JP2004164107A - Unauthorized access monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an unauthorized access detection system appropriate to detect a distributed denial of service attack (DDoS attack). <P>SOLUTION: This unauthorized access monitoring system contains a backbone network 11 and a LAN 12 housing at least one of terminal devices 121, 122 and 123 and connected to the backbone network 11 to monitor an unauthorized access to the terminal device 121 or the like housed in the LAN 12. A plurality of analyzing terminals 13 are provided in each of flow-in routes from external networks into the backbone network 11 to analyze a packet flowing from each of the flow-in routes into the backbone network 11 to extract an access suspicious as the unauthorized access, and a management terminal 14 for collecting results of analyses from each of the analyzing terminals 13 to detect an unauthorized access on the basis of a result of the total is provided. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a system for detecting unauthorized access to a server housed in a managed IP network such as a campus network, an academic network, or an ISP (Internet Service Provider), and more particularly to a distributed denial of service (DDoS) attack. Attack.DDoS: An unauthorized access detection system suitable for detecting Distributed-denial of service.
[0002]
[Prior art]
In recent years, a DDoS attack in which packets are simultaneously transmitted from a plurality of computers to an attack target computer has become a problem. In a DDoS attack, software called an agent is installed from a computer of an intruder to a computer of a third party via a communication network, and by remotely operating this agent, a large number of packets are transmitted to a computer to be attacked in a short time. To send. As a result, the computer to be attacked consumes system resources and cannot perform TCP communication processing or TCP service processing, resulting in a downtime.
[0003]
In order to protect a computer from such a DDoS attack, a method of incorporating a DDoS traceback function and various intrusion detection systems (IDS: Intrusion Detection System) into a router has been studied. In a conventional IDS, for example, a router acquires a packet on an inflow route, and extracts a destination address and a source address described in a header of the packet. If a large number of packets are transmitted from one transmission source to one destination in a short time, this is recognized as an unauthorized access.
[0004]
However, it has been pointed out that even if an IDS is incorporated in a router, packets may be lost under the current situation in which giga-order traffic is concentrated on one line, and the router does not function well. In order to speed up the IDS, introduction of a high-speed server and improvement of firmware and software have been promoted, but none of them can completely solve the problem of missing packets. Also, it is difficult to incorporate a traceback function into a large number of routers in a short period of time, so it is difficult to realize a monitoring function using the traceback function in the near future.
[0005]
In order to solve such a problem, Japanese Patent Application Laid-Open No. 2002-252654 discloses an intrusion detection function added to a router that relays packets between an internal network and an external network, and monitors packets flowing from the external network. I do. In the case of authorized access, a plurality of packets having the same session identifier are transmitted from the calling computer to the called computer, whereas in the case of unauthorized access, a plurality of different session identifiers are transmitted. Paying attention to transmitting a plurality of packets each having the following to the called computer, when such an unauthorized access count exceeds a predetermined threshold value, it is determined that this is an unauthorized attack.
[0006]
[Problems to be solved by the invention]
In the above-described conventional intrusion detection system, monitoring of a packet is performed on an inflow path from an external network to an internal network. For this reason, even if a DDoS attack can be detected, at that time, the inflow route is already occupied by the DDoS packet, and normal access is blocked.
[0007]
On the other hand, in order to solve such a technical problem, a configuration in which many intrusion detection systems are distributed and arranged on a network can be considered. However, in an attack technique such as a DDoS attack in which a single computer is accessed from a plurality of routes, there is a case where the access amount does not exceed the threshold when viewed in units of routes. For this reason, if the intrusion detection system is dispersedly arranged, it is undeniable that unauthorized access may be overlooked.
[0008]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems of the prior art and to provide an unauthorized access monitoring system capable of quickly and reliably detecting a DDoS attack.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, the present invention includes a backbone network, a LAN accommodating at least one terminal device, and a LAN connected to the backbone network, and unauthorized access to a terminal device accommodated in the LAN. An unauthorized access monitoring system for monitoring an unauthorized access monitoring system that monitors a packet flowing through each inflow route and analyzes an unauthorized access candidate; and an analysis terminal for analyzing an unauthorized access candidate. And a management terminal that collects and aggregates the results, and detects unauthorized packets.
[0010]
In an attack, such as a DDoS attack, in which an attack program is mounted on a large number of distributed computers to form a stepping stone, and a large number of packets are simultaneously transmitted to the target computer from the large number of computers used as the steppingstone, unauthorized access takes multiple routes. Through the target computer. For this reason, if a monitoring system is simply provided for each route, the number of accesses does not exceed the threshold value for determining unauthorized access, so that unauthorized access is likely to be overlooked. On the other hand, according to the configuration described above, the results collected on each route are totaled by the management terminal, so that unauthorized access can be detected without leaking.
[0011]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram conceptually showing the entire configuration of a computer network in which an unauthorized access monitoring system according to one embodiment of the present invention is introduced.
[0012]
In FIG. 1, a backbone network 11 and a local area network (LAN) 12 belong to a broadband network 1 controlled by the same ISP, and the LAN 12 accommodates computers 121 to 123 to be protected from a DDoS attack. . Each of the computers 121 to 123 is, for example, a personal computer, a mail server, a web server, or an FTP (File Transfer Protocol) server.
[0013]
The backbone network 11 is connected to other backbone networks having different management entities or external networks N1 to N4 such as the Internet via edge routers R1 to R3. The LAN 12 as the internal network is connected via an edge router R4. Each of the computers connected to the backbone network 11 and the LAN 12 has a function of transmitting and receiving IP packets using TCP / IP (Transmission Control Protocol / Internet Protocol) as a communication protocol.
[0014]
An analysis terminal that analyzes a packet flowing into the backbone network 11 via the inflow route and extracts a packet having a possibility of unauthorized access as an unauthorized access candidate is provided on an inflow route to each of the edge routers R1 to R3. 13 (131 to 133) are provided. Unauthorized access candidates extracted by each analysis terminal 13 are periodically collected by the management terminal 14 and totalized here. In the present embodiment, it is assumed that a number of computers (DDoS attackers) 15 in which agents for a DDoS attack are installed are connected to the external networks N1 to N4.
[0015]
When the analysis terminal 13 and the management terminal 14 establish a session in accordance with TCP, which is a communication protocol of the transport layer, the three-way handshake executed between the calling and called computers normally ends. It is determined whether or not the access is an unauthorized access based on whether or not the access is performed. More specifically, the called computer that has received the SYN IP packet transmitted from the calling computer returns a SYN / ACK IP packet in response. The calling computer that has received the SYN / ACK IP packet returns an ACK IP packet as a communication permission packet to the called computer to establish a session.
[0016]
On the other hand, at the time of unauthorized access, the agent installed in the calling computer unilaterally continues to transmit the SYN IP packet to the called computer without trying to establish a session. Therefore, in the present embodiment, when a SYN IP packet is detected, if an ACK IP packet corresponding to the SYN IP packet is returned from the calling computer, it is determined that the access is a legitimate access, and the ACK IP packet must be returned. If this is the case, it is determined that this is unauthorized access.
[0017]
FIG. 2 is a functional block diagram showing the configuration of each of the analysis terminals 13. The SYN IP packet extraction unit 161 filters and extracts the SYN IP packet on the inflow route. The ACK IP packet extraction unit 162 filters and extracts the ACK IP packet on the inflow path. When the SYN IP packet is detected, the entry management unit 163 extracts the header information and registers it as an entry in the data table 165. On the other hand, when the ACK IP packet is detected, the entry management unit 163 stores an entry corresponding to the ACK IP packet. The data table 165 is deleted. The unauthorized access candidate extraction unit 164 extracts entries remaining in the data table 165 even after a predetermined time has elapsed from the arrival time of the SYN IP packet as unauthorized access candidates.
[0018]
Each function of the analysis terminal 13 described above may be realized by hardware or software stored in the analysis terminal 13 in advance, or may be realized by a program downloaded from the management terminal 14. It may be. In the present embodiment, the description will be continued assuming that the analysis program is downloaded from the management terminal 14.
[0019]
FIG. 3 is a functional block diagram showing the configuration of the management terminal 14. The program introduction unit 174 downloads an analysis program for analyzing whether or not the packet is due to unauthorized access to each analysis terminal 13 based on the header information of the packet. The data collection unit 171 polls each analysis terminal 13 and periodically collects entries of unauthorized access candidates. The data totaling unit 172 totals the entries of the unauthorized access candidates collected from each analysis terminal 13. The unauthorized access detection unit 173 counts the total number N of entries in which both the destination address and the source address match for each combination of the destination address and the source address, and the total number N exceeds the unauthorized access determination threshold Nref. The combination entry is detected and identified as unauthorized access.
[0020]
Next, the operation of the present embodiment will be described in detail with reference to a flowchart. FIG. 4 is a flowchart showing the operation of the management terminal 14. In step S1, the analysis program is downloaded to each of the edge routers R1 to R3 by the program introduction unit 174 ([1] in FIG. 1). In step S2, it is determined whether it is a polling timing. In this embodiment, the polling timing is set to 10 minutes, and the apparatus is in a standby state until 10 minutes have elapsed from the previous polling timing.
[0021]
FIG. 5 is a flowchart showing a procedure of a packet analysis process executed based on the analysis program by each of the edge routers R1 to R3 having downloaded the analysis program.
[0022]
In step S21, the SYN IP packet extracting unit 161 filters the SYN IP packet on the inflow path. When the SYN IP packet is detected, in step S22, the header information such as the source address, the destination address, and the sequence number registered in the header is transmitted to the data table 165 by the entry management unit 163 together with the arrival time. Is registered as an entry to.
[0023]
In step S25, the ACK IP packet to be returned from the calling computer in response to the SYN / ACK IP packet that will be returned from the called computer in response to the SYN IP packet is: The ACK IP packet extraction unit 162 performs filtering on the inflow path. This filtering is performed only for a predetermined time t1 (about 1 second to 1 minute in this embodiment) until the timer times out in step S26, and if an ACK IP packet is detected within this predetermined time t1, In S27, the entry is deleted from the data table 165 by the entry management unit 163.
[0024]
On the other hand, if no ACK IP packet is detected within the predetermined time t1, the entry remains in the data table 165. In step S28, the presence or absence of polling from the management terminal 14 is determined, and the processes in steps S21 to S27 are repeated until polling is detected.
[0025]
Returning to FIG. 4, in the management terminal 14, when it is determined that the polling timing is reached in step S 2, in step S 3, the data collection unit 171 polls the analysis terminals 131 to 133 and stores the polled data in the respective data tables 165. Collect entries that have been.
[0026]
Returning to FIG. 5, when the analysis terminals 131 to 133 detect the polling from the management terminal 14 in step S28, in step S29, the arrival time of the SYN IP packet is selected from the entries remaining in the data table 165. Entry other than an entry with a small difference between the current time and the current time, that is, an entry related to an access in which the elapsed time from the arrival time of the SYN IP packet is short and the ACK IP packet may be detected in the future, is an unauthorized access. The candidate is extracted by the unauthorized access candidate extraction unit 164 as a candidate. In step S30, the entry of the unauthorized access candidate is transferred to the management terminal 14 ([2] in FIG. 1). In step S31, the entry of the transferred unauthorized access candidate is deleted from the data table 165 by the entry management unit 163.
[0027]
Returning to FIG. 4, when the management terminal 14 collects the entries of the unauthorized access candidates from the analysis terminals 131 to 133 in step S3, in step S4, the data totaling unit 172 totals the entries, and the source address and the destination address are collected. The number N of access entries having the same address is counted for each combination of the source address and the destination address.
[0028]
In step S5, the number of entries N for each combination is compared with the unauthorized access determination threshold Nref by the unauthorized access detection unit 173, and an entry satisfying N ≧ Nref is identified as an unauthorized access in step S6.
[0029]
As described above, in the present embodiment, an access for which the session establishment procedure based on TCP cannot be normally completed is extracted as an unauthorized access candidate at each edge router, and is collected from each edge router to obtain a source address and a destination address. Since the access is counted for each combination with the address and an access having a large total number N is finally determined to be an unauthorized access, although the number of accesses is small per edge router, the number of accesses is large through the flow through a plurality of edge routers. DDoS attacks can be reliably detected.
[0030]
By the way, in the first embodiment described above, on the assumption that the called computer that has received the SYN / ACK IP packet returns an SYN / ACK IP packet, a call is made to this SYN / ACK IP packet. It is determined whether or not this access is unauthorized based on the presence or absence of an ACK IP packet to be returned from the side.
[0031]
However, if the called computer cannot return the SYN / ACK IP packet to the SYN IP packet for some reason, the ACK IP packet may be sent even if the calling computer desires regular access. Since a packet cannot be returned, it cannot be distinguished from unauthorized access.
[0032]
Therefore, in the second embodiment of the present invention described below, the presence / absence of a SYN / ACK IP packet from the called computer in response to the SYN IP packet is also detected, and the ACK IP packet cannot be detected. However, it is possible to distinguish whether this is due to unauthorized access or to the inability of the called computer to respond.
[0033]
FIG. 6 is a functional block diagram of the analysis terminal 13 according to the second embodiment of the present invention, and the same reference numerals as those described above represent the same or equivalent parts.
[0034]
In this embodiment, the SYN / ACK IP packet extraction for extracting the SYN / ACK IP packet returned from the called computer in response to the SYN IP packet extracted by the SYN IP packet extraction unit 161 It is characterized in that a portion 166 is further provided.
[0035]
FIG. 7 is a flowchart showing the operation of the analysis terminal 13 in the present embodiment, and the same processes as those described above are denoted by the same step numbers.
[0036]
In step S21, the IP packet for SYN is detected. In step S22, when the entry is registered in the data table, in step S23, the SYN / ACK to be returned from the called computer to the calling computer. The IP packet is filtered by the SYN / ACK IP packet extraction unit 166 on the outflow route.
[0037]
This filtering is also performed for a predetermined time t2 until the timer times out in step S24, and if a SYN / ACK IP packet is detected within the predetermined time t2, the process proceeds to step S25 to perform the same processing as in the first embodiment. Is continuously executed. On the other hand, if no SYN / ACK IP packet is detected within the predetermined time t2, the process proceeds to step S27, and the entry is deleted from the data table 165.
[0038]
As described above, according to the second embodiment of the present invention, even when the called computer cannot return the SYN / ACK IP packet to the SYN IP packet for any reason, the entry is stored in the entry. Since it is deleted from the data table 165, it is possible to prevent the SYN IP packet transmitted when the called computer cannot respond, from being incorrectly recognized as an unauthorized access.
[0039]
【The invention's effect】
According to the present invention, the following effects are achieved.
(1) Each edge router extracts, as an unauthorized access candidate, an access for which the session establishment procedure based on the TCP cannot be normally completed, collects the access from each edge router, and collects the information for each combination of the source address and the destination address. Aggregation and access with a large total number N are finally identified as unauthorized access. Therefore, it is ensured that a DDoS attack in which the number of accesses per edge router is small, but the total number is large due to inflow through a plurality of edge routers is ensured. It can be detected.
(2) Even if the called computer cannot return the SYN / ACK IP packet to the SYN IP packet for some reason, the entry is deleted from the data table. It is possible to prevent the SYN IP packet transmitted when a response cannot be made from being incorrectly recognized as an unauthorized access.
[Brief description of the drawings]
FIG. 1 is a diagram conceptually showing an overall configuration of a computer network in which an unauthorized access monitoring system according to an embodiment of the present invention is introduced.
FIG. 2 is a functional block diagram of the analysis terminal shown in FIG.
FIG. 3 is a functional block diagram of a management terminal shown in FIG.
FIG. 4 is a flowchart showing an operation of the management terminal.
FIG. 5 is a flowchart showing an operation of the analysis terminal.
FIG. 6 is a functional block diagram of a second embodiment of the analysis terminal.
FIG. 7 is a flowchart showing an operation of the analysis terminal according to the second embodiment of the present invention.
[Explanation of Reference Codes] 11 Backbone network, 12 Local area network, 13 Analysis terminal, 14 Management terminal, 121 to 123 Computer, R1 to R4 Edge router, N1 to N3 External network

Claims (5)

Including a backbone network connected to an external network and a local area network (LAN) containing at least one terminal device and connected to the backbone network, monitoring unauthorized access to terminal devices contained in the LAN Unauthorized access monitoring system,
A plurality of analysis terminals provided at each of the inflow routes from the external network to the backbone network, and analyzing packets flowing into the backbone network from each inflow route to extract unauthorized access candidates;
A management terminal that collects analysis results from the respective analysis terminals and detects unauthorized access based on the totalized results. The analysis terminal monitors the SYN IP packet and its response in TCP, and extracts an access for which the response procedure could not be completed normally as an unauthorized access candidate,
The management terminal collects the unauthorized access candidates from each of the analysis terminals, and a destination address is an address of one terminal device accommodated in the LAN, and a SYN IP packet having the same source address is transmitted. 2. The unauthorized access monitoring system according to claim 1, wherein an unauthorized access is detected based on whether or not an unauthorized access is detected within a predetermined time period. The analysis terminal,
Means for detecting a SYN IP packet in TCP;
Means for detecting an ACK IP packet in response to the SYN / ACK IP packet in response to the SYN IP packet;
3. The unauthorized access monitoring system according to claim 2, further comprising: means for extracting an access by the SYN IP packet as an unauthorized access candidate when the ACK IP packet cannot be detected. The analysis terminal,
Means for detecting a SYN IP packet in TCP;
Means for detecting a SYN / ACK IP packet in response to the SYN IP packet;
Means for detecting an ACK IP packet in response to the SYN / ACK IP packet;
Means for extracting an access by the SYN IP packet as an unauthorized access candidate when the ACK IP packet cannot be detected even though the SYN / ACK IP packet has been detected. The unauthorized access monitoring system according to claim 2. The means for extracting an unauthorized access candidate, if unable to detect a SYN / ACK IP packet in response to the SYN IP packet, does not extract an access by the SYN IP packet as an unauthorized access candidate. 4. The unauthorized access monitoring system according to 4.

Images