JP2005244429A - Feature quantity extracting method for detecting abnormality of network, program for allowing computer to execute the method, feature quantity extracting apparatus, and network abnormality detecting system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a feature quantity extracting method for detecting abnormality of a network or the like enhancing detection accuracy of an illegitimate access such as an attack by using an abnormality detection system. <P>SOLUTION: The method segments an observation slot by a feature quantity extracting section 13a on the basis of an event including traffic such as a SYN packet as a feature quantity capturing a quantitative change in the traffic delivered from the Internet 11 to a network of a LAN 12 to extract the feature quantity. A data generating section 13b generates a distribution pattern of the traffic on the basis of the feature quantity, and the feature quantity extracting apparatus compares a distribution pattern in an ordinary state of the network with a distribution pattern in operation to detect the abnormality state of the network. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a network abnormality detection feature amount extraction method for obtaining a feature amount for detecting an abnormal state of a network, a program for causing a computer to execute the method, a feature amount extraction apparatus, and a network abnormality detection system.

  In recent years, along with the development of the Internet, it has become possible not only to spread to businesses, government offices and various schools, but also to individual users to always connect to the Internet. For this reason, tampering with web pages, unauthorized intrusion into the host, DoS (Denial of Service) attacks and DDoS (Distributed DoS) attacks are not only a problem for companies and providers, but also to individual users. Has been.

  Therefore, IDS (Intrusion Detection System) has been developed as a system for detecting these attacks. There are mainly two types of IDS attack detection methods, a fraud detection method and an anomaly detection method, and anomaly detection methods among them are widely studied (for example, Patent Document 1). In this anomaly detection method, for example, using the intrusion detection system of FIG. 15, in order to define a normal state of traffic, a packet unit, TCP (by a feature quantity extraction device 13 provided between the Internet 11 and the LAN 12 is used. (Transmission Control Protocol) has been proposed to extract feature amounts in session units or time slot units. Note that the feature quantity extracted by the feature quantity extraction device 13 of FIG. 15 is stored, for example, in a database in the management manager 14 and managed by the management manager 14.

JP 2000-354034 A

  However, these packets have the problem that the load becomes large due to the wider bandwidth of the network, and there is the problem that the overall characteristics of the network cannot be expressed in this session unit. . Furthermore, there is a problem that information to be extracted is divided in this time slot unit.

  The present invention has been made in view of the above-mentioned problems. A network anomaly detection feature quantity extraction method capable of improving the accuracy of detecting unauthorized access such as an attack using an anomaly detection method, and executing the method on a computer It is an object of the present invention to provide a program to be executed, a feature amount extraction apparatus, and a network abnormality detection system.

  In order to achieve the above object, in the feature extraction method of network abnormality detection according to the invention of claim 1, a detection step of detecting a predetermined event a predetermined number of times, and a feature during the detection of the event in the detection step A network anomaly detection feature quantity extraction method comprising: extracting the feature quantity for detecting an abnormal state of the network based on the event.

  According to the first aspect of the present invention, as a feature value for capturing a quantitative change in traffic flowing into the network, an event with traffic rather than a time slot for observing traffic per unit time, for example, a packet of SYN or FIN The detection accuracy of unauthorized access is improved by dividing the observation slots on the basis of and extracting feature quantities.

  Further, in the feature extraction method of network abnormality detection according to claim 2, in the extraction step, the number or ratio of at least one type of the event to the entire traffic while the event is detected a predetermined number of times is calculated, The result of the calculation is extracted as a feature quantity.

  According to the present invention, while an event is detected a predetermined number of times, a single observation slot is used, and the feature amount is extracted from the number, ratio, or amount of detected events for the entire traffic in the meantime, thereby allowing unauthorized access. Increase detection accuracy.

  Further, in the feature extraction method for network abnormality detection according to claim 3, the events detected in the detection step are TCP, UDP (User Datagram Protocol), and ICMP (Internet control Message Protocol) packets. It consists of a predetermined event in the packet of any one protocol.

  According to the present invention, feature amount extraction is performed based on a predetermined event in a packet of any one protocol among TCP, UDP, and ICMP packets flowing between the Internet and a LAN, for example, a packet such as SYN in TCP. To increase the accuracy of detecting unauthorized access.

  According to a fourth aspect of the present invention, there is provided a program that causes a computer to execute the method according to the first or second aspect.

  According to the present invention, there is provided a program for causing a computer to execute the method described in any one of claims 1 and 2, and the program can be read by the computer. One operation can be performed by a computer.

  In addition, in the feature extraction device for network abnormality detection according to claim 5, detection for detecting a predetermined event in the feature extraction device for network abnormality detection that extracts a feature amount for detecting an abnormal state of the network. There is provided a feature amount extraction device for detecting network anomalies, characterized by comprising means and extraction means for extracting a feature amount while the event is detected a predetermined number of times.

  According to this invention, an event such as SYN or FIN is detected a predetermined number of times by the detecting means, and a quantitative change in traffic flowing into the network during that time is extracted as a feature quantity by the extracting means, thereby detecting unauthorized access. Increase accuracy.

  Further, in the feature extraction device for network abnormality detection according to claim 6, the extraction means extracts the ratio of the event to the whole packet while the event is detected a predetermined number of times as the feature quantity. It is characterized by that.

  According to the present invention, the period during which an event is detected a predetermined number of times is regarded as one observation slot, and the extraction means extracts the ratio of the event with respect to the entire packet as a feature amount, thereby increasing the accuracy of detecting unauthorized access.

  According to a seventh aspect of the present invention, there is provided a network anomaly detection feature quantity extraction device further comprising a creation means for creating a traffic distribution pattern based on the feature quantity extracted by the extraction means.

  According to this invention, based on the extracted feature quantity, by newly providing a creation means for creating a traffic distribution pattern, obtain a normal traffic distribution pattern and an abnormal traffic distribution pattern, Enables monitoring of network status abnormalities.

  Further, in the network abnormality detection system according to claim 8, in the network abnormality detection system for detecting an abnormality in the network line state based on the extracted feature quantity, the feature quantity extraction device according to any one of claims 5 to 7 And a monitoring device for monitoring a network state abnormality based on the feature amount extracted by the feature amount extraction device.

  According to the present invention, for example, the normal traffic distribution pattern and the abnormal traffic distribution pattern are compared based on the feature amount extracted by the feature amount extraction device according to any one of claims 5 to 7. By monitoring the network status abnormality with the monitoring device, the network abnormal status is accurately monitored.

  As described above, according to the present invention, an event with traffic is specified as a feature amount that captures a quantitative change in traffic flowing into the network, and a feature amount during which this event is detected a predetermined number of times is extracted. Since the abnormal state of the network is detected, the abnormal state of the network can be detected within a series of packet communications, thereby improving the accuracy of detecting unauthorized access such as an attack.

  With reference to the accompanying drawings of FIG. 1 to FIG. 14, a network anomaly detection feature quantity extraction method, a program for causing a computer to execute the method, a feature quantity extraction apparatus, and a network anomaly detection system according to the present invention are described below. An embodiment will be described.

(Embodiment 1)
FIG. 1 is a schematic configuration diagram showing a schematic configuration of an intrusion detection system according to the present invention. FIG. 1 differs from FIG. 15 in that the feature quantity extraction unit 13a in the feature quantity extraction device 13 has an event predetermined by the administrator, for example, a packet in which a SYN flag is set in the TCP header among TCP packets. (Hereinafter referred to as “SYN packet”) is detected a predetermined number of times, the observation data is divided by using the interval as one observation slot, the feature amount is extracted, and the data distribution unit 13b performs traffic distribution pattern based on the feature amount. And the feature amount extraction unit 13a detects a network abnormality based on the created traffic distribution pattern.

  In other words, the flow of a series of data communication in the normal state of the network using the TCP protocol is as follows. First, a SYN packet indicating the start of data communication is sent from the sender side to the receiver side, as shown in the sequence diagram of FIG. A packet with an ACK flag set in the TCP header (hereinafter referred to as “SYN / ACK packet”), which is an acknowledgment response to the SYN packet, is transmitted from the receiver side. Next, when the sender side receives the SYN / ACK packet, the sender side returns an ACK packet which is an acknowledgment response to the SYN / ACK packet, and then sends out packet-structured data. The receiver side receives this data every time it receives the data. An ACK packet is returned to and an acknowledgment response is made. When the data communication is completed, a packet in which a FIN flag is set in the TCP header indicating the end of the data communication (hereinafter referred to as “FIN packet”) is sent from the sender side to the receiver side. By returning the FIN packet from the side to the sender side, a series of data communication is completed.

  In this embodiment, SYN (or FIN), which is always present in a series of data communications in the normal state of the network, is set in advance as a specific event, this SYN packet is detected a predetermined number of times, and the interval is set as one observation slot. The observation data is divided, the ratio between the number of all packets detected in this observation slot and the number of SYN packets is calculated, and traffic distribution data is created using this calculation result as a feature amount.

  Next, the feature quantity extraction operation of the feature quantity extraction apparatus 13 shown in FIG. 1 will be described using the flowchart of FIG. In FIG. 3, the feature quantity extraction unit 13a first sets the number of times of detection of SYN as, for example, (n + 1) as an initial set value using a counter function (step 101), and enables the number of times of detection of a specific event to be counted. Then, it is determined whether or not a SYN packet with the SYN flag set is detected (step 102).

  When SYN is detected, the feature quantity extraction unit 13a uses the counter function to detect the total number of packets while the SYN is (n + 1) times (step 103), and then the SYN is detected ( It is determined whether or not n + 1) times have been reached (step 104). If the SYN detection has not reached (n + 1) times, “1” is incremented to the number of detections n at the current time of SYN (step 105), and the next SYN packet is detected.

  If the number of SYN detections reaches (n + 1) times, the ratio of the number of SYNs to the total number of packets detected in step 103 is obtained, feature quantities are extracted, and data is created based on the feature quantities. The unit 13b creates a traffic distribution pattern (step 106). Then, the number of times SYN detection (count number) is cleared (step 107), and the next SYN packet is detected.

  In this embodiment, as shown in FIG. 1, the IDS 16 is provided in the LAN 12, and the traffic distribution pattern data created by the data creation unit 13b is stored in the database 16a. The network status is monitored by cluster analysis of traffic distribution patterns. In the present invention, the feature quantity extraction device 13 and the IDS 16 can be configured as one unit.

  In the data creation unit 13b, traffic distribution pattern data created in the normal state of the network is sent to the IDS 16 and stored in the database 16a in advance, and the traffic distribution pattern created during network operation and stored in this database. The normal traffic distribution patterns are compared, and the comparison result is output to the feature amount extraction unit 13a. The feature amount extraction unit 13a determines a network state abnormality from the comparison result.

  Also, the feature quantity extraction unit 13a notifies the firewall 15 of a warning when an abnormal network condition is detected, and the firewall 15 operates so as to block unauthorized access from the Internet 11 or the like in response to this notification. To do. In this way, by removing unauthorized access from outside the LAN that is not intended by the administrator, the security of the intrusion detection system is dramatically improved.

(Comparison with time slot method)
Next, in order to verify the effect of detecting unauthorized access by the feature quantity extraction device 13, the present inventors target traffic for one day flowing into a network (LAN 12) in which about 80 computers are operated. The following experiment was conducted. On this day, 11 host scans were confirmed, and this was the detection target.

  In this experiment, in the present invention, the SYN event is changed to 10 times, 20 times, 30 times, 40 times, and 50 times, and the SYN packet is changed to 10 times, 20 times, 30 times, 40 times, and 50 times. The ratio of SYN to the whole packet during the detection of these observation times was extracted as a feature amount. 4 to 8 show traffic distribution patterns obtained from the above observation results, and FIG. 9 shows the number of scan detections according to the event criterion of the present invention. In FIG. 9, the threshold value is 20% of that in the normal state.

  Further, as a comparative example, similar feature amounts were extracted in units of time slots, and the measurement intervals were set to 1, 3, 5, and 10 minutes. 10 to 13 show traffic distribution patterns obtained from the above observation results, and FIG. 14 shows the number of scan detections by time slots. In FIG. 14, the threshold value is 10% when the time slot is 1 minute, and 15% otherwise.

  The distribution patterns of FIGS. 4 to 8 and FIGS. 10 to 13 capture a state in which the SYN packets are temporarily increased. In normal data communication, as shown in FIG. 2, communication of data is included between SYN packets and SYN packets, but in host scan, other data is included between SYN packets and SYN packets. Communication occurs in a form that is not possible.

  In view of this point, if the distribution pattern in time slot units is verified, for example, even if SYN increases due to the host scan in the first 10 seconds, the remaining detection time becomes longer, and other data other than SYN is downloaded. As the number of communications performed increases, the total number of packets increases, and the first increase in SYN may not be detected as abnormal.

  In contrast, in the event-based distribution pattern of the present invention, when the SYN reaches a predetermined number of detections, the ratio of the number of detected SYNs to the total number of packets between them is obtained. As described above, counting the number of packets in a state where a series of communication events is divided is reduced.

  Therefore, in the number of host scans detected by the time slot shown in FIG. 14, only 8 scans are detected at the maximum, out of 11 host scans, even though the one with the highest number of detections in each time slot is adopted. could not. On the other hand, with the number of host scans detected according to the event criteria of the present invention shown in FIG. 9, all host scans can be detected, particularly when the number of observations of SYN packets is 30,40. It was possible to detect all host scans with no false positives or no detection.

  Note that the false detection and non-detection change depending on the number of SYN observations. The reason is that if the number of SYNs that are the starting points of the observation from the beginning to the end of the communication is too small, as in the case of dividing by time slots, State communication and normal state communication cannot be separated well, resulting in false detection, and if the number of SYNs is too large, small-scale host scans are buried in normal state communication, causing no detection. This is thought to be due to this.

  As described above, in this embodiment, in order to define the normal state of the network, the feature amount is extracted by dividing the observation slot based on an event with traffic, so that the detection accuracy of unauthorized access such as an attack is improved. Can be made.

  In this embodiment, the feature quantity extraction method according to the present invention is a program to be executed by a computer, and this feature quantity extraction operation is performed by causing the computer (not shown) in the feature quantity extraction apparatus 13 to read the program. Can be executed by a computer in the feature quantity extraction device 13.

  In this embodiment, the TCP packet has been described. However, the present invention is not limited to this. For example, a specific event is set from among the packets of these protocols for UDP and ICMP packets. It is also possible to extract the ratio of the number of specific events to the total number of packets while the specific event is detected a predetermined number of times as a feature amount. In the present invention, other events such as SYN and FIN can be used as a reference.

  The present invention is not limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention. In this embodiment, the feature amount is extracted by the ratio (ratio) of the predetermined number of specific events to the total number of receptions of the packet. However, the present invention is not limited to this. For example, the data amount of the specific event is determined in advance. The feature amount may be extracted based on the ratio of the data amount of the specific event to the data amount of the entire packet while the data amount of the specific event reaches a predetermined amount. Further, the target specific event may be a plurality of types, and the feature amount is not limited to the above-described ratio but may be the number thereof.

1 is a schematic configuration diagram showing a schematic configuration of an intrusion detection system according to the present invention. It is a sequence diagram which shows the flow of a series of data communications in the normal state of a network. 3 is a flowchart for explaining an operation of feature quantity extraction of the feature quantity extraction apparatus shown in FIG. 1. It is a figure which shows the traffic distribution pattern when the frequency | count of observation of the SYN packet concerning this invention is set to 10. It is a figure which shows the traffic distribution pattern at the time of setting the frequency | count of observation of the SYN packet concerning this invention to 20 times. It is a figure which shows the traffic distribution pattern when the frequency | count of observation of the SYN packet concerning this invention is set to 30 times. It is a figure which shows the distribution pattern of the traffic at the time of setting the observation frequency of the SYN packet concerning this invention to 40 times. It is a figure which shows the traffic distribution pattern when the frequency | count of observation of the SYN packet concerning this invention is set to 50 times. It is a figure which shows the scan detection number by the event reference | standard of this invention. It is a figure which shows the traffic distribution pattern when the measurement interval of the time slot in a prior art example is set to 1 minute. It is a figure which shows the distribution pattern of traffic when the measurement interval of the time slot in a prior art example is set to 3 minutes. It is a figure which shows the traffic distribution pattern when the measurement interval of the time slot in a prior art example is set to 5 minutes. It is a figure which shows the distribution pattern of traffic when the measurement interval of the time slot in a prior art example is set to 10 minutes. It is a figure which shows the scan detection number by a time slot. It is a schematic block diagram which shows schematic structure of the conventional intrusion detection system.

Explanation of symbols

11 Internet 12 LAN
13 Feature Extraction Device 13a Feature Extraction Unit 13b Data Creation Unit 14 Management Manager 15 Firewall 16 IDS
16a database 16b data analysis cluster

Claims (8)

A detection step of detecting a predetermined event a predetermined number of times;
An extraction step for extracting a feature amount while the event is detected a predetermined number of times in the detection step;
And extracting the feature amount for detecting an abnormality in the network status based on the event.   The extracting step calculates a number, a ratio, or an amount of at least one kind of the event with respect to the entire traffic while the event is detected a predetermined number of times, and extracts the calculation result as a feature amount. Item 2. A method for extracting feature values for network abnormality detection according to Item 1.   3. The event detected in the detection step includes a predetermined event in the packet of any one protocol among TCP, UDP, and ICMP packets. The feature extraction method of the network abnormality detection described.   A program for causing a computer to execute the method according to claim 1. In a network anomaly detection feature quantity extraction device that extracts feature quantities for detecting abnormal network conditions,
Detecting means for detecting a predetermined event;
Extraction means for extracting a feature amount while the event is detected a predetermined number of times;
A feature extraction device for detecting network anomalies characterized by comprising:   6. The feature extraction for network abnormality detection according to claim 5, wherein the extraction unit extracts a ratio of the event to the whole packet while the event is detected a predetermined number of times by the detection unit as a feature amount. apparatus.   7. The network according to claim 5, wherein the network abnormality detection feature amount extraction apparatus further includes a creation unit that creates traffic distribution data based on the feature amount extracted by the extraction unit. A feature extraction device for abnormality detection. In a network anomaly detection system that detects network status anomalies based on the extracted features,
A feature amount extraction device according to any one of claims 5 to 7,
A monitoring device that monitors a network state abnormality based on the feature amount extracted by the feature amount extraction device;
A network abnormality detection system characterized by comprising:

Images