JP2003289337A - Communication network, router, and distributed service refusal attack detection and defense method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To limit or stop the network inflow of a malicious call by detecting a high-level attack from a malicious user such as a distributed service refusal attack. <P>SOLUTION: A plurality of border routers on a communication network monitor TCP-SYN packets, the number of TCP-SYN packets is counted and totalized for each destination and the totalized result is mutually exchanged among the plurality of border routers. Therefore, the TCP-SYN packets flowing into the relevant communication network via the border routers are monitored and the abnormal number of TCP-SYN packet flowing into the same destination are judged as TCP-SYN packets for the purpose of the distributed service refusal attack to suppress the inflow thereof. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention belongs to the field of Internet security improving technology for dealing with a DOS attack (Denial of Services attack) in an IP communication network.

[0002]

2. Description of the Related Art Distributed denial of service (DDOSA: D
(Istributed Denial of Services Attack) will be described with reference to FIGS. 7 to 9. FIG. 7 is a conceptual diagram of a conventional communication network. FIG. 8 is a diagram for explaining the 3-way handshake. FIG. 9 is a diagram showing the format of a TCP / IP packet. Reference numerals 1 to 4 denote external communication networks. The external communication network 1 includes routers 10 to 12, the external communication network 2 includes routers 20 to 22, and the external communication network 3 includes routers 30 to 3.
2 and routers 40 to 42 belong to the external communication network 4, respectively.

Border routers 44 to 49 are connected by a communication network 5. A malicious user who launches a distributed denial of service attack may have multiple distributed site terminals 13
And 23 from the routers 10 in the external communication network 1 and the router 20 in the external communication network 2 to the target server 57 in the communication network 5 to simultaneously perform a TCP-SYN (connection establishment request) packet attack.

Each of these TCP-SYN packets attempts to establish a TCP session by the 3-way handshake shown in FIG. 8, and the site terminal 13 side or 23 side of the malicious user abandons the session during the 3-way handshake session. That is, in FIG. 8, the malicious user's site terminal 13 or 23 does not issue a TCP-ACK packet even if it receives a TCP-ACK (acknowledgement) + SYN packet. As a result, the target server 57 continues to wait for this TCP-ACK packet.
If a large number of N-packet attacks are received, the target server 57 will be overloaded and the server function will stop.

TCP at the time of establishing a TCP session
The outline of the function of the SYN packet and the format of the TCP / IP packet will be described below. Figure 9 shows TCP /
It is a format explanatory drawing of an IP packet. TCP / I
P packet is TC which is a basic communication procedure of IP communication network.
These are P and IP packets, the detailed structure of which is shown as an IP header (IP header) and a TCP header (TCP header) in FIG.
Is shown in. The IP header is composed of 20 Bytes including the destination server or router address (Destination Address: abbreviated as DA hereinafter) and the source address (Source Address: abbreviated as SA hereinafter), and the TCP header is SYN (connection establishment request (SYN)). = 1)) and ACK (acknowledgement (ACK = 1)) and other 20 control flags
e (no option).

Communication establishment by the three-way handshake shown in FIG. 8 will be described in detail. To establish a connection by TCP / IP, first, when the site terminal 13 sends a TCP-SYN packet (a packet in which SYN = 1 in FIG. 9) to the destination target server 57 (FIG. 8), the target server 57 sends TCP-SYN packet. ACK + SYN packet (A in FIG. 9)
(CK = 1, SYN = 1 packet) is sent back (in FIG. 8), and if the terminal is a normal terminal, TCP-A
A CK packet (a packet with ACK = 1 in FIG. 9) is sent back (in FIG. 3), the "3-way handshake" is established at this stage, and the communication between the site terminal 13 and the target server 57 starts. When the malicious user's site terminal 13 makes a TCP-SYN packet attack, the TCP-ACK packet is not sent back and the target server 57 continues to wait for this packet. If the target server 57 is frequently received, the target server 57 will be overloaded and the server function will stop.

[0007]

As described above, the distributed denial of service attack is caused by a malicious user attempting to establish an infinite number of TCP sessions to a specific Web server by using a plurality of distributed site terminals as a stepping stone. This is a load attack, and since the TCP session transmission sources are distributed, it is difficult to identify the site terminal of a malicious user, and it is also difficult to take countermeasures against a rejection attack.

The present invention has been made against such a background, and detects a sophisticated attack from a malicious user such as a distributed denial of service attack to limit or stop the inflow of malicious calls to the network. It is an object of the present invention to provide a communication network, a router, a program, a recording medium, and a distributed denial-of-service attack detection / defense method that can avoid the target server from being overloaded by taking an appropriate action such as performing.

[0009]

According to the present invention, a plurality of border routers in a communication network monitor TCP-SYN packets, count and total the TCP-SYN packets for each destination, and collect the results of the counting. By exchanging with each other, TCP-SYN packets flowing into the communication network via these border routers are monitored, and an abnormal number of TCP-SYN packets flowing into the same destination is monitored. It is characterized in that it is judged that the packet is a TCP-SYN packet intended for a distributed denial of service attack, and this inflow is suppressed.

That is, a first aspect of the present invention is a communication network including a plurality of border routers respectively connected to a plurality of external communication networks, and the features of the present invention are as follows.
The border router includes means for monitoring a TCP-SYN packet including a connection establishment request flowing into its own communication network, and this monitoring means counts the number of TCP-SYN packets having the same destination address, Means for notifying the other border router of the counting result of the counting means, means for receiving the counting result of the counting means from the other border router, and counting result in the other border router received by the receiving means and the counting Means for totaling the counting results based on the counting results of the own border router by the means, the means for totalizing the means for detecting the increase rate of the counting results within a predetermined time, and the detection result of the means for detecting. And a means for issuing an alarm including the information of the same destination address when the threshold value is exceeded.

Further, the counting means includes means for specifying a source address of a TCP-SYN packet having the same totalized destination address, and the means for issuing the alarm is the detection result of the detecting means. When the threshold value is exceeded, it is possible to provide a means for writing the information of the source address specified by the specifying means in the alarm.

On the basis of the alarm issued by the means for issuing the alarm, there is provided means for suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network. Is desirable.

As a result, if the site terminal of the malicious user who is performing the distributed denial of service attack can be identified, the TCP-SYN packet inflow control by the destination address and the inflow control by the source address can be performed. A more reliable inflow suppression effect can be expected as compared with inflow suppression.

For example, TCP-SY based on the destination address
The suppression of the inflow of N packets may also suppress the inflow of TCP-SYN packets from general terminals other than the malicious user's site terminal, but if the suppression of the inflow by the source address is malicious, it may be malicious. It is possible to distinguish between those caused by the user's site terminal and those not. Further, it is possible to send a warning to the user of this site terminal not to perform such an action thereafter.

It is desirable that the notifying means and the receiving means include means for transmitting / receiving the counting result by using I-BGP (Internet-Border Gateway Protocol). That is, TCP-IP is communication relating to the third and fourth layers, which is the basis of Internet communication, whereas I-BGP is a dynamic route protocol, which is a boundary gateway protocol used in AS (independent system). Is a communication function. As a result, since independent and reliable and prompt communication different from normal data communication can be performed, a distributed denial of service attack can be surely and promptly detected and prevented.

A second aspect of the present invention is a router, which is characterized by the fact that a TCP-connection including a connection establishment request that is connected to an external communication network and flows into the own communication network.
A means for monitoring the SYN packet is provided, and this monitoring means comprises means for counting the number of TCP-SYN packets having the same destination address, means for notifying another border router of the counting result of this counting means, and others. Means for receiving the counting result of the counting means from the border router,
And a means for totaling the counting results based on the counting results of the other border routers received by the receiving means and the counting results of the own border router by the counting means, the counting means being within a predetermined time of the counting results. It is provided with means for detecting the increase rate and means for issuing an alarm including the information of the same destination address when the detection result of the detecting means exceeds a threshold value.

The means for totaling comprises means for specifying the source address of the TCP-SYN packets having the totaled same destination address, and the means for issuing the alarm is such that the detection result of the means for detecting has a threshold value. When exceeding the threshold, a means for writing the information of the source address specified by the specifying means in the alarm may be provided.

Based on the alarm issued from the alarm issuing means, means for suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network is provided. Is desirable.

The notifying means and the receiving means preferably include means for transmitting and receiving the counting result using I-BGP.

A third aspect of the present invention is a program, which is characterized by being installed in an information processing device so that the information processing device controls a router connected to an external communication network. As a function corresponding to the device, a function of monitoring a TCP-SYN packet including a connection establishment request flowing into the own communication network is realized,
As a function of this monitoring, T having the same destination address
By the function of counting the number of CP-SYN packets, the function of notifying other border routers of the counting result of this counting function, the function of receiving the counting result of the counting function from other border routers, and the function of receiving this The function of totaling the count results based on the count results of the other border routers received and the count result of the own border router by the counting function is implemented, and as the function of this count,
A function of detecting an increase rate of the counting result within a predetermined time,
The function of issuing an alarm including the information of the same destination address when the detection result of the detecting function exceeds the threshold value is realized.

As a function of totaling, a function of specifying a source address of a TCP-SYN packet having the same totalized destination address is realized, and as a function of issuing the alarm, a detection result of the detecting function is a threshold value. When the value exceeds the limit, the function of writing the information of the source address specified by the specifying function in the alarm can be realized.

Based on the alarm issued by the function for issuing the alarm, a function for suppressing the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network is realized. Is desirable.

As the notification function and the reception function, it is desirable to realize a function of transmitting and receiving the counting result by using I-BGP.

A fourth aspect of the present invention is a recording medium readable by the information processing device, in which the program of the present invention is recorded. By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be installed in the information processing apparatus directly from a server holding the program of the present invention via a network.

With this, by using an information processing device such as a computer device, a sophisticated attack from a malicious user such as a distributed denial of service attack is detected, and the inflow of malicious calls to the network is restricted or stopped. By taking appropriate action, it is possible to realize a communication network equipped with a router that can avoid the target server from being overloaded.

A fifth aspect of the present invention is a distributed denial of service attack detection and protection method applied to a communication network having a plurality of border routers connected to a plurality of external communication networks, respectively. The feature is that the border router monitors TCP-SYN packets including a connection establishment request flowing into its own communication network, counts the number of TCP-SYN packets having the same destination address, and outputs the count result to another. Notifies the border router and receives counting results from other border routers, totals the counting results based on the received counting results of the other border routers and the counting results of its own border router, and the increase rate of this counting result within the specified time Is detected, and when this detection result exceeds the threshold value, an alarm including the information of the same destination address is issued. .

TC having the same total destination address
When the source address of the P-SYN packet is specified and an alarm is issued, information on the specified source address can be written in the alarm.

It is desirable to suppress the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network based on the alarm issued.

I-BGP is used between the border routers.
It is desirable to transmit and receive the counting result by using.

[0030]

DETAILED DESCRIPTION OF THE INVENTION A communication network according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a conceptual diagram of the communication network of this embodiment. FIG. 2 is a functional block diagram of the border router of this embodiment. 3 and 4 are diagrams showing an abnormal packet detection procedure of this embodiment. FIG. 5 is a flowchart showing the operation of the border router of this embodiment. FIG. 6 is a conceptual diagram of a communication network having more attack points than FIG. 1 of the present embodiment.

The present embodiment is a communication network 5 having a plurality of border routers 51 to 56 connected to a plurality of external communication networks 1 to 4, respectively, as shown in FIG. However, as shown in FIG. 2, the border routers 51 to 56 each include a distributed denial of service attack detection protection unit 515 that monitors a TCP-SYN packet including a connection establishment request flowing into the own communication network 5. The distributed denial of service attack detection / defense unit 515 counts the number of TCP-SYN packets having the same destination address.
CP-SYN packet counting function 511 and this inflow TC
The I-BGP communication function 513 which notifies the counting result of the P-SYN packet counting function 511 to the other border router and receives the counting result by the inflow TCP-SYN packet counting function 511 from the other border router, and this I
An inflow packet abnormality determination function 512 that aggregates the counting results based on the counting result of the other border router received by the BGP communication function 513 and the counting result of the own border router by the inflow TCP-SYN packet counting function 511.
The inflow packet abnormality determination function 512 detects an increase rate of the counting result within a predetermined time, and issues an alarm including the information of the same destination address when the detection result exceeds a threshold value. .

When the malicious user's site terminal does not substitute for another terminal, the inflow packet abnormality determination function 512 determines the source address of the TCP-SYN packet having the same total destination address. The alarm can be specified, and the information of the specified source address can be written in the alarm.

Based on the alarm issued from the inflow packet abnormality determination function 512, the router basic function 510 checks the inflow of the TCP-SYN packet having the same destination address or the source address included in the alarm to the communication network. Suppress.

Further, the I-BGP communication function 513 uses the I-BGP communication function 513.
The counting result is transmitted and received using BGP.

The present embodiment will be described in more detail below.

In the communication network 5 of this embodiment, as shown in FIG. 1, the TCs in which the border routers 51 to 56 flow into the communication network 5.
Monitors P-SYN packet and TCP-SY for each destination
N packets are counted and totaled, and all border routers 51 to
56 mutually exchanges information as a result of the above-mentioned aggregation of TCP-SYN packets using I-BGP, and the border routers 51 and 52, which are found to be an abnormal inflow of malicious TCP-SYN packets, are the senders. To the target server 57 from the site terminals 13 and 23 of
The target server 57 is released from the overloaded state by suppressing the inflow of CP-SYN packets or discarding all of them.

As shown in FIG. 2, a basic router function 510 is provided.
Is a network layer (3rd layer) including a relay function for delivering IP packets to a destination host.
Layer) Includes multi-protocol function corresponding to the protocol. Further, in the present embodiment, based on the alarm issued from the inflow packet abnormality determination function 512, TCP-SYN
It also has the function of discarding packets.

Incoming TCP-SYN packet counting function 51
1 counts the number of packets corresponding to the source IP address, destination IP address, information amount, and time of the TCP-SYN packet. In addition, the incoming packet abnormality determination function 512
Compares the counting results of the inflow TCP-SYN packet counting function 511 in time series to determine whether the aggregated data per unit time is normal or abnormal. For example, unit time Δ
If the increase rate per t becomes 100 times, it is determined to be abnormal.

The TCP-IP communication function 514 is a communication function relating to the third and fourth layers which are the basics of Internet communication. Further, the I-BGP communication function 513 is a dynamic route protocol and is a communication function according to a boundary gateway protocol used in AS (independent system).

Each of the border routers 51 to 56 monitors all TCP-SYN packets flowing into the communication network 5,
As a result of the monitoring, for example, the border router 51 determines that the number of TCP-SYN packets from the malicious user's site terminal 13 to the target server 57 is 100 times as much as the increase rate per unit time Δt and is abnormally large. In this case, for example, 99% of the packets are discarded, and when the border router 52 determines that the number of TCP-SYN packets from the malicious user's site terminal 23 to the target server 57 is abnormally large. , Discard, for example, 99% of the packet. In this way, it is possible to prevent the target server 57 from being overloaded.

The TCP-SYN packet is monitored by the border router 51 by the inflowing TCP-SYN packet counting function 511 and the I-BGP communication function 513.
The data amount obtained from the other border routers 52 to 56 by using the I-BGP dynamic route protocol is included in the inbound packet abnormality determination function 512.
To determine the abnormality.

3 and 4 show the abnormal packet detection procedure. In the example of FIG. 3, first, inflow TCP-SYN
The packet counting function 511 allows S in TCP flag.
A TCP-SYN packet with YN = 1 is extracted, DA (destination IP address) of the packet header is extracted and added to an entry, and each entry that matches the entry is counted up. Subsequently, the inflow packet abnormality determination function 51
By 2, the specific DA on which SYN packets are concentrated is found. In the example of FIG. 4, the list of the packets of DA = 218.60.32.1 in which TCP-SYN packets are concentrated is shown, and the SA (source IP Sort by each address) and specify the sender. In this way, the target server is DA = 218.60.32.1, and the SA of the malicious user's site terminal is found.

If the DDOS is sophisticated, it may be difficult to sort each SA. For example, when the malicious user's site terminal 13 steals the IP addresses of the terminals in the other external communication networks 2 to 3 and attacks the terminal instead, the sorting for each SA is meaningless.

FIG. 5 is a flow chart showing the operation of the border router of this embodiment.

Step 1: Incoming TCP-SYN packets in each border router 51 to 56
The SYN packet counting function 511 monitors and creates a DA list and counts it (FIG. 3). The monitor counting time is set from time (T0 + nΔt) to time (T0 + (n + 1) Δt) (n = 0, 1, 2, 3, ...) Step 2: The inflow TCP-SYN packet counting function 511 of each border router is concentrated. S on the list of DAs
Sorting and counting for each A (FIG. 4) Step 3: Unit time Δt from time (T0 + nΔt)
As the counting information of the I-BGP, the DA and SA information of the top 5 and the top 5 increasing rate of the output list of step 2 are used.
Step 4: Notify other border routers by the communication function 513: Inflow TCP-SYN packet counting function 511 for each border router determines the Δt at time (T0 + nΔt) from the output information of step 2 and the output information of step 3. TCP-SY flowed in from all border routers in a unit time
For N packets, the number of packets is counted in correspondence with the IP address of SA, the IP address of DA, the amount of information, and the time, and the inflow packet abnormality determination function 512 determines the unit time Δt.
Step 5: The inflow packet abnormality determination function 512 aggregates the number of increased packets per rank to improve the rank.
It is determined whether there is SA or DA whose rate of increase per unit time is 100 times, for example. If yes, step 6
To "No", go to Step 4 Step 6: Increase rate per unit time becomes 100 times S
The router basic function 510 of the border router into which the TCP-SYN packet having A or DA flows in is suppressed or the entire packet is discarded. Thus, it is possible to prevent the target server 57 from being overloaded by a malicious call. Becomes

Further, as shown in FIG. 6, the site terminals of the malicious user are the site terminals 33 and 43 in addition to the site terminals 13 and 23, and the target server 57 from many points.
In the case of attacking, the border routers 51 to 56 determine that it is the border routers 51, 52, 54, 55 that a large number of malicious TCP-SYN packets whose destination IP address is the target server 57 are detected. Made in
For example, 99% of the malicious TCP-SYN packet whose destination IP address is the target server 57 is discarded by each border router 51, 52, 54, 55, and the target server 57 is prevented from being overloaded.

The device for controlling the border routers 51 to 56 of this embodiment can be realized by using a computer device which is an information processing device. That is, when the computer is installed, the border routers 51 to 51 connected to the external communication networks 1 to 4 are connected to the computer.
As a function corresponding to the device that controls 56, the distributed denial of service attack detection protection unit 5 that monitors the TCP-SYN packet including the connection establishment request flowing into the own communication network.
15 as a function corresponding to the distributed denial of service attack detection protection unit 515, and an inflowing TCP-SYN packet counting function 511 for counting the number of TCP-SYN packets having the same destination address.
The count result of the inflow TCP-SYN packet counting function 511 is notified to the other border routers, and the inflow TCP-SYN packet counting function 511 from the other border routers is sent.
I-BGP communication function 513 which receives the counting result of the I-BGP communication function, and the counting result in the other border router received by this I-BGP communication function 513 and the counting result of the own border router by the inflow TCP-SYN packet counting function 511. Inflow packet abnormality determination function 5
12 and the inflow packet abnormality determination function 51
2, the function of detecting the increase rate of the counting result within a predetermined time, the function of issuing an alarm including the information of the same destination address when the detection result of the detecting function exceeds a threshold, and the totalized same TC with destination address
The information of the source address specified by the specifying function when the detection result of the detecting function exceeds a threshold as a function of realizing the function of specifying the source address of the P-SYN packet and issuing the alarm. The communication network of TCP-SYN packets having the same destination address or the source address included in the alarm based on the alarm issued from the function of issuing the alarm. The function of suppressing the inflow to the I-BGP communication function 51
3 is a device corresponding to the device for controlling the border routers 51 to 56 of the present embodiment by installing a program for realizing the function of transmitting and receiving the counting result using I-BGP in the computer device. Can be

By recording the program of this embodiment on the recording medium of this embodiment, the computer device can install the program of this embodiment using this recording medium. Alternatively, the program of this embodiment can be directly installed in a computer device from a server holding the program of this embodiment via a network.

Thus, using the computer device,
Detects advanced attacks from malicious users such as distributed denial of service attacks and avoids overloading the target server by taking appropriate actions such as limiting or stopping the inflow of malicious calls to the network. It is possible to realize the communication network 5 including the border routers 51 to 56 capable of performing the communication.

Example Summary EC (Electric Commerc)
As e) evolves, the protection of websites will become more and more important in terms of security. According to the present embodiment, the target server can detect a sophisticated attack from a malicious user such as a distributed denial-of-service attack and take appropriate actions such as limiting or stopping the inflow of a malicious call to the communication network. You can avoid being overloaded.

[0051]

As described above, according to the present invention,
Detects advanced attacks from malicious users such as distributed denial of service attacks and avoids overloading the target server by taking appropriate actions such as limiting or stopping the inflow of malicious calls to the network. be able to.

[Brief description of drawings]

FIG. 1 is a conceptual diagram of a communication network of this embodiment.

FIG. 2 is a functional configuration diagram of a border router of the present embodiment.

FIG. 3 is a diagram showing an abnormal packet detection procedure of the present embodiment.

FIG. 4 is a diagram showing an abnormal packet detection procedure of the present embodiment.

FIG. 5 is a flowchart showing the operation of the border router of this embodiment.

6 is a conceptual diagram of a communication network having more attack points than FIG. 1 of the present embodiment.

FIG. 7 is a conceptual diagram of a conventional communication network.

FIG. 8 is a diagram for explaining a 3-way handshake.

FIG. 9 is a diagram showing a format of a TCP / IP packet.

[Explanation of symbols]

1-4 External communication network 5 Communication network 10-12, 20-22, 30-32, 40-42 Routers 13, 23, 33, 43 Site terminals 44-49, 51-56 Border router 57 Target server 510 Router basic functions 511 Incoming TCP-SYN packet counting function 512 Incoming packet abnormality determination function 513 I-BGP communication function 514 TCP-IP communication function 515 Distributed denial of service attack detection protection unit

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Naoaki Yamanaka             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Masanori Uga             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation F term (reference) 5K030 GA15 HA08 HB08 HC01 HD03                       HD06 LC13 MB09

Claims (17)

[Claims] 1. A communication network comprising a plurality of border routers respectively connected to a plurality of external communication networks, wherein the border router monitors a TCP-SYN packet including a connection establishment request flowing into its own communication network. This monitoring means comprises means for counting the number of TCP-SYN packets having the same destination address, means for notifying another border router of the counting result of this counting means, and the counting from the other border router. And counting means based on the counting result of the other border routers received by the receiving means and the counting result of the own border router by the counting means. Means for detecting an increase rate of the counting result within a predetermined time, and a detection result of the detecting means. And a means for issuing an alarm including the information of the same destination address when the result exceeds a threshold value. 2. The means for totaling comprises means for specifying a source address of a TCP-SYN packet having the totaled same destination address, and the means for issuing the alarm is configured to detect the detection result of the means for detecting. The communication network according to claim 1, further comprising means for writing information of the source address specified by the specifying means in the alarm when the threshold value is exceeded. 3. A means for suppressing the inflow of a TCP-SYN packet having the same destination address or the source address included in the warning into the communication network based on the warning issued by the means for issuing the warning. The communication network according to claim 1, which is provided. 4. The means for notifying and the means for receiving are I-BGP (Internet-Border Gateway Protocol)
The communication network according to claim 1, further comprising means for transmitting and receiving the counting result by using. 5. A TCP including a connection establishment request that is connected to an external communication network and flows into its own communication network.
-Means for monitoring SYN packets, the monitoring means for counting the number of TCP-SYN packets having the same destination address, and means for notifying other border routers of the counting result of the counting means, Means for receiving the counting result of the counting means from another border router, and means for totaling the counting results based on the counting result in the other border router received by the receiving means and the counting result of the own border router by the counting means The totalizing means includes means for detecting an increase rate of the counting result within a predetermined time, and means for issuing an alarm including the information of the same destination address when the detection result of the detecting means exceeds a threshold value. A router characterized by having and. 6. The means for totaling comprises means for specifying a source address of a TCP-SYN packet having the totaled same destination address, and the means for issuing the alarm is configured to detect the detection result of the means for detecting. The router according to claim 5, further comprising means for writing information of the source address specified by the specifying means in the alarm when the threshold value is exceeded. 7. A means for suppressing the inflow of a TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network based on the alarm issued by the means for issuing the alarm. The router according to claim 5 or 6, further comprising: 8. The router according to claim 5, wherein the notifying means and the receiving means include means for transmitting and receiving the counting result by using I-BGP. 9. A TCP including a connection establishment request flowing into its own communication network as a function corresponding to a device controlling a router connected to an external communication network when installed in the information processing apparatus.
-Realize the function of monitoring SYN packets, and as the function of monitoring, the function of counting the number of TCP-SYN packets having the same destination address, and the function of notifying other border routers of the counting result of this counting function. , A function of receiving the counting result of the counting function from another border router, and a function of totaling the counting results based on the counting result in the other border router received by the receiving function and the counting result of the own border router by the counting function As a function of totalizing this, a function of detecting the increase rate of the counting result within a predetermined time, and an alarm including the information of the same destination address is issued when the detection result of the detecting function exceeds a threshold value. A program that realizes the function to perform. 10. The detection result of the detecting function is realized as a function of specifying the source address of a TCP-SYN packet having the same totalized destination address as the function of totaling, and the function of issuing the alarm. 10. The program according to claim 9, which realizes a function of writing information of a source address specified by the specifying function into the alarm when exceeds a threshold value. 11. A function of suppressing the inflow of a TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network based on the alarm issued from the function of issuing the alarm. The program according to claim 9, which is realized. 12. The program according to claim 9, wherein a function of transmitting and receiving the counting result by using I-BGP is realized as the notification function and the receiving function. 13. A recording medium readable by the information processing device, in which the program according to claim 9 is recorded. 14. A distributed denial of service (DDOSA) applied to a communication network including a plurality of border routers respectively connected to a plurality of external communication networks.
f Services Attack) In the detection and protection method, the border router monitors a TCP-SYN packet including a connection establishment request flowing into the own communication network,
The number of TCP-SYN packets having the same destination address is counted, the count result is notified to the other border router, the count result from the other border router is received, and the count result in the other border router and the received border router's Distributor characterized by totaling counting results based on the counting result, detecting an increase rate of the counting result within a predetermined time, and issuing an alarm including the information of the same destination address when the detection result exceeds a threshold value Denial of service attack detection and protection method. 15. The information of the specified transmission source address is written in the alarm when the transmission source address of the TCP-SYN packet having the totaled same destination address is specified and the warning is issued. 14. The distributed denial of service attack detection and protection method according to 14. 16. The distributed type according to claim 14 or 15, wherein based on an issued alarm, inflow of a TCP-SYN packet having the same destination address or the source address included in the alarm into the communication network is suppressed. Denial of service attack detection and protection method. 17. An IB is provided between the border routers.
The distributed denial of service attack detection and protection method according to claim 14, wherein the counting result is transmitted and received using GP.