JP4437410B2 - Security management apparatus and program - Google Patents

Description

  The present invention provides an intrusion detection system (Intrusion Detection System) for notifying a security administrator or operator of a security incident when an unauthorized access, intrusion / attack, or the like occurs on a computer or network device connected to a computer network. , Hereinafter also referred to as IDS), it relates to providing a more accurate alarm notification.

  With the spread of the Internet, the speed of information transmission has increased dramatically, and anyone can easily use IT to easily and quickly obtain the information they want. On the other hand, as laws such as the illegal access prohibition law, the provider liability law, and the personal information protection bill progress, unauthorized access to Web servers operated by ministries and companies, extensive homepage alterations, and attacks on servers have been repeated. The damage caused by computer viruses is increasing year by year.

  Also, in the enterprise, various information is required for quicker management judgment and comprehensive risk management than ever before, but the demand for information security in the company has become stricter. If corporate information is falsified due to corporate information leakage or unauthorized access, it suffers physical damage and economic loss, and social trust is lost. In addition to attacks from the outside such as the Internet, it is necessary to cope with unauthorized access from the internal network.

  In order to avoid such threats of unauthorized access, network-type unauthorized intrusion detection systems are increasingly used. Normally, a network type IDS monitors packets flowing on the network with a monitoring sensor (monitoring device), and has a database (a database of known illegal packet patterns, called a signature). If the packet is an illegal packet, an alarm is raised on the operator management apparatus (manager) to notify the security administrator or operator. In general, a security administrator contacts a related department or takes measures according to the contents of the received alarm (see, for example, Patent Document 1).

  Since the range that can be technically monitored by the monitoring sensor is limited to the segment unit of the network, it is necessary to install the monitoring sensor so as to monitor each segment as shown in FIG.

  In general, an alarm is provided with a level corresponding to the importance for each monitoring sensor. For example, a high, medium, and low level is set for each signature of each monitoring sensor, and an operation mode is adopted in which an immediate response is performed for a high level.

  However, actually, even if the detected alarm is at a high level, it is not always harmful, and it is difficult to determine whether there is actual harm due to differences in the system configuration and attack methods. For example, even when an illegal packet related to a high-level electronic mail is transmitted from the Internet to the corporate network and the packet is detected, it is not necessary to take immediate action if the packet related to the mail is blocked by a firewall. That is, in the IDS configured as shown in FIG. 11, an alarm detected by the monitoring sensor 1 is notified to the security administrator as a high level (even if it is not detected by the monitoring sensor 2). After that, the administrator confirms that the monitoring sensor 2 has not detected, and determines that no immediate action is necessary.

In general, in order to construct a secure network system, security diagnosis such as a pre- and periodic penetration test is performed on each server or network device connected to the network. This diagnosis is usually performed using a security diagnostic tool, and it is possible to check what services are running on the server, or to actually attack the server using a known attack method. Investigate vulnerabilities in There are usually hundreds or more types of diagnostic patterns. For example, assume that a security diagnosis is performed on a certain Web server. Of course, there is no problem even if the Web service is running, but if the mail or file transfer service is running, it is necessary to stop it. If it is determined that the client is vulnerable to the Nimda attack using the HTTP header, it is necessary to apply a patch or the latest module. On the other hand, if the web server is applied with the Nimda attack patch, the vulnerability to the Nimda attack is not pointed out, and there is no problem even if it receives such an attack. Therefore, even if the network type IDS detects a Nimda attack, it can be determined that there is no problem if it is an attack against a server for which appropriate measures have been taken, but in reality, an alarm is notified and the administrator By referring to the security diagnosis result or the like, it is determined that an immediate response is not necessary in the attack against the server.
JP 2002-342276 A

  As described above, when security monitoring is performed using a network type IDS, even if an alarm occurs, there may be no actual harm. In other words, it is difficult to respond quickly to alarms that are truly urgent. Therefore, there is a problem that an alarm with high importance cannot be dealt with immediately or the burden on the administrator is heavy.

  The present invention has been made to solve the above problems, and comprehensively judges alarms from each monitoring sensor raised to the operator management apparatus, and further performs security management based on the prior security diagnosis results. It is intended to notify a person (operator) of a high-level alarm, that is, a truly urgent unauthorized access. As an implementation method thereof, the determination is made based on the fraudulent log data sent to the operator management apparatus (manager) without changing any existing monitoring sensor.

The security management device according to the present invention is:
A security management device that performs security management of a network including a plurality of communication devices,
An unauthorized access log data acquisition unit for acquiring unauthorized access log data indicating at least an unauthorized access type and an unauthorized access target communication device;
Determine whether countermeasures against the unauthorized access type indicated in the unauthorized access log data are taken in the unauthorized access target communication device, and determine the risk of unauthorized access according to the presence or absence of countermeasures in the unauthorized access target communication device. A risk determination unit to determine;
And an alarm notifying unit for notifying an unauthorized access according to the risk determined by the risk determining unit.

  According to the present invention, based on the presence / absence of countermeasures against unauthorized access, it is possible to narrow down alarms that truly need emergency response and notify the administrator, thereby allowing the administrator to miss a truly dangerous alarm. In addition, an immediate response can be taken to an alarm with a great deal of harm, and the burden on the administrator can be reduced.

Embodiment 1 FIG.
FIG. 1 is a diagram showing an overall configuration example including a security emergency level adjustment system 1 (security management apparatus) according to Embodiment 1 of the present invention. The security emergency level adjustment system 1 according to the present embodiment is intended for a network including a plurality of segments, and is connected to an unauthorized intrusion detection system (IDS) 2 as in the network shown in FIG. . The unauthorized intrusion detection system 2 includes a monitoring sensor, a manager 21, and an unauthorized access log file arranged for each network segment.

  FIG. 2 is a diagram showing the configuration of the security emergency level adjustment system 1 and the unauthorized intrusion detection system 2. In the security emergency level adjustment system 1, 11 is an unauthorized access log data acquisition unit that acquires unauthorized access log data from the unauthorized access log file 22, 12 is an unauthorized access log data analysis processing unit that analyzes the acquired unauthorized access log data, 13 Is a monitoring sensor correspondence table storage unit for storing a monitoring sensor correspondence table, 14 is a diagnostic result matching processing unit (risk level determination unit) for determining a final alarm level (risk level), and 15 is a signature-diagnosis correspondence table. Signature-diagnosis correspondence table storage unit, 16 is a security diagnosis result table storage unit (unauthorized access countermeasure information storage unit) that stores a security diagnosis result table (unauthorized access countermeasure information), and 17 is an alarm level adjustment unit (alarm notification unit). It is. Specific contents of the unauthorized access log data, the monitoring sensor correspondence table, the monitoring sensor correspondence table, and the security diagnosis result table will be described later.

  Although not shown, the security emergency level adjustment system 1 can be realized by a computer having a CPU such as a microprocessor, a recording unit such as a semiconductor memory or a magnetic disk, and a communication unit. A program for realizing the function of each component included in the security emergency level adjustment system 1 is recorded in the recording means, and the operation of the security emergency level adjustment system 1 is controlled by the CPU reading these programs. It is also possible to realize the function.

  In the unauthorized intrusion detection system 2, 21 is an operator management device (manager), and 22 is an unauthorized access log file in which unauthorized access log data coming from each monitoring sensor is recorded. Usually, 21 and 22 are owned by an existing unauthorized intrusion detection system.

  FIG. 3 is a diagram for explaining the data format of the unauthorized access log file. Each data includes date of occurrence (date), time of occurrence (time), number of detected sensor (sensor-id), signature unique number (sig-id), signature name (sig-name), alarm A level (level), a transmission IP address (from-ip), a transmission port number (from-port), a destination IP address (to-ip), and a destination port number (to-port) are represented. Here, the signature unique number or the signature name indicates the unauthorized access type, and the destination IP address or the destination port number indicates the communication device (server, terminal, etc.) that is the unauthorized access target. The alarm level indicates the alertness level.

  As is clear from the target network configuration example of FIG. 1, it can be seen from this network configuration which monitoring sensor is monitoring which segment. As a result, a monitoring sensor correspondence table (stored in the monitoring sensor correspondence table storage unit 13 of FIG. 2) in which the network address and the sensor (sensor-id) are associated as shown in FIG. 4 can be created. it can.

  Next, the operation will be described with reference to FIGS.

  First, the unauthorized access log data acquisition unit 11 acquires data from the unauthorized access log file (step S1001 in FIG. 10). An example of the data acquired here is shown in FIG.

  Next, the unauthorized access log data analysis processing unit 12 analyzes the unauthorized access log data (step S1002). The data shown in FIG. 5 will be described as an example. Attention is paid to the case where the level (warning degree) indicating the alarm level is High. In this example, since the High level is 3, the Medium level is 2, and the Low level is 1, attention is paid to the case where the level is 3.

  Next, the signature unique number (sig-id), the source IP address (from-ip), the source port number (from-port), the destination IP address (to-ip), and the destination port number (to-port) are the same. Yes, those with close dates (such as within 10 seconds) are determined to be the same packet. A single packet is a packet. In the example of FIG. 5, (1) and (2), (4) and (5), (6) and (7) are the same packet, and (3) is also one packet. Information on one packet is recorded.

  Next, based on the monitoring sensor correspondence table 13 having the contents as shown in FIG. 4, it is determined which monitoring sensor is detected from the destination IP address (to-ip), and the sensor-id is specified. In the example of FIG. 5, since the to-ips of (1) to (5) are 10.10.2.1, from FIG. 4, 10.10.2.1 belongs to the segment 2 and the sensor -It is detected by the monitoring sensor whose id is 02.

  Next, in each packet, if the sensor-id obtained based on the destination IP address and the sensor-id described in the log file are the same, the alarm level (warning) The degree is kept at 3 (High), and if not, the alarm level (warning degree) is lowered (step S1003). FIG. 6 summarizes the processing so far. The above is the processing in the unauthorized access log data analysis processing unit 12.

  Next, the diagnosis result matching processing unit 14 determines whether or not there is a segment vulnerability based on the unauthorized access log data, the signature-diagnosis correspondence table, and the security diagnosis result table (step S1004), and the final alarm level (danger Degree) (step S1005).

  First, from the signature-diagnosis correspondence table having the contents shown in FIG. 8 (stored in the signature-diagnosis correspondence table storage unit 15 in FIG. 2), the detected signature unique number (sig-id) corresponds to which diagnosis. Judge whether to do. For example, it can be seen that the signature unique number 5003 and the signature name “CodeRedA” are the diagnosis name CodeRed with the diagnosis unique number 9874. This table can be created by comparing the signature of the IDS being used with the diagnostic pattern of the diagnostic tool.

  Next, from the security diagnosis result table having the contents as shown in FIG. 9 (stored in the security diagnosis result table storage unit 16 in FIG. 2), the communication device corresponding to the unauthorized access (in FIG. 9, an example of a server) Is determined to be vulnerable, that is, whether or not a countermeasure against the unauthorized access type is taken in the unauthorized access target communication device. In this example, the packet 1 whose sig-id is 5003 has a diagnosis unique number of 9874, and the target server IP address (to-ip) is 10.10.2.1 from FIG. Therefore, it is determined from FIG. 9 that there is no vulnerability (with countermeasures). As a result, a level lower than the alarm level (warning level) indicated in the unauthorized access log data is set as the final alarm level (risk level) and notified. Thereby, the contents after the alarm level adjustment by the security diagnosis result are as shown in FIG.

  Finally, the alarm level adjusting unit 17 actually adjusts the alarm level and notifies the security administrator of the alarm (step S1006). As a result, in this example, for the four unauthorized accesses, only one actually has a harmful effect, and the High level can be raised by one as an alarm.

  As described above, according to the present embodiment, it is possible to narrow down alarms that really need emergency response and notify the administrator, so that the administrator does not miss a truly dangerous alarm. An immediate response can be taken to an alarm with a large amount of actual harm, and the burden on the administrator can be reduced. Also, the implementation can be realized by using the existing one without changing the monitoring sensor and the diagnostic tool and incorporating the program on the manager side.

  Here, the security operation monitoring system described in the above embodiments includes a means for acquiring unauthorized access log data obtained from a monitored network in a network-type unauthorized intrusion detection system (IDS: Intrusion Detection System), By having means for analyzing the acquired data based on the sensor correspondence table, means for comparing with the diagnosis result based on the security diagnosis result table, and means for adjusting the alarm level from those processing results, It is characterized by notifying an operator of an unauthorized access alarm that is truly urgent.

FIG. 3 is a diagram illustrating an example of a system configuration according to the first embodiment. The figure which shows the structural example of a security emergency level adjustment system and an unauthorized intrusion detection system. The figure which shows the example of the data format of an unauthorized access log file. The figure which shows the example of the monitoring sensor correspondence table. The figure which shows the example of unauthorized access log data. The figure which shows the example of the alarm level after alarm level adjustment. The figure which shows the example of the alarm level after alarm level adjustment. The figure which shows the example of a signature-diagnosis correspondence table. The figure which shows the example of a security diagnostic result table. The flowchart figure which shows the process example of a security emergency level adjustment system. The figure explaining a prior art.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Security emergency level adjustment system, 2 Unauthorized intrusion detection system, 11 Unauthorized access log data acquisition part, 12 Unauthorized access log data analysis processing part, 13 Monitoring sensor corresponding | compatible table storage part, 14 Diagnostic result collation process part, 15 Signature-diagnosis correspondence Table storage unit, 16 Security diagnosis result table storage unit, 17 Alarm level adjustment unit, 21 Manager, 22 Unauthorized access log file.

Claims (3)

A security management device connected to an unauthorized intrusion detection system for detecting unauthorized access to a network including a plurality of communication devices and performing security management of the network ,
An unauthorized access countermeasure information storage unit for storing unauthorized access countermeasure information indicating which countermeasure against unauthorized access type is taken for each communication device;
The unauthorized access log data indicating the unauthorized access type of unauthorized access detected by the unauthorized access detection system, the communication device targeted by the unauthorized access, and the level of alertness of the unauthorized access is acquired from the unauthorized access detection system . An unauthorized access log data acquisition unit;
The alertness level is a specific level or higher than that unauthorized access log data, based on said countermeasures against unauthorized access information, measures against the unauthorized access log data indicated Ru unauthorized access type is being taken in the unauthorized access target communication device to determine dolphin not, to determine the same level as the alertness of the unauthorized access log data if it is not action is taken to have you in the unauthorized access target communication equipment as a risk of unauthorized access, communication of unauthorized access target A risk determination unit that determines a level lower than the alertness of the unauthorized access log data as the risk of unauthorized access when measures are taken in the device ;
A security management device comprising: an alarm notification unit for performing alarm notification for unauthorized access when the risk level determined by the risk level determination unit is equal to or higher than the specific level . The security management device includes:
A network including a plurality of segments each having a network address is subject to security management.
Connected to an unauthorized intrusion detection system that includes multiple monitoring sensors that monitor unauthorized access and detect unauthorized access by segment,
The unauthorized access log data acquisition unit
Obtain unauthorized access log data indicating the monitoring sensor that detected unauthorized access and the communication address of the communication device targeted by the unauthorized access,
The security management device further includes:
A monitoring sensor correspondence table storage unit for storing a monitoring sensor correspondence table indicating a network address and a monitoring sensor corresponding to each segment;
For unauthorized access log data with a warning level equal to or higher than a specific level, based on the monitoring center correspondence table, a segment provided with a network address including the communication address indicated in the unauthorized access log data and the unauthorized access It has an unauthorized access log data analysis processing unit that determines whether or not the segments targeted by the monitoring sensor indicated in the log data match, and if they match, the warning level of the unauthorized access log data is changed to a lower level. And
The risk determination unit
The unauthorized access log data analysis processing unit determines the risk of unauthorized access based on the unauthorized access countermeasure information for unauthorized access log data having a warning level equal to or higher than the specific level after processing by the unauthorized access log data analysis processing unit. The security management device according to claim 1. To a computer connected to an unauthorized intrusion detection system that detects unauthorized access to a network containing multiple communication devices ,
Obtaining unauthorized access log data the unauthorized rogue access intrusion detection system detected unauthorized access type and the unauthorized access of alertness communication device and the unauthorized access of interest level is shown from the intrusion detection system Unauthorized access log data acquisition processing,
For unauthorized access log data with a warning level equal to or higher than a specific level, the unauthorized access log data is displayed in the unauthorized access log data based on unauthorized access countermeasure information that indicates which countermeasures against unauthorized access types are taken for each communication device. that measures against unauthorized access type is determined whether or not been taken in the unauthorized access target communication device, the alertness of the unauthorized access log data if not action is taken to have your unauthorized access target communication device The same level is determined as the risk of unauthorized access, and if measures are taken in the unauthorized access target communication device, the risk is determined to be a risk of unauthorized access that is lower than the alert level of the unauthorized access log data. Processing,
An alarm notification process for performing an alarm notification for unauthorized access when the risk determined by the risk determination process is equal to or higher than the specific level .

Images