JP2003067269A - Device and method for detecting unauthorized access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize a device which can detect even an unknown attack which is not registered in a database as an attack pattern. SOLUTION: Although a server 106 and an invasion-detecting server 107 are on an equality with each other, they are implemented with different programs. When a server communication transmitter-receiver part 141 receives data from a client, it transfers the data to the server 106 and the invasion- detecting server via a communication relay part 145. A response comparing part 142 obtains the response data of the server 106 and the response data of the invasion-detecting server 107 via the communication relay part 145, compares both response data. If an eminent gap exist between them, the access is determined to be unauthorized, and a countermeasure part 144 takes an appropriate countermeasure action for unauthorized access.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an unauthorized access detection device for detecting unauthorized access via a network.

[0002]

2. Description of the Related Art FIG. 13 shows the Internet Secu.
rity Systems, Inc. (http: // www.
iss. FIG. 11 is a configuration diagram showing a conventional intrusion detection device represented by a product “RealSecure” of net /).
In order to detect an attack on the servers 704 and 705, the conventional intrusion detection device 702 monitors a packet transmitted from the Internet 701 on the same LAN 703 as the server.

FIG. 14 is a block diagram showing the internal structure of a conventional intrusion detection device. The operation of the conventional intrusion detection device 702 will be described below. The packet monitor unit 807 in the intrusion detection device constantly monitors the packet flowing on the LAN 703 and transfers the packet information to the attack determination unit 806.

The attack determination unit 806 compares the data included in the packet with the attack pattern included in the attack pattern database 808, and determines whether the packet is sent with the intention of attacking.

The packet is the attack pattern database 8
If the attack pattern matches 08, the attack determination unit 8
06 calls the countermeasure unit 805 to notify the administrator,
Execute predetermined intrusion countermeasures.

Although FIG. 13 and FIG. 14 show a network monitoring type intrusion detection device, instead of packets, it operates inside the server and monitors the log file output by the program. There are also devices. In that case, the packet monitor unit 807 is replaced with a log file monitor function, but the configuration and operation of the remaining parts are the same.

[0007]

As described above, the conventional intrusion detection device has an attack pattern as a database in advance and detects an intrusion by checking whether the input information matches the pattern. . Therefore,
It was impossible to detect an unknown attack that does not exist in the database as an attack pattern.

The present invention has been made to solve the above-mentioned problem, and transfers an input to a plurality of servers having equivalent functions and compares the responses, so that an unknown attack can be performed. Also makes it possible to detect intrusion.

[0009]

An unauthorized access detection apparatus according to the present invention comprises at least one or more monitored servers to be monitored and at least one corresponding server associated with each monitored server. Connected to and
An unauthorized access detection device for detecting unauthorized access to the monitored server by any of the client devices, wherein the access request is sent when an access request addressed to a specific monitored server is sent from any of the client devices. And sending the access request to a specific corresponding server corresponding to the specific monitored server, receiving a response to the access request from the specific corresponding server as a corresponding server response, and performing the specific monitoring. A response to the access request sent from the target server is acquired as a monitored server response, the monitored server response and the corresponding server response are compared, and the access request is based on the comparison result and the specific monitored server is the access request. It is characterized by determining whether or not it is intended for unauthorized access to.

The unauthorized access detection device has the same function as the program of the corresponding monitored server, but is connected to a corresponding server using a program having a different program configuration.

The unauthorized access detection device compares the monitored server response with the corresponding server response,
When there is a difference of a certain level or more between the monitored server response and the corresponding server response, it is determined that the access request is intended for unauthorized access to the specific monitored server.

The unauthorized access detection device, when any one of the client devices sends an access request addressed to the specific server to be monitored, an access request receiving unit that receives the access request, and the access request. The response to the access request is sent from the specific monitored server and the specific corresponding server, and the response to the access request is received as the monitored server response from the specific monitored server, and the response to the access request is handled from the specific corresponding server. A communication relay unit that receives as a server response,
A response comparison unit that compares the monitored server response with the corresponding server response, and determines whether or not the access request is for unauthorized access to the specific monitored server based on the comparison result. It is characterized by

The unauthorized access detection device monitors the data transmission / reception status for each monitored server,
When an access request addressed to the specific monitored server is sent from any of the client devices, the access request is monitored and a response to the access request by the specific monitored server is monitored as a monitored server response. And a communication relay unit that transmits the access request monitored by the monitor unit to the specific corresponding server, and receives a response to the access request from the specific corresponding server as a corresponding server response. A response comparison unit that compares the monitored server response with the corresponding server response, and determines whether or not the access request is for unauthorized access to the specific monitored server based on the comparison result. It is characterized by

The unauthorized access detection method according to the present invention includes at least one or more monitored servers to be monitored,
An unauthorized access detection method, which is connected to at least one or more corresponding servers associated with each of the monitored servers, and detects unauthorized access to the monitored server by any client device, comprising: When an access request addressed to a specific monitoring target server is transmitted from the client device, the access request is acquired, and the access request is transmitted to a specific corresponding server corresponding to the specific monitoring target server. From the corresponding server, the response to the access request is received as a corresponding server response, and the response to the access request transmitted from the specific monitored server is acquired as a monitored server response. Based on the comparison result, the access request is compared with the server response. Characterized by determining whether an object unauthorized access to a specific managed server.

The unauthorized access detection method has the same function as the program of the corresponding monitored server, but is characterized in that the unauthorized access detection method is connected to a corresponding server using a program having a different program configuration.

In the unauthorized access detection method, in the comparison between the monitored server response and the corresponding server response,
When there is a difference of a certain level or more between the monitored server response and the corresponding server response, it is determined that the access request is intended for unauthorized access to the specific monitored server.

In the unauthorized access detection method, when an access request addressed to the specific monitored server is transmitted from any of the client devices, an access request receiving step of receiving the access request and the access request The response to the access request is sent from the specific monitored server and the specific corresponding server, and the response to the access request is received as the monitored server response from the specific monitored server, and the response to the access request is handled from the specific corresponding server. Whether the communication relay step received as a server response is compared with the monitored server response and the corresponding server response, and whether the access request is for unauthorized access to the specific monitored server based on the comparison result. And a response comparison step of determining whether or not.

The unauthorized access detection method monitors the data transmission / reception status for each monitored server,
When an access request addressed to the specific monitored server is sent from any of the client devices, the access request is monitored and a response to the access request by the specific monitored server is monitored as a monitored server response. And a communication relay step of transmitting the access request monitored by the monitoring step to the specific corresponding server, and receiving a response to the access request from the specific corresponding server as a corresponding server response, A response comparison step of comparing the monitored server response with the corresponding server response, and determining whether or not the access request is intended for unauthorized access to the specific monitored server based on the comparison result. It is characterized by

[0019]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiment 1. FIG. 1 is a diagram showing a network configuration including an intrusion detection device (unauthorized access detection device) according to the present embodiment. Intrusion detection device 104
Is connected to the Internet 101 through the LAN 102, and is also connected to the server 106 and the intrusion detection server 107 through the LAN 103 and the LAN 105. However, here, the Internet represents all networks capable of sending IP packets to the intrusion detection device 104 (excluding the LAN 103 and the LAN 105).

FIG. 2 is a diagram showing an outline of the operation of this embodiment.

FIG. 3 is a diagram showing an internal configuration of the intrusion detection device 104 in this embodiment. Intrusion detection device 104
Is a server communication transmission / reception unit 141, a response comparison unit 142, a server information management unit 143, a countermeasure unit 144, a communication relay unit 14
5, the server 1 through the LAN 102 and the Internet through the LAN 103 and LAN 105.
06 and the intrusion detection server 107.

4 and 5 show the internal operation of the intrusion detection device 104 according to the present embodiment in chronological order.

FIG. 6 is a diagram showing the internal configuration of the response comparison unit 142 of the intrusion detection device 104 according to this embodiment. The response comparison unit 142 includes a response comparison control unit 1421, and various protocol correspondence comparison units 1422 to 1424. The response comparison unit 142 uses the server information management unit 143 when performing the processing.

FIG. 7 shows the contents of the server information management table managed by the server information management unit 143 in this embodiment.

With reference to FIG. 1, the intrusion detection device 104
The configuration will be described in detail. Intrusion detection device 104
Is a LAN 102 that connects to the Internet 101
And a server 10 that provides services on the Internet
6 is connected to both of the connected LANs 103. The intrusion detection device 104 is also connected to the intrusion detection server 107 via the LAN 105. The intrusion detection device corresponds to an unauthorized access detection device.

Reference numeral 106 denotes a server which is a target of intrusion detection by the intrusion detection device 104, that is, a server which is a target of monitoring by the intrusion detection device. The server 106 corresponds to the monitored server.

The intrusion detection server 107 is the server 106.
It is a server that provides a service equivalent to that on the LAN 105. For example, when the server 106 provides the WWW service to the Internet, the equivalent WWW service needs to be running on the intrusion detection server 107. However, the servers operating on the server 106 and the intrusion detection server 107 must be different programs (different applications and versions). The intrusion detection server 107 corresponds to the corresponding server.

Although only one server 106 and one intrusion detection server 107 are shown in FIGS. 1 and 2,
Actually, it is possible to arrange a plurality of servers and an intrusion detection server on the LAN. LAN 103 and L
The AN 105 can be configured as the same LAN.

Next, referring to FIG. 2, the intrusion detection device 1
The operation of 04 will be described. The intrusion detection device 104 is
It operates as a proxy for the server 106 on the LAN 202. Therefore, the client trying to receive the service of the server 106 is recognized as the service being provided on the intrusion detection device 104.

The message sent from the Internet 101 to the server 106 is sent to the intrusion detection device 104 via the LAN 102. Here, the intrusion detection device 10
4 transfers the message to the server 106 and at the same time sends it to the intrusion detection server 107.

Server 106 and intrusion detection server 107
Both process the sent message and send a reply message. These response messages are received by the intrusion detection device 104. The intrusion detection device 104, which receives the response message from both servers, compares the contents included in the message.

If the server 106 has not been attacked, the response message may differ from that of the intrusion detection server 107, although the response message may differ from application to application.
The contents are almost the same. The intrusion detection device 104 confirms that there is no noticeable difference between the response messages of both parties, determines that the access is valid, and transmits the response message sent from the server to the client on the Internet 101.

In the unlikely event that the server 106 is attacked, the server performs an operation different from the original operation, so that the response message thereof clearly differs from the response message of the intrusion detection server 107. The intrusion detection device 104 detects this difference and determines that an unauthorized access has been made, and takes appropriate measures such as notifying the administrator. The server 1
The response from 06 is called a monitored server response, and the response from the intrusion detection server 107 is called a corresponding server response.

Next, the internal structure of the intrusion detection device 104 according to the present embodiment will be described with reference to FIG. The server communication transmitting / receiving unit 141 sends a message (access request) to the server 106 via the LAN 102.
Communication relay unit 1 to receive the message and transfer the message to an appropriate server 106 and intrusion detection server 107.
45 request. The appropriate transfer destination is the server information management unit 1.
It can be obtained by using 43. Further, the server communication transmitting / receiving unit 141 receives the response message from the server from the response comparing unit 142 and returns it to the client on the Internet through the LAN 102. Further, the server communication transmission / reception unit 141 receives the countermeasure execution request from the response comparison unit 142 and sends the countermeasure execution request to the countermeasure unit 144. The server communication transmitting / receiving unit 141 functions as an access request receiving unit.

The response comparison unit 142 receives the response messages from the server 106 and the intrusion detection server 107 from the communication relay unit 145, and determines whether or not their contents match. When the response comparison unit 142 determines that the access is normal as a result of the determination, the response comparison unit 142 sends the response message from the server 106 to the server communication transmission / reception unit 14.
Send to 1. If it is determined that the access is unauthorized,
The countermeasure request message is sent to the server communication transmitting / receiving unit 141.

The server information management unit 143 receives the port number and the protocol name of the transport layer from the server communication transmission / reception unit 141, refers to the internal table, and addresses and ports of the appropriate server 106 and intrusion detection server 107. Returns the number and service name.

The countermeasure section 144 is the server communication transmitting / receiving section 14
The unauthorized access detection information is received from 1, and the unauthorized access countermeasure is executed.

The communication relay unit 145 receives the server 106 and the intrusion detection server 107 from the server communication transmitting / receiving unit 141.
Address, port, and message to be transmitted, and the corresponding server 106 and intrusion detection server 1
LAN103 and LAN1 to the designated port of 07
Send message through 05. Also, the server 10
6 or the intrusion detection server 107 to the LAN 103,
The response message is received via the LAN 105, information of the message source address, port, and server type (whether the original server or the intrusion detection server) is added, and the message is input to the response comparison unit 142.

Next, the internal operation of the intrusion detection device 104 will be described in more detail with reference to FIGS. 4 and 5. In this figure, a case where a host (client) on the Internet communicates with a server by TCP connection is described.

When the intrusion detection device 104 is activated, the server communication transmission / reception unit 141 sends a connection permission port acquisition request to the server information management unit 143 (S101), and the client can be connected from the server information management unit 143. The list of ports is acquired (S102), and the client waits for a connection on those ports.

The client communicates with the server communication transmitting / receiving unit 14
1 connects to the port waiting for connection (S10
3), the server communication transmitter / receiver 141 allocates a unique communication identifier. Next, a transfer destination search request is issued to the server information management unit 143 using the connected port number and the connection port information composed of the transport layer protocol name (TCP, UDP) as parameters (S104).
The server information management unit 143 returns the transfer destination information as the response (S105). The transfer destination information includes the transfer destination server address, the same port, the transfer destination intrusion detection server address,
The port and service name are included.

The server communication transmitting / receiving unit 141 sends a communication identifier registration request to the response comparing unit using the communication identifier and the service name included in the transfer destination information as parameters (S).
106). The response comparison unit 142 stores the obtained service information in association with the communication identifier. Next, the server communication transmitting / receiving unit 141 performs communication using the communication identifier, the protocol name of the transport layer, the transfer destination server address included in the transfer destination information, the same port, the transfer destination intrusion detection server address, and the same port as parameters. A connection request is sent to the relay unit 145 (S107). Communication relay unit 145
Connects to the port described in the transfer destination information on the corresponding server and the intrusion detection server according to the input transfer destination information (S108, S109).

Next, in FIG. 5, when data (access request) is transmitted from the client to the server communication transmitting / receiving section 141 (S110), the server communication transmitting / receiving section 141 is sent.
Is the communication relay unit 14 using the received data as a parameter.
5, a data transmission request is sent to S5 (S111). As a result, the data is transferred from the communication relay unit to both the server and the intrusion detection server (S112, S113).

When the communication relay unit 145 receives the response from the server (S114), the communication relay unit 145 sends a server response reception notification to the response comparison unit using the communication identifier as a parameter (S115). Similarly, when the communication relay unit 145 receives a response from the intrusion detection server (S11
6), the communication relay unit 145 tells the response comparison unit 142 that
An intrusion detection server response reception notification is sent using the communication identifier as a parameter (S117).

When the response from the server and the response from the intrusion detection server are complete, the response comparison unit 142 compares the received responses (S118).

As a result of the comparison, if no significant difference is found in the responses from the server and the intrusion detection server, the response comparing unit 142 causes the server communication transmitting / receiving unit 141 to use the communication identifier and the response data from the server as parameters. A response reception notice is sent as (S119). The server communication transmission / reception unit 141 that has received the response reception notification transmits the response data from the server, which has been passed as a parameter, to the client (S120).

If a significant difference is found in the responses from the server and the intrusion detection server as a result of the comparison, the response comparing section 142 sends a countermeasure execution request to the server communication transmitting / receiving section using the communication identifier as a parameter. Yes (S12
1). The server communication transmission / reception unit 141 sends a countermeasure execution request based on the communication identifier, using information about the communication as a parameter (S122). After that, the countermeasure unit 144 executes appropriate countermeasures such as notifying the administrator that unauthorized access has been made (S123).

Next, the inside of the response comparison unit will be described with reference to FIG. The response comparison unit 142 includes a response comparison control unit 1421 and various comparison units 1422 to 1424. Each of the comparison units has a comparison method for a specific service, and can be added or deleted by the user.

When the response comparison control unit 1421 receives the communication registration request sent from the server communication transmitting / receiving unit 141,
The correspondence between the communication identifier included in the communication registration request and the service name is stored.

When the response comparison control unit 1421 receives the response reception notification from the server or the intrusion detection server from the communication relay unit 145, the response comparison control unit is associated with the communication identifier included in the response reception notification. The service name of the corresponding service is acquired, and the comparison unit having the response comparison function in the service is called.

The various comparison units compare the responses from the input server and the intrusion detection server, and compare whether the responses match. If the responses match, the response comparison control unit 1421 outputs a comparison result match notification. The notification includes the communication identifier and the data input from the server. When the responses do not match (when there is a difference of a certain level or more), the comparison result mismatch notification is output. The notification includes the communication identifier.

The response comparison control unit 1421 which has received the comparison result agreement notification from the various comparison units, the server communication transmission / reception unit 1
41, a communication identifier included in the comparison result match notification,
A response reception notification is sent using the data from the server as a parameter. When the comparison result mismatch notification is received, the response comparison control unit 1421 causes the server communication transmitting / receiving unit 141 to
A countermeasure request is sent using the communication identifier in the comparison result mismatch notification as a parameter.

Finally, the operation of the server information management unit 143 will be described with reference to FIG. FIG. 7 shows a server information table managed in the server information management unit 143. The table includes a connection port 601, a transport layer protocol 602, a service name 603, a server IP address 604, a server port 605, an intrusion detection server IP address 606, and an intrusion detection server port 607.

Upon receiving the connection permission port acquisition request from the server communication transmission / reception unit 141, the server information management unit 143 outputs the list constituted by the columns of 601 and 602 of the internal table as the connection permission port.

The server information management unit 143 receives a transfer destination search request from the server communication transmission / reception unit 141 using the port number and the protocol name of the transport layer as parameters.
Searches for an entry in the corresponding table using them as keys. Service name 6 from the entry found
03, the server address 604, the port 605, the intrusion detection server address 606, and the port 607 are acquired and returned as transfer destination information.

As described above, unlike the conventional intrusion detection technique, the configuration shown in the present embodiment has an effect of being able to detect an intrusion even for an unknown attack.

Embodiment 2. FIG. 8 is a diagram showing a network configuration including the intrusion detection device according to the second embodiment. The intrusion detection device 104 is connected to the LAN 102,
The LAN 10 to which the intrusion detection server 107 is connected
3 is also connected. The LAN 102 is a type of LAN in which communication between a client on the Internet 101 and a server 106 can be monitored by an intrusion detection device.

FIG. 9 shows the internal structure of the intrusion detection device 104. The intrusion detection device 104 includes a network monitor unit 146, a communication relay unit 145, a response comparison unit 142,
It is composed of a countermeasure section 144 and a server information management section 143. The internal structure of the response comparison unit 142 is the same as that shown in FIG. The network monitor unit corresponds to the monitor unit.

10 and 11 are diagrams showing the operation of the intrusion detection device 104 in this embodiment.

FIG. 12 is a diagram showing the configuration of a server information management table managed by the server information management unit 143 in the intrusion detection device according to this embodiment.

Next, the operation will be described with reference to FIGS. The network monitor unit 146 is a LAN
Among the packets flowing on 102, the packets that are input / output to / from the target server are monitored.

The network monitor unit 146 sends a monitor target server request to the server information management unit 143 at the time of activation (S201), and a list of addresses, ports, and transport layer protocols of servers to monitor communication on the network. Is obtained (S202).

When the client on the Internet connects to the server to be monitored, it is detected by the network monitor unit 146 (S203). The network monitor unit 146 assigns a communication identifier and sends a transfer destination search request to the server information management unit 143 using the server address, port, and transport layer protocol as parameters (S204). The server information management unit 143 returns the transfer destination information to the network monitor unit (S205). The transfer destination information includes the address, port, and service name of the intrusion detection server 107.

Next, the network monitor unit 146 sends a communication registration request to the response comparison unit 142 (S206), as in the case of the first embodiment, and the communication relay unit 145
A connection request is sent (S207). However, in the present embodiment, unlike the case of the first embodiment, information regarding the server is not passed to the communication relay unit 145. After that, the communication relay unit 145 connects to the intrusion detection server 107 (S
208).

Next, in FIG. 11, when the network monitor unit 146 detects data transmission (access request) from the client (S209), the data transmission request is sent to the communication relay unit 145 as in the case of the first embodiment. (S
210). Here, the data transmission request sent to the communication relay unit 145 includes the monitored data (access request). After transmitting the data to the intrusion detection server (S211), the communication relay unit 145 receives the response from the intrusion detection server (S212), and then sends the intrusion detection server response reception notification to the response comparison unit 142 ( S213). This operation is also similar to that of the first embodiment.

The network monitor unit 146 uses the server 1
When a response from 06 to the client is detected (S21
4), a server response reception notification is sent to the response comparison unit 142 (S215). Here, the server response reception notification sent to the response comparison unit 142 includes the response from the server monitored by the network monitoring unit 146. The parameters are the same as in the first embodiment.

The response comparison unit 142, which receives the response from the server and the response from the intrusion detection server, compares the responses as in the case of the first embodiment (S216). If the comparison results match, the network monitor unit 146 is notified of the comparison match using the communication identifier as a parameter (S217).

If the comparisons do not match (if there is a difference of a certain level or more), a countermeasure execution request is sent to the network monitor unit 146 (S218). The parameters are the same as those in the first embodiment.

The network monitor unit 146 that has received the countermeasure execution request receives the countermeasure unit 14 as in the case of the first embodiment.
A measure execution request is sent to the server 4 (S219). Upon receiving the countermeasure execution request, the countermeasure unit 144 performs the countermeasure process against the intrusion similarly to the case of the first embodiment (S220).

Finally, the operation of the server information management unit 143 of this embodiment will be described with reference to FIG. FIG. 12 shows a server information management table managed in the server information management unit 143. This table shows the server IP address 1201, port 1202,
It is composed of an intrusion detection server 1203, a port 1204, a transport layer protocol 1205, and a service name 1206.

The server information management unit 143, which has received the monitoring target server request from the network monitoring unit 146,
A list of the server IP address 1201, port 1202 and transport layer protocol 1205 is returned to the network monitor unit 146.

The server information management unit 143, which has received the transfer destination search request from the network monitor unit 146 with the server IP address, port, and transport layer protocol as parameters, uses the intrusion detection server IP address 12
03, port 1204, service name 1206 are returned to the network monitor unit 146.

As described above, the intrusion detection device according to the present embodiment has the effect that it is not necessary to change the connection of the existing server to the LAN in addition to the effect described in the first embodiment.

Although the unauthorized access detection device according to the present invention has been described in the above first and second embodiments, the unauthorized access detection device according to the present invention is performed by the same processing procedure as in the first and second embodiments. A detection method can also be realized.

Here, the features of the intrusion detection device according to the first and second embodiments will be summarized.

The intrusion detection devices according to the first and second embodiments are (1) equivalent to the server (plurality of servers) to be monitored,
There may be multiple intrusion detection servers realized by different programs (2) By transferring the input from the client to the intrusion detection server and comparing the server response with the intrusion detection server response It is characterized by detecting the presence or absence of intrusion.

The intrusion detection device according to the first embodiment is characterized by being installed between an external LAN and a server and operating as a proxy for the server.

The intrusion detection device according to the second embodiment is characterized by having a network monitor function and monitoring the communication between the monitored server and the client.

The intrusion detection devices according to the first and second embodiments are characterized by changing the response comparison method for each service provided by the server.

The intrusion detection devices according to the first and second embodiments are characterized in that the comparison function for each service can be added or deleted.

The intrusion detection device according to the first embodiment has a connection port, a transport layer protocol, a service name,
It is characterized by having a server information management table having server IP address, port, intrusion detection server IP address, and port as items.

The intrusion detection device according to the first embodiment is characterized by having a server information management table having server IP address, port, intrusion detection IP address, port, transport layer protocol, and service name as items. To do.

[0083]

As described above, according to the present invention, when an access request addressed to a specific monitoring target server is transmitted from any of the client devices, the specific monitoring target server and the specific monitoring target server are sent to the specific monitoring target server. Receives a response to the access request from the corresponding corresponding server, compares the received responses, and determines whether the access request is intended for unauthorized access to the specific monitored server based on the comparison result. Therefore, there is an effect that even an unknown unauthorized access can be detected.

Further, according to the present invention, when an access request addressed to a specific monitoring target server is transmitted from any of the client devices, the access request is monitored and a response to the access request from the specific monitoring target server is sent. It is possible to detect unknown unauthorized access without changing the existing network configuration by monitoring the response and comparing the monitored response with the response received from a specific corresponding server to determine the presence or absence of unauthorized access. There is an effect.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of a network including an intrusion detection device according to a first embodiment.

FIG. 2 is a diagram showing an operation outline according to the first embodiment.

FIG. 3 is a diagram showing an example of an internal configuration of an intrusion detection device according to the first embodiment.

FIG. 4 is a diagram showing an operation procedure of the intrusion detection device according to the first embodiment.

FIG. 5 is a diagram showing an operation procedure of the intrusion detection device according to the first embodiment.

FIG. 6 is a diagram showing an example of an internal configuration of a response comparison unit.

FIG. 7 is a diagram showing an example of a server information management table.

FIG. 8 is a diagram showing a configuration example of a network including an intrusion detection device according to the second embodiment.

FIG. 9 is a diagram showing an example of an internal configuration of an intrusion detection device according to the second embodiment.

FIG. 10 is a diagram showing an operation procedure of the intrusion detection device according to the second embodiment.

FIG. 11 is a diagram showing an operation procedure of the intrusion detection device according to the second embodiment.

FIG. 12 is a diagram showing an example of a server information management table.

FIG. 13 is a diagram showing a configuration example of a network including a conventional intrusion detection device.

FIG. 14 is a diagram showing an example of the internal configuration of a conventional intrusion detection device.

[Explanation of symbols]

101 Internet, 102 LAN, 103 L
AN, 104 Intrusion detection device, 105 LAN, 106
Server, 107 intrusion detection server, 141 server communication transmission / reception unit, 142 response comparison unit, 143 server information management unit, 144 countermeasure unit, 145 communication relay unit, 146
Network monitor section.

Claims (10)

[Claims] 1. Connected to at least one or more monitored servers to be monitored and at least one or more corresponding servers associated with each of the monitored servers,
An unauthorized access detection device for detecting unauthorized access to the monitored server by any of the client devices, wherein the access request is sent when an access request addressed to a specific monitored server is sent from any of the client devices. And sending the access request to a specific corresponding server corresponding to the specific monitored server, and receiving a response to the access request from the specific corresponding server as a corresponding server response, the specific monitoring Acquiring a response to the access request sent from the target server as a monitored server response, comparing the monitored server response with the corresponding server response, and based on the comparison result, the access request is the specific monitored server. Characterized by determining whether the purpose is unauthorized access to Unauthorized access detection device. 2. The unauthorized access detection device has the same function as the program of the corresponding monitored server,
The unauthorized access detection device according to claim 1, wherein the unauthorized access detection device is connected to a corresponding server that uses a program having a different program configuration. 3. The unauthorized access detection device, when comparing the monitored server response and the corresponding server response, when there is a difference of a certain level or more between the monitored server response and the corresponding server response. The unauthorized access detection device according to claim 1 or 2, wherein the access request is determined to be for an unauthorized access to the specific monitoring target server. 4. The unauthorized access detection device includes an access request receiving unit that receives the access request when an access request addressed to the specific monitored server is transmitted from any one of the client devices, and the access request. Is transmitted to the specific monitored server and the specific corresponding server, and a response to the access request is received as a monitored server response from the specific monitored server, and a response to the access request is received from the specific corresponding server. And a corresponding server response are compared with a communication relay unit that receives as a corresponding server response, and the access request aims at unauthorized access to the specific monitored server based on the comparison result. It has a response comparison part which judges whether or not it is characterized by the above-mentioned. Unauthorized access detection device. 5. The unauthorized access detection device monitors the data transmission / reception status for each monitoring target server, and when an access request addressed to the specific monitoring target server is transmitted from any of the client devices,
A monitor unit that monitors the access request and also monitors a response to the access request by the specific monitoring target server as a monitoring target server response, and transmits the access request monitored by the monitoring unit to the specific corresponding server. In addition, a communication relay unit that receives a response to the access request from the specific corresponding server as a corresponding server response, compares the monitored server response and the corresponding server response, and based on the comparison result, the access request. 4. The unauthorized access detection device according to claim 1, further comprising: a response comparison unit that determines whether or not the unauthorized access to the specific monitoring target server is intended. 6. Connected to at least one or more monitored servers to be monitored and at least one or more corresponding servers associated with each of the monitored servers,
An unauthorized access detection method for detecting unauthorized access to the monitored server by any of the client devices, wherein the access request is sent when an access request addressed to a specific monitored server is sent from any of the client devices. And sending the access request to a specific corresponding server corresponding to the specific monitored server, and receiving a response to the access request from the specific corresponding server as a corresponding server response, the specific monitoring Acquiring a response to the access request sent from the target server as a monitored server response, comparing the monitored server response with the corresponding server response, and based on the comparison result, the access request is the specific monitored server. Characterized by determining whether the purpose is unauthorized access to Unauthorized access detection method. 7. The unauthorized access detection method has the same function as the program of the corresponding monitored server,
The unauthorized access detection method according to claim 6, wherein the unauthorized access detection method is connected to a corresponding server that uses a program having a different program configuration. 8. The method for detecting unauthorized access according to claim 4, wherein in the comparison between the monitored server response and the corresponding server response, there is a certain level or more difference between the monitored server response and the corresponding server response. The unauthorized access detection method according to claim 6 or 7, wherein the access request is determined to be an unauthorized access to the specific monitored server. 9. The unauthorized access detection method comprises: an access request receiving step of receiving the access request when an access request addressed to the specific monitored server is transmitted from any of the client devices; Is transmitted to the specific monitored server and the specific corresponding server, and a response to the access request is received as a monitored server response from the specific monitored server, and a response to the access request is received from the specific corresponding server. And a corresponding server response are compared with the communication relay step of receiving as a corresponding server response, and the access request aims at unauthorized access to the specific monitored server based on a comparison result. And a response comparison step for determining whether or not Unauthorized access detection method according to claim 6-8. 10. The unauthorized access detection method monitors the data transmission / reception status for each monitored server, and when an access request addressed to the specific monitored server is transmitted from any of the client devices,
A monitoring step of monitoring the access request and monitoring a response to the access request by the specific monitoring target server as a monitoring target server response; and transmitting the access request monitored by the monitoring step to the specific corresponding server. In addition, a communication relay step of receiving a response to the access request from the specific corresponding server as a corresponding server response, comparing the monitored server response and the corresponding server response, and based on the comparison result, the access request 9. The unauthorized access detection method according to claim 6, further comprising: a response comparison step of determining whether or not the unauthorized access to the specific monitoring target server is intended.