JP4878630B2 - Communication server and DoS attack prevention method - Google Patents

Description

  The present invention relates to a communication server and a DoS (Denial of Service attack) attack protection method.

  In recent years, communication systems that perform communications via the Internet and provide services such as call control have become widespread, while attacks by unauthorized access intended to interfere with such systems are increasing.

  In particular, a DoS attack that generates a large amount of unauthorized access to a communication server in the system, increases the load on the communication server, causes a problem in service provision, or in the worst case, brings down the communication server. And DDoS (Distributed Denial of Service attack) attacks are difficult to distinguish from legitimate access, and it is difficult to take effective countermeasures, which plagues system administrators. Hereinafter, when a DoS attack is used, a DDoS attack is also included.

  As a technique for protecting the system from such a DoS attack, Patent Document 1 discloses an abnormal traffic detection device that detects abnormal traffic between a SIP server or SIP client to be protected from a DoS attack and the Internet. A technique for installing and detecting a DoS attack is described. The abnormal traffic detection device acquires information on the processing state of the SIP transaction processing from the header of the SIP packet, monitors the SIP packet processed in the SIP transaction processing, and acquires the monitored SIP packet and the acquired SIP transaction processing. And abnormal packet traffic due to unauthorized access based on the information regarding the processing state of the packet.

  As another technique for protecting the system from a DoS attack, Patent Literature 2 describes the number of packets received from each user terminal per unit time in an edge router that accommodates the user terminals. A technique is described in which when the number of packets exceeds a preset threshold value, a DoS attack is determined and packet transmission from the user terminal is restricted.

  In the technologies described in Patent Document 1 and Patent Document 2, communication is performed by installing an abnormal traffic detection device or an edge router having a function of detecting a DoS attack between a communication server and the Internet. A DoS attack can be protected without imposing a burden on the server or the like.

  As still another technique for protecting the system from a DoS attack, Patent Literature 3 describes the number of signals received from each terminal within the first monitoring period in a communication server in a system having a plurality of terminals. When the counted number of signals exceeds the first threshold, the number of signals having a predetermined processing content is counted from the signals received from the terminal within the second monitoring period, and the signal having the predetermined processing content is counted. A technique for determining a DoS attack when the number exceeds a second threshold is described. In this technique, since the number of signals of specific processing contents is counted, a DoS attack can be detected with higher accuracy according to the service specifications. In addition, with this technique, unlike the techniques of Patent Document 1 and Patent Document 2, it is not necessary to prepare a device such as an abnormal traffic detection device or an edge router, so that the cost required to protect the system from a DoS attack is suppressed. be able to.

JP 2007-267151 A Japanese Patent Laid-Open No. 2006-100844 JP 2006-237892 A

  However, the techniques described in Patent Documents 1 to 3 described above have the following problems.

  In the technique described in Patent Document 1, it is necessary to prepare an abnormal traffic detection device for each SIP server or SIP client to be protected, and there is a problem that the cost required to protect the system from a DoS attack increases.

  In addition, in the technique described in Patent Document 2, since it is impossible to specify in advance who is a DoS attacker, the number of packets from each user terminal is counted, and whether or not the DoS attack is based on the result is counted. It is necessary to add a function to be determined to all edge routers, and there is a problem that the cost required to protect the system from a DoS attack increases.

  In the technique described in Patent Document 3, as described above, the communication server is provided with a function for determining whether or not it is a DoS attack, so that the cost can be reduced. However, in this technology, since the communication server determines whether or not it is a DoS attack, the process itself becomes a load on the communication server, and if the load factor of the communication server is high, the process of the entire communication server is affected. There is a possibility of effect. The load factor is a value indicating the ratio of the processing amount actually performed by the communication server to the maximum processing amount of the communication server.

  An object of the present invention is to reduce the cost by performing a DoS attack detection process on a communication server and reduce the load caused by the detection process when the load ratio of the communication server is high, and DoS attack defense It is to provide a method.

In order to achieve the above object, the communication server of the present invention provides:
In a communication server that sends and receives signals to and from a terminal,
A storage unit that records a load factor of the communication server, a DoS attack detection condition, and a DoS attack regulation content in association with each other;
A load factor calculating unit for calculating a load factor of the communication server;
While monitoring the signal received from the terminal, the terminal performs a DoS attack based on the detection condition associated with the load factor calculated by the load factor calculation unit and the result of the monitoring. A detection unit for determining whether or not to go;
Transmission / reception to / from the terminal determined to be performing a DoS attack at the detection unit based on the regulation content associated with the load factor calculated at the load factor calculation unit at the storage unit And a restricting section for restricting a signal to be transmitted.

In order to achieve the above object, the DoS attack defense method of the present invention comprises:
A DoS attack prevention method performed by a communication server having a storage unit that records the DoS attack detection condition and the DoS attack restriction content,
A recording step of associating the load factor of the communication server with the detection condition of the DoS attack and the restriction content against the DoS attack in the storage unit;
A calculation step of calculating a load factor of the communication server;
Whether the terminal is performing a DoS attack based on the detection condition associated with the load factor calculated in the calculation step and the result of the monitoring while monitoring the signal received from the terminal A detection step for determining whether or not;
Based on the regulation content associated with the load factor calculated in the calculation step in the storage unit, the signal transmitted to and received from the terminal determined to be performing a DoS attack in the detection step And a regulation step for regulating.

  As described above, in the present invention, the communication server calculates its own load factor, and detects and regulates the DoS attack while changing the DoS attack detection condition and the DoS attack regulation content according to the calculated load factor. Do.

  In this way, since the DoS attack is detected and regulated by the communication server, the cost can be reduced, and the load can be reduced by changing the DoS attack detection condition and the regulation contents according to the load rate of the communication server. When the rate is high, the DoS attack can be detected and regulated so that the communication server is not loaded.

It is a block diagram which shows the structure of the communication system of one Embodiment of this invention. It is a block diagram which shows an example of a structure of the call control apparatus shown in FIG. It is a figure which shows an example of a structure of the detection condition table shown in FIG. It is a figure which shows an example of a structure of the regulation condition table shown in FIG. It is a figure which shows an example of a structure of the load factor corresponding | compatible table shown in FIG. The conceptual diagram explaining an example of operation | movement of a detection part and a control part when the load factor of the call control apparatus shown in FIG. 2 is low. The conceptual diagram explaining an example of operation | movement of a detection part and a control part when the load factor of the call control apparatus shown in FIG. 2 is high. 3 is a flowchart illustrating an example of an operation when the load factor of the call control device illustrated in FIG. 2 is low. 3 is a flowchart for explaining an example of an operation when the load factor of the call control device shown in FIG. 2 is high. 3 is a sequence chart for explaining an example of the operation of the communication system shown in FIG. 1.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of a communication system according to an embodiment of the present invention.

  As illustrated in FIG. 1, the communication system according to the present embodiment includes an NGN (Next Generation Network) 1 and terminal devices 5 a and 5 b connected to the NGN 1.

  NGN 1 is a network having a packet transfer layer 2 and a service control layer 3.

  The packet transfer layer 2 is a collection of functions for transferring packets.

  The service control layer 3 includes a call control device 4 as a component device, and is a collection of functions for controlling various services provided to the terminal devices 5a and 5b.

  The call control device 4 is a communication server that performs call control between the terminal devices 5a and 5b, detects a DoS attack based on detection conditions set in advance, and from the terminal devices 5a and 5b that perform the DoS attack. And the incoming calls to the terminal devices 5a and 5b are restricted. Further, the call control device 4 periodically calculates its own load factor, and changes the DoS attack detection conditions and the DoS attack restriction content according to the load factor calculation result. In the call control performed by the call control device 4, the terminal device 5a, 5b accommodated by the call control device 4 accepts a call made from the terminal device 5a, 5b that is the call source, and sends it to the terminal device 5a, 5b that is the call destination. There are subscriber-type call control for transmitting an incoming call and relay-type call control for transferring a call accepted by another call control device 4 (not shown) to another call control device 4 (not shown). Further, although only one call control device 4 exists in FIG. 1, a plurality of call control devices 4 may exist.

  The terminal devices 5a and 5b are terminal devices operated by a user of a communication service provided by the communication system according to the present embodiment. In FIG. 1, only the terminal devices 5a and 5b are present as terminal devices, but there may be only one or more than two.

Hereinafter, the configuration of the call control device 4 which is a feature of the present invention will be described in detail.
(Configuration of call control device 4)
FIG. 2 is a block diagram showing an example of the configuration of the call control device 4 shown in FIG. In FIG. 2, only the components related to the function of detecting and regulating the DoS attack, which is a feature of the present invention, of the functions of the call control device 4 are shown. Since the above-described call control can be realized using a known technique such as SIP-based call control, the description thereof is omitted here.

  As illustrated in FIG. 2, the call control device 4 illustrated in FIG. 1 includes a storage unit 41, a load factor calculation unit 42, a selection unit 43, a detection unit 44, and a regulation unit 45.

  Further, the storage unit 41 includes a detection condition table 411, a restriction condition table 412, and a load factor correspondence table 413.

  The detection condition table 411 is a table in which detection conditions for detecting a DoS attack, which are input by a maintenance person of the communication system of the present embodiment, are recorded for each detection type serving as an identifier.

  The restriction condition table 412 is a restriction type that is an identifier of restriction contents for restricting outgoing calls from the terminal devices 5a and 5b that are performing a DoS attack and incoming calls to the terminal devices 5a and 5b, which are input by the maintainer. It is a table recorded for each.

  The load factor correspondence table 413 is a table in which the detection type recorded in the detection condition table 411 and the restriction type recorded in the restriction condition table 412 are recorded in association with the load factor of the call control device 4.

  The load factor calculation unit 42 calculates the load factor of the call control device 4 based on a change in the CPU (Central Processing Unit) usage rate during a predetermined period set by the maintenance person, and notifies the selection unit 43 of the load factor. Here, for example, when the predetermined period is set to 30 seconds by the maintenance person, the load factor calculating unit 42 calculates the load factor 70% when the state where the CPU usage rate is 70% or more continues for 30 seconds or more. It shall be. Note that the load factor calculation method of the call control device 4 is not limited to the above-described calculation method based on the CPU usage rate. For example, other hardware resources such as the memory usage rate of the call control device 4 You may use the method of calculating according to a use condition.

  The selection unit 43 accesses the storage unit 41 and acquires a detection type and a regulation type corresponding to the load factor from the load factor correspondence table 413 based on the load factor notified from the load factor calculation unit 42. In addition, the selection unit 43 acquires the detection condition of the acquired detection type and the restriction content of the restriction type from the detection condition table 411 and the restriction condition table 412, respectively, and notifies the detection unit 44 and the restriction unit 45.

  The detection unit 44 monitors outgoing calls from the terminal devices 5a and 5b and incoming calls to the terminal devices 5a and 5b. Based on the monitoring result and the detection condition notified from the selection unit 43, the terminal devices 5a and 5b Determine if you are attacking. For example, if SIP is used for call control, the detection unit 44 transmits the number of SIP message signals transmitted and received between the call control device 4 and the terminal devices 5a and 5b based on the notified detection conditions. When the number of counted signals satisfies the detection condition, it is determined that the terminal devices 5a and 5b are performing a DoS attack. For example, when the detection unit 44 determines that the terminal device 5a is performing a DoS attack, the detection unit 44 notifies the regulation unit 45 that the DoS attack from the terminal device 5a has been detected. Further, when the detection unit 44 detects that the attack is in a continuous state even after the DoS attack is detected, the detection unit 44 notifies the restriction unit 45 to that effect. When SIP is used for call control, the detection unit 44 may count only the INVITE message signal used for establishing the SIP session among the SIP message signals.

  The restriction unit 45 receives the notification from the detection unit 44, and based on the restriction content notified from the selection unit 43, the transmission from the terminal devices 5a and 5b performing the DoS attack and the transmission to the terminal devices 5a and 5b. Restrict incoming calls. The restricting unit 45 transmits an alarm notifying that the restriction is being applied to the maintenance person. Here, restricting the transmission from the terminal devices 5a and 5b refers to discarding the signals received from the terminal devices 5a and 5b regardless of where the destination is. Further, restricting incoming calls to the terminal devices 5a and 5b refers to discarding signals from the terminal devices 5a and 5b regardless of where the transmission source is.

Below, the structure of the detection condition table 411, the regulation condition table 412, and the load factor correspondence table 413 is demonstrated.
(Configuration of detection condition table 411)
FIG. 3A is a diagram illustrating an example of the configuration of the detection condition table 411 illustrated in FIG. 2.

  As illustrated in FIG. 3A, the detection condition table 411 illustrated in FIG. 2 indicates a period for counting the number of signals received from the same IP address and the same port number in the call control device 4 for each detection type. The time width and the number serving as a threshold used when determining whether or not the DoS attack is based on the number of signals counted during the time width are recorded as DoS attack detection conditions.

  For example, in the example illustrated in FIG. 3A, in the case of the detection type A, the detection unit 44 is conditional on receiving Md or more signals from the same IP address and the same port number during the time width Nd. Then, it is determined that the DoS attack is received from the terminal devices 5a and 5b having the IP address. Similarly, in the case of the detection type B, the detection unit 44 determines a DoS attack on the condition that more than Me signals are received from the same IP address and the same port number during the time width Ne, and the detection type C In this case, the DoS attack is determined on condition that Mf or more signals are received from the same IP address and the same port number during the time width Nf.

It is assumed that the time width has a relationship of Nd>Ne> Nf, and the number serving as a threshold has a relationship of Md <Me <Mf. Therefore, in the example shown in FIG. 3A, the detection conditions become stricter in the order of detection type A <detection type B <detection type C, and the terminal devices 5a and 5b that match the detection conditions in this order will receive DoS. The possibility of being attacked increases.
(Configuration of restriction condition table 412)
FIG. 3B is a diagram illustrating an example of the configuration of the restriction condition table 412 illustrated in FIG.

  As shown in FIG. 3-2, the restriction condition table 412 shown in FIG. 2 includes, for each restriction type, restriction contents for outgoing calls from the terminal devices 5 a and 5 b that are performing a DoS attack, and the terminal devices 5 a and 5 b. The contents of restrictions on incoming calls to 5b are recorded. Here, the partial restriction means that the signal is discarded at a certain rate set by the maintenance person, for example, once every three times, and the full restriction means that all signals are discarded. Means to discard.

For example, in the example illustrated in FIG. 3B, in the case of the restriction type 1, the restriction unit 45 partially restricts transmission from the terminal devices 5 a and 5 b performing the DoS attack, and then sends the restriction to the terminal devices 5 a and 5 b. No restrictions on incoming calls. Similarly, in the case of the restriction type 2, the restriction unit 45 completely restricts outgoing calls from the terminal devices 5a and 5b performing the DoS attack, does not restrict incoming calls to the terminal devices 5a and 5b, and does not restrict the incoming calls to the terminal devices 5a and 5b. In the case of 3, the transmission from the terminal devices 5a and 5b performing the DoS attack and the incoming call to the terminal devices 5a and 5b are completely restricted.
(Configuration of load factor correspondence table 413)
FIG. 3-3 is a diagram illustrating an example of the configuration of the load factor correspondence table 413 illustrated in FIG. 2.

  As illustrated in FIG. 3C, the load factor correspondence table 413 illustrated in FIG. 2 records the load factor of the call control device 4, the detection condition, and the restriction type in association with each other. Here, the load factor of the call control device 4 is divided into two states, a high load factor and a low load factor, and the detection conditions and the restriction types are recorded in association with each other. Here, a case where the load factor is 70% or more is defined as a state where the load factor is high, and a case where the load factor is smaller than 70% is defined as a state where the load factor is low.

  The maintenance person can record the load factor of the call control device 4 in association with the detection condition and the restriction type in the load factor correspondence table 413. In the example shown in FIG. On the other hand, the detection types A to C are recorded in association with the restriction types 1 to 3, respectively, and the detection type A or the detection type C is recorded in association with the restriction type 3 for a high load rate. Yes.

The detection process shown in FIG. 2 for detecting the DoS attack and the operation of the restricting process for restricting the outgoing call from the terminal devices 5a and 5b and the restricting process of the restricting unit 45 to the terminal devices 5a and 5b will be described below. To do.
(Detection processing and restriction processing when the load factor of the call control device 4 is low)
FIG. 4A is a conceptual diagram illustrating an example of operations of the detection process of the detection unit 44 and the restriction process of the restriction unit 45 when the load factor of the call control device 4 illustrated in FIG. 2 is low.

  As shown in FIG. 4A, when the load factor calculated by the load factor calculation unit 42 shown in FIG. 2 is smaller than 70%, that is, when the load factor is low, the detection unit 44 first detects the load factor. When the detection process is performed based on the detection condition of the detection type A with the loosest condition and a DoS attack is detected, the control unit 45 is informed of that fact. In response to this, the restriction unit 45 applies restriction of restriction type 1 corresponding to detection type 1, and transmits an alarm indicating the restriction to the maintenance person.

  Next, the detection unit 44 performs detection processing based on the detection condition of the detection type B, and when detecting a DoS attack, notifies the regulation unit 45 to that effect. In response, the restriction unit 45 applies restriction type 2 corresponding to the detection condition B, and transmits an alarm 2 indicating that the restriction type 2 restriction has been applied to the maintenance person.

  Next, the detection unit 44 performs detection processing based on the detection condition of the detection type C with the strictest detection condition, and when detecting a DoS attack, notifies the restriction unit 45 to that effect. In response to this, the restriction unit 45 applies restriction of restriction type 3 corresponding to the detection condition C, and transmits an alarm 3 indicating that to the maintenance person.

If the detection unit 44 does not match the detection condition as a result of performing the detection process based on the detection condition of the detection type A after detecting the DoS attack, the detection unit 44 determines that the DoS attack has been calmed down, and indicates that. The restriction unit 45 is notified. In response to this, the restricting unit 45 performs a process of releasing the restriction and returning to the normal state. In addition, when the detection unit 44 does not match the detection condition as a result of performing the detection process based on the detection condition of the detection type B, the detection unit 44 determines that the DoS attack is going to calm down, and determines the DoS attack. The detection condition to be used is changed from the detection condition B to the detection condition A, and a notification to that effect is sent to the regulation unit 45. In response to this, the restriction unit 45 performs a process of returning to the restriction of restriction type 1 corresponding to the detection condition A, or releasing the restriction and returning to the normal state. Similarly, if the detection unit 44 does not match the detection condition as a result of performing the detection process based on the detection condition of the detection type C, the detection unit 44 determines that the DoS attack is about to calm down, and determines the DoS attack. Is changed from the detection condition C to the detection condition B or the detection condition A, and a notification to that effect is sent to the regulation unit 45. In response to this, the regulation unit 45 determines that the regulation type 2 corresponding to the detection type B is regulated or the regulation type 1 regulation corresponding to the detection type A is returned to or is calmed down, and the regulation is released. Processing to return to the state of.
(Detection processing and restriction processing when the load factor of the call control device 4 is high)
FIG. 4B is a conceptual diagram illustrating an example of operations of the detection process of the detection unit 44 and the restriction process of the restriction unit 45 when the load factor of the call control device 4 illustrated in FIG. 2 is high.

  As shown in FIG. 4B, when the load factor calculated by the load factor calculation unit 42 shown in FIG. 2 is 70% or more, that is, when the load factor is high, the detection unit 44 first detects the detection type. When the detection process is performed based on the detection condition of either A or detection type C and a DoS attack is detected, the restriction unit 45 is notified of this. In response to this, the restriction unit 45 places a restriction of restriction type 3 and transmits an alarm 3 indicating that to the maintenance person. It is assumed that the detection unit 44 uses the condition selected by the maintenance person among the detection type A and detection type C conditions.

  In addition, after detecting the DoS attack, the detection unit 44 performs the detection process based on the detection type A or the detection type C, and determines that the DoS attack has been calmed down when the detection condition is not met. This is notified to the regulation unit 45. In response to this, the restricting unit 45 performs a process of releasing the restriction and returning to the normal state.

  As described above, in the communication system according to the present embodiment, the processing when the load factor of the call control device 4 is high has fewer steps than the processing when the load factor is low. In this way, the load applied to the call control device 4 by the detection processing and the restriction processing when the load factor is high by changing the processing contents of the detection processing and the restriction processing to be performed according to the load factor of the call control device 4. Can be reduced.

The operation of the call control device 4 shown in FIG. 2 will be described in detail below.
(Operation of call control device 4 when load factor is low)
First, the operation when the load factor of the call control device 4 shown in FIG. 2 is low will be described.

  FIG. 5 is a flowchart for explaining an example of the operation when the load factor of the call control device 4 shown in FIG. 2 is low.

  As shown in FIG. 5, first, the storage unit 41 shown in FIG. 2 is configured by the maintenance person to associate the detection condition, the restriction content, the load factor of the call control device 4, the detection condition, and the restriction content, Is recorded in the detection condition table 411, the regulation condition table 412 and the load factor correspondence table 413, respectively (step A1).

  Next, the load factor calculation unit 42 periodically calculates the load factor of the call control device 4 (step A2) and notifies the selection unit 43 of the load factor.

  Next, the selection unit 43 acquires the detection type and the regulation type from the load factor correspondence table 413 based on the load factor notified from the load factor calculation unit 42. Here, since the load factor of the call control device 4 is low, the detection types A to C and the regulation types 1 to 3 corresponding to them are acquired.

  Next, the selection unit 43 acquires the detection conditions of the detection types A to C from the detection condition table 411, acquires the restriction contents of the restriction types 1 to 3 from the restriction condition table 412 (step A3), and detects them. Notification to the unit 44 and the regulation unit 45.

  Next, the detection unit 44 counts the number of signals received from each of the terminal devices 5a and 5b during the time width Nd based on the detection condition of the detection type A (step A4), and from the terminal devices 5a and 5b. When Md or more signals are received (step A5), it is determined that the terminal devices 5a and 5b are performing a DoS attack, and this is notified to the regulation unit 45. In response to this, the restricting unit 45 applies restriction of restriction type 1 to outgoing calls from the terminal devices 5a and 5b and incoming calls to the terminal devices 5a and 5b that are determined to be performing a DoS attack (step A6). ), Alarm 1 is transmitted to the maintenance person (step A7).

  When the detection unit 44 detects a DoS attack under the detection type A detection condition, the number of signals received from each of the terminal devices 5a and 5b during the time width Ne based on the detection type B detection condition. Is counted (step A8), and when more than Me signals are received from the terminal devices 5a and 5b (step A9), it is determined that the terminal devices 5a and 5b are performing a DoS attack, and the control unit 45 is notified. In response to this, the restricting unit 45 applies restriction of restriction type 2 to outgoing calls from the terminal devices 5a and 5b determined to be performing a DoS attack and incoming calls to the terminal devices 5a and 5b (step A10). ), Alarm 2 is transmitted to the maintenance person (step A11).

  Furthermore, when a DoS attack is detected under the detection condition of detection type B, the detection unit 44 receives signals received from the terminal devices 5a and 5b during the time width Nf based on the detection condition of detection type C. When the number is counted (step A12) and Mf or more signals are received from the terminal devices 5a and 5b (step A13), it is determined that the terminal devices 5a and 5b are performing a DoS attack, and that is regulated. Notify the unit 45. In response to this, the restricting unit 45 applies restriction of restriction type 3 to outgoing calls from the terminal devices 5a and 5b and incoming calls to the terminal devices 5a and 5b that are determined to be performing a DoS attack (step A14). ), Alarm 3 is transmitted to the maintenance person (step A15).

  Even after the alarm 3 is transmitted, the detection unit 44 repeatedly counts the number of signals received from each of the terminal devices 5a and 5b during the time width Nf based on the detection condition of the detection type C (step A16). When Mf or more signals are received from the devices 5a and 5b (step A17), the control unit 45 is notified of this. In response to this, the restricting unit 45 determines that the DoS attack is continuing, and restricts outgoing calls from the terminal devices 5a and 5b and incoming calls to the terminal devices 5a and 5b that are determined to be performing the DoS attack. Continue regulation by Type 3.

  In step A5, when the number of signals counted during the time width Nd is smaller than Md, the detection unit 44 determines that neither of the terminal devices 5a and 5b has been subjected to a DoS attack, and proceeds to step A4. Return and repeat counting.

  Further, in step A9, when the number of signals counted during the time width Ne is smaller than Me, the detection unit 44 determines that the DoS attack has subsided if the count number is smaller than Md. In addition to notifying the restricting unit 45, the process returns to step A4 and repeats counting. Further, the restriction unit 45 releases the restriction based on the notification (step A18). In addition, the detection part 44 returns to step A8, and repeats a count, when count number is more than Md and smaller than Me.

  In step A13, when the number of signals counted during the time width Nf is equal to or greater than Mf, the detection unit 44 determines that the DoS attack has subsided if the count number is smaller than Md, and regulates that. In addition to notifying the unit 45, the process returns to step A4 to repeat counting. The restricting unit 45 returns to Step A18 and cancels the restriction based on the notification.

  In step A13, when the count number during the time span Nf is greater than or equal to Md and smaller than Me, the detection unit 44 determines that the DoS attack is about to calm down and notifies the regulation unit 45 to that effect. At the same time, the process returns to step A8 to repeat counting. Further, the restricting unit 45 changes the restriction type from the restriction type 2 to the restriction type 1 based on the notification (step A19). When the count number is equal to or greater than Me and smaller than Mf, the detection unit 44 returns to Step A12 and repeats the count.

  Further, in step A17, when the number of signals counted during the time width Nf is smaller than Mf, the detection unit 44 determines that the DoS attack has subsided if the count number is smaller than Md. In addition to notifying the restricting unit 45, the process returns to step A4 and repeats counting. The restricting unit 45 returns to Step A18 and cancels the restriction based on the notification.

  In step A17, if the count number during the time width Nf is greater than or equal to Md and smaller than Me, the detection unit 44 determines that the DoS attack is going to calm down, and notifies the regulation unit 45 to that effect. At the same time, the process returns to step A8 to repeat counting. Further, the restricting unit 45 returns to step 19 and changes the restriction type from the restriction type 3 to the restriction type 1 based on the notification.

In step A17, when the count number during the time width Nf is greater than or equal to Me and smaller than Mf, the detection unit 44 determines that the DoS attack is about to calm down and notifies the regulation unit 45 to that effect. At the same time, the process returns to step A12 to repeat counting. Further, the restriction unit 45 changes the restriction type from the restriction type 3 to the restriction type 2 based on the notification (step A20).
(Operation of call control device 4 when load factor is high)
Next, the operation when the load factor of the call control device 4 is high will be described.

  FIG. 6 is a flowchart for explaining an example of the operation when the load factor of the call control device 4 shown in FIG. 2 is high. It is assumed that the detection type A is selected in advance as a detection type used by the detection unit 44 when the load factor is high by the maintenance person.

  As shown in FIG. 6, first, the storage unit 41 shown in FIG. 2 determines whether the maintenance condition is associated with the detection condition, the restriction content, and the association of the load factor of the call control device 4 with the detection condition and the restriction content. When input, they are recorded in the detection condition table 411, the regulation condition table 412, and the load factor correspondence table 413, respectively (step B1).

  Next, the load factor calculation unit 42 periodically calculates the load factor of the call control device 4 (step B2) and notifies the selection unit 43 of the load factor.

  Next, the selection unit 43 acquires the detection type and the regulation type from the load factor correspondence table 413 based on the load factor notified from the load factor calculation unit 42. Here, since the load factor of the call control device 4 is high, the detection type A and the restriction type 3 are acquired.

  Next, the selection unit 43 acquires the detection condition of the detection type A from the detection condition table 411 based on them, acquires the restriction content of the restriction type 3 from the restriction condition table 412 (step B3), The detection unit 44 and the regulation unit 45 are notified.

  Next, the detection unit 44 counts the number of signals received from each of the terminal devices 5a and 5b during the time width Nd based on the detection condition of the detection type A (step B4), and from the terminal devices 5a and 5b. When Md or more signals are received (step B5), it is determined that the terminal devices 5a and 5b are performing a DoS attack, and this is notified to the regulation unit 45. In response to this, the restricting unit 45 applies restriction of restriction type 3 to outgoing calls from the terminal devices 5a and 5b determined to be performing a DoS attack and incoming calls to the terminal devices 5a and 5b (step B6). ), Alarm 3 is transmitted to the maintenance person (step B7).

  Even after the alarm 3 is transmitted, the detection unit 44 repeatedly counts the number of signals received from each of the terminal devices 5a and 5b during the time width Nd based on the detection condition of the detection type A (step B8). When Md or more signals are received from the devices 5a and 5b (step B9), it is determined that the DoS attack is continuing, and this is notified to the regulation unit 45. In response to this, the restriction unit 45 continues the restriction by restriction type 3 for the transmission from the terminal devices 5a and 5b determined to be performing the DoS attack and the incoming call to the terminal devices 5a and 5b.

  In addition, when the number of signals counted during the time width Nd is smaller than Md in step B5, the detection unit 44 determines that neither of the terminal devices 5a and 5b has been subjected to a DoS attack, and proceeds to step B4. Return and repeat counting.

  In addition, if the number of signals counted during the time width Nd is smaller than Md in step B9, the detection unit 44 determines that the DoS attack has subsided, notifies the regulation unit 45 to that effect, and Return to B4 and repeat counting. Further, the restriction unit 45 releases the restriction based on the notification (step B10).

Below, operation | movement of the communication system of this embodiment is demonstrated.
(Operation of communication system)
FIG. 7 is a sequence chart for explaining an example of the operation of the communication system shown in FIG. FIG. 7 shows a sequence between the terminal device 5a and the call control device 4.

  Here, the operation of the communication system when the load factor of the call control device 4 shown in FIG. 1 is low will be described.

  As shown in FIG. 7, first, in the call control device 4 shown in FIG. 1, the storage unit 41 shown in FIG. 2 includes the detection condition input by the maintenance person, the contents of regulation, and the load of the call control device 4. The association of the rate with the detection condition and the regulation content is recorded in the detection condition table 411, the regulation condition table 412 and the load factor correspondence table 413, respectively (step C1).

  Next, in the call control device 4, the load factor calculation unit 42 calculates the load factor of the call control device 4, and notifies the selection unit 44 of the calculation result (step C2). In response to this, the selection unit 44 determines from the detection condition table 411, the restriction condition table 412, and the load factor correspondence table 413, based on the calculation result, the detection type A that is the detection condition of the DoS attack when the load factor is low. To C and the corresponding restriction types 1 to 3 are acquired (step C3), and they are notified to the detection unit 44 and the restriction unit 45.

  Here, as shown in FIG. 7, it is assumed that the terminal device 5a shown in FIG. 1 starts to repeatedly transmit, for example, a session establishment request as a DoS attack to the call control device 4 (step C4).

  Next, in the call control device 4, the detection unit 44 counts the number of signals received from the terminal device 5a based on the detection type 1 detection condition (step C5). Then, restriction of restriction type 1 is applied to the terminal device 5a (step C6). In addition, the detection unit 44 counts the number of signals received from the terminal device 5a based on the detection condition of the detection type 2 (step C7). (Step C8). Furthermore, the detection unit 44 counts the number of signals received from the terminal device 5a based on the detection type 3 detection condition (step C9). Restriction of restriction type 3 is applied (step C10).

  Thereafter, in the call control device 4, the detection unit 44 continues counting the number of signals received from the terminal device 5 a even after the restriction type 45 is restricted by the restriction type 45 (step C <b> 11). When it is detected that the DoS attack has subsided, the restriction unit 45 is notified accordingly. In response, the restriction unit 45 releases the restriction on the terminal device 5a (step C12).

  As described above, in the present embodiment, the call control device 4 calculates its own load factor, and changes the DoS attack detection conditions and the DoS attack restriction contents according to the calculated load factor. Perform detection and regulation.

  In this way, since the DoS attack is detected and regulated by the call control device 4, the cost can be suppressed, and the detection condition and regulation contents are changed according to the load factor of the call control device 4, When the load factor is high, the DoS attack can be detected and regulated so that the call control device 4 is not loaded.

  In addition, since the DoS attack can be detected and regulated, the end users who are users of the terminal devices 5a and 5b can use the network at any time because the security of the network is increased. For a person, by providing a secure network, satisfaction of end users and service providers can be improved, and the end users and service providers can be enclosed.

1 NGN (Next Generation Network)
2 packet transfer layer 3 service control layer 4 call control device 5a, 5b terminal device 41 storage unit 42 load factor calculation unit 43 selection unit 44 detection unit 45 regulation unit 411 detection condition table 412 regulation condition table 413 load factor correspondence table

Claims (12)

In a communication server that sends and receives signals to and from a terminal,
A storage unit that records the load factor of the communication server, the DoS attack detection condition set in a plurality of stages according to the load factor of the communication server, and the restriction content for the DoS attack in association with each other;
A load factor calculating unit for calculating a load factor of the communication server;
While monitoring the signal received from the terminal, the terminal performs a DoS attack based on the detection condition associated with the load factor calculated by the load factor calculation unit and the result of the monitoring. A detection unit for determining whether or not to go;
Transmission / reception to / from the terminal determined to be performing a DoS attack at the detection unit based on the regulation content associated with the load factor calculated at the load factor calculation unit at the storage unit possess a regulating portion for applying the regulations with respect to the signal to be,
The storage unit
For each detection condition, a detection type that is an identifier of the detection condition, a time width indicating a period for counting the number of signals received from the terminal by the communication server, and the number of signals counted during the time width A detection condition table that records a threshold value used when determining whether or not the terminal is performing a DoS attack based on;
For each restriction content, the restriction type that is an identifier of the restriction content, the restriction content for the signal received from the terminal that is determined to be performing a DoS attack by the detection unit, and the signal that is transmitted to the terminal A regulation condition table recording the regulation contents;
A load factor correspondence table in which the load factor, the detection type, and the restriction type are recorded in association with each other;
The detection type and the restriction type corresponding to the load factor calculated by the load factor calculation unit are acquired from the load factor correspondence table, and the load factor is supported based on the acquired detection type and the restriction type. A selection unit that acquires the detection condition and the restriction content from the detection condition table and the restriction condition table;
The detection unit determines whether the terminal is performing a DoS attack based on the detection condition acquired by the selection unit,
The said control part is a communication server which places restrictions on the signal transmitted / received between the said terminals based on the said control content acquired in the said selection part . The communication server according to claim 1 ,
The detection unit counts the number of signals received from the terminal during the time span included in the detection condition acquired by the selection unit in the monitoring, and when the number of signals is equal to or greater than the threshold, A communication server that determines that the terminal is performing a DoS attack. The communication server according to claim 2 ,
The detection unit continuously counts the number of signals received from the terminal during the time span even after determining that the terminal is performing a DoS attack,
The restriction unit is a communication server that releases restriction on the terminal when the number of signals counted by the detection unit is smaller than the threshold value. In the communication server according to claim 2 or claim 3 ,
The load factor correspondence table records the detection type and the restriction type in association with each other,
The detection unit, when a plurality of detection conditions are acquired by the selection unit, the detection condition used to determine whether or not the terminal is performing a DoS attack according to the number of signals counted in the monitoring Change
The said control part is a communication server which changes the said control content used for the said control to the said control content corresponding to the said changed detection condition, when the said detection conditions are changed in the said detection part. In the communication server according to any one of claims 2 to 4 ,
The communication server transmits and receives a SIP message signal as the signal to and from the terminal, and performs call control of the terminal.
The detection unit is a communication server that counts the number of SIP message signals received from the terminal in the monitoring. The communication server according to claim 5 ,
The detection unit is a communication server that counts the number of INVITE message signals among SIP message signals received from the terminal in the monitoring. A DoS attack prevention method performed by a communication server having a storage unit that records the DoS attack detection condition and the DoS attack restriction content,
A recording step of associating the load factor of the communication server with the detection condition of the DoS attack set in a plurality of stages according to the load factor of the communication server and the restriction content with respect to the DoS attack in the storage unit in association with each other; ,
A calculation step of calculating a load factor of the communication server;
Whether the terminal is performing a DoS attack based on the detection condition associated with the load factor calculated in the calculation step and the result of the monitoring while monitoring the signal received from the terminal A detection step for determining whether or not;
Based on the regulation content associated with the load factor calculated in the calculation step in the storage unit, the signal transmitted to and received from the terminal determined to be performing a DoS attack in the detection step possess and regulatory step of applying the regulation Te,
The storage unit
For each detection condition, a detection type that is an identifier of the detection condition, a time width indicating a period for counting the number of signals received from the terminal by the communication server, and the number of signals counted during the time width A detection condition table that records a threshold value used when determining whether or not the terminal is performing a DoS attack based on;
For each regulation content, the regulation type that is the identifier of the regulation content, the regulation content for the signal received from the terminal determined to be performing a DoS attack in the detection step, and the signal transmitted to the terminal A regulation condition table recording the regulation contents;
The load factor, and a load factor correspondence table in which the detection type and the restriction type are recorded in association with each other,
The detection type and the restriction type corresponding to the load factor calculated in the calculation step are acquired from the load factor correspondence table, and the detection corresponding to the load factor is obtained based on the acquired detection type and the restriction type. A selection step of acquiring conditions and the contents of the regulation from the detection condition table and the regulation condition table;
In the detection step, based on the detection condition acquired in the selection step, it is determined whether the terminal is performing a DoS attack,
The DoS attack protection method , wherein in the restriction step, a restriction is applied to a signal transmitted to and received from the terminal based on the restriction content acquired in the selection step . The DoS attack defense method according to claim 7 ,
In the detection step, the number of signals received from the terminal during the time span included in the detection condition acquired in the selection step in the monitoring is counted, and when the number of signals is equal to or greater than the threshold, A DoS attack defense method for determining that a terminal is performing a DoS attack. The DoS attack defense method according to claim 8 ,
In the detection step, even after it is determined that the terminal is performing a DoS attack, the number of signals received from the terminal continuously during the time span is counted,
The DoS attack protection method, wherein in the restriction step, the restriction on the terminal is released when the number of signals counted in the detection step is smaller than the threshold value. In the DoS attack defense method according to claim 8 or 9 ,
The load factor correspondence table records the detection type and the restriction type in association with each other,
In the detection step, when a plurality of the detection conditions are acquired in the selection step, the detection conditions used for determining whether or not the terminal is performing a DoS attack according to the number of signals counted in the monitoring. Change
In the restriction step, when the detection condition is changed in the detection step, the restriction content used for the restriction is changed to the restriction content corresponding to the changed detection condition. The DoS attack defense method according to any one of claims 8 to 10 ,
The communication server transmits and receives a SIP message signal as the signal to and from the terminal, and performs call control of the terminal,
In the detection step, the DoS attack defense method of counting the number of SIP message signals received from the terminal in the monitoring. The DoS attack defense method according to claim 11 ,
In the detection step, a DoS attack protection method of counting the number of INVITE message signals among SIP message signals received from the terminal in the monitoring.

Images