monitoring a network and to a computer-readable storage medium which implements the methods.

In large organizations, such as internationally operating groups, a variety of network devices, such as PCs, servers, routers, switches, firewalls connected to a communication network or network. Different areas of an organization must be able to communicate with various other areas of the organization via the communication network. The communication has accesses made from a source address to a destination address. In this case, an access can additionally be characterized by a service for which the access is performed. For example, an access may be access to a web page provided by a web server. From an originating address, e.g. from an IP address, via the port 80 of the Internet Protocol, the web page can be requested from the web server. Port 80, in this example, is the service through which the access is performed.

However, there are areas or addresses between which communication is undesirable. In particular due to security risks, accesses between origin and destination addresses for certain services must be detected or prevented. So it can be e.g. be necessary for the users of PCs, which are built in conference rooms, to deny access to data of a personnel department. For this purpose, the accesses that originate from IP addresses of the PCs in the conference room can be monitored so that the corresponding accesses to unusual destination addresses are detected. If access is not to be prevented in principle, then it is at least desirable to detect when potentially potentially dangerous accesses are being carried out in order to take suitable monitoring or prevention measures.

On certain network devices, e.g. Routers, firewalls, or switches can be defined to prevent access by unwanted access rules that prevent access between different addresses. The access rules are stored in so-called access lists (access control lists or firewall rule sets or label-based technologies such as TrustSec). Especially with very large organizations, however, it is complex, if not impossible, to define the access rules optimally, since these are normally defined by the responsible personnel. The number of access rules can quickly grow so high that efficient configuration of access rules and access monitoring is not possible.

The DE 10 2006 029 013 A1 describes a method for automatically including addresses in a list of accepted broadcasters to detect unwanted calls.

The US 2014/0380456 A1 describes monitoring a network, monitoring traffic, collecting data, and automatically generating rules based on the collected data.

The DE 10 2008 059 487 A1 describes a method for generating an access rule based on log data with source and / or destination addresses in order to monitor a communication network in an automation system.

Starting from the described prior art, the object is to provide a method and a system which overcome the disadvantages mentioned. In particular, a high level of security is to be achieved within a communications network. Further, it should enable a user to efficiently monitor the network communication. Furthermore, a method is to be provided which keeps the required storage space and required computing time low. Furthermore, a method and a system is provided, which makes it possible to efficiently monitor a large network.

The object is achieved by a method according to claims 1 or 12 and a computer-readable storage medium according to claim 13.

• - Empfangen einer Vielzahl von Logeinträgen von mindestens einem Netzwerkgerät, wobei jeder Logeintrag einen Zugriff in dem Netzwerk von einer Ursprungsadresse auf eine Zieladresse dokumentiert;
• - Zuordnen einer Auswahl von Ursprungsadressen und/oder Zieladressen zumindestens einer Adressgruppe, wobei eine Adressgruppe mindestens ein Intervall für mindestens eine Ursprungsadresse oder Zieladresse definiert;
• - Erzeugen mindestens einer Zugriffsregel unter Verwendung der Adressgruppe;
• - Anwenden der Zugriffsregel in dem Netzwerk, wobei die Zugriffsregel mindestens ein Netzwerkgerät dazu veranlasst, Zugriffe, die nicht von der Zugriffsregel umfasst sind, zu kennzeichnen und/oder zu unterbinden.

In particular, the object is achieved by a method for securing / monitoring a communication network, the method comprising:

• - receiving a plurality of log entries from at least one network device, each log entry documenting access in the network from an originating address to a destination address;
• Assigning a selection of source addresses and / or destination addresses to at least one address group, wherein an address group defines at least one interval for at least one source address or destination address;
• - generating at least one access rule using the address group;
• - Apply the access rule in the network, wherein the access rule causes at least one network device to identify and / or prohibit accesses not covered by the access rule.

The invention is based on the finding that the participants of a communication network generally comply with the rules prescribed by an organization. The participants of the communication network perform in normal operation so only those accesses that are required for the daily completion of their work. The accesses of the normal operation can be used to generate access rules that allow all occurring in normal operation accesses or mark as non-hazardous. If necessary, a critical revision of the identified accesses by a user can also take place.

In the case of communication between devices of a network, log entries can be received at network devices that document access from an originating address to a destination address. A log entry may be generated based on access from an originating address to a destination address. The communication can be carried out via the internet protocol and the addresses can be IP addresses. When log entries are received from a network device, a selection from the source or destination addresses may be assigned to an address group. An address group defines at least one interval for at least one origin or destination address. An interval may also be defined in one embodiment from a plurality of source and / or destination addresses. In one embodiment, the interval may be defined based on the source address (s) and / or destination address (s).

The log entries may, in one embodiment, include the number of bytes transmitted / transmitted and / or the number of packets transmitted and / or the transmitted packets and / or a time stamp that may include date and time and / or information via network interfaces, particularly a router or a switch over which data is on or off.

An access rule can determine the extent to which accesses between an originating address and a destination address are allowed or permitted.

However, the access rule can also be additionally or alternatively used to identify accesses that are not included in the access rule or, alternatively, to identify those accesses that are encompassed by the access rule.

Thus, a kind of filter is provided which makes it possible to filter out from a large number of accesses those which do not satisfy or satisfy the access rules. The access rules thus also provide a new way of representing the accesses within the network, which allows a user to observe a large number of accesses in a clear manner. With a very large number of accesses, as is commonplace in large enterprises, it is presented to a user, e.g. a system administrator, only through the process allows to efficiently identify those accesses that pose a potential threat to the communication network.

Access rules can contain information about which origin addresses to which destination addresses accesses are blocked or marked. A selection of source addresses or destination addresses is combined into address groups. The access rules can be generated based on the address group, e.g. by using the address groups as placeholders in the access rules. Thus, a single access rule may suffice to permit or deny and / or mark a plurality of different accesses made from different source and destination addresses.

• - Ursprungs- und/oder Zieladresse und/oder
• - Serviceangabe und/oder
• - Information über Schnittstellen

aufweisen.A plurality of origin or destination addresses of the log entries are assigned to the address group in which the associated log entries are the same

• - origin and / or destination address and / or
• - Service specification and / or
• - Information via interfaces

exhibit.

Assigning destination addresses to an address group whose associated log entries resemble one another in a feature (e.g., originating and / or destination address, service indication, router interface information) provides a way to reduce the number of access rules generated. It is often the case that accesses to a single destination address are made from different source addresses in a network. For example, when a client ("client") communicates with a server. With the described embodiment, it is possible to assign all the addresses of the clients, that is to say the originating addresses, to an address group. This means that only one single access rule for accessing the server has to be created for all clients.

In one embodiment, the interval may be defined using supernetting, in particular using at least one bitmask.

The interval may be defined by bitmasks in one embodiment (e.g., by "supernetting"). Two IP addresses that differ only in the last digit (4th octet) may be e.g. to be defined as belonging to the subnet / 24 (in the "Classless Inter-Domain Routing" notation). The / 24 indicates that the first 24 bits of the netmask are set to the value "1", ie the first three octets are the same. It provides an easy way to summarize a variety of addresses.

In one embodiment, at least two non-consecutive source and / or destination addresses may define the interval.

Source and destination addresses may have order. This is followed by an address to another address, the order may be predetermined by the binary representation of the addresses. At least two addresses can define an interval of addresses in that the addresses serve as boundaries of the interval. Defining the interval by means of source addresses that are not consecutive can thus include including the addresses between the two addresses.

In another embodiment, however, addresses may also lie in the interval which do not lie between the addresses which define the interval.

This is advantageous because blurring is allowed when creating the access rules. In the embodiment described, the access rule defined on the basis of the address group therefore also includes addresses which are not directly present in the log entries.

In one embodiment, the address group may be formed by a union of the source or destination addresses of the selection of the log entries. In other embodiments, other sets of addresses generated by set operations such as e.g. the intersection.

When the union amount of the source or destination addresses of the log entries is formed and an access rule is generated by using the thus generated address group, another possibility is provided to control the number of denied accesses in the network.

1. a. Feststellen, ob die Anzahl der erzeugten Zugriffsregeln unter einem, insbesondere numerischen, Zugriffsregel-Schwellwert liegt;
2. b. Anpassen des Schärfeparameters, wenn die Anzahl der erzeugten Zugriffsregeln über dem Zugriffsregel-Schwellwert liegt,

wobei das Erzeugen und die Schritte a und b wiederholt werden können, bis die Anzahl der Zugriffsregeln unter dem Zugriffsregel-Schwellwert liegt.In one embodiment, assigning the source or destination addresses to the address group may be performed based on a sharpening parameter, wherein the sharpening parameter may correspond to the size of the interval, wherein the generating may additionally comprise the steps of:

1. a. Determining whether the number of access rules generated is below an, in particular numeric, access rule threshold value;
2. b. Adjusting the sharpening parameter if the number of access rules generated is above the access rule threshold,

wherein the generating and steps a and b may be repeated until the number of access rules is below the access rule threshold.

If e.g. only two IP addresses are to be assigned to an address group that differ only in their last digit, so there are a variety of intervals, which include both IP addresses. The choice of the interval may be made on the basis of a focus parameter in the embodiment described above. The value of the focus parameter may correspond to the size of the interval. The sharpening parameter can be a numeric value, where a high value can result in a "small" interval. The "small" interval comprises only a small range of IP addresses, e.g. 2 IP addresses. A low value of the sharpness parameter results in an interval comprising a wide range of IP addresses, e.g. 128 IP addresses.

In one embodiment, the sharpening parameter may be a network share in supernetting.

A low value of the sharpening parameter (large interval) may result in the generation of a small number of access rules, and a high value of the sharpening parameter (small interval) may result in the generation of a large number of access rules. If a sharpening parameter is used, the number of access rules created can be precisely controlled.

In order to increase the maintainability of the system, it is desirable to keep the number of access rules generated small. In the described embodiment, the number of desired access rules can be set directly by the focus parameter. An iterative process allows the sharpening parameter to be changed until the number of access rules created is equal to or less than the desired number of access rules.

It is also possible for very large organizations with many different accesses to generate only a small set of access rules. It is thus possible for a user to quickly obtain a comprehensive overview of the generated access rules. The maintainability and security of the communication network is increased.

In one embodiment, an access rule may correspond to a number of possible accesses included by the access rule.

To calculate the number of possible accesses included in an access rule, the at least one address group used by the access rule can be understood as a vector or an address set. Each element of the vector or set may correspond to a source or destination address. If an access rule uses more than one address group, the number of possible accesses of an access rule included in the described embodiment may result from the cardinality of the union of the address sets.

In one embodiment, a connection sharpening parameter may be used in generating an access rule, wherein the generating comprises determining whether the number of possible accesses included in the access rule is less than the value of the connection sharpening parameter.

Using a connection sharpening parameter is particularly advantageous when it is important to accurately control the number of accesses included in the access rules, e.g. to adapt the rules to restrictions of network devices.

In one embodiment, at least two access rules may be combined into one access rule. When the destination addresses and / or the originating addresses of an access rule are understood as address sets, summarization in one embodiment can be implemented by forming the union amounts of the address sets of the originating addresses.

By combining at least two access rules, the number of accesses covered by the access rule is thus increased.

In the described embodiment, before summarizing the access rules, it may be calculated how many additional accesses are included by the merging of the access rule to be generated.

The number of additional accesses can be calculated in one embodiment by methods known per se.

The aggregation of access rules may be performed in one embodiment using the connection sharpening parameter, the summarizing may include a determining step of determining whether the number of possible accesses included in the aggregate access rule is less than the value of the connection sharpening parameter.

In one embodiment, the designated accesses and / or the generated access rule may be displayed on a user interface.

It is thus created a way to visualize the communication of a communication network with the access rules for a user. By reducing the required access rules, e.g. From 1000 to 10, it is only made possible for a person to process or record the information about the communication in the communication network.

In a further embodiment, generating the at least one access rule may comprise generating at least one mapping, wherein the mapping is generated based on at least one same source address and / or destination address and / or service indication. The mapping can map the source addresses and / or destination addresses to the access rule.

To map the addresses of the at least one access rule, an image may be used. This ensures that the log entries can be uniquely assigned to an access rule. The image may e.g. to be a lookup table. Furthermore, the mapping may be a data structure that makes a logical grouping.

Such an embodiment has the advantage that simple data structures can be used which map a large number of source or destination addresses to an access rule. During the application of the access rules in the communication network, it is necessary to be able to quickly determine whether access from an access rule is included or not.

A lookup table provides an efficient data structure that allows for efficient retrieval of entries. In one embodiment, the lookup table may be implemented as a hash table or as a tree, eg a B-tree or B ⁺ -tree. A In one embodiment, possible data structure is an object group as provided by different routers, switches, and firewalls.

In one embodiment, the plurality of log entries may be recorded in a further step prior to receiving over a predetermined period of time.

In order to have all the relevant accesses occurring during normal operation as the basis for generating the access rules, it may be necessary to record the accesses in the communication network over a predetermined period of time. Thus, a record can be e.g. record the traffic in the communication network for three months. The recorded log entries can then be used to create the access rules as described.

In one embodiment, the mapping may include partitioning the plurality of log entries into a plurality of log groups. The size of the log groups can be specified by a parameter with a numerical value, in particular 1000, preferably 10000, the size of the log group indicating the number of log entries in the log group. The log groups can then be processed in parallel, wherein each log group is processed in particular by a processor, thread or process on a processor or a plurality of processors. The assignment may e.g. implemented by means of BigData techniques, e.g. the MapReduce algorithm.

The described embodiment allows the scaling of the invention to a very large number of log entries. A log group can be considered a batch so that a large number of stacks can be analyzed by batch processing techniques.

In one embodiment, while applying the access rule to the network, further log entries are received that document tagged accesses in the network, wherein the access rule is updated using the further log entries, wherein the updated access rule comprises the tagged accesses of the further log entries.

If accesses denoted during the access rule are applied, it is possible for a responsible user to centrally monitor the accesses and to detect conspicuous access patterns. In addition, it is possible to update the access rule if the designated accesses are to be included in the access rule. In this case, a user can manually specify that the accesses should be included in the access rule.

For example, if an originating address is increasingly tagged in conjunction with different destination addresses, it can be a security risk. A monitoring user can then, in a next step, talk to the appropriate employee or departmental user to see if the traffic was deliberate and authorized.

Further, in one embodiment, while applying the access rules, only the marked log entries may be recorded or stored. It is possible to save only a small number of log entries after the described initial recording phase in which all log entries are used to create the access rules. This saves a lot of storage space and processing power. Especially with network devices with low hardware resources, such as Routers, this is an advantage. Even with a small number of network devices, the generated log files can lead to a very large amount of data. However, with the described embodiment, the amount of data to be stored can be significantly reduced.

In a further embodiment, the communication network may be segmented into at least two zones, a first address group being associated with a first zone and a second address group being associated with a second zone.

In particular, if the network is segmented into zones, it is advantageous to monitor communication between the zones. In particular, the communication between zones presents an increased security risk. The definition of zones also allows a user to quickly judge whether accesses between an originating address and a destination address pose an increased risk.

In one embodiment, an address associated with a zone may be marked as trusted ("trusted"). Trusted addresses within a zone can be assigned to network devices that have enhanced security mechanisms. For example, servers have their own security mechanisms, such as firewalls, which can make it unnecessary to restrict access from and / or to the associated address. Additionally, in one embodiment, generating access rules may be performed using the addresses marked as trusted. At least one access rule can be marked as trusted for all Addresses are generated. That is, the addresses marked as trusted can form an address group, under the use of which an access rule can be generated.

In one embodiment, an address that is not assigned to a zone can also be marked as trusted ("Trusted Externals"). The address may be e.g. be associated with a server, e.g. is the global server of a communication network. Such servers often access a variety of addresses in different zones.

Thus, with the embodiment described, increased flexibility is provided since individual access rules can be generated for individual addresses within and outside a zone.

In one embodiment, the source and / or destination addresses in the network may be assigned at least one type based on the log entries, the type corresponding to permissions in the network.

Servers in a communication network can e.g. Connect to a variety of network devices. In particular, other network devices often access server services. The addresses corresponding to the servers are thus often stored as destination addresses in log entries. A classifier, such as a SVM (Support Vector Machine) or a Naive Bayesian Network can assign a type to the addresses based on the log entries, the type corresponding to permissions within the network. The type can e.g. automatically classify the address of the server as type "server". The type "server" can correspond to an authorization, according to which accesses from all possible addresses should be allowed. The server can be marked as trusted.

In one embodiment, a type of access rule generation type may be used, wherein accesses from arbitrary source addresses to destination addresses to which the type is assigned are covered by the access rule.

So it's possible to use the type to create access rules. This leads to an increased scalability of the described solution.

In one embodiment, the interval may be formed by the source addresses associated with a type.

The type can be used to create access rules. In this case, all addresses to which a type is assigned can define the interval which is used to generate the access rules. The addresses of one type can thus form the address group, whereby the number of access rules generated is reduced again.

• - Empfangen von zumindest zwei Logeinträgen von mindestens einem Netzwerkgerät, wobei die Logeinträge jeweils zumindest eine Ursprungsadresse und/oder eine Zieladresse, insbesondere jeweils IP-Adressen, und/oder eine Serviceangabe, insbesondere eine Portangabe, umfassen;
• - Analysieren der Logeinträge, wobei das Analysieren das Identifizieren von zumindest einer gemeinsamen Ursprungsadresse und/oder einer gemeinsamen Zieladresse und/oder einer gemeinsamen Serviceangabe umfasst;
• - Erzeugen mindestens einer Abbildung und mindestens einer Zugriffsregel, wobei die Abbildung auf Basis der identifizierten gemeinsamen Ursprungsadresse und/oder Zieladresse und/oder Serviceangabe erzeugt wird, und wobei die Abbildung die Ursprungsadresse und/oder Zieladresse und/oder Serviceangabe auf die Zugriffsregel abbildet;
• - Anwenden der Zugriffsregel in dem Netzwerk, wobei die Zugriffregel das Netzwerkgerät dazu veranlasst, Zugriffe, die nicht von der Abbildung auf die Zugriffsregel umfasst sind, zu kennzeichnen und/oder zu unterbinden.

Furthermore, the object is achieved by a method for securing / monitoring a network, comprising:

• Receiving at least two log entries from at least one network device, the log entries each comprising at least one source address and / or a destination address, in particular respective IP addresses, and / or a service specification, in particular a port specification;
• - analyzing the log entries, wherein the analyzing comprises identifying at least one common source address and / or a common destination address and / or a common service indication;
• Generating at least one map and at least one access rule, wherein the mapping is generated based on the identified common source address and / or destination address and / or service indication, and wherein the mapping maps the source address and / or destination address and / or service indication to the access rule;
• Applying the access rule in the network, the access rule causing the network device to identify and / or prohibit accesses not covered by the mapping to the access rule.

It is therefore also possible for log entries to be received by a network device, the log entries each comprising at least one source address and one destination address and / or a service indication. In a further step, the log entries can be analyzed, whereby common source addresses and / or common destination addresses and / or common service information are identified. By identifying, it is possible to generate an image that maps the identified common source addresses, addresses, and / or service information to an access rule. A reduction in the amount of memory required is achieved because a large number of addresses and / or service information can be combined into a single image.

The object is further achieved by a computer-readable storage medium containing instructions that cause at least one processor to implement one of the methods described above when the instructions are executed by the processor.

There are identical or similar advantages as have already been described in connection with one of the mentioned methods.

All embodiments can be combined with any desired solutions of the task. In particular, all embodiments described in connection with the described methods also relate to the described systems for securing / monitoring a network.

Further embodiments emerge from the subclaims.

• 1 eine schematische Ansicht eines Kommunikationsnetzwerks;
• 2 einen weiteren Ausschnitt des Kommunikationsnetzwerks der 1 in einer schematischen Darstellung;
• 3 ein Ablaufdiagramm für ein Regelerzeugungsverfahren;
• 4 ein Ablaufdiagramm eines Regelverfeinerungsverfahrens;
• 5 ein Ablaufdiagramm für ein Optimierungsverfahren;
• 6 ein Ablaufdiagramm für ein Verfahren zur automatischen Erkennung;
• 7 eine schematische Darstellung eines Lernprozesses;
• 8 eine schematische Darstellung eines Endpunktes im Kommunikationsnetzwerk;
• 9 eine schematische Darstellung eines Routers;
• 10 eine schematische Darstellung eines Servers;
• 11 ein Ablaufdiagramm für ein Notfallverfahren und
• 12 eine schematische Darstellung eines Systems zur Netzwerküberwachung.

The invention will be described by means of several embodiments, which are explained in more detail with reference to figures. Hereby show:

• 1 a schematic view of a communication network;
• 2 another section of the communication network of 1 in a schematic representation;
• 3 a flow chart for a rule generation process;
• 4 a flowchart of a rule refinement process;
• 5 a flowchart for an optimization method;
• 6 a flowchart for a method for automatic detection;
• 7 a schematic representation of a learning process;
• 8th a schematic representation of an end point in the communication network;
• 9 a schematic representation of a router;
• 10 a schematic representation of a server;
• 11 a flowchart for an emergency procedure and
• 12 a schematic representation of a system for network monitoring.

An object of the invention is to detect conspicuous or unwanted communication between network subscribers. For this purpose, in one embodiment, in a first phase, the communication network 200 analyzed or the communication recorded and in a second phase based on the record a variety of access rules 24 . 92 be generated, which identify unwanted or conspicuous communication or access.

1 shows a schematic representation of a communication network 200 in a first embodiment. It shows the 1 only part of the entire communication network 200 , It can be at the 1 but also a complete communication network 200 act.

In the first embodiment, the communication network comprises 200 a first endpoint 1 and a second endpoint 1' , The endpoints 1 '1' can represent, for example, PCs or mobile phones. For communication in the communication network 200 send the endpoints 1 . 1' first and second network data 6 . 6 ' to internal interfaces 32 a router 30 , The router 30 has the task of communicating between the endpoints 1 . 1' to enable. The router 30 includes an external interface 31 and the inner interfaces 32 ,

The router 30 sends log entries in the first embodiment 7 over the outer interface 31 to a log server 10 , This may be the router 30 always log entries 7 to the log server 10 send when the endpoints 1 '1' communicate with each other, for example, when endpoint 1 network data 6 at endpoint 1' would like to send. Sending the network data 6 . 6 ' can be done through a variety of network protocols. For example, the TCP / IP set of protocols could be used, with the different ones on layer 4 ("Transport layer") defined protocols (eg "TCP" or "UDP") can be used. Every communication in the communication network 200 can be understood as access from a source address to a destination address. A single log entry 7 consequently documents access within the communication network 200 , The log server 10 records all accesses in the communication network 200 on.

The log entries 7 may each include an originating address, a destination address and / or a service indication, such as a port. In a further embodiment, the log entries 7 a timestamp and / or the number of bytes sent, and / or the interface via which the network data 6, 6 'are sent to the router 30 have been sent. In other embodiments, the router may be 30 also be a switch or a firewall.

The log entries 7 can on the log server 10 Eg be stored in the form of a text file, a binary file and / or in a relational database or a schemalose database.

2 shows a schematic representation of the communication network 200 , which is an extension of the communication network 200 of the 1 is. The 2 shows two routers 30 ' . 30 " , if necessary, router communication data 35 exchange with each other. To the router 30 ' . 30 " connected endpoints 1 , 1 'are not shown. The routers 30 ' . 30 " send log entries 7 . 7 ' to a log server 10 that saves these. If a certain number of log entries 7, 7 'on the log server 10 is stored, the log server sends 10 the collected log entries 8th to an analysis server 20 , The log server can do this 10 the collected log entries 8th after the expiration of a period or after the existence of a certain number of log entries 7 . 7 ' to the analysis server 20 send or the analysis server 20 gets the collected log entries 8th periodically or continuously from the log server 10 off ("polling"). The log server 10 collects log entries in the first embodiment for three months 7 . 7 ' so that all expected in everyday life accesses are recorded at least once. The duration of the collection is preset by a user in the first embodiment, the predetermined duration being a numerical parameter. It is possible in other embodiments that the log server 10 as long as log entries 7 . 7 ' collects until a predetermined amount of data is stored. For example, when a storage medium of the log server 10 is half full.

In one embodiment, the analysis server receives 20 the collected log entries 8th and analyzes the collected log entries 8th , A selection unit 21 of the analysis server 20 examines the collected log entries 8th on patterns to access rules 24 . 92 to create. For example, the selection unit 21 of the analysis server 20 , Destination addresses of the log entries 7 . 7 ' assign to an address group that has been accessed by many source addresses. In another embodiment, it is possible that such originating addresses are assigned to address groups having a common destination address or that those source and destination addresses are assigned to address groups that have a common service indication or port in the log entries 7 . 7 ' feature. A special form of the address group is "any". The address group "any" includes all possible addresses in the network 200 , If, for example, all accesses to arbitrary destination addresses from a particular source address should be marked as harmless, "any" can be used in access rule 24, 92.

In a first embodiment, object groups may be used to associate the addresses with the address groups. A symbolic name is selected for the address group and a lookup table is used to assign the symbolic name to the addresses or service information or ports.

• - 10.0.0.2 und
• - 10.0.0.3

durch eine Bitmaske (/31) zusammengefasst werden, bei der die letzte Stelle der Zieladresse als Bitmuster 0 oder 1 sein kann. In einer weiteren Ausführungsform ist es möglich, mehr als nur die aufgezeichneten Adressen in einem Intervall zusammenzufassen. So ist es z.B. möglich, dass Adressen, die zu einem großen Adressintervall gehören, zu einer Adressgruppe zusammengefasst werden. Die Adressgruppe kann also mehr Adressen umfassen als aufgezeichnet wurden.In a further embodiment, supernetting can be used for the assignment. This bitmask is used to summarize intervals of IP addresses. For example, two addresses

• - 10.0.0.2 and
• - 10.0.0.3

be summarized by a bit mask (/ 31), in which the last digit of the destination address as a bit pattern can be 0 or 1. In another embodiment, it is possible to group more than just the recorded addresses in one interval. It is thus possible, for example, for addresses belonging to a large address interval to be combined into an address group. The address group may thus include more addresses than were recorded.

How many addresses are combined to form an address group, ie the size of the interval, can be set via a sharpening parameter. In this case, a low sharpness mean that a large number of addresses are assigned to an address group that is not in log entries 7 . 7 ' were recorded. On the other hand, a high sharpness value may mean that exactly those addresses that have been recorded are assigned to an address group. The sharpening parameter can be a numeric value that is preset by a user.

• Zugriffsregel 1:
  • object-group network Gruppel
  • 10.0.0.2
  • 10.0.0.3
  • ip access-list extended ACL_BASIC
  • permit ip object-group Gruppel any
  Zugriffsregel 1 ist eine Zugriffsregel 24 für das Kommunikationsnetzwerk 200 des ersten Ausführungsbeispiels. Endpunkt 1 hat die IP-Adresse 10.0.0.2 und Endpunkt 1' hat die IP-Adresse 10.0.0.3 zugewiesen bekommen. Die Adressen 10.0.0.2 und 10.0.0.3 sind durch Zugriffsregel 1 einer Adressgruppe zugeordnet. Der Adressgruppe ist ferner der Name „Gruppe1“ zugeordnet. Allen IP-Adressen, die der Gruppe 1 zugewiesen sind, werden gemäß der obigen Zugriffsregel 24 Zugriffe auf sämtliche andere Netzwerkteilnehmer („any“) erlaubt (permit), wie durch die letzte Zeile des Beispiels definiert wird. Die Zugriffsregeln 1 kann durch Supernetting vereinfacht werden:

• Zugriffsregel 2:
  • Object-group Network Gruppel
  • 10.0.0.2/31
  • ip access-list extended ACL_BASIC
  • permit ip object-group Gruppel any

Using the address groups, creates a generation unit 21 of the analysis server 20 access rules 24 indicating whether communication between an originating address and a destination address is desirable. An example of such an access rule 24 is:

• access rule 1 :
  • object-group network group
  • 10.0.0.2
  • 10.0.0.3
  • ip access-list extended ACL_BASIC
  • permit ip object-group grouping any
  access rule 1 is an access rule 24 for the communication network 200 of the first embodiment. endpoint 1 has the IP address 10.0.0.2 and endpoint 1' has been assigned the IP address 10.0.0.3. The addresses 10.0.0.2 and 10.0.0.3 are by access rule 1 assigned to an address group. The address group is also assigned the name "Group1". All IP addresses belonging to the group 1 are assigned according to the above access rule 24 Access to all others Network participant ("any") allows (permit), as defined by the last line of the example. The access rules 1 can be simplified by supernetting:

• access rule 2 :
  • Object-group Network Group
  • 10.0.0.2/31
  • ip access-list extended ACL_BASIC
  • permit ip object-group grouping any

Like access rule 2 shows, supernetting leads to a simplification of the access rule 24 because only one line is needed to define all the corresponding IP addresses. With a large number of IP addresses, so clear access rules 24 to be created. Also, the number of necessary access rules 24 be reduced.

The analysis server 20 created in the first embodiment by means of a generating unit 22 access lists 9 . 9 ' that have a variety of access rules 24 include. The access lists 9 . 9 ' are performed using a transmission unit 23 of the analysis server 20 to the router 30 ' . 30 " Posted. In the current embodiment, each router 30 . 30 ' only one access list 9 . 9 ' sent, which is associated with access through the appropriate router 30 , 30 'were executed.

The routers 30 ' . 30 " can now based on the access lists 9 . 9 ' future access, not by the access rules 24 the access lists 9 . 9 ' are included. In one embodiment, it is also possible for the routers 30 ', 30 "to have the accesses not subject to the access rules 24 the access lists 9 , 9 'include, prevent. Alternatively, it is possible to mark or prevent those accesses that are dependent on the corresponding access rules 24 are included, depending on what is desired.

When all accesses are recorded on a network, the number of recorded accesses is so large that a user is unable to detect unwanted or extraordinary accesses. This occurs especially in large networks already when, over a short period of time (a few hours / days) log entries in the log server 10 to be collected. A user can more easily detect and fend off a hazard based on the small number of designated accesses.

3 FIG. 12 is a schematic flowchart of a rule generating method 50. In the rule generating method 50 is in the first log entries collection step 51 a large number of log entries over a defined period of time 7 , 7 'collected. In an assignment step 52 become the collected log entries 7 . 7 ' analyzed. Address groups are created based on eg source addresses, destination addresses and / or service information. The address groups define an interval for source and destination addresses. Of course it is also possible to set the address groups on the basis of further entries in the log entries 7 To create existing information. In a rule generating step 53 becomes at least one access rule using the generated address groups 24 generated in the release step 54 is released for use. The release step 54 is optional and can be used by a user of the operator organization of the communication network 200 be executed or automated until revoked. The automatically shared access rules 24 can be checked by the user at a later time (eg daily or weekly) and undone if necessary. In a rule application step 55 become the generated access rules 24 in the communication network 200 used to identify and possibly block access that is not from the generated access rules 24 are included.

4 shows a rule refinement process 60 which after creating a first set of access rules 24 can be executed. At the beginning of the procedure 60 is already a set of access rules 24 generated. In a log entries collection step 61 become log entries 7 . 7 ' collected or saved. For example, log entries can always be made for 5 minutes 7 . 7 ' to be collected. In a subsequent rule adjustment step 62 become the collected log entries 8th analyzed. There are new access rules 92 created or the existing access rules 24 are based on the source or destination addresses in the newly recorded log entries of the step 61 updated. The addresses in the newly recorded log entries 7 . 7 ' For example, permissions can be assigned so that addresses form permission groups. An authorization can be a communication authorization. For example, it may be specified that an originating address of a log entry applies to all other addresses in the communication network 200 may access. It is possible the new access rules 92 also using the authorization group.

In a subsequent release step 63 become the changed or generated access rules 92 manually or automatically released again. Subsequently, the changed access rules 92 or the newly created access rules in a rule translation step 64 on the communication network 200 applied. The procedure 60 then moves again with the log entries collection step 61 continued.

The 5 shows a flowchart of an optimization method 70 , which is another embodiment for adapting the already existing access rules 24 represents. This is done in a first log entries collection step 71 a variety of log entries 7 . 7 ' collected or saved. In a subsequent rule generating step 72 become the source or destination addresses of the collected log entries 8th assigned to address groups depending on a sharpening parameter. Based on the assignment, access rules are used 24 generated. A very low set sharpening parameter can cause a very large number of access rules AR to be generated. However, this can be disadvantageous, since thus a release of the generated access rules 24 by a user is made more difficult. In the worst case, each access would have a single access rule 24 to be created. This is not manageable for the user. Therefore, in the subsequent decision step 73 checks whether the number of access rules AR generated is below a predetermined access rule threshold ZS initialized with an initial numeric value (eg 200).

If the number of generated access rules AR is above the access rule threshold ZS, the sharpening parameter will be in a focus adjustment step 76 lowered. What is the value of the sharpness parameter in the sharpness adjustment step 76 can be pre-set by a user. The process then moves again to the rule generation step 72 where the new value of the sharpening parameter assigns the addresses of the log entries 8th is considered to address groups.

In the subsequent decision step 73 it is again checked whether the number of access rules AR generated is below the access rule threshold value ZS. If the number of generated access rules AR is below the access rule threshold value ZS, the method proceeds with a rule application step 77 continued. In the rule application step 77 of the optimization process 70 become the access rules 24 in the communication network 200 applied so that accesses are not affected by the access rules 24 are included, marked and possibly prevented.

6 shows a method for automatic detection 80 and allocation of network devices to network zones 4 . 5 (please refer 12 ), so-called auto-discovery. In this case, in a first zone creation step 81 zones 4 . 5 for the communication network 200 Are defined. The communication network 200 can be in zones 4 . 5 be segmented so that logical areas of an organization, such as a group, such as human resources and marketing, are assigned to different zones. A zone 4 . 5 can through a router 30 . 30 ' . 30 " (please refer 9 ) To be defined. All communication from outside the zone 4 . 5 into the zone 4 . 5 into and from within the zone 4 . 5 outside the zone 4 . 5 thus runs through the defining router 30 . 30 ' . 30 " , Of course, there are several routers 30 . 30 ' . 30 " conceivable that together a zone 4 . 5 define.

router 30 . 30 ' . 30 " that a zone 4 . 5 typically comprise one or more external interfaces 31 . 31 ' . 31 " and one or more internal interfaces 32 . 32 ' . 32 " , This will be accesses that are only within the appropriate zone 4 . 5 be performed, only via the internal interfaces 32 . 32 ' . 32 " executed.

In the current embodiment, the log entries include 7 . 7 ' also information indicating whether access via an external interface 31 . 31 ' , 31 "or via an inner interface 32 . 32 ' . 32 " is performed. It is thus possible to determine if the source address is within a zone 4 . 5 located by the appropriate router 30 . 30 ' . 30 " is defined. In the zone member recognition step 82 Now all source addresses are identified which correspond to accesses via internal interfaces at the corresponding routers 30 . 30 ' 30 " received. The identified addresses are thus a zone 4 . 5 assigned. The identified addresses are then assigned to a corresponding zone group.

The zone group belonging to the zone 4 . 5 can correspond in an access rule 24 be used. For example, a zone group can define an address interval that includes all addresses of the zone. It is also possible that a plurality of intervals are defined by the zone group, all intervals together comprising all addresses of the zone.

It is possible that all accesses between addresses associated with a common zone 4, 5 are governed by a single access rule 24 be included. The use of zone groups creates a way to group addresses without many individual addresses in an access rule 24 To have to perform as described in the use of bit masks for supernetting. Also it is for one with the evaluation of the access rules 24 entrusted users easier to decide if an access rule 24 is to be applied when zone groups are generated which, for example, reflect the corporate structure.

Within a zone 4 . 5 can be a server assigned to an address 40 be provided, which has its own security mechanisms, such as a firewall 42 (please refer 10 ). To one fine gradation of access rules 24 It is advantageous if the address of the server 40 another access rule 24 is assigned as the remaining addresses of the zone 4 . 5 ,

Based on the log entries 7 . 7 ' it is possible to perform a classification of the addresses of the zone members. For example, the address of the server 40 often as the destination address in log entries 7 . 7 ' to be named. Furthermore, it is possible that the server 40 multiplied with other servers 40 ' (please refer 12 ) outside the zone 4 communicated. Therefore, log entries contain 7 often the address of the server 40 as the source address if the destination address is outside the zone 4 lies. The classification is performed in the current embodiment using a support vector machine. Of course, other classifiers are conceivable, such as Bayes classifiers. The classification is based on the pairs of source and destination addresses and other information contained in the log entries 7 . 7 ' are stored.

In the step of recognizing trusted internal zone members 83 , so-called trusted internals, as described above, for example, the server 40 recognized. In the following step for the detection of trusted external network members 84 , so-called Trusted Externals, addresses can be identified, the trusted network members, such as outside the zones 4 . 5 lying server 40 ' , assigned. Again, the access patterns of the outside of the zones 4 . 5 lying server 40 ' used to get the address of the server 40 ' automatically add to the group of trusted external network members.

In the following rule refinement step 85 For example, a user can automatically create and optionally automatically release special access rules for the recognized trusted internal zone members and for the recognized trusted external network members. In the final rule reduction step 86 access rules can be summarized which contain redundant information.

A set of access rules can be reduced by matching the address ranges encompassed by the access rules. The source or destination addresses of the corresponding access rules are compared. For example, a first access rule can be the address of the endpoint 1 of the 12 include, as the destination address any other addresses are allowed. If a second access rule is defined which allows accesses from any addresses to any other addresses ("any to any"), then the second access rule also includes the first access rule. The first access rule can be deleted. In another example, the first access rule is already encompassed by a third access rule that allows access from the addresses of endpoints 1 and 1 'to any other addresses. Again, the first access rule can be deleted.

7 shows the schematic process of the learning process 90 , The learning process 90 provides a further adjustment ("fine-tuning") of generated access rules 24 ready and can be executed after creating a first rule set. This is done in a log entries processing step 91 a variety of log entries 7 . 7 ' analyzed. The log entries processing step 91 can be executed in parallel on different processors and / or computers, eg in a cluster. This guarantees scalability of the described solution.

In the log entries processing step 91 become access rules 92 generated as described above, in the control matching step 93 with existing access rules 24 be compared. Is a newly created access rule 92 already by an existing access rule 24 includes, with the log entries processing step 91 continued. Is the newly created access rule 92 not yet from the existing access rules 24 includes, then becomes the new access rule 92 the already existing access rules 24 added and in the simplification step 95 becomes the new set of access rules 94 , simplified, if possible. The method then proceeds to the log entries processing step 91 using the new set of access rules 94 continued.

8th shows an example of an endpoint 1 . 1' . 1" that has an endpoint arithmetic unit 2 and an endpoint network adapter 3. An endpoint 1 , 1 ', 1 "thus exemplifies each possible device in the communication network 200 represents.

9 shows an example of a router 30 . 30 ' . 30 " , The router 30 . 30 ' , 30 "in one embodiment comprises a network computing unit 34 that is designed to handle accesses via an external interface 31 or via an inner interface 32 of the network adapter 33 were received, process. In particular, the network computing unit 34 formed in one embodiment, log entries 7 . 7 ' to generate or in the storage unit 36 temporarily.

10 schematically shows the structure of a server 40 . 40 ' , The server 40 , 40 'in one embodiment comprises a server computing unit 41 , optionally an integrated or upstream firewall 42 and a server network adapter 43 , The server 40 . 40 ' thus has other security mechanisms that server memory 44 protects against unauthorized access.

11 1 shows a flow diagram of a "lockdown" 100. First, the rule refinement method 60 executed, which is already related to 4 has been described. In one embodiment, it may be due to external circumstances, such as the increased occurrence of attacks on the communication network 200 , to execute an emergency activation step 102 come. As a result, all accesses other than access rules 24 . 92 are included, be prevented. Thus, it is not possible to execute accesses that have not yet been recorded, as they may be executed by external attackers.

All recorded accesses in normal operation, prior to execution of the emergency activation step 102 but are still allowed. Thus, the operation of the organization operating the communication network 200 is ensured. New accesses can be made in the connection matching step 103 are identified, and become in the connection blocking step 104 initially stopped. Thereafter, the inhibited accesses in the fine-tuning step 105 , eg after optionally going through the rule refinement process 60 , be allowed manually or automatically. This allows increased security and functionality of the entire communication network 200 ,

12 shows the schematic structure of a communication network 200 in an embodiment with endpoints 1 . 1' . 1" one in zone 4 internal server 40 and a non-zone ("external") server 40 ' , The endpoints 1 . 1' . 1" are in the embodiment of 12 as a client to the appropriate server 40 . 40 ' educated. The endpoints 1 . 1' . 1" , as well as the servers 40 and 40 ' are IP addresses assigned to the endpoint 1 and those to the server 40 assigned IP addresses of a first zone 4 assigned. The to the endpoints 1 and 1' assigned IP addresses are a second zone 5 assigned. The server 40 ' are assigned other IP addresses that are not in zone 4 still zone 5 are included. The zones 4 . 5 represent corporate divisions such as marketing and human resources. It is assumed that human resources and / or marketing people communicate superficially with other human resources or marketing personnel.

router 30 ' . 30 " of the 12 each have external interfaces 31 ' . 31 " and internal interfaces 32 ' . 32 " on. The endpoint 1 and the server 40 can do this, for example, via the inner interface 32 ' the router 30 ' communicate with each other. The endpoints 1' . 1" can over the inner interface 32 "of the router 30 " communicate with each other. To communicate with the server 40 may be the endpoint 1' the second zone 5 , an access via the inner interface 32 " of the router 30 " and the outer interface 31 ' of the router 30 '. router 30 ' So can through the interfaces 31 ' . 32 ' determine if access is within within the first zone 4 (in detail about the inner interface 32 ' ) or from outside the first zone 4 (in detail via the outer interface 31 ' ) he follows.

The router 30 ' and the router 30 " First, store all accesses, each via their outer or inner interfaces 31 ' . 31 " . 32 ' . 32 " be executed as log entries 7 . 7 ' in local storage facilities 36 , Is a variety of log entries 7 . 7 ' stored, for example, after expiration of a predetermined period of time, the log entries 7 . 7 ' to a log server 10 sent and aggregated there. In another embodiment, the routers may 30 ' . 30 " the log entries 7 . 7 ' also directly to the log server 10 for storage send to the resources or storage devices 36 the router 30 ' . 30 " to relieve. The log server 10 sends the collected log entries 8th for analysis to an analysis server 20 or the analysis server 20 gets the collected log entries 8th periodically or continuously from the log server 10 , so-called "polling" from. The analysis server 20 analyzes the collected log entries 8th and forms address groups using access rules as described above 24 be generated. The analysis server 20 can perform the auto-discovery described above, in which the IP addresses are automatically assigned to their respective zones 4 . 5 be assigned. If the log entries 7 . 7 ' Information about the inner and outer interfaces, about which the corresponding accesses to the routers 30 ' . 30 " it is possible the IP addresses of the zones 4 . 5 assign. For example, log entry contains 7 an indication that access by systems / network devices behind router 30 'via the inner interface 32 ' at the router 30 ' has been received. The analysis server 20 can now change the source IP addresses of the first zone 4 assign that in log entries 7 occur through the internal interface 32 'of the router 30 ' have been received.

The analysis server can do this 20 also using a classifier, the IP address of the server 40 Assign the type "Server". The classifier can perform the classification based on a variety of characteristics. In the current embodiment of the 12 operates the server 40 a web server, so the endpoints 1 . 1' . 1" over port 80 frequently requests to the server 40 make. The accumulation of access via port 80 on the server 40 mapped IP address is an indicator that it is the server 40 is a web server. The analysis server 20 generates an access rule 24 for the server 40 that specifies all traffic to the server 40 from the first and the second zone 4 . 5 over port 80 allowed are. For endpoint 1 generates the analysis server 20 however, a rule that only communicates with the server 40 allowed, so no accesses to IP addresses that one endpoints 1' , 1 "of the second zone 5 assigned.

For the IP addresses of the endpoints 1' . 1" the second zone 5 become two access rules 24 generated. A first access rule specifies that only accesses from IP addresses of the endpoints 1 . 1' from or to IP addresses of the second zone 5 are assigned, should not be logged or prevented. A second access rule indicates that accesses to the server 40 the first zone 4 from the endpoints 1 . 1' not logged or prevented.

The generated access rules for IP addresses that are the first zone 4 are assigned by the analysis server 20 to routers 30 ' sent to the application. Generated access rules for IP addresses of the second zone 5 are assigned by the analysis server 20 to routers 30 " sent to the application.

Of course, the user can also define a new access rule manually or assign zones or address groups to IP addresses and subnets.

Following are all requests on the routers 30 ' . 30 " marked (and possibly locked in the "lockdown"), not by the access rules executed there 24 are included. The marked accesses are then sent to the log server 10 which sends them to the analysis server 20 forwards. One with the security of the communication network 200 entrained user evaluates the identified accesses by means of the rule refinement method 60 generated access rules.

The user can provide access to more details for each IP address or subnet appearing in the access rules. In this case, further information about the IP addresses of external systems (eg IP address database, network security monitoring systems, IP Reputation Investigation) can be queried, such as the location of the source IP address or the destination IP address, for example The names of the associated zones, the subnet, the network users associated with the IP addresses, and / or the names or IP addresses of the routers through which the access is made, as well as security information (eg threat assessment by other network monitoring systems, list of connections of these IP addresses the last 24 hours or even IP reputation services).

In other embodiments, the advanced details for the IP addresses become access rules 24 . 92 automatically queried and already collected and provided by the analysis tool at the time of the analysis.

The system assists the user therein (e.g., by aggregating the additional information in an email) in a simple manner to initiate an investigation within the organization that conducts intensive traffic inquiry.

Furthermore, the user could cause future accesses to be caused by an access rule 24 . 92 represented in the future (originating IP address and / or destination IP address and / or service port), in the future it no longer appears, ie ignored. Similarly, it may mean that at least a subset of the recorded information with the by the access rule 24 . 92 covered access, such as the same source and / or destination address.

If the authorized user again wishes to display log entries corresponding to the ignored accesses, the ignoring (of source or destination IP addresses and services) of individual originating and / or destined addresses may be canceled and the log entries (in the form of new proposed access rules 92 ) visible in a timely manner. In one embodiment, log entries are also still recorded which have been hidden from the user by the user interface.

In the context of this application, the identification of accesses may in particular mean that accesses are logged, preferably recorded or stored.

LIST OF REFERENCE NUMBERS

1, 1 ', 1 "

endpoint

2

Endpoint computing unit

3

Endpoint network adapter

4

first zone

5

second zone

6, 6 ', 6 ", 6'"

network data

7, 7 '

Log entries

8th

collected log entries

9, 9 '

access list

10

logserver

20

Analysis server

21

selector

22

generating unit

23

transmission unit

24

access rules

30, 30 ', 30 "

router

31, 31 ', 31 "

outer interface

32, 32 ', 32 "

Inner interface

33

Network Adapters

34

Network processing unit

35

Router communication data

36

memory device

40, 40 '

server

41

Server computing unit

42

firewall

43

Server Network Adapter

44

server memory

50

Rule creation process

51

Log entries collection step

52

assigning step

53

Rule application step

54

releasing step

55

Rule conversion step

60

Usually refining process

61

Log entries collection step

62

Rule matching step

63

releasing step

64

Rule conversion step

70

optimization methods

71

Log entries collection step

72

Rule generation step

73

decision step

76

Focus adjustment step

77

Rule application step

80

Automatic detection method

81

Zone creation step

82

Zone members detection step

83

Detection of trusted internal zone members

84

Detection of trusted external network members

85

Usually refining step

86

Generally reducing step

90

learning process

91

Log entries processing step

92

New generated rule

93

Regelabgleichungsschritt

94

New set of rules

95

simplification step

100

Emergency procedure (lockdown)

101

monitoring procedures

102

Emergency activation step

103

Connection Setup step

104

Call blocking step

105

Fine-tuning step

200

Communication network

Claims (13)

Method for securing / monitoring a network (200), characterized by : receiving a plurality of log entries (7, 7 ') from at least one network device (30, 30', 30 "), each log entry (7, 7 ') having a Documenting access (6, 6 ') in the network (200) from an originating address to a destination address; - associating a selection of originating addresses and / or destination addresses with at least one address group, wherein an address group defines at least one interval for at least one originating address or destination address; Generating (53) at least one access rule (24, 92) using the address group; - Applying (55) the access rule (24, 92) in the network (200), the access rule (24, 92) causing at least one network device (30, 30 ', 30 ") to initiate accesses (6, 6') are not encompassed by the access rule (24, 92), characterized and / or inhibited, characterized in that a plurality of origin or destination addresses of the log entries (7, 7 ') are assigned to the address group in which associated log entries ( 7, 7 ') have the same source and / or destination address and / or service specification and / or information via interfaces. Method according to Claim 1 , characterized in that the log entries (7, 7 ') - a service indication and / or - a time stamp and / or - the number of bytes sent and / or - information via interfaces on the data on or go out, in particular a router (30, 30 ', 30 ") and / or a switch and / or a firewall is assigned. Method according to one of the preceding claims, characterized in that the interval is defined using supernetting, in particular using at least one bit mask. Method according to one of the preceding claims, in particular according to one of Claims 1 - 2 , characterized in that the address group is formed by a union of the source addresses or the destination addresses of the selection of the log entries (7, 7 '). Method according to one of the preceding claims, in particular according to Claim 3 , characterized in that at least two non-consecutive source and / or destination addresses define the interval. Method according to one of the preceding claims, in particular according to Claim 3 characterized in that the assigning of the source addresses or destination addresses to the address group is performed based on a sharpening parameter, the sharpening parameter corresponding to the size of the interval, and wherein the generating additionally comprises the steps of: a. Determining whether the number of access rules (AR) generated is below a, in particular numerical, access rule threshold (ZS); b. Adjusting the sharpening parameter when the number of access rules (AR) generated is above the access control threshold (ZS), wherein the generating and steps a and b are repeated until the number of access rules (AR) is below the access rule threshold (ZS ) lies. Method according to one of the preceding claims, characterized in that during the application of the access rule (24, 92) further log entries are received which document identified accesses in the network (200), the access rule (24, 92) using the further log entries is updated, wherein the updated access rule (24, 92) comprises the marked accesses of the other log entries. Method according to one of the preceding claims, characterized in that source and / or destination addresses in the network (200) on the basis of the log entries (7, 7 ') at least one type is assigned, in particular using a Stützvektormaschine and / or Naive Bayesschen Network, where the type corresponds to permissions within the network (200). Method according to one of the preceding claims, in particular according to Claim 8 characterized in that a type is used to generate the access rule (24, 92), wherein accesses (6, 6 ') from originating addresses to destination addresses to which the type is associated comprise access rules (24, 92) are. Method according to one of the preceding claims, in particular according to Claim 8 , characterized in that the interval is formed by the source addresses associated with a type. Method according to one of the preceding claims, characterized in that the method further comprises: - representing the identified accesses (6, 6 ') and / or the generated access rules (92) on a user interface. Method for securing / monitoring a network (200), characterized by : - receiving at least two log entries (7, 7 ') from at least one network device (30, 30', 30 "), wherein the log entries (7, 7 ') respectively at least one source address and / or one destination address, in particular in each case IP addresses, and / or a service specification, in particular a port specification, - analyzing (52) the log entries (7, 7 '), wherein the analyzing (52) the identification of at least one common source address and / or a common destination address and / or at least one common service indication, Generating (53) at least one map and at least one access rule (24, 92), wherein the map is generated based on the identified common source address, destination address, and / or service indication, and wherein the mapping includes the source address and / or destination address and / or service indication maps the access rule (92); Applying (55) the access rule (24, 92) in the network (200), the access control (24, 92) causing the network device (30) to access (7, 7 ') not from the map to the network Access rule (24, 92) are included, mark and / or to prevent. A computer-readable storage medium containing instructions that cause (at least) a processor to implement a method as claimed in any one of the preceding claims when the instructions are executed by the processor.

Images