JP3730642B2 - Attack packet detection apparatus and method - Google Patents

Description

  The present invention relates to an attack packet detection apparatus and method suitable for detecting an unknown attack packet from packets received from a network.

In recent years, there are various techniques for detecting attack packets (illegal packets) that attack a security hole in a module (packet processing module) that processes packets on devices connected to the network and defending against attacks by the attack packets. Has been developed. As a representative technique for detecting this attack packet, a technique using a pattern file (that is, a static pattern file) in which patterns common to attack packets (attack patterns) are previously databased is known (for example, patents). Reference 1). A device to which this technology is applied includes a defense module including the pattern file described above between a network interface and a packet processing module. When the network interface receives a packet from the network, the defense module compares the content of the received packet with the pattern information in the pattern file. If they do not match, the defense module forwards the received packet to the packet processing module. On the other hand, if the two match, the defense module regards the received packet as an attack packet, discards the received packet, and does not transfer it to the packet processing module. At the same time, the defense module outputs information about discarded packets, logs such as time, and notifies the device administrator.
Japanese Patent Laid-Open No. 2002-63084 (paragraphs 0066 and 0067, FIG. 1)

  According to the above-described conventional technology, a packet that matches a pattern registered in the pattern file in advance can be detected as an attack packet, so that an attack by the packet can be prevented. However, the conventional technique cannot detect an attack packet having an unknown pattern that is not registered in the pattern file, and therefore cannot protect against an attack by an unknown attack packet.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an attack packet detection apparatus and method that can detect an unknown attack packet from packets received from a network.

  According to one aspect of the present invention, there is provided an attack packet detection device that is provided in a packet processing device including a packet processing module that processes a packet received from a network and detects an attack packet from the received packet. . The attack packet detection device includes: a packet storage unit that stores a received packet; a unit that deletes the packet from the packet storage unit when processing by the packet processing module for the received packet is completed; and a storage unit that stores the packet in the packet storage unit Means for detecting a received packet remaining in the packet storage means even after a certain period of time has elapsed, and determines that the received packet detected by the detection means is an unknown attack packet for the packet processing device Means.

  In such a configuration, a packet received from the network is temporarily stored in the packet storage unit, and the packet is deleted from the packet storage unit when processing by the packet processing module (that is, original processing) for the received packet is completed. By configuring the received packet remaining in the packet storage unit even after a lapse of a certain time since it was stored in the packet storage unit, the packet processing device including the packet processing module has entered an unknown state. It can be detected as an attack packet.

  Here, pattern storage means for storing pattern information indicating a pattern for identifying the packet extracted from the received packet determined to be an unknown attack packet, and the received packet are stored in the pattern storage means. A packet comparison means for comparing with a pattern indicated by each pattern information, a means for discarding a corresponding received packet as an attack packet when a match is detected by the comparison by the packet comparison means, and a packet comparison means A means for transferring the corresponding received packet to the packet processing module when a match is not detected in the comparison, and when the received packet is discarded by the discarding means, the packet is also deleted by the deleting means. It may be configured to be deleted from the storage means.

  In such a configuration, as a result of detecting that the packet processing apparatus has entered an abnormal state due to a received packet, the cause packet is identified as an unknown attack packet, and the packet is identified. By automatically registering new pattern information indicating a pattern in the pattern storage means, it is possible to prevent subsequent attacks by similar packets. In addition, when a subsequent attack by a similar packet is defended, that is, when a similar packet received thereafter is detected as an attack packet and discarded, the packet is deleted from the packet storage means. It is possible to prevent erroneous detection that the packet is an unknown attack packet.

  In addition, in order to make it possible to easily detect a received packet remaining in the packet storage unit even after a predetermined time has elapsed since it was stored in the packet storage unit, the received packet stored in the packet storage unit is managed. Packet management information storage means for storing management information for storing management information including time information indicating the storage time of the received packet, and adding the management information stored in the packet management information storage means A configuration in which a corresponding received packet is detected as a target packet by detecting management information in which an elapsed time from the time indicated by the time information included in the management information to the current time has passed a fixed time; Good. Here, by deleting the management information of the detected received packet from the packet management information storage unit, the packet managed by the management information can be logically deleted from the packet storage unit.

  In addition, in order to determine whether the received packet detected by the detecting means is an unknown attack packet, the state of the portion of the attack packet detecting device inside or outside the attack packet detecting device that is processing the received packet is If it is monitored whether it is abnormal and it is determined that the received packet is an unknown attack packet only if it is abnormal, the unknown attack packet can be determined more reliably. Here, the state outside the attack packet detection device can be monitored by, for example, cooperating with the packet processing module.

  According to the present invention, a packet received from the network is temporarily stored in the packet storage unit, and the packet is deleted from the packet storage unit when processing by the packet processing module for the received packet is completed. Even after a predetermined time has passed since the data is stored in the storage unit, the received packet remaining in the packet storage unit can be detected as an unknown attack packet.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a packet processing apparatus according to an embodiment of the present invention. In FIG. 1, a packet processing apparatus 10 includes a network I / F (interface) 11 connected to a network 20, a packet processing module 12, and an attack packet defense module (hereinafter abbreviated as a defense module) directly related to the present invention. 13). In the present embodiment, the packet processing module 12 and the defense module 13 are realized by a CPU (not shown) included in the packet processing device 10 executing a packet processing program and a defense program, respectively.

  The defense module 13 is an attack packet defense device that protects the packet processing module 12 from attack packets with the packet processing module 12 as a protection target. The defense module 13 cooperates with the packet processing module 12 to detect that the packet processing module 12 has entered an abnormal state due to a received packet, and the causing packet is set as an unknown attack packet. And a function to determine. That is, the defense module 13 has a function as an attack packet detection device that detects an unknown attack packet from a series of received packets. The defense module 13 also has a function of automatically registering information indicating a pattern extracted from a received packet determined as an unknown attack packet in a pattern file, and matches a pattern automatically registered in the pattern file among the received packets. A function of discarding (similar) packets.

  The defense module 13 includes a lower layer packet transfer I / F 131, an upper layer packet transfer I / F 132, an upper layer packet processing notification I / F 133, and a storage unit 134. The lower layer packet transfer I / F 131 exchanges packets with the network I / F 11 of the lower layer (that is, an interface module closer to the physical layer of the network 20). The upper layer packet transfer I / F 132 exchanges packets with the packet processing module 12 of the upper layer (that is, the packet processing module 12 to be protected, which is further away from the physical layer of the network 20). The upper layer packet processing notification I / F 133 exchanges information regarding packet processing with the packet processing module 12. The storage unit 134 is realized by a storage area allocated to the defense module 13 among storage areas (nonvolatile areas) of a nonvolatile storage device (not shown) included in the packet processing device 10. The nonvolatile storage device is, for example, a hard disk drive.

  The storage area of the storage unit 134 is allocated to a storage area (a storage packet management table storage area) for storing the storage packet management table 134a, a packet storage area 134b, and a pattern file storage area 134c. The storage area of the storage packet management table 134a and the packet storage area 134b may be secured in a volatile storage device as will be described later.

  The packet storage area 134b is an area for temporarily storing received packets. The stored packet management table 134a is a packet management information storage unit used to store management information for managing packets stored in the packet storage area 134b. This management information includes a status flag indicating the status of the stored packet and time information indicating the time. That is, each entry in the stored packet management table 134a includes a flag field in which a status flag is set and a time field in which time information is set. The time information includes date information. The status indicated by the status flag includes an “unused” status indicating that the corresponding entry in the stored packet management table 134 a is not used (that is, a free entry), and the corresponding packet is in the defense module 13. The “internal processing” state indicating that processing is in progress, and the “external processing” state indicating that the corresponding packet is being processed outside the defense module 13 (here, the packet processing module 12). is there. The pattern file storage area 134c is used to store a pattern file in which information on an attack pattern for the packet processing module 12 is stored. Here, it is possible to add pattern information to the pattern file storage area 134c (internal pattern file) and to delete pattern information from the pattern file storage area 134c (internal pattern file).

  FIG. 2 shows an example of the data structure of the storage packet management table 134a and the packet storage area 134b. The stored packet management table 134a has a group of entries for storing management information, and the packet storage area 134b has a group of entries for storing received packets. Here, the entry (i-th entry) in the stored packet management table 134a referred to by the index i and the entry (i-th entry) in the packet storage area 134b referenced by the same index i correspond to each other. Yes. That is, the management information of the packet stored in the entry referred to by the index i in the packet storage area 134b is stored in the entry referenced by the index i in the stored packet management table 134a.

  Referring back to FIG. 1, the defense module 13 further includes a received packet management unit 135, a packet comparison unit 136, and a log output warning processing unit 137. The received packet management unit 135 adds / deletes pattern information for the pattern file storage area 134c (internal pattern file), registers / deletes received packets for the packet storage area 134b, and a stored packet management table. Information is written to each field of the entry in 134 a and the received packet is transferred to the packet comparison unit 136. In addition, when the packet stored in the packet storage area 134b satisfies a predetermined determination condition, the received packet management unit 135 determines that the packet is an unknown attack packet, and extracts pattern information from the packet. Then, it is newly registered in the pattern file storage area 134c. The packet comparison unit 136 compares the received packet received from the received packet management unit 135 with each pattern information in the pattern file storage area 134c. If there is pattern information that matches the received packet as a result of the comparison, the packet comparing unit 136 determines that the received packet is a known attack packet. In this case, the packet comparison unit 136 functions as a packet discarding unit, discards the received packet, and notifies the log output warning processing unit 137. Further, when there is no pattern information that matches the received packet as a result of the comparison, the packet comparing unit 136 determines that the received packet is not an attack packet. In this case, the packet comparison unit 136 causes the received packet to be transferred to the upper layer (packet processing module 12) by the upper layer packet transfer I / F 132. The log output warning processing unit 137 records the contents of the attack, the reception date and time, the transmission source, etc. as a log and displays it when the received packet is considered to be an attack packet as a result of the comparison by the packet comparison unit 136. The system administrator is warned through an output means such as a device.

Next, the operation of this embodiment will be described focusing on the operation of the defense module 13 in the packet processing apparatus 10 of FIG.
[Initialization during installation]
First, in the present embodiment, only when the defense module 13 is realized by installing a defense program in the packet processing apparatus 10 and then the defense module 13 is activated for the first time, the initialization process shown in the flowchart of FIG. This is performed by the management unit 135. This initialization process is referred to as an initialization process at the time of installation (when the defense module 13 is installed). Here, the received packet management unit 135 sets the status flags of all entries in the stored packet management table 134a to be set to an “unused” state (step S1).

[Process when receiving packets]
Next, processing at the time of packet reception will be described with reference to the flowchart of FIG.
It is assumed that the packet received from the network 20 is transferred from the network I / F 11 forming the lower layer to the lower layer packet transfer I / F 131 in the defense module 13. The lower layer packet transfer I / F 131 receives the packet transferred from the lower layer (network I / F 11) and transfers the received packet to the received packet management unit 135 (step S11).

  When the received packet management unit 135 receives the received packet transferred from the lower layer packet transfer I / F 131, the entry indicating that the status flag is “unused” from the entries in the stored packet management table 134 a, that is, a free entry Is obtained, the empty entry is secured, and the index X of the empty entry is obtained (step S12a). Next, the received packet management unit 135 stores the received packet in an entry (Xth entry) in the packet storage area 134b referred to by the index X (step S12b). The received packet management unit 135 changes the status flag set in the flag field in the entry in the stored packet management table 134a referred to by the index X to a status indicating “internal processing”, and Time information indicating the current time (and the date of the internal process) (and date) is stored in the middle time field (step S12c). The received packet management unit 135 transfers the received packet to the packet comparison unit 136 (step S12d).

  The packet comparison unit 136 extracts the pattern information stored in the pattern file storage area 134c, for example, in order from the top. Each time the packet comparison unit 136 extracts the pattern information from the pattern file storage area 134c, the packet comparison unit 136 compares the pattern indicated by the pattern information with the content of the reception packet transferred from the reception packet management unit 135. The packet comparison unit 136 repeats this operation until it detects that the pattern indicated by the pattern information extracted from the pattern file storage area 134c matches the received packet, or until all the pattern information has been compared (step S1). S13).

  If the pattern indicated by any of the pattern information in the pattern file storage area 134c matches the content of the received packet (step S14), the packet comparison unit 136 determines that the received packet is an attack packet (known attack packet). It is judged that. In this case, the packet comparison unit 136 discards the received packet and notifies the log output warning processing unit 137 that an attack packet has been detected (step S15). Then, the log output warning processing unit 137 records information on the received packet determined to be an attack packet (information of attack contents, reception date and time, transmission source, etc.) as a log and indicates that the packet has been attacked. A warning process is performed to notify the administrator or the like by voice message output, display message output, or the like (step S16). In this warning processing, the log output warning processing unit 137 notifies the received packet management unit 135 that the received packet is regarded as an attack packet and discarded.

  When receiving the packet discard notification that the received packet has been discarded from the log output warning processing unit 137, the received packet management unit 135 searches for an entry in the packet storage area 134b in which the received packet is stored, and the index X Get. The received packet management unit 135 changes the status flag set in the entry corresponding to the index X in the stored packet management table 134a from the status indicating “internal use” to the status indicating “not used” (step S1). S17).

  On the other hand, if no match is detected even if the pattern indicated by the pattern information is compared with the content of the received packet for all the pattern information in the pattern file storage area 134c (step S14), the packet comparison unit 136 The comparison result indicating the mismatch is notified to the received packet management unit 135. Then, the received packet management unit 135 searches the stored packet management table 134a for an entry corresponding to the received packet, and changes the status flag in the entry from a state indicating “internal processing” to a state indicating “external processing”. At the same time, the time information in the entry is changed to indicate the current time (that is, the external processing start time) (and date) (step S18). On the other hand, the packet comparison unit 136 transfers the received packet to the upper layer packet transfer I / F 132. The upper layer packet transfer I / F 132 transfers this received packet to the packet processing module 12 of the upper layer (step S19).

  When the packet processing module 12 receives a packet transferred from the upper layer packet transfer I / F 132 in the defense module 13, the packet processing module 12 processes the packet. If the processing of the received packet has been completed normally, the packet processing module 12 returns the packet processing completion and information regarding the completed packet to the defense module 13.

[Processing when packet processing in upper layer is completed]
Next, the operation when the processing of the packet transferred from the upper layer packet transfer I / F 132 to the upper layer packet processing module 12 is normally completed in the module 12 will be described with reference to the flowchart of FIG. To do. First, it is assumed that the packet processing module 12 notifies the defense module 13 of the completion of packet processing. Information regarding the completed packet is added to the packet processing completion notification. The upper layer packet processing notification I / F 133 in the defense module 13 receives the packet processing completion notification from the packet processing module 12, and transmits the notification to the received packet management unit 135 (step S21). When receiving the packet processing completion notification, the received packet management unit 135 searches the packet storage area 134b for the packet notified of the processing completion from the packet processing module 12, and obtains the index X of the entry storing the packet. The received packet management unit 135 changes the status flag set in the entry corresponding to the index X in the stored packet management table 134a from the status indicating “in use” to the status indicating “not used” (step S1). S22).

[Unknown attack packet detection processing]
Next, processing for detecting an unknown attack packet (unknown attack packet detection processing) will be described with reference to the flowchart of FIG. This process is executed periodically, for example. This process is also executed at the beginning of the end process of the defense module 13 described later.

  First, the received packet management unit 135 sets an index i designating an entry in the stored packet management table 134a to an initial value 0 (step S31). Next, the received packet management unit 135 refers to the entry of the index i in the stored packet management table 134a (step S32). The received packet management unit 135 checks the status flag set in the entry of index i (step S33).

  If the status flag in the entry of index i indicates “internal processing” or “external processing”, the received packet management unit 135 indicates the time information set in the time field of the entry. The time (set time) (that is, the start time of the internal process or external process currently in progress) is compared with the current time (step 34). Then, the received packet management unit 135 determines whether or not a predetermined reference time has elapsed since the time indicated by the time field (that is, the start time of the internal process or external process currently in progress) (step 35). .

  If the reference time has elapsed since the time indicated in the time field, that is, if the state of “internal processing” or “external processing” of the packet continues beyond the reference time, the received packet management unit 135 , It is determined that there is a possibility that the “internal processing” or “external processing” packet is an unknown attack packet. The reason is as follows.

  First, that the state of “internal processing” continues beyond the reference time means that the packet processing inside the defense module 13 is not completed even after the reference time has elapsed. Therefore, there is a possibility that a problem such as the defense module 13 falling into an infinite loop or abnormally terminating due to the received packet has occurred. In addition, if the state of “external processing” continues beyond the reference time, the same problem may occur in the packet processing module 12 of the upper layer with respect to the packet being “external processing”. There is sex.

  Accordingly, the received packet management unit 135 determines whether or not the packet “internal processing” or “external processing” is an unknown attack packet that has some adverse effect on the defense module 13 or the packet processing module 12 to be protected. In order to determine whether or not the module performing the “internal processing” or “external processing” (that is, the defense module 13 or the packet processing module 12) is monitored (step S36). Here, the received packet management unit 135 checks the status of the program for executing “internal processing” or “external processing”.

  Means for confirming the execution state of a program is conventionally known. If the operating system (OS) is Windows (registered trademark), it can be realized using, for example, a task manager, and if it is UNIX (registered trademark), ps. This can be realized using a command. In addition to this, the program for executing “internal processing” or “external processing” can also be executed by incorporating a function for informing the state to the outside in advance (for example, a function for periodically sending a survival signal). It is possible to check the state.

  The received packet management unit 135 applies such means to determine whether or not a program for performing “internal processing” or “external processing” is currently in an execution state, and whether the usage rate of the CPU or memory is high. You can check how much. The reception packet management unit 135 monitors the execution state of the program (process) for performing “internal processing” or “external processing” in the packet processing module 12 or the defense module 13, and as a result, when the program is not being executed, Alternatively, when the behavior is abnormal, such as the usage rate of the CPU or memory being abnormal (being a certain threshold value or more), it is determined that the execution state of the program is abnormal (step S37). In this case, the received packet management unit 135 determines that the “internal processing” or “external processing” packet is an unknown attack packet that has some adverse effect on the defense module 13 or the packet processing module 12 to be protected ( decide. Therefore, the received packet management unit 135 extracts a pattern for specifying the packet from the “internal processing” or “external processing” packet, and stores the pattern information indicating the pattern in the pattern file storage area 134c. It is additionally registered in the registered pattern file (step S38). Here, the packet to be subjected to pattern extraction is stored in an entry in the packet storage area 134b corresponding to the entry in the stored packet management table 134a in which the time information used in the comparison in step S34 is set. ing. That is, the packet from which the pattern is to be extracted is stored in the entry in the packet storage area 134b specified by the index i.

  Even if it is determined that the program for performing “internal processing” or “external processing” is in an abnormal state, the “internal processing” or “external processing” packet is an unknown attack packet only once. If the same state is observed in the unknown attack packet detection process after the next time, it may be determined that the packet is an unknown attack packet.

  In the above example, in order to simplify the description, the same reference time is applied in any state of “internal processing” or “external processing”. However, a unique reference time (first and second reference times) is applied to each of “internal processing” and “external processing”, for example, the state of “internal processing” or “external processing” It is preferable to determine whether each exceeds the first or second reference time. Here, the standard time required for “external processing” is longer than the standard time required for “internal processing”. For this reason, the second reference time is set to a value longer than the first reference time.

  The following method can be applied to the extraction of a pattern (for specifying the packet) from a packet determined to be an unknown attack packet. For example, it is a method in which the source address of the packet is used as a pattern. When this method is applied and the transmission source address is registered as a pattern in the pattern file in the pattern file storage area 134c, all packets from the same transmission source can be discarded as attack packets thereafter. Further, by registering the packet data itself as a pattern, it is possible to prevent the packet from being processed as an attack packet when a packet of similar data is transmitted thereafter.

  In this embodiment, packets are managed one by one. A certain set of units of these packets generally has some meaning. Therefore, for example, in a session (connection) of a communication protocol represented by TCP (Transmission Control Protocol), a set of a series of packets transmitted using the session (connection) is stored and managed together with the arrival order of the packets. It is also possible to apply the method to do. In this method, when a certain packet is regarded as an attack, a set of a series of packets to which the packet belongs, that is, the session itself can be regarded as an attack. Therefore, after that, when a packet group having the same order and data is received, a pattern can be created so as to be determined as an attack and registered in the pattern file.

  When the received packet management unit 135 registers the pattern of the received packet determined to be an unknown attack packet in the pattern file (step S38), the received packet management unit 135 stores the received packet pattern in the stored packet management table 134a specified by the index i. The status flag of the entry is changed from a status indicating “internal processing” or “external processing” to a status indicating “unused” (step S39). The process of changing the status flag of the entry in the saved packet management table 134a to the status indicating “unused” is saved in the management information saved in the entry and the entry in the packet save area 134b corresponding to the entry. This is equivalent to logically deleting the received packet.

  Next, the received packet management unit 135 determines whether or not all entries in the stored packet management table 134a have been processed (step S40). If an unprocessed entry remains, the received packet management unit 135 increments the index i by 1 (step S41), and the entry in the stored packet management table 134a after the increment (that is, the next entry). The process starting from step S32 is executed on the target. The received packet management unit 135 also passes the reference time from the time indicated by the time field of the index i entry when the status flag set in the entry of the index i indicates “unused” (step S33). If not (step S35), or if the state of the program for executing “internal processing” or “external processing” is normal (step S37), it is determined that the corresponding received packet is an attack packet. If not, the process proceeds to step S40 as it is. The received packet management unit 135 executes the above processing for all entries in the stored packet management table 134a (step S38).

[End processing of defense module 13]
Next, the termination process of the defense module 13 will be described with reference to the flowchart of FIG. This termination process is executed, for example, when the packet processing apparatus of FIG. 1 is shut down.

  First, the received packet management unit 135 executes unknown attack packet detection processing according to the procedure shown in FIG. 6 (step S51). By executing this process, it is clear that the meaning of the status flag set in each entry of the stored packet management table 134a is as follows.

“Unused”: The corresponding entry is not used and is empty.
“Internal processing”: The corresponding entry is used, and the packet registered in the entry is being processed in the defense module 13. Since the reference time has not elapsed since the start of the process, the process is being performed correctly at this time.
“External processing”: The corresponding entry is used, and the packet registered in the entry is being processed outside the defense module 13. Since the reference time has not elapsed since the start of the process, the process is being performed correctly at this time.

  When the received packet management unit 135 finishes the unknown attack packet detection process (step S51), all the entries in the stored packet management table 134a are targeted, and all the status flags of the entries indicate “unused”. Set (step S52). As a result, in this embodiment, when the termination processing of the defense module 13 is completed, the status flags of all entries in the stored packet management table 134a indicate that the entry is “unused” (not used). Show). If the defense module 13 or the packet processing module 12 ends abnormally (that is, if the packet processing device 10 ends abnormally) during “internal processing” or “external processing” of the packet, the flowchart of FIG. The termination process according to is not performed. In this case, the status flag indicating “internal processing” or “external processing” at the time of abnormal termination is not changed to a status indicating “unused”.

  In the present embodiment, in the termination process of the defense module 13, all of the flags are set to a state indicating “unused” regardless of the state flag state of each entry. However, only for entries that have a status flag that indicates "internal use" and entries that have a status flag that indicates "external internal use", the flag indicates "not used" You may make it change to.

[Processing when the defense module 13 is activated]
Next, the process (initialization process) at the time of starting the defense module 13 will be described with reference to the flowchart of FIG. The initialization process at the time of installation in FIG. 3 is executed only when the defense module 13 is activated for the first time, whereas the process of FIG. 8 is performed after the defense module 13 is activated for the first time. It is executed at every start-up. )
First, the received packet management unit 135 sets an index i designating an entry in the stored packet management table 134a to an initial value 0 (step S61). Next, the received packet management unit 135 refers to the entry of the index i in the stored packet management table 134a (step S62). The received packet management unit 135 checks the status flag set in the entry of the index i (step S63).

  If the status flag in the entry of the index i indicates “internal processing” or “external processing”, the received packet management unit 135 selects “internal processing” or “ During “external processing”, it is determined that the defense module 13 or the packet processing module 12 ended abnormally and the termination processing of the defense module 13 was not executed. If the status flag indicates “internal processing”, the received packet management unit 135 determines that the cause of the abnormal termination of the defense module 13 during the “internal processing” of the packet is that the packet is an unknown attack packet. It is judged that it was because of. Similarly, when the status flag indicates “external processing”, the received packet management unit 135 indicates that the packet processing module 12 has terminated abnormally during “external processing” of the packet. It is determined that the attack packet was found.

  Therefore, when the status flag of the entry in the stored packet management table 134a designated by the index i indicates “internal processing” or “external processing”, the received packet management unit 135 determines the packet corresponding to the entry. A pattern is extracted from the packet stored in the entry in the storage area 134b by the method described above, and pattern information indicating the pattern is additionally registered in the pattern file stored in the pattern file storage area 134c (step S64).

  When the received packet management unit 135 registers the pattern of the received packet determined to be an unknown attack packet in the pattern file (step S64), the received packet management unit 135 stores the received packet pattern in the stored packet management table 134a specified by the index i. The status flag of the entry is changed from a status indicating “internal processing” or “external processing” to a status indicating “unused” (step S65). Next, the received packet management unit 135 determines whether or not all entries in the stored packet management table 134a have been processed (step S66). If an unprocessed entry remains, the received packet management unit 135 increments the index i by 1 (step S67), and targets the entry in the saved packet management table 134a after the increment, in step S62. The process starting from is executed. If the status flag set in the entry of index i indicates “unused” (step S63), the received packet management unit 135 determines that the corresponding received packet is not an attack packet and proceeds to step S66. move on. The received packet management unit 135 executes the above processing for all entries in the stored packet management table 134a (step S66).

  As described above, in the present embodiment, the protection module 13 (the received packet management unit 135) indicates that the processing is not completed by the stored packet management table 134a when the protection module 13 is activated. Is detected, and it is determined that the packet is an attack packet to the packet processing module 12 (upper module) that is the defense target or the defense module 13 itself. The defense module 13 (the received packet management unit 135 therein) extracts a pattern from the packet determined to be an attack packet, and newly adds it to the pattern file. Thereby, when the same packet is received after the next time, an attack by the packet can be prevented.

  Instead of automatically registering the pattern extracted from the attack packet in the pattern file, the contents of the packet are notified to the system administrator using, for example, e-mail, and whether or not the packet is regarded as an attack packet (that is, Whether or not the received packet management unit 135 determines that the packet is an attack packet may be left to the administrator's judgment. Further, it is possible to set not only both the packet processing module 12 and the defense module 13 but also one of the objects to be determined as being attacked.

  In the above-described embodiment, the storage packet management table 134a area and the packet storage area 134b are secured in the storage area of a nonvolatile storage device such as a hard disk drive together with the pattern file storage area 134c. However, the storage packet management table 134a area and the packet storage area 134b may be secured in the storage area of the volatile storage device.

  In the configuration using the nonvolatile storage device as in the above embodiment, when the defense module 13 or the packet processing module 12 to be protected ends abnormally, that is, the defense module 13 and the packet processing module 12 to be protected are executed. When the packet processing apparatus 10 being terminated abnormally, information remains in the nonvolatile storage device even after the packet processing apparatus 10 is restarted. For this reason, unknown attack packets can be detected as in the above example. On the other hand, unlike the above embodiment, when a configuration in which the area of the storage packet management table 134a and the packet storage area 134b are secured in the storage area of the volatile storage device is applied, the storage packet management table 134a There is an advantage that the access time to the packet storage area 134b can be shortened. However, when the packet processing apparatus 10 is abnormally terminated, the information in the volatile storage device is lost. Therefore, after the packet processing apparatus 10 is restarted, information on the storage packet management table 134a and the packet storage area 134b does not remain in the volatile storage device. Therefore, the configuration using the volatile storage device can be applied to detection of an attack other than an attack in which the packet processing device 10 itself ends abnormally.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment.

The block diagram which shows the structure of the packet processing apparatus which concerns on one Embodiment of this invention. The figure which shows the data structure example of the preservation | save packet management table 134a and the packet preservation | save area | region 134b in FIG. 6 is a flowchart showing a procedure of initialization processing at the time of installation in the embodiment. The flowchart which shows the procedure of the process at the time of packet reception in the embodiment. 9 is a flowchart showing a processing procedure when packet processing is completed in an upper layer in the embodiment. The flowchart which shows the procedure of the unknown attack packet detection process in the embodiment. The flowchart which shows the procedure of the completion | finish process of the defense module 13 in the embodiment. The flowchart which shows the procedure of the process at the time of starting of the defense module 13 in the embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Packet processing apparatus, 11 ... Network I / F (interface), 12 ... Packet processing module, 13 ... Defense module (attack packet detection apparatus), 20 ... Network, 131 ... Lower layer packet transfer I / F, 132 ... Upper Layer packet transfer I / F, 133 ... upper layer packet processing notification I / F, 134 ... storage unit, 134a ... storage packet management table (packet management information storage means), 134b ... packet storage area, 134c ... pattern file storage area, 135... Received packet management unit, 136... Packet comparison unit (discard means), 137.

Claims (10)

An attack packet detection device that is provided in a packet processing device including a packet processing module that processes a packet received from a network and detects an attack packet from received packets,
Packet storage means for storing received packets;
Means for deleting the packet from the packet storage means when processing by the packet processing module for the received packet is completed;
Means for detecting a received packet remaining in the packet storage means even after a predetermined time has elapsed since being stored in the packet storage means;
An attack packet detection apparatus comprising: a means for determining that the received packet detected by the detection means is an unknown attack packet for the packet processing apparatus. Pattern storage means for storing pattern information indicating a pattern for identifying the packet extracted from the received packet determined to be an unknown attack packet by the determination means;
A packet comparison means for comparing the received packet with a pattern indicated by each pattern information stored in the pattern storage means;
A means for discarding a corresponding received packet as an attack packet when a match is detected in the comparison by the packet comparison means;
Means for transferring a corresponding received packet to the packet processing module if no match is detected in the comparison by the packet comparison means;
The attack packet detection apparatus according to claim 1, wherein the deletion unit deletes the packet from the packet storage unit even when the received packet is discarded by the discard unit. Management information for managing received packets stored in the packet storage means, further comprising packet management information storage means for storing management information including time information indicating the storage time of the received packets,
The detection means includes, among the management information stored in the packet management information storage means, an elapsed time from the time indicated by the time information included in the management information to the current time has passed the predetermined time. The received packet managed by the detected management information,
The deletion unit logically deletes the packet managed by the management information from the packet storage unit by deleting the management information of the received packet detected by the detection unit from the packet management information storage unit. The attack packet detection apparatus according to claim 2. A first state in which there is no corresponding packet for managing the received packet stored in the packet storage means, a second state in which the corresponding packet is processed in the attack packet detection device, or a corresponding state Management information including flag information indicating a third state in which a packet is processed outside the attack packet detection device, and time information indicating a time when the flag information indicates the second or third state Packet management information storing means for storing, comprising: flag information indicating the second state and time information indicating a time when the received packet is stored when the received packet is stored in the packet storing means Packet management information storage means for storing information;
When a mismatch is detected in the comparison by the packet comparison unit, the flag information included in the management information of the corresponding received packet stored in the packet management information storage unit is changed to indicate the third state. And means for changing the time information in the management information to indicate the time at that time,
The detection means includes flag information included in the management information from the management information stored in the packet management information storage means indicating the second state and included in the management information. Management information whose elapsed time from the time indicated by the time information to the current time has passed the first fixed time is detected, and the management information is selected from the management information stored in the packet management information storage means Management information in which the flag information included in the information indicates the third state, and the elapsed time from the time indicated by the time information included in the management information to the current time has passed the second fixed time To detect the received packet managed by the detected management information,
When the received packet is detected by the detecting unit, the deleting unit sets the flag information included in the received packet management information stored in the packet management information storing unit to the first state. When the received packet is discarded by the discarding unit by changing, the flag information included in the management information of the discarded received packet stored in the packet management information storing unit is changed to the first information. In any case, the management information of the received packet is logically deleted from the packet management information storage unit, and the received packet is logically deleted from the packet storage unit. The attack packet detection apparatus according to claim 2.   The determining means is processing the received packet inside the attack packet detecting apparatus or outside the attack packet detecting apparatus in order to determine whether the received packet detected by the detecting means is an unknown attack packet 2. The attack packet detection apparatus according to claim 1, further comprising means for monitoring whether or not the state of said part is abnormal, and determines that the received packet is an unknown attack packet only when it is abnormal.   2. The attack packet detection apparatus according to claim 1, wherein the detection means is periodically activated during an operation period of the attack packet detection apparatus. The packet storage means is a rewritable nonvolatile storage means,
The detection means is also activated at the end of the attack packet detection device,
7. The attack packet detection device according to claim 6, wherein the deletion unit deletes all received packets from the packet storage unit after the detection operation by the detection unit is completed when the attack packet detection device is terminated.   8. The attack packet detection device according to claim 7, wherein the detection unit detects a received packet remaining in the packet storage unit even when the attack packet detection device is activated.   A means for notifying the system administrator of the received packet determined to be the attack packet via the output means in order to entrust the system administrator with the right or wrong of the determination by the determining means that the packet is an attack packet; The attack packet detection device according to claim 1. An attack packet detection method for detecting an attack packet from received packets in a packet processing device including a packet processing module for processing a packet received from a network,
Storing the received packet in a packet storage means;
Deleting the packet from the packet storage means when the processing by the packet processing module for the received packet is completed;
Detecting a received packet remaining in the packet storage unit even after a predetermined time has elapsed since being stored in the packet storage unit;
And determining the received packet detected in the detection step as an unknown attack packet for the packet processing device.

Images