JP2006164038A - Method for coping with dos attack or ddos attack, network device and analysis device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the following problem of a network system: an unanalyzable packet is generated without analyzing all the packets, so that an attack flow cannot be specified. <P>SOLUTION: The packet is sampled in an IP router 2, and is transferred to an analysis device 8. When the analysis device 8 detects that the packet of a prescribed value or above is transmitted to the same host within a prescribed time, the analysis device 8 decides that communication thereof is the attack flow to the host, and communicates information related to the flow to the IP router 2 from the analysis device 8. The IP router 2 receiving it extracts only the packet related to the flow, and transmits it to the analysis device 8. The analysis device 8 analyzes the sampled IP packet, accurately identifies a DoS attack or a DDoS attack, and instructs the IP router to disposes of the identified IP packet for a prescribed time, or to make band control to the IP packet. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network system capable of dealing with a Denial of Service attack (hereinafter abbreviated as a DoS attack) targeting a server on the Internet or a Distributed Denial of Service attack (hereinafter abbreviated as a DDoS attack).

  A DDoS attack on the Internet refers to an attack that prevents a service provided by a server on the network from functioning by causing the service to stop functioning. The execution means of this attack is a method of consuming and denying services by consuming network and server resources by transmitting a large amount of IP packets to the target server. In recent years, DDoS attacks that devour network lines have increased, and it is necessary to provide stable services for the Internet, which is already becoming a social infrastructure, so it is necessary to take positive measures in the carrier network as well. Is increasing.

As a method for preventing such a DDoS attack, for example, there are techniques disclosed in Patent Document 1, Patent Document 2, and the like.
JP 2002-335246 A JP 2003-283554 A

  However, in the above-mentioned network type system that detects and defends against in-line traffic in advance, sufficient processing performance for processing traffic expected in the future can be secured in accordance with the increase in network bandwidth. However, there is a problem that such a system is very expensive. In addition, the method of analyzing the packet mirrored by the mirror port of the switch or TAP with the analysis system and performing the defense in the network type can perform detailed traffic analysis processing, but all packets are always processed by port mirroring or network tap. When a large amount of attacks are received to transfer the traffic, all the traffic cannot be transferred, so there is a problem that the traffic analysis cannot be performed accurately. In addition, the packet sampling method that performs sampling with a specific probability, and the method of detecting the attack by analyzing the sample packet information using a statistical method with an analysis system is a sampling method. Although it is possible to monitor the entire traffic, it is difficult to accurately identify the DDoS attack flow by state monitoring that monitors bi-directional traffic because it is a sampling that treats all traffic equally. There was a problem that even normal user traffic was accidentally discarded.

  An object of the present invention is to provide a DoS attack or a method for dealing with a DDoS attack, a network device, and an analysis device, which solves a problem in which a packet that cannot be analyzed occurs without analyzing all packets and an attack flow cannot be identified. There is to do.

The method of dealing with the DoS attack or DDoS attack of the present invention is as follows.
A network device sampling traffic to all hosts connected to an access network accommodated in the network device, and forwarding the sampled IP packet to an analysis device;
The analysis device analyzes the sampled IP packet, detects a DoS attack or a DDoS attack, and detects a DoS attack or a network device connected to an access network that accommodates a host that has detected the DDoS attack. Instructing to select and sample only IP packets that match a particular bit pattern among packets addressed to the host;
The network device that has received the instruction from the analysis device selects and samples an IP packet that matches a specific bit pattern, and transfers the sampled IP packet to the analysis device;
The analysis device analyzes the sampled IP packet, accurately identifies a DoS attack or a DDoS attack, discards the identified IP packet for a predetermined time, or performs bandwidth control on the IP packet. Instructing the network device;
The network device that has received the instruction includes a step of discarding the subsequent IP packet for a certain period of time or performing bandwidth control on the packet.

  The network device (for example, IP router) samples the IP packet by the sampling unit for the traffic to all the hosts connected to the access network accommodated by itself, and analyzes the collected sample IP packet by the analysis device. Monitor network-wide traffic. And, by detecting that the data is continuously transmitted to the same host within a predetermined time, the DoS attack or the DDoS attack is detected, and only the detected noticeable traffic is collected. By instructing the network device, only the detected noticeable traffic is collected, the DDoS attack packet flow is accurately determined, and the normal user traffic communicating with the host under attack is erroneously discarded. DDoS attack traffic is protected only by DDoS attack traffic, by traffic band limitation (policing, shaving, etc.) or by filtering.

  According to the present invention, it is possible to solve a problem in which a packet that cannot be analyzed and an attack flow cannot be identified without analyzing all the packets.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of a network system capable of dealing with a DoS attack targeting a server on the Internet or a DDoS attack according to an embodiment of the present invention.

  The network system according to the present embodiment includes a carrier network 1, IP routers 2, 3, and 4, a server 5 that is a DDoS attack target, a user terminal 6 that communicates with the server 5, and a DDoS attack against the server 5. The user terminal 7 which performs and the analyzer 8 are provided.

  FIG. 2 is a configuration diagram of the IP routers 2 to 4. The IP routers 2 to 4 include network interfaces 11 and 12, a sampling unit 13 including a sampling selection unit 14, a transfer unit 15, a filter unit 16, and a control unit 17. In FIG. 2, the configuration that the IP router originally has is omitted. The sampling unit 13 samples IP packets for traffic to all hosts connected to the access network 10. The transfer unit 15 transfers the sampled IP packet to the analysis device 8. The sampling selection unit 13 samples an IP packet that matches a specific bit pattern. The filter unit 16 discards the detected IP packet for a predetermined time or performs bandwidth control on the IP packet.

  FIG. 3 is a diagram showing the configuration of the analyzer 8. The analysis device 8 includes a network interface 21, a control unit 22, and an analysis unit 23. The packet sampling data transferred from the transfer unit 15 of the IP router 2 is received by the network interface 21 via the network 1 ′. When receiving the packet sampling data, the network interface 21 passes the packet sampling data to the analysis unit 23 by the control unit 22. The analysis unit 23 is configured by hardware or software, or hardware and software, and monitors the traffic of the entire network by statistical means, and detects that the traffic destined for a certain target exceeds a threshold and has a high rate.

  Here, the operation of the network system configured as described above will be described. In the IP routers 2, 3, and 4, the sampling unit 13 samples IP packets for traffic to all hosts connected to the access network 10 accommodated therein. Then, the transfer unit 15 transfers the sampled IP packet to the analysis device 8. In the analysis device 8, the analysis unit 23 analyzes the collected sample IP packet and monitors the traffic of the entire network. Then, a DoS attack or a DDoS attack is detected by detecting that a specific packet is continuously transmitted to the same host within a predetermined time.

  Next, the analysis device 8 that has detected the DDoS attack addressed to the host sends a specific bit pattern (IP packet) to the IP router connected to the access network 10 that accommodates the host. The destination IP address, source IP address, source port number, destination port number, protocol, etc.) are selected and instructed to be sampled.

  In the IP router 2 that has received an instruction from the analysis device 8, the sampling selection unit 13 matches a specific bit pattern (IP packet destination IP address, source IP address, source port number, destination port number, protocol, etc.). The IP packet to be sampled is sampled, and the transfer unit 15 transfers the sampled IP packet to the analyzer 8.

  The analysis device 8 analyzes the collected sample IP packets of the host to be noticed, and detects that the packets are continuously transmitted over the threshold within a predetermined time for the host; By performing state monitoring (confirming the normality of the flow based on upstream and downstream state transition definitions) by analyzing bi-directional traffic, the DDoS attack packet flow is accurately identified, and a DDoS attack is performed against the IP router. An instruction is given to discard the IP packet flow for which the packet flow has been identified for a certain period of time or to perform bandwidth control on the IP packet flow.

  Finally, in the IP router that has received an instruction from the analysis device 8, the detected IP packet is discarded by the filter unit 16 for a certain period of time or is subjected to bandwidth control.

  As a method for sampling the packet, the sampling unit 13 may sample the packet at regular time intervals. Alternatively, the number of packets that have passed may be counted, and the packets may be sampled every certain number. The sampled packet may be copied, or only header information may be extracted.

  Consider a case where an attacker 7 is performing a DDoS attack on the server 5 communicating with the user terminal 6. In this case, the IP router 4 samples the IP packet for the traffic addressed to the server 5 by the sampling unit 13, and transfers the IP packet sampled by the transfer unit 15 to the analyzer 8. The analysis device 8 analyzes the collected sample IP packets, and detects a DDoS attack by detecting that the packet is continuously transmitted to the server 5 within a predetermined time period.

  Next, the analysis device 8 that has detected the DDoS attack addressed to the server 5 instructs the IP router 4 to select and sample only the detected packet addressed to the server 5 and the response packet from the server 5. Here, the instruction from the analysis device 8 includes specific bit pattern (IP packet destination IP address, source IP address, source port number, destination port number, protocol, etc.) information.

  In the IP router 4 that has received an instruction from the analysis device 8, the sampling selection unit 14 selects only the packet addressed to the server 5 detected by the analysis device 8 and its response packet, samples them all, and sends the sampled IP packet to the transfer unit 15. To the analyzer 8.

  The analysis device 8 analyzes the collected packet addressed to the server 5 and the sample IP packet of the response packet, and has continuously transmitted more than a threshold value within a predetermined time to the server 5 address. And the state monitoring by analyzing the bidirectional traffic, the DDoS attack packet flow is accurately identified, and the IP packet flow that has identified the DDoS attack packet flow with respect to the IP router 2 is determined for a certain period of time. Instructs to perform bandwidth control for discard or IP packet flow.

  Finally, in the IP router 2 that receives the instruction from the analysis device 8, the detected IP packet is discarded by the filter unit 16 for a certain period of time, or bandwidth control is performed.

  Next, the DDoS attack defense method in the network system of FIG. 1 will be described using the sequence chart of FIG.

  Consider a case where an attacker 7 is performing a DDoS attack on the server 5 communicating with the user terminal 6.

  In the IP router 4, the IP packet is sampled by the sampling unit 13 for traffic addressed to the server 5 (steps 101 and 102), and the sampled sampling packet 201 is transferred to the analyzer 8 by the transfer unit 15 (step 103). In the analysis device 8, the collected sample packet 201 is analyzed by the analysis unit 23 (step 104), and it is detected that the packet is continuously transmitted over the threshold within a predetermined time for the server 5. Thus, a DDoS attack is detected (step 105).

  When a DDoS attack is detected, the analysis device 8 causes the control unit 22 to select and sample only the detected packet addressed to the server 5 and the response packet from the server 5 to the IP router 4 for sampling. Instruction 202 is performed. Here, the specific traffic sampling instruction 202 from the analysis device 8 includes information on a specific bit pattern (IP packet destination IP address, source IP address, source port number, destination port number, protocol, etc.). ing.

  In the IP router 4 that has received an instruction from the analysis device 8, the sampling selection unit 14 selects only the packet addressed to the server 5 detected by the analysis device 8 and its response packet, samples all the packets, and samples the sampled packet 203. Transfer to the analyzer 8.

  In the analysis device 8, the collected packet addressed to the server 5 and the sample packet 203 of the response packet are analyzed by the analysis unit 23, and continuously within a predetermined time for the server 5 more than a threshold value. An IP packet that accurately identifies the DDoS attack packet flow and detects the DDoS attack packet flow with respect to the IP router 4 by detecting the transmission and performing state monitoring by analyzing bidirectional traffic. A filter instruction 204 is issued so as to discard the flow for a certain period of time or perform band control.

  Finally, in the IP router 4 that has received the filter instruction 204 from the analysis device 8, the detected IP packet is discarded by the filter unit 16 for a certain period of time or is subjected to bandwidth control.

  FIG. 5 is a diagram for explaining a method in which the IP routers 2, 3, 4 manage the specific traffic sampling instruction 202 or the filter instruction 204 from the analysis device 8. Each IP router 2, 3, 4 has a table 300. This table 300 describes two types of information: filter information and information for sampling specific traffic, and the IP address of the IP packet (SA ), Destination IP address (DP), transmission source port number (SP), destination port number (DP), protocol (Protocol), and the like.

  As a second embodiment of the present invention, an attacker 6 is performing a DDoS attack on a server 5 communicating with a user terminal 5, and an IP router (IP router 2) closest to the attacker 6 Consider the case of selective sampling and filtering only packets. In this case, the IP router 2 samples the IP packet from the traffic addressed to the server 5 by the sampling unit 13, and the sampled IP packet is transferred to the analyzer 8 by the transfer unit 15. Then, the analysis device 8 analyzes the collected sample IP packets and detects the DDoS attack by detecting that the packets are continuously transmitted to the server 5 within a predetermined time. To do.

  Next, the analysis device 8 that has detected the DDoS attack addressed to the server 5 instructs each of the IP routers 2 and 3 to select and sample only the detected packet addressed to the server 5 and the response packet from the server 5. To do. Here, the instruction from the analysis device 8 includes specific bit pattern (IP packet destination IP address, source IP address, source port number, destination port number, protocol, etc.) information.

  In the IP routers 2 and 3 receiving the instruction from the analysis device 8, the sampling selection unit 14 selects only the packet addressed to the server 5 detected by the analysis device 8 and its response packet, and samples them all. The transferred IP packet is transferred to the analyzer 8.

  The analysis device 8 analyzes the collected packet addressed to the server 5 and the sample IP packet of the response packet, and has continuously transmitted more than a threshold value within a predetermined time to the server 5 address. And the state monitoring by analyzing bidirectional traffic, the DDoS attack packet flow is accurately identified, and the IP router 2 that is closest to the attacker 7 is identified with the DDoS attack packet flow. Instructs the packet flow to be discarded for a certain period of time or to perform bandwidth control.

  Finally, the IP router 2 closest to the attacker 7 who received the instruction from the analysis device 8 discards the detected IP packet at the filter unit 16 for a certain period of time or performs bandwidth control.

  In the above embodiment, the operation has been described in the case of receiving a DDoS attack. However, the operation is similar in the case of receiving a DoS attack.

It is a figure which shows the structure of the network system by one Embodiment of this invention which can cope with the DoS attack which targeted the server on the internet, or a DDoS attack. It is a block diagram of the IP router in the network system of FIG. It is a block diagram of the analyzer in the network system of FIG. 2 is a sequence chart showing a DDoS attack defense method of the network system of FIG. 1. 4 is a diagram for explaining a method in which each IP router 2, 3, 4 manages a specific traffic sampling instruction 202 or a filter instruction 204 from the analysis device 8. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Carrier network 1 'Network 2, 3, 4 IP router 5 Server 6 User terminal 7 Attacker 8 Analyzer 9 Carrier network 10 Access network 11,12 Network interface 13 Sampling part 14 Sampling selection part 15 Transfer part 16 Filter part 17 Control Unit 21 Network interface 22 Control unit 23 Analysis unit 101-109 Step 201, 203 Sampling packet 202 Specific traffic sampling instruction 204 Filter instruction 300 Table

Claims (5)

A method of dealing with a DoS attack or a DDoS attack targeting a server on the Internet in a network system,
A network device sampling IP packets to all hosts connected to an access network accommodated in the network device, and transferring the sampled IP packets to an analysis device;
The analysis device analyzes the sampled IP packet, detects a DoS attack or a DDoS attack, and detects a DoS attack or a network device connected to an access network that accommodates a host that has detected the DDoS attack. Instructing to select and sample only IP packets that match a particular bit pattern among packets addressed to the host;
The network device that has received the instruction from the analysis device selects and samples an IP packet that matches a specific bit pattern, and transfers the sampled IP packet to the analysis device;
The analysis device analyzes the sampled IP packet, accurately identifies a DoS attack or a DDoS attack, discards the identified IP packet for a predetermined time, or performs bandwidth control on the IP packet. Instructing the network device;
The network apparatus which received this instruction | indication discards subsequent IP packet for a fixed time, or performs the bandwidth control with respect to this packet, The method of coping with a DoS attack or a DDoS attack.   The method according to claim 1, wherein the network device copies a sample packet obtained by time-based sampling or count-based sampling, or extracts packet header information from the packet.   The analysis device analyzes the acquired sample packet information by statistical means, and if it detects that the traffic to a certain target exceeds a threshold and the rate is high, the network device pays attention to the detected attention. The method according to claim 1, wherein only the bidirectional packets between the target to be selected are instructed to sample all the packets, and the analysis apparatus collects only the target target bidirectional traffic. In network equipment,
A sampling unit for sampling IP packets to all hosts connected to an access network accommodated in the network device;
A transfer unit for transferring the IP packet sampled by the sampling unit to the analyzer;
The sampling unit selects an IP packet to be sampled, samples an IP packet that matches a specific bit pattern according to an instruction from the analyzer, and transfers the sampled IP packet from the transfer unit to the analyzer A sampling selection control unit;
A network device comprising: a filter unit that discards a detected packet for a certain period of time or performs bandwidth control on the packet according to an instruction from the analysis device. A network interface for receiving packet sampling data transmitted by the network device via the network;
The sampled IP packet is analyzed, a DoS attack or a DDoS attack is detected, and a packet addressed to the detected host is sent to a network device connected to an access network accommodating the host that has detected the DoS attack or DDoS attack Instructs to select and sample only IP packets that match a specific bit pattern, and analyzes the IP packet sampled by the network device in response to the instruction, and accurately detects a DoS attack or a DDoS attack. Analyzing means for identifying and discarding the identified IP packet for a predetermined time or instructing the network device to perform bandwidth control on the IP packet.

Images