JP2003333092A - Network system, method of tracing attack packet and method of preventing attack packet - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To obtain a network system capable of identifying a attack source of DoS (denial of service) attack, and relaying normal traffics without troubles, while suppressing consumption of network resources by illegal traffics, even when fraudulent traffics are generated due to DoS attack. <P>SOLUTION: This network system is provided with a plurality of routers (11, 12, 13, 14, 15, 21, 22 and 23), which cooperate in requesting the adjacent routers to monitor packets with each other, in order to take countermeasures against the DoS attack targeting servers over the Internet. Each of the routers which are requested to monitor the packets detects the attacker packets matching a specific bit pattern, thereby tracing the transmission source of the attack packets. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network system including a plurality of routers such as the Internet, and particularly to a DoS (Denial of Service) attack or a DDoS (Distributed Denial) targeting a server on the Internet. of service) a network system that may be attacked, an attack packet tracking method and an attack packet defense method in the system.

[0002]

2. Description of the Related Art A conventional defense method against a DoS attack in a network system will be described below. recent years,
Operational disruption due to attacks targeting servers on the Internet is increasing, and DoS is one of the attack methods.
There is an attack. There are several methods for DoS attacks,
A typical attack method is one in which a malicious user sends a large amount of packets to a target server.
Such a DoS attack places an excessive load on the server and prevents the server from providing the service. That is,
Putting a heavy load on the network makes the service virtually unavailable.

As another attack method, a program for DoS attack is sent to a third party site with weak security, and a plurality of attack sources (third party sites) send DoS to all targeted servers at once. Attacking DDoS
Attacks are also increasing. A server that has been attacked may not only be unable to provide services, but in some cases the server itself may go down.

As a defense measure against such an attack, for example, Japanese Patent Laid-Open Nos. 2001-265678 and 200
There is a technique disclosed in JP-A 1-273209.
Here, a technique is disclosed in which a server targeted by an attack by a malicious user prevents the server from stopping itself. Further, as a method of tracking an attack route, for example, Japanese Patent Laid-Open No.
1-308918 gazette, JP 2001-217834 A.
Several methods are disclosed in Japanese Laid-Open Publications and the like.

[0005]

However, the above
In a conventional network system, protection is performed only by a server that is an attack target, and in a network used in an attack, an attack packet is relayed without being distinguished from a normal packet. Therefore, there is a problem that network resources from the attack source to the server are consumed by the unauthorized traffic. Further, in general, an attack packet in a DoS attack (or DDoS attack) is one-sided, and the source address is often spoofed, which makes it difficult to identify the attack source. .

The present invention has been made in view of the above, and when an illegal traffic due to a DoS attack (or a DDoS attack) occurs, the attack source can be specified, and further, network resources due to the illegal traffic can be identified. Network system capable of relaying normal traffic without hindrance, traffic tracking method and attack packet protection method in the system,
Aim to get.

[0007]

[Means for Solving the Problems]
In order to achieve the object, in the network system according to the present invention, in order to cope with a DoS (Denial of Service) attack targeting a server on the Internet, all routers adjacent to each other cooperate with each other. A plurality of routers requesting packet monitoring for each of the packets, and each of the routers requested to monitor traces the source of the attack packet by detecting an attack packet that matches a specific bit pattern. Is characterized by.

In the network system according to the next invention, a D system targeting a server on the Internet is used.
In order to deal with a DoS (Distributed Denial of Service) attack, a plurality of routers that cooperate with each other and request packet monitoring from all adjacent routers are provided, and each router requested to monitor is By detecting an attack packet that matches a specific bit pattern, a plurality of sources of the attack packet are traced.

In the network system according to the next invention, when the routers having the packet monitoring function and the routers having no packet monitoring function coexist, all the routers having the packet monitoring function are requested to monitor the packet. It is characterized by

The network system according to the next invention is characterized in that the router closest to the source of the detected attack packet discards the attack packet.

In the network system according to the next invention, a D targeting a server on the Internet is used.
oS (Denial of Service) attacks and DDoS (Distr
In order to deal with ibuted Denial of Service attack, a specific bit pattern for identifying a DoS attack and a new attack packet used for the DDoS attack is exchanged in cooperation with each other, and It is characterized by comprising a plurality of routers for detecting a matching attack packet.

In the network system according to the next invention, when a router having an attack packet detection function and a router having no attack packet detection function coexist, the above-mentioned specific It is characterized by notifying a bit pattern.

In the network system according to the next invention, each of the routers periodically exchanges all bit patterns held therein.

In the network system according to the next invention, each of the routers monitors all traffic.

In the attack packet tracing method according to the next invention, a D targeting a server on the Internet is used.
In order to cope with an os (Denial of Service) attack, a plurality of routers cooperate with each other to request packet monitoring from all adjacent routers, and each of the monitoring request steps. The router includes a source tracking step of tracking the source of the attack packet by detecting the attack packet that matches a specific bit pattern.

In the attack packet tracing method according to the next invention, D that targets a server on the Internet is used.
In order to deal with a DoS (Distributed Denial of Service) attack, a plurality of routers cooperate with each other to request a packet monitor from all adjacent routers, and the monitor request step. Each router
A source tracking step of tracking a plurality of sources of the attack packet by detecting the attack packet that matches a specific bit pattern.

In the attack packet protection method according to the next invention, D that targets a server on the Internet is used.
oS (Denial of Service) attacks and DDoS (Distr
In order to deal with ibuted Denial of Service) attacks, multiple routers cooperate with each other to perform DoS attacks and DD
an exchange step of exchanging a specific bit pattern for identifying a new attack packet used in an oS attack,
A detection step of detecting an attack packet that matches the specific bit pattern.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of a network system, an attack packet tracking method and an attack packet defense method in the system according to the present invention will be described below in detail with reference to the drawings. The present invention is not limited to this embodiment.

Embodiment 1. FIG. 1 is a diagram showing a configuration of a first embodiment of a network system according to the present invention. In FIG. 1, 1 is a core network, and 1
1, 12, 13, 14, and 15 accommodate access lines from a plurality of users and store user data in the core network 1.
Is an edge router relaying to, a core router relaying user data in the core network 1, 21 is a host targeted by a DoS (Denial of Service) attack, 32 is a host 31 The crackers that attack the DoS attack against the users 33 and 34 are the users who communicate with the host 31.

Here, the operation of the network system configured as above will be described. Edge router 1
In 1 to 15, the traffic to the host connected to the access line accommodated in itself is monitored. Then, match the bit pattern of any bit in the packet,
Identify the packet. By this operation, it is detected that packets of a specific type have been continuously transmitted to the same host by a threshold value or more within a predetermined time.
That is, "TCP SYN flood", "ICMP echo request f
Detects DoS attacks such as "lood" and "UDP flood" that continuously send packets to the attack target.

For example, in the present embodiment, the cracker 3
Attack packet from 2 to host 31 is edge router 1
3, it is assumed that the data is transmitted via the core routers 23 and 21, and the edge router 11. In this case, first, the edge router 11 detects a DoS attack addressed to the host 31. Then, the edge router 11 that has detected the DoS attack requests the core router 21 to monitor the packet addressed to the host 31.

Next, the core router 21, which receives the monitoring request from the edge router 11, monitors the packet addressed to the host 31 and detects the DoS attack addressed to the host 31.
It requests the neighboring routers (core routers 22 and 23) other than the edge router 11 which is the monitoring request source to monitor the packet addressed to the host 31.

Next, the core router 22, which has received the monitoring request from the core router 21, monitors the packet addressed to the host 31. However, in the case of the above route, since the attack packet does not pass through the core router 22,
Since the DoS attack on the host 31 cannot be detected within the fixed time, the core router 22 stops monitoring the packet addressed to the host 31.

The core router 23, which has received the monitoring request from the core router 21, also similarly monitors the packet addressed to the host 31. In the case of the above route, since the attack packet passes through the core router 23, that is, the host 31
Since the DoS attack addressed to the core router 23 is detected, the core router 23
It requests neighboring routers (edge routers 12, 13) other than the core routers 21, 22 to monitor packets addressed to the host 31.

Next, the edge router 12, which has received the monitoring request from the core router 23, monitors the packet addressed to the host 31. However, in the case of the above route, since the attack packet does not pass through the edge router 12, that is, the DoS attack on the host 31 cannot be detected within a certain period of time, the edge router 12 stops monitoring the packet addressed to the host 31. To do.

Similarly, the edge router 13 which receives the monitoring request from the core router 23 also monitors the packet addressed to the host 31. In the case of the above route, since the attack packet passes through the edge router 13, that is, the DoS attack addressed to the host 31 is detected, the edge router 13 is detected.
Then, after recognizing that there is no adjacent router other than the core router 23, the attack source of the DoS attack is identified as being connected to the access line accommodated by itself.

Finally, the edge router 13 that has identified the access line of the attack source discards all the detected attack packets.

As described above, in the present embodiment, first, D
The edge router accommodating the access line of the host targeted by the oS attack detects the DoS attack, and then the edge router requests the neighboring router to monitor the packet addressed to the attack target host, and the DoS attack is detected. The neighboring router further requests the neighboring router to monitor the packet targeted for the attack target host, and the router that has detected the DoS attack subsequently requests the neighboring router to monitor the packet targeted for the attack target host. Track the attack source. As a result, the source of the attack packet in the DoS attack can be finally specified.

Further, in this embodiment, the edge router which is the entrance of the attack packet discards the attack packet. As a result, the attack packet is not relayed to the core network, and the resource consumption of the attack packet can be suppressed in the entire network system. Further, the packet addressed to the host from each user can be relayed without being affected by the attack packet.

Embodiment 2. In the above-described first embodiment, when a DoS attack is detected, a request for monitoring a packet addressed to the attack target host is made to "hop-by-hop". On the other hand, in the second embodiment, in a system including a router having no packet monitoring function, for example, only a router having a packet monitoring function is requested to monitor a packet addressed to an attack target host. The configuration of the network system in this embodiment is the same as that in FIG. 1 of the first embodiment.

In this embodiment, it is assumed that only the edge router has the packet monitoring function and the core router does not have the packet monitoring function. In this case, the edge router 11 which has detected the DoS attack addressed to the host 31 requests the edge routers 12, 13, 14, 15 to monitor the packet addressed to the host 31 via the core router having no packet monitoring function.

As described above, in this embodiment, only the router having the packet monitoring function is used to trace the source of the attack packet in the DoS attack. As a result, it can be easily installed in an existing network system.

Embodiment 3. FIG. 2 is a diagram showing the configuration of the third embodiment of the network system according to the present invention. In FIG. 2, 40 is a core network, and 4
1, 42, 43, 44, 45 and 46 are edge routers that accommodate access lines from a plurality of users and relay user data to the core network 40.
53 and 54 are core routers that relay user data in the core network 40, and 61 is a DDoS (Dist).
ributed Denial of Service) is an attack target host, and 62, 63, and 64 are hosts that serve as a stepping stone for a DDoS attack and send an attack packet to the host 61.

Here, the operation of the network system configured as described above will be described. In addition, DDoS
The attack detection method is the same as in the first embodiment described above.

When an attack packet to the host 61 is transmitted from the hosts 62, 63, 64 set as a platform, the edge router 41 detects a DDoS attack addressed to the host 61. At this time, the attack packet from the host 62 passes through the edge router 42 and the core routers 52 and 51, the attack packet from the host 63 passes through the edge router 43 and the core routers 52 and 51, and the attack packet from the host 64 passes. , Edge router 44, and core routers 53 and 51. Then, in the edge router 41 that has detected the DDoS attack, the core router 5 that is the adjacent router
1 to monitor the packet addressed to the host 61.

Next, the core router 51, which has received a packet monitoring request from the edge router 41, monitors the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be equal to or lower than the threshold value at the time of detection by the edge router 41. When the core router 51 detects a DDoS attack addressed to the host 61, the adjacent routers (core routers 52, 5) other than the requesting edge router 41 are detected.
3) Request the monitoring of the packet addressed to the host 61 to 3).

Next, the core router 52, which has received the monitoring request from the core router 51, monitors the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be set equal to or lower than the threshold value at the time of detection by the core router 51. In the core router 52, the DDo addressed to the host 61
When an S attack is detected, adjacent routers (core router 54, edge routers 42, 4) other than the requesting core router 51 are detected.
3) Request the monitoring of the packet addressed to the host 61 to 3).

Similarly, the core router 53, which has received the monitoring request from the core router 51, also monitors the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be set equal to or lower than the threshold value at the time of detection by the core router 51. In the core router 53, the DDo addressed to the host 61
When an S attack is detected, adjacent routers (core router 54, edge routers 44, 4 other than the requesting core router 51) are detected.
5) Request the monitoring of the packet addressed to the host 61 to 5).

Next, the core router 54, which has received the monitoring request from the core routers 52 and 53, monitors the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be equal to or lower than the threshold value at the time of detection by the core routers 52 and 53. However, here, since the attack packet does not pass through the core router 54, that is, the DDoS attack on the host 61 cannot be detected within a fixed time, the core router 54 stops monitoring the packet addressed to the host 61.

Similarly, the edge routers 42 and 43 receiving the monitoring request from the core router 52 also monitor the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be set equal to or lower than the threshold value at the time of detection by the core router 52. Here, since the attack packet passes through the edge routers 42 and 43, that is, the DDoS attack on the host 61 can be detected within a fixed time, the edge routers 42 and 43 have no adjacent routers other than the core router 52. After recognizing that, the attack source of the DDoS attack specifies that the attack source is connected to the access line accommodated by itself.

Similarly, the edge routers 44 and 45, which have received the monitoring request from the core router 53, also monitor the packet addressed to the host 61. At this time, the threshold value for detecting the DDoS attack may be set equal to or lower than the threshold value at the time of detection by the core router 53. Here, since the attack packet passes through the edge router 44, that is, the DDoS attack on the host 61 can be detected within a certain period of time, the edge router 44 recognizes that there is no adjacent router other than the core router 53. , The source of the DDoS attack is connected to the access line that the DDoS attack accommodates. The edge router 45 stops monitoring the packet addressed to the host 61 because the attack packet does not pass through the edge router 45, that is, the DDoS attack cannot be detected against the host 61 within a fixed time.

Finally, the edge routers 42, 43, and 44 that have specified the attack source access line discard all detected attack packets.

As described above, in the present embodiment, first, D
The edge router accommodating the access line of the host which is the target of the DoS attack detects the DDoS attack, and next,
The edge router requests the neighboring router to monitor the packet targeted for the attack target host, and the neighboring router that detects the DDoS attack further requests the neighboring router to monitor the packet targeted for the attack target host, and then executes the DDoS attack. The detected router traces the attack source by successively requesting neighboring routers to monitor packets for the attack target host. As a result, it is possible to finally specify a plurality of transmission sources of the attack packet in the DDoS attack.

Further, in this embodiment, the edge router which is the entrance of the attack packet discards the attack packet. As a result, the attack packet is not relayed to the core network, and the resource consumption of the attack packet can be suppressed in the entire network system. Further, the packet addressed to the host from each user can be relayed without being affected by the attack packet.

Fourth Embodiment In the third embodiment described above, when a DDoS attack is detected, a monitoring request for a packet addressed to the attack target host is made to "hop-by-hop". On the other hand, in the fourth embodiment, in a system having a router having no packet monitoring function, for example, only a router having a packet monitoring function is requested to monitor a packet addressed to an attack target host. The configuration of the network system according to the present embodiment is the same as that shown in FIG.
Is the same as.

In this embodiment, it is assumed that only the edge router has the packet monitoring function and the core router does not have the packet monitoring function. In this case, the edge router 41 that has detected the DDoS attack addressed to the host 61 sends the host 61 to the edge routers 42, 43, 44, 45, 46 via the core router having no packet monitoring function.
Request monitoring of addressed packets.

As described above, in this embodiment, only the router having the packet monitoring function is used to trace the source of the attack packet in the DDoS attack. As a result, it can be easily installed in an existing network system.

Embodiment 5. Next, the operation of the network system according to the fifth embodiment will be described. The configuration of the network system in this embodiment is the same as that in FIG. 1 of the first embodiment.

Edge routers 11, 12, 13, 14, 1
In 5, the traffic to the host connected to the access line accommodated in itself is monitored. Then, the attack packet used for the DoS attack (or DDoS attack) is detected by matching the attack packet detection pattern held by itself and the bit pattern of an arbitrary bit in the received packet to identify the packet. The attack packet detection pattern held by each router may be registered by automatically detecting an attack by the router, or may be manually registered by the user or the administrator.

For example, when a new attack packet detection pattern is registered, the edge router 14 notifies the adjacent core router 22 of the new attack packet detection pattern.

Next, the core router 22, which has received the new attack packet detection pattern from the edge router 14, closely examines whether the notified attack packet detection pattern exists in the attack packet detection patterns held by itself. At this time, if the notified attack packet detection pattern does not exist, the attack packet detection pattern is registered and a new attack packet is detected for the adjacent routers (edge router 15, core routers 21, 23) other than the edge router 14. Notify the pattern.

Next, the edge router 15, which has received the new attack packet detection pattern from the core router 22, closely examines whether the notified attack packet detection pattern exists in the attack packet detection patterns held by itself. At this time, if there is no notified attack packet detection pattern, the attack packet detection pattern is registered.

Similarly, in the core router 21 which has received the new attack packet detection pattern from the core router 22,
Examine whether the notified attack packet detection pattern exists in the attack packet detection patterns held by itself. At this time, if the notified attack packet detection pattern does not exist, the attack packet detection pattern is registered, and the new attack packet detection pattern is notified to the adjacent routers (edge router 11, core router 23) other than the core router 22. To do.

Similarly, the core router 23 which receives a new attack packet detection pattern from the core router 22
Then, in the attack packet detection pattern held by itself,
Scrutinize for the presence of the advertised attack packet detection pattern. At this time, if the notified attack packet detection pattern does not exist, the attack packet detection pattern is registered and a new attack packet detection pattern is added to the adjacent routers (edge routers 12, 13, core router 21) other than the core router 22. To notify.

Next, in the edge routers 11, 12, and 13 that have received the notification of the new attack packet detection pattern from the core router 21 or 23, the notified attack packet detection pattern is included in the attack packet detection patterns held by itself. Scrutinize if it exists. At this time, if there is no notified attack packet detection pattern,
The attack packet detection pattern is registered.

Then, for example, when the cracker 32 transmits a packet matching the newly registered attack packet detection pattern to the host 31, the edge router 11 performs the above-mentioned matching process to obtain the Do addressed to the host 31.
Detect S attack (or DDoS attack).

As described above, in this embodiment, the router in which the new attack packet detection pattern is registered is
The process of notifying the neighboring router of the attack packet detection pattern is repeatedly executed to notify all the routers in the network of the new attack packet detection pattern. As a result, DoS attack (or DDoS attack)
Can protect the host from attack packets in.

In this embodiment, the attack packet detection pattern is notified when a new attack packet detection pattern is registered. However, the present invention is not limited to this, and all attacks held by the router are regularly held. The packet detection pattern may be notified. As a result, even when the configuration of the network system is changed such as the addition of a new router, the attack packet detection pattern can be shared by all the routers.

In this embodiment, the edge router detects the attack packet by monitoring the traffic addressed to the host connected to the access line accommodated by itself, but the present invention is not limited to this. You may want to monitor traffic at your router. This allows the router close to the source of the attack packet to detect the attack packet.

Sixth Embodiment In the above-described fifth embodiment, when a new attack packet detection pattern is registered, the attack packet detection pattern is notified to “hop-by-hop”. On the other hand, in the sixth embodiment, in a system including a router having no attack packet detection function, for example, only the router having the attack packet detection function is notified of the attack packet detection pattern. The configuration of the network system in this embodiment is the same as that in FIG. 1 of the first embodiment.

In this embodiment, it is assumed that the edge router has the attack packet detection function and the core router does not have the attack packet detection function. In this case, the edge router 14 in which the new attack packet detection pattern is registered
Then, the attack packet detection pattern is notified to the edge routers 11, 12, 13, and 15 via the core router having no attack packet detection function.

As described above, in this embodiment, the router having the attack packet detecting function is used to detect the attack packet in the DoS attack (or the DDoS attack).
As a result, it can be easily installed in an existing network system.

[0063]

As described above, according to the present invention, first, the router accommodating the access line of the host that is the target of the DoS attack detects the DoS attack, and then the router becomes the neighboring router. In response, the neighboring router that has detected the DoS attack packet monitoring request further requests the neighboring routers to monitor the attack target host packet, and then the router that has detected the DoS attack successively The system configuration is configured to trace the attack source by requesting the router to monitor the packet addressed to the attack target host. As a result, finally D
The source of the attack packet in the oS attack can be specified,
Has the effect.

According to the next invention, first, the router accommodating the access line of the host to be attacked by the DDoS attack detects the DDoS attack, and then the router sends a packet to the attack target host to the neighboring router. Of the DDoS attack, the neighboring router further requests the neighboring router to monitor the packet addressed to the attack target host, and then the router that detects the DDoS attack successively attacks the neighboring host to the neighboring router. The system was configured to trace the attack source by requesting the monitoring of the packet addressed to it. As a result, it is possible to finally specify a plurality of transmission sources of the attack packet in the DDoS attack.

According to the next invention, only the router having the packet monitoring function is used to trace the source of the attack packet in the DoS attack. As a result, there is an effect that it can be easily introduced into an existing network system.

According to the next invention, the edge router serving as the entrance of the attack packet discards the attack packet. As a result, the attack packet is not relayed to the core network, so that the resource consumption of the attack packet can be suppressed in the entire network system. Further, it is possible to relay the packet addressed to the host from each user without being affected by the attack packet.

According to the next invention, the router in which the new attack packet detection pattern is registered repeatedly executes the processing of notifying the neighboring router of the attack packet detection pattern, and all routers in the network are System configuration to notify the new attack packet detection pattern. As a result, the host can be protected from the DoS attack or a new attack packet in the DDoS attack.

According to the next invention, a DoS attack or DDoS attack is made by using a router having an attack packet detection function.
Detect attack packets in an attack. As a result, there is an effect that it can be easily introduced into an existing network system.

According to the next invention, all attack packet detection patterns held by the router are periodically notified. As a result, even if the configuration of the network system is changed, such as the addition of a new router, the attack packet detection pattern can be shared by all the routers.

According to the next invention, all routers monitor the traffic. This has the effect that the router close to the source of the attack packet can detect the attack packet.

According to the next invention, first, the router accommodating the access line of the host which is the target of the DoS attack detects the DoS attack, and then the router sends a packet to the neighboring host to the attack target host. Of the DoS attack is detected by the neighboring router, and the neighboring router further requests the neighboring router to monitor the packet addressed to the attack target host, and then the router that detects the DoS attack successively attacks the neighboring router to the neighboring router. The source of the attack is traced by requesting monitoring of the addressed packet. This has the effect of finally identifying the source of the attack packet in the DoS attack.

According to the next invention, first, the router accommodating the access line of the host to be attacked by the DDoS attack detects the DDoS attack, and then the router sends a packet to the neighboring host to the attack target host. Of the DDoS attack, the neighboring router further requests the neighboring router to monitor the packet addressed to the attack target host, and then the router that detects the DDoS attack successively attacks the neighboring host to the neighboring router. The source of the attack is traced by requesting monitoring of the addressed packet. As a result, it is possible to finally specify a plurality of transmission sources of the attack packet in the DDoS attack.

According to the next invention, the router in which the new attack packet detection pattern is registered repeatedly executes the processing of notifying the neighboring router of the attack packet detection pattern to all routers in the network. The new attack packet detection pattern is notified. As a result, the host can be protected from the DoS attack or a new attack packet in the DDoS attack.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of first, second, fifth, and sixth exemplary embodiments of a network system according to the present invention.

FIG. 2 is a diagram showing a configuration of third and fourth embodiments of the network system according to the present invention.

[Explanation of symbols]

1,40 Core network, 11, 12, 13, 1
4,15,41,42,43,44,45,46 Edge router 21,22,23,51,52,53,54
Core router, 31, 61, 62, 63, 64 host, 32 cracker, 33, 34 users.

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 5B089 GA31 HA10 KA17 KB07 KC51                       MC08                 5K030 GA15 HA08 HC01 HD03 KA01                       KA05 KX28 LC13 MA01 MC08

Claims (11)

[Claims] 1. In a network system capable of coping with a DoS (Denial of Service) attack targeting a server on the Internet, a plurality of routers which cooperate with each other and request all adjacent routers to monitor a packet. The network system, wherein each router requested to monitor traces the source of the attack packet by detecting the attack packet that matches a specific bit pattern. 2. In a network system capable of coping with a DDoS (Distributed Denial of Service) attack targeting a server on the Internet, a plurality of routers cooperating with each other and requesting all adjacent routers to monitor a packet. The network system according to claim 1, wherein each of the routers requested to monitor traces a plurality of sources of attack packets by detecting an attack packet that matches a specific bit pattern. 3. When the routers having the packet monitoring function and the routers not having the packet monitoring function coexist, requesting the packet monitoring to all the routers having the packet monitoring function. The network system described in. 4. The network system according to claim 1, wherein the router closest to the source of the detected attack packet discards the attack packet. 5. A DoS (Denial of Service) attack targeting a server on the Internet and a DDoS (Dist)
ributed denial of service) In a network system that can cope with an attack, exchange a specific bit pattern for identifying a DoS attack and a new attack packet used for a DDoS attack by cooperating with each other and exchanging the specific bit. A network system comprising: a plurality of routers that detect attack packets that match a pattern. 6. When a router having an attack packet detection function and a router having no attack packet detection function coexist,
6. The specific bit pattern is notified to all routers having an attack packet detection function.
The network system described in. 7. The network system according to claim 5, wherein each of the routers periodically exchanges all bit patterns held therein. 8. The network system according to claim 5, 6 or 7, wherein each of the routers monitors all traffic. 9. In an attack packet tracing method of a network system capable of dealing with a DoS (Denial of Service) attack targeting a server on the Internet, a plurality of routers cooperate with each other to all adjacent routers. Monitoring request step for requesting packet monitoring by means of a packet, and a source tracking step for tracking the source of the attack packet by each of the routers requested for monitoring detecting an attack packet that matches a specific bit pattern. An attack packet tracking method comprising: 10. In an attack packet tracing method for a network system capable of dealing with a DDoS (Distributed Denial of Service) attack targeting a server on the Internet, a plurality of routers cooperate with each other and all adjacent routers. Monitoring request step for requesting packet monitoring to each of the routers, and each router requested for monitoring detects an attack packet that matches a specific bit pattern, and sends a trace of multiple sources of the attack packet. An attack packet tracking method comprising: a source tracking step. 11. A DoS (Denial of Service) attack and a DDoS (D) targeting a server on the Internet.
In a method of defending an attack packet of a network system capable of dealing with an istributed Denial of Service attack, a plurality of routers cooperate with each other to perform a DoS attack and a D
And a step of exchanging a specific bit pattern for identifying a new attack packet used for the DoS attack, and a step of detecting an attack packet matching the specific bit pattern. Attack packet defense method.