JP6272258B2 - Optimization device, optimization method, and optimization program - Google Patents

Description

  The present invention relates to an optimization device, an optimization method, and an optimization program.

  In order to protect networks from complex and sophisticated cyber attacks, there are various security devices such as FW (Fire Wall), IDS (Intrusion Detection System), WAF (Web Application Firewall) and the like. In order to protect the network from cyber attacks, traffic control is performed based on static policies determined in advance to use specialized security devices such as input communication protocols and applications. Yes.

  However, since there is a difference in the detection characteristics of cyber attacks depending on the security device, a single security device may miss a complicated and sophisticated cyber attack. Missing cyber attacks can cause serious problems for the network, so reducing missed cyber attacks is an important issue. Therefore, the degradation of cyber attack detection performance is prevented by using multiple security devices.

  A technique called service chaining that dynamically selects a network device to be routed according to the characteristics of an input packet is known (see Non-Patent Document 1). According to service chaining, in accordance with a preset policy, a network device to be used in accordance with characteristics such as an input communication source IP (Interet Protocol) address, protocol, or communication content of L (Layer) 7 You can specify the combination and order. For example, when a plurality of types of communication including HTTP (HyperText Transfer Protocol) communication coexist, the traffic can be controlled so that only the HTTP communication uses a network device specialized for HTTP communication.

W.John, K.Pentikousis, G.Agapiou et al., “Research Directions in Network Service Chaining,” IEEE SDN4FNS, 2013

  If service chaining is applied to various types of communications that may be a cyber attack, it is possible to control traffic through a security device specialized for cyber attacks in various types of communications. However, if there are multiple security devices with different detection characteristics specialized for cyber attacks in the same type of communication, traffic control based on the static policy and communication type set in advance will cause the security device It was not possible to select and use according to the detection characteristics. Therefore, all security devices in the security device group specialized for cyber attacks in the same type of communication must be used at the same time, resulting in a delay in communication and an increase in the amount of traffic to be processed by each security device. There was a risk of it.

  The present invention has been made in view of the above, and an object of the present invention is to reduce a communication delay and reduce a load to be processed by a security device without degrading a cyber attack detection performance.

  In order to solve the above-described problems and achieve the object, the optimization device according to the present invention stores detection pattern information indicating a correspondence between a pattern indicating a feature of communication and a security device that has detected the pattern. A characteristic recording unit, a calculation unit that calculates a pattern indicating the characteristics of the input communication, and a similar pattern that is similar to the calculated pattern are extracted from the detection characteristic recording unit, and the similar pattern is detected. And a determining unit that determines a security device to be passed through the input communication based on the security device.

  According to the present invention, communication delay can be reduced and the load to be processed by the security device can be reduced without reducing the cyber attack detection performance.

FIG. 1 is a schematic diagram showing a schematic configuration of an optimization apparatus according to an embodiment of the present invention and a security countermeasure system to which the optimization apparatus is applied. FIG. 2 is an explanatory diagram for explaining a conventional security countermeasure system. FIG. 3 is a diagram illustrating a data configuration example of detection pattern information according to the present embodiment. FIG. 4 is an explanatory diagram for explaining the operation of the optimization apparatus of the present embodiment. FIG. 5 is an explanatory diagram for explaining the operation of the optimization apparatus of the present embodiment. FIG. 6 is an explanatory diagram for explaining the operation of the optimization apparatus of the present embodiment. FIG. 7 is a flowchart showing the optimization processing procedure of this embodiment. FIG. 8 is a sequence diagram showing the optimization processing procedure of this embodiment. FIG. 9 is a diagram illustrating a computer that executes an optimization program.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by this embodiment. Moreover, in description of drawing, the same code | symbol is attached | subjected and shown to the same part.

[Security system configuration]
FIG. 1 is a schematic diagram illustrating a schematic configuration of an optimization apparatus according to the present embodiment and a security countermeasure system to which the optimization apparatus is applied. As shown in FIG. 1, the security countermeasure system 10 includes an optimization device 1, a security device group 2, a network (NW) device 3, and a network (NW) control device 4. The security devices constituting the security device group 2 are, for example, next generation FW, IDS / IPS (Intrusion Prevention System), WAF, and the like, and detect various types of cyber attacks. The network device 3 is, for example, a router or a switch. The network control device 4 is, for example, an OpenFlow Switch, a virtual switch, a Reverse Proxy, or the like, and controls packet communication so as to pass through a designated security device in the security device group 2.

  A packet received from an external network 5 such as the Internet is delivered to a terminal device in the internal network (NW) 6 via the network device 3, the network control device 4, and the security device group 2.

  As illustrated in FIG. 2, the conventional security countermeasure system 100 is configured such that an input packet passes through all security devices in the security device group 2.

  In the present embodiment, the optimization device 1 executes an optimization process to be described later, thereby controlling the security device that passes packets in the security device group 2 according to the characteristics of communication that may cause a cyber attack. Specify for device 4.

  The network control device 4 applies service chaining, for example, and performs communication control so that the packet passes through the designated security device.

  When receiving a packet, the security device operates in accordance with preset setting information. For example, the communication is interrupted, or the detected cyber attack information is notified to the optimization device 1 by a log communication function (syslog) or the like.

[Configuration of optimization device]
The optimization apparatus 1 is realized by a general-purpose computer such as a workstation or a personal computer, and includes a detection characteristic recording unit 11 and a control unit 12.

  The detection characteristic recording unit 11 is realized by a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The detection characteristic recording unit 11 may be configured to communicate with the control unit 12 via a telecommunication line such as a LAN (Local Area Network) or the Internet.

  The detection characteristic recording unit 11 stores detection pattern information indicating a correspondence between a pattern indicating communication characteristics and a security device that has detected the pattern. Specifically, the detection pattern information stored in the detection characteristic recording unit 11 includes, for each pattern corresponding to each row, the presence / absence of a detection characteristic for each feature, attack, and security device as illustrated in FIG. Is done.

  Here, the feature means a pattern indicating the feature of communication, and for example, a query character string included in the HTTP request is exemplified. In the example shown in FIG. 3, the pattern on the first line is characterized by including a query character string “‘ or X = X ”.

  The attack indicates whether or not each detected pattern is a cyber attack. In the example shown in FIG. 3, “◯” is recorded when the detected pattern is a cyber attack, and “X” is recorded when the detected pattern is not a cyber attack.

  The presence / absence of detection characteristics for each security device means whether each security device in the security device group 2 has detected a characteristic of communication of each pattern. In the example shown in FIG. 3, it is recorded as “detection” that WAF A and WAF B as security devices have detected a cyber attack, that is, have a detection characteristic, for the pattern “'or X = X” in the first row. Has been. In FIG. 3, nothing having no detection characteristic is blank and is not recorded.

  The control unit 12 is realized using a CPU (Central Processing Unit) or the like that executes a processing program stored in a memory, and functions as the calculation unit 121 and the determination unit 122 by executing the processing program.

  The calculation unit 121 calculates a pattern indicating the characteristics of the input communication. Specifically, as illustrated in FIG. 4, the calculation unit 121 receives input of information such as header information, communication data, or analysis results from the network device 3 or the like from the network control device 4, A pattern indicating the characteristics of communication is calculated.

  FIG. 4 illustrates a security countermeasure system 10 when the input communication is HTTP communication, and a plurality of WAFs (WAF A, WAF B, and WACF C) are illustrated as the security device group 2. In the example shown in FIG. 4, a character string such as “ID = user1”, “Password = ′ or 1 = 1−−” is included in the query character string of the input HTTP request. In this case, the calculation unit 121 calculates a pattern such as “user1”, “‘ or X = X−− ”,“ X = X−− ”by applying a calculation algorithm such as a character string kernel.

  Here, the character string kernel converts the character string into a numerical value string called a feature vector according to a rule for specifying a partial character string included in the character string. However, the algorithm for calculating the pattern indicating the characteristics of communication is not limited to the character string kernel. Moreover, the pattern which shows the characteristic of communication may be collected from the information regarding the input communication instead of being calculated.

  The determination unit 122 extracts a similar pattern, which is a pattern similar to the calculated pattern, from the detection characteristic recording unit 11, and selects a security device that passes the input communication based on the security device that has detected the similar pattern. decide.

  Specifically, the determination unit 122 first compares the pattern calculated by the calculation unit 121 with the pattern stored in the detection characteristic recording unit 11, and extracts similar patterns that are similar from the detection characteristic recording unit 11. In the example illustrated in FIG. 4, “′ or X = X” and “X = X” are extracted from the detection characteristic recording unit 11 as similar patterns.

  Next, the determination unit 122 refers to the information associated with the extracted similar pattern, and based on the security device that has detected the similar pattern, the combination of the minimum number of security devices that passes the input communication To decide. Then, the determination unit 122 designates the determined security device in the network control device 4 and causes the network control device 4 to execute communication control so that the input communication passes through the determined security device.

  In the example shown in FIG. 5, from the extracted similar patterns, the pattern “'or X = X” can be detected as a cyber attack with WAF A and WAF B, and the pattern “X = X” It can be seen that it is not an attack. Therefore, the determination unit 122 determines WAF A and WAF B as security devices that pass the input communication. In this way, when WAF A and WAF B detect the pattern “’ or X = X−− ”, it is estimated that the attack can be determined as a cyber attack.

  The determination unit 122 stores the calculated pattern, the determined combination of security devices, and the detection result in the detection characteristic recording unit 11. Specifically, as illustrated in FIG. 6, the determination unit 122 records, in the detection characteristic recording unit 11, that WAF A and WAF B have been detected using “′ or X = X−−” as a cyber attack. As a result, cyber attack detection cases corresponding to communication characteristics are accumulated, and the detection characteristics of each security device are learned. Therefore, it is possible to optimize, that is, minimize the number of security devices to be used with high accuracy.

  The detection pattern information in the detection characteristic recording unit 11 also records a pattern that is not a detected cyber attack. As a result, the false detection for erroneously detecting a non-cyber attack as a cyber attack is learned, so that the false detection can be prevented with high accuracy.

[Optimization procedure]
Next, the optimization processing procedure in the optimization apparatus 1 will be described with reference to the flowchart of FIG. 7 and the sequence diagram of FIG. The flowchart in FIG. 7 and the sequence diagram in FIG. 8 start, for example, at the timing when the operator inputs an instruction to start processing by operating an input unit (not shown).

  First, the calculation unit 121 receives communication information from the network device 3 via the network control device 4 (steps S1, S11, S12).

  The calculation unit 121 calculates communication characteristics. Then, the determination unit 122 refers to the detection characteristic recording unit 11 and searches for past similar patterns similar to the calculated communication feature pattern (steps S2 and S13).

  When there is no similar pattern (step S3, No), the determination unit 122 determines a combination of security devices designated in advance as a security device that passes the input communication (step S4).

  On the other hand, if there is a similar pattern (steps S3, Yes, S14), the determination unit 122 combines the minimum number of security devices that pass the input communication based on the security device that detected the similar pattern. Is determined (step S5).

  The determination unit 122 designates the determined combination of security devices to the network control device 4 (steps S6 and S15).

  Further, the determination unit 122 acquires a detection result from the security device (steps S16 and S17), and records the calculated pattern in the detection characteristic recording unit 11 (steps S7 and S18). As a result, the series of optimization processing ends.

  As described above, in the optimization apparatus 1 of the present embodiment, the calculation unit 121 calculates a pattern indicating the characteristics of the input communication, and the determination unit 122 generates a similar pattern similar to the calculated pattern. Based on the security device extracted from the detection characteristic recording unit 11 and detecting the similar pattern, the security device through which the input communication is passed is determined. Thereby, the optimization apparatus 1 of this embodiment can detect a cyber attack reliably and efficiently using the minimum number of security devices according to the detection characteristics. Therefore, communication delay can be reduced and the load to be processed by the security device can be reduced without reducing the cyber attack detection performance.

  In addition, the optimization apparatus 1 accumulates the cyber attack detection cases corresponding to the communication characteristics in the detection characteristic recording unit 11 and learns the detection characteristics of each security device. As a result, it is possible to optimize, that is, minimize the number of security devices to be used with high accuracy.

[Other Embodiments]
[program]
It is also possible to create a program in which processing executed by the optimization device 1 according to the above embodiment is described in a language that can be executed by a computer. In this case, the same effect as the above-described embodiment can be obtained by the computer executing the program. Furthermore, the program similar to the above-described embodiment may be realized by recording the program on a computer-readable recording medium, and reading and executing the program recorded on the recording medium. Hereinafter, an example of a computer that executes an optimization program that realizes the same function as the optimization apparatus 1 will be described.

  As shown in FIG. 9, the computer 1000 that executes the optimization program includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network. Interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. For example, a mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050. For example, a display 1061 is connected to the video adapter 1060.

  Here, as shown in FIG. 9, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each table described in the above embodiment is stored in the hard disk drive 1031 or the memory 1010, for example.

  Further, the optimization program is stored in the hard disk drive 1031 as a program module 1093 in which a command executed by the computer 1000 is described, for example. Specifically, a program module describing each process executed by the optimization apparatus 1 described in the above embodiment is stored in the hard disk drive 1031.

  Data used for information processing by the optimization program is stored as program data 1094 in, for example, the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 to the RAM 1012 as necessary, and executes the above-described procedures.

  Note that the program module 1093 and the program data 1094 related to the optimization program are not limited to being stored in the hard disk drive 1031, but are stored in a removable storage medium and read by the CPU 1020 via the disk drive 1041 or the like. May be issued. Alternatively, the program module 1093 and the program data 1094 related to the optimization program are stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and are transmitted via the network interface 1070. May be read by the CPU 1020.

  As mentioned above, although embodiment which applied the invention made | formed by this inventor was described, this invention is not limited with the description and drawing which make a part of indication of this invention by this embodiment. That is, other embodiments, examples, operational techniques, and the like made by those skilled in the art based on this embodiment are all included in the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 Security countermeasure system 1 Optimization apparatus 11 Detection characteristic recording part 12 Control part 121 Calculation part 122 Determination part 2 Security equipment group 3 Network equipment 4 Network control apparatus

Claims (4)

A detection characteristic recording unit for storing detection pattern information indicating a correspondence between a pattern indicating a characteristic of communication and a security device that detects that the pattern is a cyber attack or is not a cyber attack ;
A calculation unit that calculates a pattern indicating the characteristics of the input communication;
A similar pattern, which is a pattern similar to the calculated pattern, is extracted from the detection characteristic recording unit, and a security device that passes the input communication is determined based on the security device that has detected the similar pattern. A decision unit;
An optimization device comprising: The determination unit acquires a detection result of the determined security device, and updates the detection characteristic recording unit using the acquired detection result, the calculated pattern, and the determined security device. The optimization apparatus according to claim 1. An optimization method executed by an optimization device,
The optimization device includes a detection characteristic recording unit that stores detection pattern information indicating correspondence between a pattern indicating a communication characteristic and a security device that detects that the pattern is a cyber attack or is not a cyber attack. Prepared,
A calculation step of calculating a pattern indicating the characteristics of the input communication;
A similar pattern, which is a pattern similar to the calculated pattern, is extracted from the detection characteristic recording unit, and a security device that passes the input communication is determined based on the security device that has detected the similar pattern. A decision process;
An optimization method characterized by including A calculation step for calculating a pattern indicating the characteristics of the input communication;
A detection pattern indicating a correspondence between a pattern indicating a communication characteristic and a security device that has detected that the pattern is a cyber attack or a non-cyber attack. A determination step of determining a security device that is to be routed through the input communication based on the security device that has been extracted from the detection characteristic recording unit that stores the information and has detected the similar pattern;
An optimization program that causes a computer to execute.

Images