JP2002073433A - Break-in detecting device and illegal break-in measures management system and break-in detecting method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a break-in detecting device which detects illegal break-in by judging from packets, and if illegal break-in occurs, takes measures to prevent illegal break-in. SOLUTION: In a computer network system, the break-in detecting device 100 is provided with the following: a communication means 110; a packet analyzing means 120 that determines whether or not the illegal break-in is proceeding by analyzing the received packets; a measure means 130 that if it is judged that the illegal break-in is proceeding, performs closing of protocol processing or ports, shutting down of communication and the like; an illegal break-in monitoring means 140 that monitors whether or not the attack of illegal break-in and the like is terminated; and a measure removing means 150 that if it is judged that the attack of illegal break-in and the like is terminated, removes the measures of shutting down of communication and the like.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to a computer network system.

[0002]

2. Description of the Related Art FIG.
97 is an example of a conventional hub with an intrusion prevention function based on the hub with an intrusion prevention function shown in FIG. The hub with an intrusion prevention function attempts to determine whether or not an unauthorized access is made based on the address of the transmission source of the packet. In the figure, 50 is a hub. 51 is a memory. 52 is a data bus. 53j (j = 1 to N) is a port (PHY: physical layer unit).

Next, the operation will be described. In the figure, first, an IP (I
(Internet Protocol) address range is set, and the set contents are stored in the memory 51. next,
The hub 50 is an ARP (Address Resolution).
(IonProtocol) frame is checked. If this source IP address is not included in the range of the permitted IP addresses held in the memory 51, it is determined that an unauthorized terminal is connected to the network, and an appropriate port 53j is connected to the data bus 52. Disconnect from

[0004]

In a conventional hub with an intrusion prevention function, whether a packet is an illegal packet is determined by using a source IP address of the packet and whether the value is a preset value. Was. Therefore, when an intruder who performs fraud accesses from a legitimate request source, it cannot be determined that the packet is a fraudulent one, even though it is a fraudulent intrusion.

[0005] Further, when a port is cut off to prevent intrusion, no measure is taken to automatically open the port in response to a packet or connection from a legitimate user. Therefore, to make the port usable again,
An administrator operation such as an instruction from the console or a restart is required. If devices such as terminals are located not only on one floor, but also on multiple floors and different buildings,
Automatically interrupting communication to prevent intrusion is effective as a countermeasure. However, if communication is interrupted forever, communication necessary for business cannot be performed forever, which hinders business. In order to smoothly operate the business system while responding to the attack, the business system must be restarted immediately unless an unauthorized intrusion is made.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problems, and has as its object to detect unauthorized intrusions not from the request source of the packet but from the packet. Another object of the present invention is to take countermeasures such as blocking communication when the packet is illegal. Further, it is another object of the present invention to automatically release the interrupted communication without any trouble of an administrator and perform communication if an unauthorized intrusion is not performed.

[0007]

According to the present invention, there is provided an intrusion detection apparatus comprising: a communication unit for transmitting and receiving a packet; a packet for analyzing a packet received by the communication unit and detecting an unauthorized packet from the analyzed packet. An analysis unit, and a countermeasure unit for taking measures to prevent an unauthorized intrusion of an unauthorized packet when the packet analysis unit detects an unauthorized packet.

[0008] The intrusion detection device further monitors the presence or absence of the unauthorized intrusion based on the detection result of the packet analysis unit, and determines an unauthorized intrusion end in which the unauthorized intrusion ends. When the intrusion monitoring unit determines the end of the unauthorized intrusion, the intrusion monitoring unit is characterized by including a countermeasure canceling unit that cancels the countermeasures taken by the countermeasure unit to prevent the unauthorized intrusion.

[0009] The packet analyzer is characterized in that a packet containing predefined data is an invalid packet.

[0010] The packet analyzer defines at least one of a communication protocol name, a communication port number, and a predetermined character string as the pre-defined data.

The countermeasure unit is characterized in that, as a countermeasure for preventing an unauthorized intrusion, communication of an unauthorized packet is interrupted.

The countermeasure section stops using the communication port used by the communication section to shut off the communication, and the intrusion detection device further stops using the communication port used by the countermeasure section. In this case, a communication port notifying unit for opening a communication port different from the used communication port and notifying the opened communication port to a predetermined transmission source is provided.

[0013] The intrusion detection device further resumes the use of the communication port whose use has been stopped when the reception of the illegal packet is completed, and notifies the predetermined transmission source of the restart of the communication port. An end notification unit is provided.

An intrusion countermeasure management system according to the present invention is an intrusion countermeasure management system including an information processing device and an intrusion detection device connected to the information processing device via a communication network to detect an intrusion. The intrusion detection device, a communication unit that transmits and receives packets via the communication network, a packet analysis unit that analyzes the received packets, and detects an unauthorized packet from the analyzed packets,
When the packet analysis unit detects an illegal packet, the countermeasure unit that takes measures to prevent the illegal intrusion of the illegal packet and the communication port used by the countermeasure unit are stopped. A communication port notifying unit for opening a communication port different from the communication port used and notifying the opened communication port to the information processing device, wherein the information processing device sends a packet to the communication network. A transmission / reception unit that receives a communication port notified from the communication port notification unit along with the transmission, and a temporary port setting unit that sets communication using the communication port received by the transmission / reception unit. And

The intrusion detection device further monitors the presence or absence of the unauthorized intrusion, and determines the termination of the unauthorized intrusion by the unauthorized intrusion monitoring unit that determines the termination of the unauthorized intrusion to terminate the unauthorized intrusion. In the case of the above, the countermeasure canceling unit for canceling the countermeasure for preventing the unauthorized intrusion, and when the reception of the illegal packet is completed, the use of the communication port whose use has been stopped is resumed, and the communication port whose use is stopped is restarted. An intrusion termination notification unit that notifies the information processing device of the intrusion, the transmission / reception unit receives a notification from the intrusion termination notification unit, and the temporary port setting unit communicates the communication port whose use has been stopped. The setting is changed to the communication to be used.

The intrusion detection method according to the present invention includes a communication step of transmitting and receiving a packet, a packet analyzing step of analyzing the received packet and detecting an invalid packet from the analyzed packets, and a packet analyzing step. And a countermeasure step for taking a countermeasure for preventing an unauthorized intrusion in which an unauthorized packet enters when an unauthorized packet is detected.

The intrusion detection method further monitors the presence or absence of the unauthorized intrusion, and determines the end of the unauthorized intrusion by the unauthorized intrusion monitoring step of determining whether or not the unauthorized intrusion is completed and the unauthorized intrusion monitoring step. And a countermeasure canceling step for canceling the countermeasure for preventing the unauthorized intrusion.

[0018]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 is a configuration diagram of an embodiment showing an intrusion detection device and an intrusion detection method of the present invention. In FIG. 1, reference numeral 100 denotes an intrusion detection device that analyzes whether or not a received packet has been subjected to unauthorized intrusion and, when it is determined that intrusion has been performed, takes measures such as communication interruption. A communication unit (communication unit) 110 receives or transmits a packet. Reference numeral 120 denotes a packet analysis unit (packet analysis unit) that determines whether the received packet is invalid. Reference numeral 130 denotes a countermeasure unit (countermeasure unit) for performing a countermeasure such as communication interruption. 140 is a measure 130
If a countermeasure is taken, the intrusion monitoring means (intrusion monitoring unit) monitors whether or not an intrusion has been performed. Reference numeral 150 denotes a countermeasure canceling unit (countermeasure canceling unit) that cancels a countermeasure such as communication interruption when the unauthorized intrusion monitoring unit 140 determines that no unauthorized intrusion has been performed. In this specification, a packet collectively refers to all data flowing on a network and does not refer to specific data.

Next, the operation will be described with reference to FIG. First, the intrusion detection device 100 receives a packet from an external network by the communication unit 110 (S1).
0). Then, the packet analysis means 120 analyzes whether the packet is invalid or not as in the example described later (S2).
0). If it is determined that the received packet is invalid (Yes in S30), the packet is not relayed by the countermeasure means 130 and the communication is cut off (S40). Then, the intrusion detection device 100 uses the unauthorized intrusion monitoring means 140 to monitor whether or not an unauthorized intrusion has been performed as in an example described later (S50). If it is determined that the unauthorized intrusion has not been performed (Yes in S60), the communication blocking is released by using the countermeasure release unit 150 (S70), and the relay of the packet is restarted (S80).

[0020] As described above, whether or not an unauthorized device is determined is determined not only by the address of the request source but also by the data, command, access frequency, and the like in the packet. Even if you try to get in, you can detect it.

Further, by using the intrusion monitoring means 140 and the countermeasure canceling means 150, the communication is automatically resumed after the intrusion is completed. Is reduced.

Next, an example of a packet analysis method will be described. The packet analysis method is roughly divided into the following two methods. (1) Pattern matching for checking a character string or code included in a packet. (2) A statistical method for detecting a certain number or more packets in a certain time.

Next, three examples of the pattern matching of the above (1) and one example of the statistical method of the above (2) will be shown. Pattern matching 1: A method for detecting a buffer overflow attack on a mail server. When a buffer overflow attack is applied to the mail server, the mail server does not operate normally such as abnormal termination and malfunction. In order to detect this attack, it is analyzed whether the packet has the following pattern. TCP header Destination Port = 25 (indicating SMTP) TCP data Judgment is made based on whether or not the argument of the following smtp command is 128 bytes or more. “Hello”, “mail from:”, “rcpt
To: "," vrfy "," expn "Buffer overflow attacks on mail servers are actually pop (Post Office Protocol).
ol), and the above is merely an example. Also, for attacks on mail servers, smtp (Si
Mple Mail Transfer Protocol
ol) There are various attacks such as obtaining information such as a user name and the presence or absence of a user using a command.

Pattern matching 2: FTP cwd
￣ Root attack detection method. Upon receiving this attack, ftp (File Transf
erProtocol) server is obtained root authority. Therefore, a program that performs tampering or theft of important files such as a password file, or performs unauthorized processing such as a virus is set up and executed, and ft
The p server may not work properly. In order to detect this attack, it is analyzed whether the packet has the following pattern. TCP header Destination Port = 21 (FTP-C
ONTROL) Detects a character string of TCP data "cwd @ root". “Cwd” is a control command used in ftp. Commands other than those described above can be used.

Pattern matching 3: http phf
How to detect attacks using bugs. In response to this attack, http (Hyper Text
Transfer Protocol) server executes a command with root authority. Therefore, there is a possibility that an important file such as a password file is falsified or stolen, or a program for performing illegal processing such as a virus is set up and executed, and the http server does not operate normally. In order to detect this attack, it is analyzed whether the packet has the following pattern. TCP header Destination Port = 80 (HTTP) TCP data Detects character strings of “get” and “/ phf”. “phf” is one of the program names. It is also possible to use a program name other than the above.

Statistical method 1: SYN flood attack detection method (example of denial of service (DoS) attack). When this attack is received, resources are lost due to SYN packet correspondence, the load on the system increases, and other services cannot be executed. In order to detect this attack, it is analyzed whether or not there is a certain number (for example, 100) or more of the following packets within a certain time (for example, 10 seconds). Destination Address of IP header
Is common. TCP (Transmission Control)
Protocol) SYN flag in the header is 1, ACK
The flag is 0. SYN-Flood is one of the attack names
One. It is also possible to use attack names other than the above.

Next, an example of intrusion monitoring in the case of a DoS attack will be described. It is determined within a certain period of time (for example, 10 seconds) whether or not the intrusion for the DoS attack has been completed.
Is determined based on whether the number of specific packets is equal to or less than a predetermined number (for example, 100). These thresholds are merely examples, and may be changed for each type of attack. In addition, the threshold value when it is determined that an attack has occurred may not be the same as the threshold value when it is determined that an attack has ended.

In the example of the first embodiment, communication of all packets is cut off as a countermeasure. Therefore, if communication of all packets is interrupted, normal packets will not be transmitted. Therefore, depending on the type of attack, icmp, tcp,
By not performing packet relay for each protocol such as udp, not all packets but only packets related to an attack may be blocked. Also, not for each protocol, but for tcp or udp (User
By interrupting the communication for each port number of the ram protocol, a countermeasure may be taken so that a normal packet can be normally communicated. That is, as an example, when there is an attack related to an e-mail, tc representing the e-mail
By blocking only the packet with the p port number 25, access to the Web server (tcp port number 8
0) and FTP (tcp port number 21). Further, a measure may be taken so that communication is interrupted for each source / destination address. In addition, for an attack performed by establishing a tcp session, the tcp session may be disconnected by transmitting a reset packet.

The following countermeasures are assumed as countermeasures that can be taken by the countermeasure means 130. (A) Block communication (B) Send attack packet to attacker (response,
(Repeat) (C) Return a lie response (decoy, make the other party think that the intrusion was successful) The above is an example, and a countermeasure method other than the above may be used.

The interruption of the communication is performed by discarding the packet transferred to the intrusion detection device 100. When interrupting the communication, all the packets transferred to the intrusion detection device 100 may be discarded, or some of them may be discarded. The interruption of communication includes closing ports and closing protocols. Closing a port is performed by discarding a packet with the same communication port. The protocol is closed by discarding a packet having the same communication protocol.

Further, in this embodiment, even after an unauthorized intrusion is detected by the packet analysis means 120, the packet is transferred from the transmission source to the intrusion detection device 100. All packets transferred to the intrusion detection device 100 are analyzed by the packet analysis unit 120, and based on the analysis result, the unauthorized intrusion monitoring unit 140 monitors whether or not the unauthorized intrusion has been completed.

Further, as described above, after detecting an unauthorized intrusion,
Although the packet analysis unit 120 analyzes all the packets transferred to the intrusion detection device 100, the packet analysis unit 120 may separately include a unit for inspecting the same packet as the packet in which the fraud is detected. That is, it is also possible to divide the functions like an analysis program that checks only the detected fraud after detecting the unauthorized intrusion. Specifically, the program can be divided into a program that analyzes all items and a program that analyzes only specific items.

Although the case where a control command, a program name, and an attack name are used as data used for pattern matching has been described, the present invention is not limited to these. Data other than the above may be used.

As described above, the computer network system is characterized by an intrusion detection device having the following means and an intrusion countermeasure management system using the intrusion detection device having the following means. (A) communication means; (b) packet analysis means for analyzing received packets to determine whether an unauthorized intrusion has been performed; (c) protocol or port when it is determined that an unauthorized intrusion has been performed; Measures to close or shut down communication.

Further, the intrusion detection device has the following means. (D) Intrusion monitoring means for monitoring whether an attack such as unauthorized intrusion has ended, and (e) Countermeasure canceling means for canceling measures such as communication interruption when it is determined that an attack such as unauthorized intrusion has ended.

Embodiment 2 In the above embodiment, the intrusion detection device 100 is an example in which the packet analysis unit 120, the countermeasure unit 130, and the countermeasure cancellation unit 150 are provided on the same device. However, each means does not have to be implemented on the same device. For example, the following configuration is also possible. In addition to the intrusion detection device 100, a countermeasure device for implementing a countermeasure and a management device for managing the countermeasure device are provided. The intrusion detection device 100 notifies the management device whether the attack is being performed or has ended. The management device
The countermeasure device may be instructed to take a countermeasure or cancel the countermeasure according to the content of the notification.

Embodiment 3 In the first embodiment,
As a countermeasure in case of unauthorized intrusion, communication was cut off. However, in that case, communication of normal packets using the same protocol or the same port is also interrupted. Therefore, next, an embodiment will be described in which normal packets are communicated using a temporary port in order to pass normal packets.

FIG. 3 is a block diagram of an embodiment showing an unauthorized intrusion countermeasure management system in such a case. In FIG. 3, B is an intrusion detection device that analyzes whether or not a received packet is unauthorized. 30j (j = 1 to N) is an information processing device 30j that performs information processing such as business.

FIG. 4 is an example of a configuration diagram of the intrusion detection device 200. In FIG. 4, reference numeral 210 denotes a communication unit (communication unit) that receives or transmits a packet. Reference numeral 220 denotes a packet analysis unit (packet analysis unit) that determines whether the received packet is invalid. Reference numeral 230 denotes a countermeasure unit (countermeasure unit) for performing a countermeasure such as communication interruption. Reference numeral 231 denotes a communication port notification unit (communication port notification unit) that notifies a temporary communication path. Reference numeral 240 denotes an intrusion monitoring unit (intrusion monitoring unit) that monitors whether the attack detected by the packet analysis unit 220 is still being performed. Reference numeral 250 denotes a countermeasure canceling unit (countermeasure canceling unit) that cancels a countermeasure such as communication interruption when the unauthorized intrusion monitoring unit 240 determines that no unauthorized intrusion has been performed. 251 indicates that the unauthorized intrusion monitoring means 240 determines that no unauthorized intrusion has been performed;
This is an unauthorized intrusion completion notification unit (an unauthorized intrusion completion notification unit) that notifies the information processing device 30j (j = 1,..., N) that the intrusion has been completed.

FIG. 5 shows an information processing device 30j (j = 1,.
.., N). In FIG. 5, 31
0 is a transmission / reception means (transmission / reception unit), 320 is an intrusion detection device 2
This is a temporary port setting means (temporary port setting unit) for setting communication with a communication channel designated from 00.

Next, the operation will be described with reference to FIG. FIG.
The processing having the same step number as the above indicates the same processing. The intrusion detection device 200 analyzes the packet (S10) received by the communication means 210 using the packet analysis means 220 (S20). As a result of the analysis, when it is determined that the packet is invalid (Yes in 30), the communication is cut off without relaying the packet by the countermeasure 230 (S40).
Further, the communication port notifying unit 231 is different from the port number (for example, 25) used by the unauthorized packet and is not used by another application (for example, 9).
000) (S41), and the communication port notification means 23
1 to notify the information processing apparatus 30j that the application using No. 25 is to communicate at 9000 (S42).

The information processing device 30j receives the communication port number to be changed (S100), and changes the setting of the communication port using the temporary port processing means 320, so that the application using the number 25 becomes 900.
Communication is performed using No. 0 (S101).

The intrusion detection device 200 monitors whether or not an unauthorized intrusion has been performed by the unauthorized intrusion monitoring means 240, as in the first embodiment (S50). When the intrusion detection device 200 determines that the attack has been completed by the unauthorized intrusion monitoring means 240 (Yes in S60), the intrusion detection device 200 releases the communication cutoff using the countermeasure cancellation means 250 (S70), and restarts the packet relay. (S80). Further, by notifying the information processing device 30j of the end of the attack using the unauthorized intrusion completion notifying means 251 (S71), the information processing device 30j resumes communication with the normal port number 25 (S110, S111). ).

As described above, even if a certain port is closed as a countermeasure, since a temporary port is used, normal packets communicated through the closed port can be transmitted and received without interruption. Thus, the application such as business can be continuously operated without stopping the system.

In the above example, the temporary port selection and notification are performed by the intrusion detection device 200, but need not necessarily be performed by the intrusion detection device 200. In addition to the intrusion detection device 200, a management device that manages ports used by each application is provided.
May notify the management device of the closed port, and the management device may select a temporary port and notify each application. In FIG. 4, the communication port notification unit 231 is used.
Has shown the configuration included in the countermeasure unit 230, but the communication port notification unit 231 may be a separate component from the countermeasure unit 230. Similarly, unauthorized intrusion end notification means 2
51 may be a component separate from the countermeasure canceling means 250.

As described above, in the computer network system, in addition to the intrusion detection device of the first embodiment, an intrusion detection device having the following means and an intrusion prevention system using the intrusion detection device are characterized. And (F) means for temporarily opening a port when communication is interrupted such as closing of a protocol or port, and (g) means for notifying of a temporarily opened port.

Further, the unauthorized intrusion prevention system includes an information processing apparatus having the following means. (A) means for receiving a notification of a temporarily opened port from the intrusion detection device, (b) means for performing communication using the temporarily opened port, and (c) notification of the end of the attack from the intrusion detection device. Means to receive communication and resume communication at the original port.

[0048]

As described above, the present invention has an effect that an attack from a legitimate request source can be detected by judging whether or not the contents of a packet are illegal.

After the countermeasure is implemented (for example, after the port is closed), it is monitored whether or not the attack is continuing. If the attack is completed, the countermeasure is canceled (for example, the port is opened).
By doing so, the countermeasure can be automatically canceled without manual intervention, so that the provision of tasks and services can be promptly resumed after the countermeasure is completed. Then, since the countermeasure is automatically canceled, the work of the administrator for canceling the countermeasure can be omitted, and human work related to the management and operation of the computer network system can be reduced.

According to the present invention, an unauthorized packet can be detected based on predetermined data.

According to the present invention, by interrupting the communication, it is possible to prevent an unauthorized packet from being transferred.

Also, as a countermeasure against attacks, even if the normally used port is closed, each application (information processing device) is notified of the temporary port, and each application communicates with the temporary port, so that normal use is possible. Can provide application services.

According to the present invention, the communication port whose use has been interrupted can be quickly and automatically restarted after the countermeasure is completed.

[Brief description of the drawings]

FIG. 1 is a configuration diagram illustrating an example of an intrusion detection device according to a first embodiment.

FIG. 2 is a flowchart illustrating an example of an operation of the intrusion detection method according to the first embodiment.

FIG. 3 is a diagram showing an example of the overall configuration of an unauthorized intrusion countermeasure management system according to a second embodiment.

FIG. 4 is a configuration diagram illustrating an example of an intrusion detection device according to a second embodiment.

FIG. 5 is a configuration diagram illustrating an example of an information processing device according to Embodiment 2;

FIG. 6 is a flowchart illustrating an example of an operation of an intrusion detection method according to the second embodiment.

FIG. 7 is a configuration diagram showing an example of a conventional example.

[Explanation of symbols]

1 communication network, 50 hubs, 51 memories, 52 data buses, 53j (j = 1 to N) ports, 100, 200
Intrusion detection device, 110, 210 communication means, 120,
220 Packet analysis means, 130, 230 Countermeasure means, 140, 240 Intrusion monitoring means, 150, 25
0 Countermeasure canceling means, 231 Communication port notification means, 25
1 unauthorized intrusion end notification means, 301 to 30N, 30j
(J = 1 to N) information processing apparatus, 310 transmitting / receiving means,
320 Temporary port setting means.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/22

Claims (11)

[Claims] A communication unit that transmits and receives a packet; a packet analysis unit that analyzes a packet received by the communication unit and detects an invalid packet from the analyzed packets; An intrusion detection device, comprising: a countermeasure that takes a countermeasure for preventing an unauthorized intrusion in which an unauthorized packet enters when detected. 2. The intrusion detection device further monitors the presence or absence of the unauthorized intrusion based on the detection result of the packet analysis unit, and determines an unauthorized intrusion termination in which the unauthorized intrusion ends. If the intrusion monitoring unit determines that the intrusion has ended,
2. The intrusion detection device according to claim 1, further comprising a countermeasure canceling unit configured to cancel the countermeasure for preventing the unauthorized intrusion taken by the countermeasure unit. 3. The intrusion detection device according to claim 1, wherein the packet analysis unit determines that a packet including data defined in advance is an invalid packet. 4. The packet analysis unit according to claim 3, wherein the packet analysis unit defines at least one of a communication protocol name, a communication port number, and a predetermined character string as the data to be defined in advance. Intrusion detection device. 5. The intrusion detection device according to claim 1, wherein the countermeasure unit blocks communication of an unauthorized packet as a countermeasure for preventing unauthorized intrusion. 6. The countermeasure unit stops use of the communication port used for interrupting communication, and the intrusion detection device further stops using the communication port used by the countermeasure unit. 6. The intrusion according to claim 5, further comprising a communication port notification unit that opens a communication port different from the communication port used and notifies the predetermined communication source of the opened communication port. Detection device. 7. The intrusion detection device further resumes the use of the communication port whose use has been stopped when the reception of the illegal packet ends, and notifies the predetermined transmission source of the restart of the communication port. The intrusion detection device according to claim 6, further comprising an unauthorized intrusion completion notification unit. 8. An unauthorized intrusion countermeasure management system comprising an information processing device and an intrusion detection device connected to the information processing device via a communication network to detect unauthorized intrusion, wherein the intrusion detection device comprises: A communication unit that transmits and receives packets via the communication unit; a packet analysis unit that analyzes the received packet and detects an invalid packet from the analyzed packets; and a packet analysis unit that detects an invalid packet. A countermeasure that takes measures to prevent unauthorized intrusion of illegal packets, and a communication port that is different from the communication port used when the communication port used by the countermeasure is stopped. A communication port notifying unit that notifies the information processing apparatus of the opened communication port, and the information processing apparatus transmits a packet to the communication network. Transmitting / receiving a communication port notified from the communication port notification unit, and a temporary port setting unit configured to set communication using the communication port received by the transmission / reception unit. Characteristic intrusion countermeasure management system. 9. The intrusion detection device further monitors the presence or absence of the unauthorized intrusion, and determines whether or not the unauthorized intrusion is terminated by the unauthorized intrusion monitoring unit. If the determination is made, the countermeasure canceling unit cancels the countermeasure for preventing the above-mentioned unauthorized intrusion, and, when the reception of the illegal packet is completed, the communication port whose use has been stopped is restarted and the communication port whose use is stopped is stopped. An intrusion termination notification unit for notifying the information processing apparatus of the resumption of the intrusion, the transmission / reception unit receives a notification from the intrusion termination notification unit, and the temporary port setting unit communicates the suspended communication. 9. The unauthorized intrusion countermeasure management system according to claim 8, wherein the setting is changed to communication using a port. 10. A communication process for transmitting and receiving packets, a packet analysis process for analyzing the received packets and detecting an invalid packet from the analyzed packets, and a case where an invalid packet is detected in the packet analysis process. And a countermeasure step for taking a countermeasure for preventing an unauthorized intrusion of an unauthorized packet. 11. The intrusion detection method further comprises: an intrusion monitoring step of monitoring the presence or absence of the intrusion and judging the end of the intrusion to terminate the intrusion; 11. The intrusion detection method according to claim 10, further comprising: a step of releasing the countermeasure for preventing the unauthorized intrusion when the determination is made.