JP4380710B2 - Traffic anomaly detection system, traffic information observation device, and traffic information observation program - Google Patents

Description

The present invention, traffic anomaly detection system, traffic information observation equipment,及 Beauty relates traffic information observation program, for example, be applied to the traffic abnormality detection system for detecting traffic abnormalities in a wide area network.

  In recent years, with the development of network technology, its importance has increased, and network systems have penetrated as social infrastructure. On the other hand, new and sophisticated viruses are generated every day. Threats such as virus infections cause network failures, and the damage increases with the scale of the network. Therefore, a system that monitors network traffic and detects anomalies is strongly desired.

  Conventionally, as a system for detecting an abnormality in a network, for example, there is a technique as shown in Patent Document 1.

  The technique described in Patent Document 1 is a security technique that copes with a distributed denial of service attack (DDOS). Specifically, a plurality of border routers monitor TCP-SYN (connection establishment request) packets flowing into the respective communication networks, count the number of TCP-SYN packets with the same destination, and send them to other border routers. The count result is notified. Then, each border router counts the count results of the same destination, determines that it is a DDOS attack when the rate of increase within a predetermined time exceeds a threshold value, and suppresses the inflow of the packet.

JP 2003-289337 A

  However, the conventional traffic abnormality detection method detects a traffic abnormality at the timing when some kind of incident occurs. Therefore, the cause investigation and countermeasures are started after that, and there is a problem that it takes time from attack to countermeasure.

  Here, as an incident for detecting a traffic anomaly, for example, detection of a specific influence such as a decrease in performance of a protected host device, an inability to provide a service, a decrease in access capability due to a traffic overload, or, for example, Intrusion detection system (IDS; Intrusion Detection System) and attack pattern detection using a security system such as a firewall.

  In addition, when the fact of the attack is revealed, the audit trail has already been discarded, and there is no means to investigate the source of the occurrence. There were also problems such as having to.

Therefore, while a short time the time from attack by the attack packets to addressed, it is possible to reliably hold the trail of the attack, the traffic anomaly detection system, traffic information observation equipment,及 Beauty, traffic information observation program Is required.

In order to solve this problem, a traffic abnormality detection system according to a first aspect of the present invention is a network abnormality detection system that detects an abnormality of a monitored network due to an attack packet flowing into the monitored network from one or a plurality of external networks. (1) One or a plurality of relay means provided between the monitored network and each external network for relaying communication packets exchanged with each external network, and (2) corresponding respectively All communication packets that pass through the relay means, and the header information of each communication packet that has passed through each relay means is divided into N (N is an integer of 2 or more), the divided ones are hashed, and each hash value is addressed and then, as passage history digest table flags certain value indicated by each address One or a plurality of packet information holding means possessed, (3) an attack detection means for detecting the inflow of attack packets, and (4) when an attack by an attack packet is detected by the attack detection means, a packet passes inquiry means for inquiring whether passing through, by referring to the digest table is passing over the history of each relay unit having the (5) receives an inquiry from the packet passes inquiry unit, packet information holding means, Us Packet that detects the passage of attack packets in each relay means depending on whether or not the header information of the received target packet is divided into N, the divided one is Hashed, and a flag is set in the value indicating each Hash as an address Passage detection means, and (6) detection of whether or not an attack packet has passed through each relay means from the packet passage detection means. Based on the results, characterized in that it comprises a penetration port specifying means for specifying a relay means that a penetration opening of attack packets.

The traffic information observation apparatus of the second aspect of the present invention includes one or a plurality of relay means between each of one or a plurality of external networks and the network, and an attack that flows into the network from any of the external networks In the traffic information observation apparatus constituting the network anomaly detection system for detecting an anomaly of the network due to the packet, (1) capturing all communication packets passing through the corresponding relay means, and for each communication packet passing through each relay means Packet information holding that divides the header information into N (N is an integer of 2 or more), converts the divided information to Hash, uses each Hash value as an address, and holds a digest table with a flag set to the value indicated by each address as passing history Means, and (2) from an external traffic information management device, When hammer packet is subjected to whether the query that has passed through the relay means, by referring to the digest table is passing over the history of each relay unit included in the packet information holding means, the header information of the target packet received the inquiry N And a packet passage detection unit that detects the passage of the attack packet in each relay unit depending on whether or not a flag is set in a value indicating each hash as an address. To do.

The traffic information observation program of the third aspect of the present invention includes one or a plurality of relay means between each of one or a plurality of external networks and the network, and an attack that has flowed into the network from any of the external networks A traffic information observation apparatus that constitutes a network abnormality detection system that detects an abnormality of the network due to a packet, (1) each communication packet that has passed through each relay means by fetching all communication packets that pass through the corresponding relay means Packet information that holds a digest table in which the header information is divided into N (N is an integer greater than or equal to 2), the divided one is Hashed, each Hash value is an address, and the value indicated by each address is flagged as a passage history Holding means, (2) from an external traffic information management device An attack packet is subjected to whether the query that has passed through the relay means, by referring to the digest table is passing over the history of each relay unit included in the packet information holding means, the header information of the target packet received the inquiry N This is used to function as a packet passage detection means for detecting the passage of an attack packet in each relay means depending on whether a flag is set in the value indicating each hash as an address. is there.

  According to the present invention, it is possible to shorten the time taken from the attack by the attack packet to the countermeasure and to securely hold the trail of the attack.

(A) less than the first embodiment, the traffic abnormality detection system of the present invention, the traffic information observed equipment,及 Beauty, a first embodiment of the traffic information observation program, will be described with reference to the accompanying drawings.

  In the first embodiment, for example, a case will be described in which the present invention is applied to a system that detects traffic anomalies in a broadband network configured by connecting a plurality of ISP (Internet Service Provider) managed networks.

  In the first embodiment, when an attack from one or a plurality of external networks is detected on the protection target host device that is the protection target, the entry point of the attack packet is determined based on the passage information of the attack packet. At the same time, it is possible to cope with the attack.

(A-1) Configuration of the First Embodiment FIG. 1 is a configuration diagram showing the configuration of the traffic abnormality detection system 5 of the first embodiment. In FIG. 1, an ISP network 7-1 managed by a network service provider is connected to ISP networks 7-2 and 7-3 managed by another network service provider via routers 3-1, 3-2. It shall be. Of course, the number of ISP networks to be connected to each other is not limited.

  As the network medium of each of the ISP networks 7-1 to 7-3, for example, a wired line such as an electric line or an optical fiber line, or a part having all or part of a wireless line can be applied. Further, the protocol employed in the layer corresponding to the transport layer of the OSI basic reference model is not particularly limited, but, for example, TCP, UDP, ICMP, or the like can be applied.

  In FIG. 1, the ISP network 7-1 includes at least observation probe devices 1-1 to 1-3, a manager device 2, routers 3-1 to 3-3, and protection target host devices 4-1 to 4-3. Configured.

  Although not shown in FIG. 1, the ISP network 7-1 includes, for example, a user terminal, a server, a voice communication terminal (telephone terminal, communication terminal for realizing a soft phone, a mobile phone, etc.) as other components. Including network devices and the like. The other ISP networks 7-2 and 7-3 also have the same configuration as the ISP network 7-1.

  The observation probe devices 1-1 to 1-3 connect to the routers 3-1 to 3-3, acquire all communication packets relayed through the routers 3-1 to 3-3, and perform various processes described later. To do.

  FIG. 2 is a functional block diagram illustrating an internal configuration of the observation probe device 1 (1-1 to 1-3) according to the first embodiment.

  In FIG. 2, the observation probe apparatus 1 includes a packet acquisition function unit 101, a packet information holding function unit 102, a statistical object selection function unit 103, a statistical function unit 104, a manager transmission / reception function unit 105, a packet passage detection function unit 106, a log mode. It has at least a switching function unit 107, a packet passing log output function unit 108, a filter signal transmission function unit 109, a Hash digest table 110, and a statistical object setting table 111.

  The observation probe device 1 is connected to the extended storage area 112. The extended storage area 112 may be provided in the observation probe apparatus 1 or may be provided outside.

  The packet acquisition function unit 101 captures all communication packets relayed by the router 3 and supplies the captured communication packets to a function unit described later.

  The packet information holding function unit 102 holds packet information of a communication packet when the packet acquisition function unit 101 acquires the communication packet.

  Various methods can be applied to the packet information holding method. In the first embodiment, the packet information holding function unit 102 hashes the header information of the communication packet by using the Hash function. A digest table 110 having a Hash value as an address is prepared, and a flag (for example, “1”) is set to the value indicated by the address (Hash value).

  Here, in the first embodiment, the header information of the communication packet is divided into N parts (N is 2) so that the sizes are almost the same based on parameters such as the transmission source IP address and the transmission source port at the time of Hashing. Then, the divided data are converted using the Hash function. At this time, each divided part may be converted using different Hash functions (that is, a plurality of Hash functions for one packet), or may be converted using one Hash function. Also good.

  The statistical target selection function unit 103 selects statistical target information for taking statistics of communication traffic while referring to the statistical target setting table 111. The statistical target selection function unit 103 may select not only one type of statistical target information but also a plurality of types of statistical target information.

  Here, the types of statistical target information in the statistical target setting table 111 are, for example, five types: a transmission source IP address, a transmission source port number, a transmission destination IP address, a transmission destination port number, and a protocol ID. For example, to explain with an item example of “protocol ID”, for example, “0x0800” indicating IPv4, “0x0806” indicating ARP, etc. are set in “protocol ID” if “TCP / IP”. Has been.

  The statistical function unit 104 aggregates the number and size of communication packets corresponding to the statistical target information selected by the statistical target selection function unit 103 to obtain traffic flow statistical information (hereinafter also referred to as traffic statistical information). is there. The statistical function unit 104 transmits the aggregated traffic flow statistical information to the manager device 2 at predetermined time intervals.

  The manager transmission / reception function unit 105 exchanges information with the manager device 2.

  When receiving an inquiry about the target packet from the manager device 2, the packet passage detection function unit 106 refers to the Hash digest table 110 and searches for the presence or absence of the passage of the target communication packet. The packet passage detection function unit 106 notifies the manager device 2 of whether or not the target packet has passed.

  Here, as a method of searching for the presence / absence of packet passage, information for identifying the target packet is extracted from the inquiry information, and the target packet identification information is divided into N parts under the same conditions as when the information is stored in the digest table 110, and is converted to Hash. To do. Then, when N Hash values are used as addresses and a flag (for example, “1”) is set for all of the indicated values, the passage of the target packet is detected.

  The log mode switching function unit 107 switches the log mode to the extended storage area 112 to On when the target packet is detected by the packet passage detection function unit 106 (that is, when the occurrence of an attack packet is detected), and then the manager When the notification from the device 2 is received (that is, when the attack is released or converges), the log mode is switched to Off.

  The packet passage log output function unit 108 records the packet passage history in the extended storage area 112 when the log mode to the extended storage area 112 is On. At this time, the packet information holding function unit 10 records the packet passage history in the Hash digest table 102 as in the normal case.

  When receiving a filter command from the manager device 2, the filter signal transmission function unit 109 gives a filter signal to the router 3 to which the device 1 is connected. Thereby, inflow of attack packets to be filtered can be suppressed.

  The manager device 2 aggregates the statistical information of traffic from the observation probe device 1 on the same ISP network 7 and acquires security log information from the other system 8 to detect an attack packet. The manager device 2 performs various processes to be described later on the observation probe device 1 on the same ISP network 7.

  FIG. 3 is a functional block diagram showing the internal configuration of the manager device 2. In FIG. 3, the manager device 2 includes a packet passage inquiry function unit 201, a statistics request function unit 202, a filter command function unit 203, an intrusion discrimination function unit 204, a traffic abnormality detection function unit 205, a statistical object setting function unit 206, A security attack detection function unit 207.

  The security attack detection function unit 207 acquires security log information managed by the other system 8, refers to the acquired security log information, and attacks packet information that attacks the protection target host devices 4-1 to 4-3. Is detected.

  Here, the other system 8 is a system that performs security management on the ISP network 7, and corresponds to, for example, a server that performs predetermined processing, an IDS, a firewall, and the like. Further, the security log information of the other system 8 corresponds to, for example, server log information that is a log of application processing executed by the server, IDS log information of IDS, firewall log information of a firewall, and the like.

  Moreover, it is desirable that the timing for acquiring the security log information from the other system 8 is real-time, and for example, it is acquired constantly or at intervals of several seconds.

  When the packet passing inquiry function unit 201 detects attack packet information that attacks the protection target host devices 4-1 to 4-3, It makes an inquiry about whether or not an attack packet has passed.

  First, when a traffic abnormality detection function unit 205, which will be described later, detects a traffic abnormality, it identifies attack packet information based on statistical information in which the abnormality has occurred.

  For example, the attack packet information is specified based on the transmission destination IP address, transmission destination port number, transmission source IP address, transmission source port number, and protocol ID when an abnormality occurs.

  Then, the packet passage inquiry function unit 201 transmits information including the attack packet information to each observation probe device 1 to make an inquiry. When making an inquiry, not all of the five elements of information (transmission destination IP address, transmission destination port number, transmission source IP address, transmission source port number, protocol ID) but some information may be used as inquiry information. Good.

  The statistical request function unit 202 requests all the observation probe apparatuses 1-1 to 1-3 on the ISP network 7 to transmit communication traffic statistical information. Here, the statistics request function unit 202 instructs each observation probe apparatus 1-1 to 1-3 of the observation time of the traffic statistics information. The observation time is a statistical time for performing traffic statistics. In the first embodiment, the observation time is instructed to perform statistics every m seconds.

  The traffic abnormality detection function unit 205 further aggregates the traffic statistical information acquired from all the observation probe devices 1-1 to 1-3, and detects a traffic abnormality based on the traffic statistical information.

  Here, as a method of collecting statistical information of communication traffic, for example, by destination, by source, by protocol, by unit time (for example, every minute, every hour, every day, etc.), these types Various methods aggregated from various viewpoints, such as a method of combining a plurality of methods, can be applied.

  In addition, as a method for detecting traffic abnormality, there is a method of detecting traffic abnormality when, for example, the aggregation result of traffic statistical information per predetermined time exceeds a predetermined threshold in order to detect a sudden change in traffic.

  The intrusion detection function unit 204 manages the presence / absence information on the passage of the target packet notified from each of the observation probe devices 1-1 to 1-3 when an attack occurs, and the target packet is determined based on the integrated information. The entry point that has entered the ISP network 7 is determined.

  Here, the details of the method of determining the entry port will be described in the operation section. For example, the number of passing of the target packet is obtained for each observation probe device 1 from the passing information of the target packet from each observation probe device 1, Based on the result, the observation probe device 1 that has passed the target packet is determined. Then, the router 3 to which the observation probe device 1 that has passed the target packet is connected is determined as the entry port of the target packet.

  The filter command function unit 203 transmits a filter signal for instructing suppression of intrusion of attack packets to the observation probe apparatus 1.

  The statistical object setting function unit 206 centrally manages the statistical object setting table 111 of each observation probe apparatus 1-1 to 1-3, and issues an instruction to edit or update the contents of the statistical object setting table 111. Thereby, the edit / update of the content of the statistics object of each observation probe apparatus 1-1 to 1-3 can be remotely operated. In other words, in order to investigate the attack status, the contents of the statistical object can be changed according to the attack.

(A-2) Operation of the First Embodiment Next, the operation of the traffic abnormality detection process of the first embodiment will be described with reference to the drawings.

  The outline of the overall operation of the traffic abnormality detection process of the first embodiment will be described.

  First, the observation probe devices 1-1 to 1-3 on the ISP network 7-1 fetch all communication packets that pass through the connected border routers 3-1 to 3-3, and obtain traffic statistical information. And each observation probe apparatus 1-1 to 1-3 transmits traffic statistical information to the manager apparatus 2 for every predetermined time.

  When the manager device 2 receives an attack from the external network on the protection target host devices 4-1 to 4-3, the manager device 2 transmits packet information of the attack packets to all the observation probe devices 1-1 to 1-3. .

  Then, the observation probe devices 1-1 to 1-3 detect the presence / absence of the passage of the target packet from the hash digest table 110 based on the packet information of the target packet by the packet passage detection function unit 106, and obtain the result. A reply is sent to the manager device 2.

  In response to this, the manager device 2 determines the entry port through which the attack packet has entered, and issues a filter command.

  Next, details of processing in the observation probe apparatus 1 will be described with reference to the drawings. FIG. 4 is an explanatory diagram for explaining an operation flow in the observation probe apparatus 1.

  In FIG. 4, first, the packet acquisition function unit 101 of the observation probe apparatus 1 captures all communication packets passing between the external network and the ISP network 7 via the traffic monitoring port 113 (F1).

  The communication packet acquired by the packet acquisition function unit 101 is given to the packet information holding function unit 102 (F2), is hashed by the packet information holding function unit 102, and is held in the Hash digest table 110 as a communication history ( F3).

  Here, processing performed by the packet information holding function unit 102 will be described with reference to FIGS. 5 and 6.

  First, the packet information holding function unit 102 divides the IP header of a communication packet into N parts for each header component such as a transmission source IP address and a transmission source port (S1). At this time, it divides | segments so that a division | segmentation size may become substantially the same size.

  Then, the packet information holding function unit 102 uses the Hash function to Hash-convert each divided packet header (S2), and prepares a Hash digest table 110 having each Hash value obtained as an address in the memory. Then, a flag (for example, “1”) is set to the value indicated by each address (S4). Thereby, the packet information of the communication packet can be held while the holding capacity is reduced.

  Returning to FIG. 4, the description will be continued. In the observation probe apparatus 1, the statistical object selection function unit 103 refers to the statistical object setting table 111 and selects the statistical object of the traffic statistical information (F5).

  When the communication packet is acquired by the packet acquisition function unit 101 (F4), the statistical function unit 104 determines the packet that is the statistical target of the traffic statistical information selected by the statistical target selection function unit 103 (F6). The number and / or size are totaled, and the totaled result is given to the manager transmission / reception function unit 105 (F7). The count result is transmitted from the manager transmission / reception function unit 105 to the manager device 2 (F8).

  Here, an example of statistical processing by the statistical function unit 104 will be described. For example, the statistical function unit 104 performs grouping with five types of packet feature data items as shown in FIG. That is, in FIG. 10, “transmission source IP address”, “transmission destination IP address”, “transmission source port number”, “transmission destination port number”, and “protocol ID” are grouped as feature data items.

  Then, the statistical function unit 104 sorts the grouped packet feature data type data and counts the same packet feature data type data. In addition, the statistical function unit 104 rearranges the packet feature data types in the descending order of the counts, adds the data sizes of the same packet feature data types, sorts the packet feature data type data in the descending order of the sizes, and so on. To do.

  Next, the operation when the manager device 2 inquires about the presence / absence of the passage history of the target packet will be described.

  In FIG. 4, when an inquiry about the presence / absence of the passage history of the target packet is given from the manager device 2 to the manager transmission / reception function unit 105 (F9), the received inquiry information is given to the packet passage detection function unit 106 (F10). ).

  The packet passage detection function unit 106 searches for the presence or absence of passage of a packet that matches the inquiry information while referring to the Hash digest table 110 (F11), and returns the result to the manager device 2 (F10, F8). .

  Here, processing in the packet passage detection function unit 106 will be described with reference to FIG.

  In FIG. 7, first, the packet passage detection function unit 106 divides the inquiry information including the packet information of the target packet into N (S11), and Hash-converts the divided pieces of information using the Hash function (S12). At this time, the division method and the Hashing condition are the same as those when the packet information holding function unit 102 holds the packet information in the Hash digest table 110.

  The packet passing detection function unit 106 searches for the value of the address in the Hash digest table 110 using the Hash value thus obtained as an address (S13).

  Then, the packet passage detection function unit 106 determines that “the target packet has passed” (S15) if all the searched address values are “1” (S14), and otherwise (S14) It is determined that no packet has passed (S16).

  In addition, the bit length of the packet is divided and shortened so that the collision rate of the hash value is lowered and the passage confirmation is performed with high accuracy. Although a method of converting one packet with a plurality of Hash functions is also effective, the efficiency of Hash conversion is improved by dividing the packet into short pieces with one function.

  Returning to FIG. 4, when the occurrence of an attack packet is detected (F12), the log mode switching function unit 107 switches the log mode for logging to the extended storage area 112 to On (F13), and the packet information holding function unit 102 The packet passing log output function unit 108 records the communication history in the extended storage area 112 together with the recording of the communication history in the Hash digest table 110 (F14). Thereafter, when the manager mode 2 gives a log mode release or attack convergence condition through the manager transmission / reception function unit 105, the log mode switching function unit 107 switches the log mode to Off (F12).

  Here, conditions for setting the log mode to On and Off will be described. For example, when any of the following (a) to (c) is applicable, the log mode switching function unit 106 sets the log mode to On. (A) When the count of data of the same packet feature data type counted by the statistical processing by the statistical function unit 104 has increased by a threshold value or more compared to a predetermined time before (for example, t minutes before) (b) Attack detection from the manager (C) The data size of the packet feature data type calculated by the statistical processing by the statistical function unit 104 has increased by a threshold or more compared to n minutes ago.

  Next, for example, when the log mode switching function unit 106 receives an attack end notification from the manager device, or corresponds to one of the following (d) and (e), the log mode is set to Off (no change). ). (D) When the data ranked in the count ranking TOP10 of the data of the packet feature data type arranged by the statistical processing by the statistical function unit 104 has not changed from n minutes ago, (e) the statistical processing by the statistical function unit 104 The count of data of the same packet characteristic data type counted does not increase or decrease by more than a threshold value compared with a predetermined time before (for example, t minutes before).

  When a filter setting signal is given from the manager device 2 to the manager transmission / reception function unit 105 (F9), a filter setting signal is given to the filter setting transmission function unit 109 (F15), and the filter signal transmission function unit 109 is connected to the border router 3 In response to this, a filter setting signal is transmitted (F16).

  Next, details of processing in the manager device 2 will be described with reference to the drawings. FIG. 8 is an explanatory diagram for explaining an operation flow in the manager device 2.

  The security attack detection function unit 207 of the manager device 2 fetches security log information such as a server log, IDS log, and firewall log from the other system 8, for example, and based on these security log information, attack packets against the protection target host device 4 Information is detected (F17).

  As a result, when an attack packet against the protection target host device 4 is detected, the security attack detection function unit 207 notifies the packet passage inquiry function unit 201 of the packet information of the attack packet (F18).

  Then, the packet passage inquiry function unit 201 inquires of all the observation probe devices 1 on the ISP network 7 whether or not there is a passage history of the target packet (F19).

  As a result, each observation probe apparatus 1 searches for the presence history of the target packet described in F9 to F11 in FIG. 4 and the like, and the result is sent from each observation probe apparatus 1 to the packet transmission inquiry of the manager apparatus 2. It is returned to the function unit 201.

  Then, the intrusion port discrimination function unit 204 comprehensively counts information on the presence / absence of passage histories returned from each observation probe device 1, and determines the intrusion port of the attack packet based on the totalization result ( F20).

  Here, an example of the entrance determination process in the entrance determination function unit 204 will be described with reference to FIG.

  In FIG. 9, when the entrance detection function unit 204 receives information about the presence / absence of the passage history of the target packet from each observation probe device 1, the intrusion port determination function unit 204 determines the number of target packets that have passed through each observation probe device 1. It calculates | requires for every apparatus 1 (S31).

  For example, it is assumed that the number of attack packets detected by the security attack detection function unit 207 is w, and information on the presence / absence of passage history is received from, for example, z observation probe devices P1, P2,. In this case, for example, the intrusion detection function unit 204 determines that the number of packets passed by the observation probe P1 is 2, the number of packets passed by the observation probe P2, and the number of packets passed by the observation probe P3. The number is 0,..., The number of packets that are passed by the observation probe Pz is 5 and so on.

  Next, the entrance determination function unit 204 obtains the passing rate of the target packet for each observation probe device 1 (S32), and when it is equal to or higher than the predetermined passing rate (S33), the border that the observation probe device 1 observes. It is determined that the router 3 is an entry point (S34). Otherwise, it is determined that the router 3 is not an entry point (S35).

  For example, in the case of the above example, the passing interest rate at the observation probe apparatus P1 is 2 / w, the passing ratio at the observation probe apparatus P2 is 4 / w, the passing ratio at the observation probe apparatus P3 is 0 / w,. The passing ratio at the probe device Pz is 5 / w. For example, if the passage ratio is 20% or more, it is determined that there is a high possibility of being an intrusion port for attack packets, and in this case, the observation probe P3 determines that it is not an intrusion port because the passage history is 0.

  If the attack packet passage ratio is low, whether it is an attack in actual operation or a non-attack where the hash value of a packet accidentally collided is determined statistically and empirically from past results. It should be. For example, in the above case, it is determined that 95% of the attack packets have entered the ISP network 7 via the border router to which the observation probe devices P1, P2, and Pz are connected, and are determined to have been subjected to the DDoS attack. .

  Returning to FIG. 8, the statistics request function unit 202 makes a traffic statistics request to the statistics function unit 104 of each observation probe apparatus 1 so as to observe the number of packets and the traffic amount every m seconds, for example (F21). In response to this, each observation probe device 1 transmits the traffic statistical information aggregated according to the traffic statistics request to the manager device 2.

  The statistical object setting function unit 206 instructs to edit / update the contents of the statistical object setting table 111 of each observation probe apparatus 1 by remote control (F25). Thereby, the statistical function unit 104 of the observation probe apparatus 1 can operate according to the statistical object setting table 111.

  The traffic anomaly detection function unit 205 receives the statistical information of the traffic in each observation probe device 1, investigates the statistical information transition per unit time, and determines that a change equal to or greater than a predetermined threshold is the occurrence of an attack (F22).

  Here, as a method for determining an attack based on the transition of traffic statistical information, for example, the observed number of packets per unit time exceeds 150% of the average number of packets in a steady state, Traffic is increased by 20% or more from the same time zone on the same day of the week, and the rate of increase in the number of packets destined for a specific IP address / port is 15% or more. In addition, any one of the examples given here may be used as a criterion, or a plurality or all of these examples may be used as a criterion.

  When the occurrence of an attack is determined by the traffic anomaly detection function unit 205 (F23), the filter command function unit 203 sends a border router to the filter signal transmission function unit 105 of the observation probe device 1 connected to the border router 3 at the entrance. 3 transmits a filter setting signal indicating filtering of attack packets (F24).

(A-3) Effect of First Embodiment As described above, according to the first embodiment, the manager device 2 detects an abnormality based on the transition of the statistical information of the traffic flow, and immediately enters the border of the intrusion port. By issuing a filter instruction to the router 3, it is possible to prevent an attack packet from flowing into the ISP network 7.

  Further, according to the first embodiment, since the observation probe device 1 transmits the filter signal to the router, it is possible to immediately cope with the attack.

  Furthermore, according to the first embodiment, the manager device 2 can query each observation probe device 1 as to whether or not the target packet that is considered to cause an abnormality has passed. Even if it is, the entry point of the attack packet can be specified, so that appropriate filtering can be performed.

  Furthermore, according to the first embodiment, the observation probe apparatus 1 includes the log mode switching function unit 107 and the packet passing log output function unit 108, so that the observation probe apparatus 1 is longer than the observation time that can be covered by the digest table 110. Even when an attack is performed over a long period of time, the packet passage history can be maintained, so that it is possible to avoid the problem that the trail of the attack cannot be secured and to avoid excessive use of resources by mode switching.

(B) Other Embodiments (B-1) In the first embodiment, the packet information holding function unit of the observation probe apparatus has shown the case where the packet is divided into N and Hashed by one Hash function. A plurality of Hash functions may be used. As a result, the packet passing error detection rate due to the Hash value collision can be further reduced, and the accuracy of attack packet passing detection can be improved.

(B-2) In the first embodiment, the entrance detection function unit has been described as an example in which the security attack detection function unit 207 functions when an attack occurrence is detected. It may be configured to function even when detected.

(B-3) In the first embodiment, the case where one manager device is provided with one ISP network has been described. However, a plurality of manager devices may be provided. In this case, an overall management device that further supervises a plurality of manager devices may be provided.

  In addition, one observation probe device may observe a traffic flow passing through a plurality of border routers. In this case, the observation probe device needs to identify which router the traffic flow has passed through is statistical information.

(B-4) The functional units included in the observation probe device described in the first embodiment may not be physically mounted on the same observation probe device. That is, as long as cooperation processing can be achieved between the functional units and the functions described in the first embodiment can be realized, the functional units may be separately distributed.

  Similarly, each functional unit included in the manager device of the first embodiment may be separately distributed.

  Furthermore, the manager device may have some or all of the functional units of the observation probe device, or the observation probe device may have some or all of the functional units of the manager device. .

  Further, the border router may be mounted with some or all of the functional units of the observation probe device, or may be mounted with some or all of the functional units of the manager device. Further, the border router may be mounted with part or all of the functional units of the observation probe device and part or all of the functional units of the manager device.

(B-5) The observation probe device and the manager device described in the first embodiment can be realized by software processing realized by a hardware resource (for example, a CPU) executing a program. That is, various functions of the observation probe device and the manager device are stored as programs. Note that the processing of the observation probe device and the manager device may be realized by hardware.

It is a lineblock diagram showing the whole traffic anomaly detection system composition of a 1st embodiment. It is a functional block diagram which shows the internal structure of the observation probe apparatus of 1st Embodiment. It is a functional block diagram which shows the internal structure of the manager apparatus of 1st Embodiment. It is explanatory drawing which shows the operation | movement flow in the observation probe apparatus of 1st Embodiment. It is explanatory drawing explaining packet information holding | maintenance of 1st Embodiment. It is a flowchart which shows the packet information holding process of 1st Embodiment. It is a flowchart which shows the presence or absence search process of the passage history of the object packet of 1st Embodiment. It is explanatory drawing which shows the operation | movement flow in the manager apparatus of 1st Embodiment. It is a flowchart which shows the process which judges the intrusion opening of 1st Embodiment. It is explanatory drawing explaining the example of the grouping by the statistical process of 1st Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 (1-1 to 1-3) ... Observation probe apparatus, 101 ... Packet acquisition function part, 102 ... Packet information holding function part, 103 ... Statistical object selection function part, 104 ... Statistical function part, 105 ... Manager transmission / reception function part , 106 ... packet passage detection function unit, 107 ... log mode switching function unit, 108 ... packet passage log output function unit, 109 ... filter signal transmission function unit, 110 ... Hash digest table, 111 ... statistical object setting table, 112 ... extension Storage area, 2... Manager device, 201. Packet passing inquiry function section, 202. Statistics request function section, 203 ... Filter command function section, 204 ... Intrusion discrimination function section, 205 ... Traffic abnormality detection function section, 206 ... Statistics Target setting function unit, 207... Security attack detection function unit, 3-1 to 3-3... Router, 4-1 -3 ... protected host device, 7 - 1 to 7 - 3 ... ISP network.

Claims (8)

In a network anomaly detection system for detecting an anomaly of a monitored network due to an attack packet flowing into the monitored network from one or a plurality of external networks,
One or a plurality of relay means provided between the monitored network and each external network, for relaying communication packets exchanged with each external network;
Capture all communication packets that pass through the corresponding relay means , divide the header information of each communication packet that has passed through the relay means into N (N is an integer of 2 or more), hash the divided ones, One or a plurality of packet information holding means for holding each Hash value as an address and holding as a passage history a digest table flagged for the value indicated by each address ;
Attack detection means for detecting inflow of the attack packet;
A packet passage inquiry means for inquiring whether or not the attack packet has passed through each of the relay means when an attack by the attack packet is detected by the attack detection means;
When receiving the inquiry from the packet transit inquiry unit, by referring to the digest table is the through excessive history of each relay unit having the above packet information holding means, the header information of the target packet that received the inquiry N Packet passing detection means for detecting the passage of the attack packet in each of the relay means according to whether or not the divided one is Hashed and a flag is set in a value indicating each Hash as an address ;
An intrusion port specifying unit for specifying the relay unit serving as an intrusion port for the attack packet based on a detection result of whether or not the attack packet has passed through each relay unit from the packet passage detection unit. Network anomaly detection system characterized by When the intrusion port of the attack packet is specified by the intrusion port specifying unit, a suppression command unit that instructs to suppress the inflow of the attack packet that passes through the relay unit of the intrusion port;
2. The network abnormality according to claim 1, further comprising: a filter setting unit configured to set a filter for suppressing the inflow of the attack packet to the relay unit in response to a suppression command from the suppression command unit. Detection system. Separately from the holding of the passing history of each packet information holding means, an extended storage means for storing the passing history passing through each relay means while the log mode is operating,
A passage history storage control means for operating the log mode and storing the passage history passing through each relay means in the extended storage means when an attack by the attack packet is detected by the attack detection means; The network abnormality detection system according to claim 1 or 2, characterized in that Refer to the passage history of each relay means of each packet information holding means, and use the statistical object information selected from the statistical object setting table as a key to aggregate the statistical information of the traffic flow passing through each relay means 1 or With multiple statistical tools,
The attack detection means detects an attack based on the statistical information of a traffic flow that passes through the relay means periodically received from the statistical means. Network anomaly detection system.   Statistical object management means for centrally managing the contents of a plurality of statistical object information set in the statistical object setting table of each statistical means and updating the contents of the statistical object information collectively with each statistical means The network abnormality detection system according to claim 4, further comprising: The attack detection means receives security log information held by another network abnormality detection system that detects an attack packet with another network different from the monitored network as a monitoring target, and detects an attack based on the security log information The network abnormality detection system according to claim 1, wherein: One or a plurality of relay means are provided between each of the one or a plurality of external networks and the monitoring target network, and an abnormality of the monitoring target network is detected by an attack packet flowing into the monitoring target network from any of the above external networks. In the traffic information observation device that constitutes the network anomaly detection system that
Capture all communication packets that pass through the corresponding relay means , divide the header information of each communication packet that has passed through the relay means into N (N is an integer of 2 or more), hash the divided ones, One or a plurality of packet information holding means for holding each Hash value as an address and holding as a passage history a digest table flagged for the value indicated by each address ;
External traffic information management apparatus, when the attack packets receives a query whether passing through the respective relay device, the digest table is the through excessive history of each relay unit having the above packet information holding means Referring to the header information of the target packet that has received the inquiry, the header information is divided into N parts, and the divided parts are hashed, and the above-mentioned relay means at each relay means determines whether or not a flag is set in the value indicating each hash as an address. A packet passage detection means for detecting passage of an attack packet;
A traffic information observation apparatus comprising: One or a plurality of relay means are provided between each of the one or a plurality of external networks and the monitoring target network, and an abnormality of the monitoring target network is detected by an attack packet flowing into the monitoring target network from any of the above external networks. The traffic information observation device that constitutes the network anomaly detection system
Capture all communication packets that pass through the corresponding relay means , divide the header information of each communication packet that has passed through the relay means into N (N is an integer of 2 or more), hash the divided ones, One or a plurality of packet information holding means for holding each hash value as an address and holding a digest table flagged for the value indicated by each address as a passage history;
From the outside of the traffic information management system, when the attack packets receives a query whether passing through the respective relay means, the digest table is the through excessive history of each relay unit having the above packet information holding means Referring to the header information of the target packet that has received the inquiry, the header information is divided into N parts, and the divided parts are hashed, and the above-mentioned relay means at each relay means determines whether or not a flag is set in the value indicating each hash as an address. Packet passage detection means for detecting passage of attack packets,
Traffic information observation program to function as

Images