JP2003099339A - Infiltration-detecting and infiltration-preventing device and program therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent attacks made by attacking packets. SOLUTION: This is an infiltration-detecting and infiltration-preventing device for detecting the infiltration of attacking IP packets and preventing the attack. In addition, there are provided a firewall function means which refers to a fixed rule representing the relation between the header information of preliminarily fixed IP packets, based on the header information of the IP packets received and the attack, and passes non-attacking IP packets, while blocking the attacking IP packets; and a filter-type IDS function means which passes the non-attacking IP packets, while blocking the attacking IP packets based on the payload information of the IP packets which pass the firewall function means. The filter-type IDS function part 13, different from conventional interception-type IDS, can instantly block the attacking IP packets.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an intrusion detection / defense apparatus and program used for network security against unauthorized access, denial of service attacks, and the like.

[0002]

2. Description of the Related Art Conventionally, a method of arranging a firewall at a boundary with an external network has been widely used as a method of ensuring security of an internal network such as a corporate network or an internal network.

The firewall has a function of filtering IP packets based on preset filtering rules (hereinafter referred to as setting roots). The setting rule includes header information such as a source IP address, a destination IP address, a service (protocol), and an action (Accept / Accept) corresponding to the header information.
It is a set with Reject.

[0004] Based on the contents of the setting rule that matches the header information of the IP packet, the firewall can
By accepting or rejecting P packets, the internal network can be protected from inappropriate intrusion of IP packets.

However, the firewall has an IP having header information corresponding to "accept" on the setting rule.
Regarding packets, there is a drawback that even an illegal IP packet cannot prevent intrusion.

Therefore, in recent years, a network interception-type intrusion detection system (IDS; Intrusion Detection Syst) is branched and connected to an internal network behind a firewall.
It is possible to use em).

The intrusion detection system has a database of attack patterns (hereinafter referred to as attack pattern DB) in advance, and intercepts I from the internal network.
It is determined whether or not the P packet is an attacking IP packet (hereinafter, also referred to as attack packet) based on matching / non-matching with the attack pattern DB. If the result of this determination is that they match, the intrusion detection system notifies the administrator that the attack packet has entered.

Further, it is possible to make a cooperation between these products and request the firewall to temporarily block the attack packet from the intrusion detection system. In this case, as the firewall, for example, the product name “Firewall-1 (FireWall-1, (registered trademark)), CheckPoint (CheckPoint) Company” can be used.
As the intrusion detection system, for example, the product name “RealSecure (registered trademark), ISS company” can be used.

[0009]

However, in the intrusion detection system as described above, even if an intrusion of an attack packet is detected and the administrator is notified, by the time the notification reaches the administrator, the notification on the internal network is lost. The target device is attacked by the attack packet.

Further, recently, from the viewpoint of attacking the device again after attacking the intrusion detection system, a denial of service attack (D) for transmitting a large number of IP packets addressed to the intrusion detection system (D
An oS attack (Denial of Service attack) may occur. In this case, the intrusion detection system cannot execute the original intrusion detection process due to the processing of a large number of IP packets addressed to itself.

The present invention has been made in consideration of the above situation, and an object thereof is to provide an intrusion detection / defense apparatus and a program capable of preventing an attack by an attack packet.

Another object of the present invention is to provide an intrusion detection / prevention device and program capable of preventing a denial of service attack against itself.

[0013]

A first aspect of the present invention is an intrusion detection / defense apparatus for detecting an intrusion of an IP packet that is an attack to prevent the attack, and is provided in the header information of the received IP packet. Based on the preset setting information indicating the relationship between the header information of the IP packet and the attack, based on the firewall, firewall function means for blocking the attacking IP packet while passing the IP packet that does not become the attack, An intrusion detection / filtering unit for blocking an IP packet that is an attack based on payload information of the IP packet that has passed through the firewall function unit, and passing an IP packet that is not an attack It is a defense device.

As described above, unlike the conventional interception type IDS, the filter type IDS function means can immediately block an attacking IP packet and prevent an attack by an attacking packet.

In a second aspect based on the first aspect, the IDS function means is provided with an ID per unit time.
It is determined whether or not the number of IP packets addressed to the S function means exceeds a threshold value, and when the result of the determination exceeds the threshold value, another IP packet for the IDS function means is blocked. It is an intrusion detection / defense apparatus equipped with a mass packet denial function means for temporarily setting a setting rule in the firewall function means.

In this way, a large amount of I
When the P packet is detected, the corresponding IP packet is temporarily blocked by the firewall function means. Therefore, in addition to the effect of the first invention, a denial of service attack against the IDS function can be prevented.

A third aspect of the invention is based on the first or second aspect of the invention and is based on the relationship between the preset header information of the IP packet provided in the firewall function means and the ON / OFF state of the IDS function means. In addition, the intrusion detection / defense device includes IDS switching function means for switching the on / off state of the IDS function means.

Since the firewall function means controls the ON / OFF of the IDS function means in this way, in addition to the operation of the first or second aspect of the invention, wasteful execution of the IDS function means is eliminated and the load of the IDS function means is reduced. Can be reduced. As a result, the throughput of the device can be improved.

Although each of the above inventions is expressed by the name and category of "apparatus", the invention is not limited to this, and any other program such as "program", "storage medium", "method", "system" or "method" may be used. It may be expressed by name or category.

[0020]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. (First Embodiment) FIG. 1 is a schematic diagram showing the configuration of a network system to which an intrusion detection / defense apparatus according to a first embodiment of the present invention is connected. In this network system, a firewall (FW) 3 is provided between an external network 1 such as the Internet and an internal network 2 such as a company / organization. This firewall 3 is a DMZ (Demilitarize) between both networks 1 and 2.
d Zone; demilitarized zone) LAN4 is being constructed. LA
On the N4, open the web via the intrusion detection / prevention device 10.
The server 5 is branched and connected.

Here, the intrusion detection / defense apparatus 10 filters all IP packets that pass through the firewall 3 and propagate on the LAN 4, and pass or block each IP packet to the LAN 4 on the public Web server 5 side. It is composed of molds.

Specifically, as shown in FIG. 2, the intrusion detection / defense apparatus 10 includes an outer I / F 11, a firewall function unit 12, an IDS (Intrusion Detection System) function unit 13, and an inner I / F 14. .

The outer I / F 11 is a LAN interface for sending each IP packet on the LAN 4 on the firewall 3 side to the firewall function unit 12.

The firewall function unit 12 has an external I /
Each I in all IP packets sent from F11
Based on the header information of the P packet and a preset setting rule, each IP packet is set to the IDS function unit 13
It has the function of passing or blocking.

This setting rule can be used with the same contents as the setting rule of the firewall 3 at the front stage, but it is arranged at the rear side of the intrusion detection / defense apparatus 10 from the viewpoint of effectively functioning the firewall function unit 12. It is preferable that the content is related to the element (eg, public Web server 5).

The IDS function unit 13 uses the attack pattern DB (d
aabase) 13a, and based on the payload information of each IP packet in all the IP packets sent from the outer I / F 11 and the content of the attack pattern DB 13a held in advance, the inner I / F 14 It has the function of passing or blocking.

In this attack pattern DB 13a, an attack pattern having a higher certainty than the attack pattern DB in the conventional intrusion detection system is stored corresponding to the payload information of the IP packet. The conventional intrusion detection system does not discard the IP packet, so that the reliability is low (eg, keyword detection), while the IDS function unit 13 of the present embodiment discards the IP packet, so that the reliability is high (eg. , Keyword detection + confirmation of data length) is required.

Further, since the conventional intrusion detection system only notifies after the intrusion detection, the administrator is required to perform the protection, and therefore the certainty of the attack pattern may be low, whereas the IDS function unit of this embodiment is not required. There is also a circumstance that a high degree of certainty is required for the attack pattern because the 13 protects itself.

The inner I / F 14 sends each IP packet passing through the IDS function unit 13 to the LAN on the public Web server 5 side.
4 is a LAN interface for sending data to the network.

Incidentally, such an intrusion detection / defense device 10
Can be realized by a hardware configuration and / or a software configuration. For example, in the case of a software configuration, it is realized by previously installing a program for realizing the firewall function and the IDS function from the storage medium or the network in the computer of the intrusion detection / defense apparatus 10.

Next, the intrusion detection /
The operation of the defense device will be described with reference to the flowchart of FIG.

Now, assume that an IP packet addressed to the public Web server 5 is transmitted from a terminal device (not shown) on the external network, and this IP packet passes through the firewall 3 and is taken into the intrusion detection / defense device 10 from the LAN 4. .

In the intrusion detection / defense device, the outside I /
F11 receives the IP packet (ST1) and sends this IP packet to the firewall function unit 12.

The firewall function unit 12 compares the sent IP packet with the setting rule (ST2), discards the IP packet if it should be rejected (ST3), and sends it to the IDS function unit 13 if it is an accepted IP packet. Send out.

The IDS function unit 13 relates to this IP packet, payload information of the IP packet and attack pattern D.
The attack pattern in B is compared (ST4), and if the two match, the IP packet is discarded (ST).
5) If they do not match, the IP packet is sent to the inner I / F 14 (ST6), and the process returns to step ST1.

The inner I / F 14 sends the sent IP packet to the LAN 4 on the public Web server 5 side.

As a result, the firewall function unit 12
Only IP packets that have not been discarded by both the IDS function unit 13 and the IDS function unit 13 reach the public Web server 5.

As described above, according to this embodiment, unlike the conventional interception-type IDS, the filter-type IDS function unit 13 can immediately block an IP packet that is an attack, and can be disclosed by an attack packet. It is possible to prevent an attack on the Web server 5.

Supplementally, the conventional intrusion detection system is
It is an interception type and is a system that does not protect only by intrusion detection. On the other hand, the IDS function unit 13 of the present embodiment is a filter type, which is a system for detecting and preventing intrusion. Therefore, the present embodiment can obtain the above-mentioned effects, unlike the related art.

Further, since the firewall function unit 12 in the previous stage reduces the number of IP packets in advance, the I
Processing amount per unit time in the DS function unit 13 (hereinafter,
Throughput).

(Second Embodiment) FIG. 4 is a schematic diagram showing the structure of an intrusion detection / defense apparatus according to the second embodiment of the present invention. The same parts as those in the above-mentioned drawings are designated by the same reference numerals. The detailed description thereof will be omitted, and different parts will be mainly described here. In addition, in each of the following embodiments, the description of the overlapping portions will be omitted in the same manner.

That is, the present embodiment is a modification of the first embodiment, and the IDS function unit 13 can dynamically set the setting rule of the firewall function unit 12. Specifically, for example, The firewall function unit 12 is provided with a dynamic rule setting unit 13b that can set a setting rule for blocking an IP packet used for a denial of service attack (DoS).

Here, the dynamic rule setting unit (mass packet rejection function means) 13b is provided in the IDS function unit 13 and uses the IDS function unit 13 itself as the destination IP address.
A function for counting the number of P packets and, when the count result per unit time exceeds a threshold value, I
It has a function of setting a setting rule for blocking P packets in the firewall function unit 12 and a function of canceling the setting rule after a predetermined time.

The destination IP address of the DoS attack is
The public Web server 5 is not limited to the IDS function unit 13.

Next, the intrusion detection /
The operation of the defense device will be described with reference to the flowchart of FIG. Now, as described above, it is assumed that steps ST1 to ST4 are completed. That is, the IDS function unit 13 includes
There is an IP packet that passes through the firewall function unit 12 and does not correspond to the attack pattern in the attack pattern DB 13a.

If the IP packet does not have a destination IP address addressed to itself 13, the IDS function unit 13 proceeds to step ST6 described above and sends the IP packet to the inner I / F 14. On the other hand, when this IP packet has a destination IP address addressed to itself 13, the dynamic rule setting unit 13b counts the number of such IP packets (ST11).

Here, the dynamic rule setting section 13b determines whether or not the number of IP packets per unit time exceeds a predetermined threshold value (ST12), and if not, proceeds to the above-mentioned step ST6. IP packet inside I / F 14
Send to.

On the other hand, when the threshold value is exceeded, the dynamic rule setting unit 13b temporarily adds a setting rule to the firewall function unit 12 to block an IP packet having a destination IP address addressed to the function unit 13 itself. Set (ST1
3).

Consequently, thereafter, in addition to the existing setting rule, the firewall function unit 12 discards this IP packet when the destination IP address of the IP packet received from the outer I / F 11 is addressed to the IDS function unit 13. ST1
~ ST3).

After the elapse of a certain period of time when it is considered that the DoS attack has ended, the dynamic rule setting section 13b proceeds to step ST1.
The setting rule additionally set in 3 is canceled (ST14).

As a result, the intrusion detection / prevention device 10 is
Similarly to the above, the processing from step ST1 is continued. As described above, according to the present embodiment, when a large number of IP packets addressed to the IDS function unit 13 are detected, the firewall function unit 12 is temporarily interrupted to block the corresponding IP packets. In addition to the effect
A denial of service attack against the IDS function can be protected.

Supplementally, in the conventional network interception type intrusion detection system, the DoS similar to that of this embodiment is used.
Even if you want to protect against attacks, the intrusion detection system notifies the firewall via the network, so the delay time is long.

However, according to this embodiment, the IDS function unit 13 has the firewall function unit 12 in the same device 10.
Since it will notify you, the shortest delay time will be required.

Further, even if the destination of a large number of IP packets is the public Web server at the latter stage, in the past, since the intrusion detection system is a network interception type, all I
Since the P packet reaches each device via the network, the defense of the attack becomes uncertain.

On the other hand, in this embodiment, the IDS function unit 13
Since it is a filter type, all IP packets can be blocked, and the defense of attacks is ensured.

(Third Embodiment) FIG. 6 is a schematic diagram showing the structure of an intrusion detection / defense apparatus according to a third embodiment of the present invention. That is, this embodiment is a modification of the first embodiment, and the firewall function unit 12 has a function (IDS switching function means) capable of switching the ON / OFF state of the IDS function unit 13, Specifically, for example, the firewall function unit 12 has an on / off state table 12a that associates the header information of the IP packet with the on / off state of the IDS function unit 13, and creates this on / off state table 12a. Firewall function part 12
The IDS function unit 13 is provided with a table setting unit 13c for setting the table.

Here, the on / off state table 12a
Is a table that the firewall function unit 12 refers to when performing on / off control of the IDS. As shown in FIG. 7, for example, a pair of a source IP address and an on / off state is set in advance. Has become.

Specifically, the on / off state table 12
a is an IDS function unit 1 in the case of an unreliable source IP address (eg, an IP address on the external network 1)
3 is turned on (execution state) and reliable source IP
Address (eg, IP address on internal network 2)
In this case, the IDS function unit 13 is set to the off state (stop state).

Note that "unreliable" means "there is a possibility of being an attack source, or the possibility thereof is higher than that of" reliable "", and "reliable" is "an attack source." There is no possibility or the possibility is lower than “unreliable” ”.

On the other hand, the table setting unit 13c is provided in the IDS function unit 13, and when the firewall function unit 12 notifies the setting rule, the on / off state table 12a is created based on the setting rule and is obtained. The firewall function section 12 has a function of setting the on / off state table 12a thus set.

Here, to create the on / off state table 12a relating to the on / off state of the IDS function unit 13 from the setting rule of the firewall function unit 12, for example, the sender IP address of the rejection target in the setting rule is set. For the source IP address on the containing network, I
It is set such that the DS function unit 13 is turned on. In other words, the intrusion detection / prevention process is set to the ON state for the IP packet related to the rejection target of the firewall function unit 12. However, not limited to this, the valid on / off state table 1 is based on the setting rule.
Any method can be used as long as it can create 2a.

Next, the intrusion detection /
The operation of the defense device will be described with reference to the flowchart of FIG. First, the firewall function unit 12 notifies the IDS function unit 13 of the setting rule as shown in FIG. 8 (ST21).

The IDS function unit 13 uses HTTP (Hypertext).
Transfer Protocol) based on the setting rules for
ON / OFF state table 1 for source IP address
2a is created (ST22), and this on / off state table 12a is set in the firewall function unit 12.

As a result, the firewall function unit 12
Can switch the on / off state of the IDS function unit 13.

Next, the intrusion detection / defense apparatus 10 processes steps ST1 to ST3 as described above. Here, during step ST2, it is assumed that the firewall function unit 12 can accept the IP packet based on its own setting rule.

At this time, the firewall function unit 12
Uses the source IP address extracted from the IP packet as a search key to refer to the on / off state table 12a (ST23). As a result of this reference, when the on / off state table 12a indicates that the IDS function unit 13 is turned on, the firewall function unit 12 switches the IDS function unit 13 to the on state. As a result, the IDS function unit 13 is turned on and the step ST is performed as described above.
4 to ST6 are executed.

On the other hand, as a result of the reference in step ST23, I
When the on / off state table 12a indicates that the DS function unit 13 is turned off, the firewall function unit 12
Switches the IDS function unit 13 to the off state and transmits the IP packet to the inner I / F 14 (ST6a).

Thus, for example, the external network 1
IP packets from the terminal device to the public Web server 5 are inspected by turning on the IDS function unit 13, but IP packets from the terminal device on the internal network 2 to the public Web server 5 turn off the IDS function unit 13. It is possible to realize a switching operation in which the state is changed to pass.

As described above, according to this embodiment, the firewall function unit 12 turns on / off the IDS function unit 13.
Since the off control is performed, in addition to the effects of the first or second embodiment, wasteful execution of the IDS function unit 13 can be eliminated and the load on the IDS function unit 13 can be reduced. As a result,
The throughput of the device can be improved.

(Fourth Embodiment) FIG. 9 is a schematic diagram showing the structure of an intrusion detection / defense apparatus according to a fourth embodiment of the present invention.

That is, the present embodiment is an example in which the second and third embodiments are combined with each other. Specifically, as shown in FIG. 9, the on / off state table 12a and the dynamic rule setting unit 13b are used. Also, a table setting unit 13c is provided at the same time, and as shown in FIG. 10, it operates according to the above-described flowchart combining FIG. 5 and FIG.

Therefore, the configurations of the second and third embodiments can be realized at the same time, and the effects of both embodiments can be obtained at the same time.

The method described in each of the above embodiments is
As a program that can be executed by a computer, a magnetic disk (floppy (registered trademark) disk,
Hard disk, etc., Optical disk (CD-ROM, D
It can be stored in a storage medium such as a VD), a magneto-optical disk (MO), a semiconductor memory or the like and distributed.

The storage medium may have any storage format as long as it can store the program and can be read by a computer.

Further, an OS (operating system) running on the computer based on the instructions of the program installed in the computer from the storage medium,
MW such as database management software and network software
(Middleware) or the like may execute a part of each processing for realizing the present embodiment.

Further, the storage medium in the present invention is not limited to a medium independent of a computer, but includes a storage medium in which a program transmitted via a LAN, the Internet or the like is downloaded and stored or temporarily stored.

Further, the number of storage media is not limited to one, and the case in which the processing in this embodiment is executed from a plurality of media is also included in the storage media in the present invention, and the medium configuration may be any configuration.

The computer according to the present invention executes each process in the present embodiment based on the program stored in the storage medium, and is a device such as a personal computer or a plurality of devices connected to the network. It may have any configuration such as an established system.

The computer in the present invention means
Not only a personal computer but also an arithmetic processing unit, a microcomputer, and the like included in an information processing device, which collectively refer to a device and a device that can realize the functions of the present invention by a program.

The invention of the present application is not limited to the above-described embodiments, and can be variously modified at the stage of implementation without departing from the spirit of the invention. In addition, the respective embodiments may be implemented by being combined appropriately as far as possible, in which case the combined effects can be obtained. Further, the above-described embodiments include inventions at various stages, and various inventions can be extracted by appropriately combining a plurality of disclosed constituent requirements. For example, when the invention is extracted by omitting some of the constituent elements shown in the embodiment, when omitting the extracted invention, the omitted portions are appropriately supplemented by well-known and common techniques. It is something that will be done.

Besides, the present invention can be variously modified and implemented without departing from the gist thereof.

[0082]

As described above, according to the present invention, it is possible to prevent an attack by an attack packet. Also, it can prevent denial of service attacks against itself.

[Brief description of drawings]

FIG. 1 is a schematic diagram showing a configuration of a network system to which an intrusion detection / defense device according to a first embodiment of the present invention is connected.

FIG. 2 is a schematic diagram showing a configuration of an intrusion detection / defense device according to the same embodiment.

FIG. 3 is a flowchart for explaining an operation in the same embodiment.

FIG. 4 is a schematic diagram showing a configuration of an intrusion detection / defense device according to a fourth embodiment of the present invention.

FIG. 5 is a flowchart for explaining an operation in the same embodiment.

FIG. 6 is a schematic diagram showing the configuration of an intrusion detection / defense device according to a third embodiment of the present invention.

FIG. 7 is a schematic diagram showing a configuration of an on / off state table in the same embodiment.

FIG. 8 is a flowchart for explaining the operation in the same embodiment.

FIG. 9 is a schematic diagram showing the configuration of an intrusion detection / defense device according to a fourth embodiment of the present invention.

FIG. 10 is a flowchart for explaining the operation in the same embodiment.

[Explanation of symbols]

1 ... External network 2 ... Internal network 3 ... Firewall 4 ... LAN 5 ... Public Web server 10 ... Intrusion detection / prevention device 11 ... Outside I / F 12 ... Firewall function 12a ... on / off state table 13 ... IDS functional unit 13a ... Attack pattern DB 13b ... Dynamic rule setting section 13c ... table setting section 14 ... Inside I / F

Claims (6)

[Claims] 1. An intrusion detection / prevention device for detecting an intrusion of an IP packet that constitutes an attack and protecting the attack, wherein an IP packet which is set in advance based on header information of the received IP packet Referring to a setting rule indicating the relationship between header information and an attack, a firewall function unit that blocks an IP packet that becomes an attack while passing an IP packet that does not become an attack, and an IP packet that has passed through the firewall function unit An intrusion detection / defense apparatus comprising: a filter-type IDS function unit that blocks an IP packet that is an attack based on payload information while passing an IP packet that is not an attack. 2. The intrusion detection / defense apparatus according to claim 1, wherein it is determined whether or not the number of IP packets addressed to the IDS function unit per unit time provided in the IDS function unit exceeds a threshold value. However, when the determination result exceeds the threshold value, a mass packet denial function means for temporarily setting another setting rule for blocking the IP packet addressed to the IDS function means in the firewall function means is provided. Intrusion detection / prevention device characterized by 3. The intrusion detection / defense apparatus according to claim 1, wherein the firewall function unit is provided with header information of an IP packet set in advance and an ON / OFF state of the IDS function unit. An intrusion detection / prevention device comprising IDS switching function means for switching the ON / OFF state of the IDS function means on the basis of the above relationship. 4. A program used in an intrusion detection / prevention device for detecting an intrusion of an IP packet that is an attack and protecting the attack, wherein the computer of the intrusion detection / prevention device receives the received IP packet. Based on the header information of the above, referring to a preset setting rule indicating the relationship between the header information of the IP packet and the attack, the IP packet that becomes the attack is blocked while the IP packet that does not become the attack is passed. A program for realizing a function, a filter-type IDS function that blocks an IP packet that is an attack based on payload information of an IP packet that has passed through the firewall function, while allowing an IP packet that is not an attack to pass through. 5. The program according to claim 4, wherein an ID per unit time is added to the computer of the intrusion detection / prevention device to the IDS function.
It is determined whether or not the number of IP packets addressed to the S function exceeds a threshold value, and when this determination result exceeds the threshold value, another setting rule for blocking the IP packet addressed to the IDS function. A program for realizing a large packet rejection function that temporarily sets the above-mentioned firewall function. 6. The program according to claim 4 or 5, wherein the computer of the intrusion detection / prevention device has a preset IP packet header information added to the firewall function and the IDS function turned on. A program for realizing an IDS switching function for switching the ON / OFF state of the IDS function based on the relationship with the ON / OFF state.