JP2005301766A - Communication recording system, relay apparatus and communication recording method used for them - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication recording system, which can reduce use capacity of recording media and efficiently analyze occurrence situations or logs for particular actions. <P>SOLUTION: A relay apparatus 1, which relays packets on networks 100 and 200, transfers packets to an action monitor system 2 at any time or at appropriate time, and the action monitor system 2 detects particular actions or their signs from the packets received from the relay apparatus 1. If detecting particular actions or their signs, the action monitor system 2 transmits information related to the particular actions to the relay apparatus 1. When receiving detection information on the particular actions from the action monitor system 2, the relay apparatus 1 mirrors packets, which are matched to all or parts of the information, to a storage device 2. In the storage device 2, only packets, which are instructed to be mirrored by the relay apparatus 1, are recorded, so that only the packet information related to the particular actions is recorded. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication recording system, a relay device, and a communication recording method used for them, and more particularly to a communication recording method related to a specific action.

  In recent years, packets passing through the network include packets for executing specific actions such as unauthorized access to the inside of the network, access to specific Web pages, access to specific programs such as computer viruses, or activation. There may be.

  In order to analyze the source of a packet for executing these specific actions, a method of recording all the packets passing through the network is used (for example, see Patent Document 1). This method is known to be used in providers that provide an internet access environment.

JP 2001-217834 A

  In the conventional communication recording method described above, all packets passing through the network must be recorded. However, as the speed of the line increases with the spread of broadband, the number of packets passing through the relay apparatus becomes enormous, and it is becoming difficult to record and hold all packets.

  Accordingly, an object of the present invention is to solve the above-described problems, reduce the usage capacity of the recording medium, and perform a communication recording system and a relay device that can efficiently analyze the occurrence of specific actions, logs, etc. And providing a communication recording method used for them.

A communication recording system according to the present invention includes a relay device that relays a packet on a network, and records the packet passing through the network on a storage medium,
Detecting means for detecting at least one of a specific action set in advance from the packet and a sign of the specific action; and storing at least a part of the packet in which either the specific action or the sign of the specific action is detected Means for recording on a medium.

A relay device according to the present invention is a relay device that relays a packet on a network,
There is provided means for recording in a storage medium at least a part of a packet in which at least one of a specific action set in advance and a sign of the specific action is detected from the packet.

  The communication recording method according to the present invention is a communication recording method for recording a packet passing through the network in a storage medium in a system including a relay device that relays a packet on a network, and from the packet to the relay device side. There is provided a step of recording at least a part of a packet in which at least one of the specific action set in advance and a sign of the specific action is detected in a storage medium.

That is, the communication recording system of the present invention is characterized in that only packets relating to a specific action set in advance among packets passing through the network are recorded in the storage device.
In the communication recording system of the present invention, a relay device that relays a packet on the network always or appropriately transfers the packet to the behavior monitoring system, and the behavior monitoring system receives a specific action or a sign of a specific behavior from the packet received from the relay device. To detect.

  When the behavior monitoring system detects a specific behavior or a sign of the specific behavior, the behavior monitoring system transmits information determined to be related to the specific behavior to the relay device. When the relay device receives the detection information of the specific behavior from the behavior monitoring system, the relay device mirrors a packet that matches all or part of the information to the storage device.

  The storage device records only the packet for which the mirroring is instructed from the relay device, so that it is possible to record only the packet information related to the specific action.

  As a result, in the communication recording system of the present invention, it is possible to reduce the use capacity of the recording medium by recording only the packets related to the specific action, and to efficiently analyze the occurrence state of the specific action and the log. It becomes possible.

  Further, in the communication recording system of the present invention, since the packet is recorded in the storage device regardless of the presence or absence of the specific action during the mirroring time limit, it is possible to reduce the load of the action monitoring system for the specific action. If the behavior monitoring system can sufficiently withstand the load, it is possible to record only the specific behavior while monitoring all accesses by setting the mirroring deadline to “0”.

  Furthermore, in the communication recording system of the present invention, by mirroring all or part of the mirroring target packet, the used capacity of the recording medium can be further reduced, and the storage capacity can be used efficiently.

  With the configuration and operation described below, the present invention can reduce the usage capacity of the recording medium, and can effectively analyze the occurrence of specific actions and logs. It is done.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a communication recording system according to an embodiment of the present invention. In FIG. 1, a communication recording system according to an embodiment of the present invention relays a packet flowing on networks 100 and 200, and monitors a packet on networks 100 and 200 to indicate a specific action or a sign of a specific action. It comprises an action monitoring system 2 to detect and a recording device 3 that records packets flowing on the networks 100 and 200.

  The relay device 1 relays packets on the networks 100 and 200, and copies a part or all of the received packets and transmits them to another port, or transmits them to another destination by encapsulating them. . The storage unit 3 records packets that flow on the networks 100 and 200.

  The behavior monitoring system 2 monitors packets on the networks 100 and 200 and detects a specific behavior set in advance or a sign thereof. Here, the specific action refers to, for example, unauthorized access, access to a specific Web page, access to a specific program, or activation. In addition to the above-mentioned behavior, the specific behavior includes a behavior that causes some trouble in the system.

  FIG. 2 is a block diagram showing a configuration of the relay apparatus 1 of FIG. In FIG. 2, the relay apparatus 1 has a packet relay function 11 that relays packets on the networks 100 and 200, a copy function 12 that copies a part or all of the received packet and transmits it to another port, and a received packet It consists of an encapsulation function 13 that transmits a part or all of it to another destination by encapsulating it.

  In this embodiment, the relay apparatus 1 is provided with the copy function 12 and the encapsulation function 13. However, the present invention is also applied to an apparatus having one of the copy function 12 and the encapsulation function 13. Is possible.

  FIG. 3 is a block diagram showing a configuration of the behavior monitoring system 2 of FIG. In FIG. 3, the behavior monitoring system 2 includes a packet monitoring function 21 that monitors packets on the networks 100 and 200 and detects a specific behavior or a sign thereof.

  The packet monitoring function 21 is based on information such as a transmission source and a destination added to the packet transferred from the relay device 1, whether the number of authentication failures is a predetermined value or more, whether the access is outside work hours, Keystroke speed is not different from normal, access from a specific user, IP address and user name match, access from other than normal route, transmission / reception of specific (key) information, or larger than a specific size It is determined whether the information is transmitted or received, and the specific action or its sign is detected based on the determination result.

  FIG. 4 is a diagram showing the configuration of a mirroring condition addition message used in one embodiment of the present invention. In FIG. 4, the mirroring condition addition message is composed of a transmission source, a destination, other conditions such as a copy part designation of a packet for mirroring, a mirroring time limit, and a mirroring continuation determination time limit.

  The mirroring time limit represents a period during which the relay device 1 mirrors a packet corresponding to the mirroring condition to the storage device 3 and does not transfer the packet to the behavior monitoring system 2 during that time. The mirroring continuation determination time limit represents a time limit for transferring a packet to the behavior monitoring system 2 although the packet is mirrored to the storage device 3.

  FIGS. 5 to 7 show the Shi prefecture steamer showing the operation of the communication recording system according to one embodiment of the present invention. The operation of the communication recording system according to one embodiment of the present invention will be described with reference to FIGS.

  FIG. 5 shows a flow until the relay device 1 sets a mirroring condition in order to mirror only the packet related to the specific action to the storage device 3 in this embodiment. The above flow will be described with reference to FIG.

  First, when receiving a packet from the network 100 (a1 in FIG. 5), the relay device 1 transfers the received packet to the behavior monitoring system 2 different from the original destination (a2 in FIG. 5).

  When the behavior monitoring system 2 detects the specific behavior or the sign of the specific behavior from the packet, the behavior monitoring system 2 transmits a mirroring condition addition message shown in FIG. 4 to the relay device 1 (a3 in FIG. 5). Thereafter, the behavior monitoring system 2 returns the packet received from the relay device 1 to the relay device 1 (a4 in FIG. 5).

  When the received packet satisfies the mirroring condition, the relay device 1 copies a part or all of the packet by the copy function 12 and transmits it to the storage device 3 (a5 in FIG. 5). The packet is transmitted to the original destination (a6 in FIG. 5).

  FIG. 6 shows a flow when the relay apparatus 1 receives a packet corresponding to the mirroring condition within the mirroring time limit in this embodiment. The above flow will be described with reference to FIG.

  When the relay device 1 receives a packet that satisfies the mirroring condition within the mirroring time limit (b1 in FIG. 6), the copy function 12 copies part or all of the corresponding packet and transmits it to the storage device 3 ( B2) of FIG. Thereafter, the relay device 1 transmits this packet to the original destination of the corresponding packet (b3 in FIG. 6).

  FIG. 7 shows a flow when the relay apparatus 1 receives a packet corresponding to the mirroring condition outside the mirroring time limit in this embodiment. The above flow will be described with reference to FIG.

  When the relay device 1 receives a packet that satisfies the mirroring condition within the mirroring continuation determination time limit (c1 in FIG. 7), the relay device 1 transfers the received packet to the behavior monitoring system 2 that is different from the original destination (c2 in FIG. 7).

  The behavior monitoring system 2 returns the packet received from the relay device 1 to the relay device 1 (c3 in FIG. 7). At this time, the behavior monitoring system 2 transmits a mirroring condition addition message to the relay device 1 when the packet monitoring function 21 detects the specific behavior or a sign of the specific behavior from the packet.

  When receiving the mirroring condition addition message, the relay device 1 extends the period of the list according to the content of the message. The relay device 1 transmits a copy of the traffic to the storage device 3 (c4 in FIG. 7), and transmits the packet to the original destination of the corresponding packet (c5 in FIG. 7).

  8 and 9 are flowcharts showing the operation of the relay device 1 in FIG. 1, FIG. 10 is a flowchart showing the operation of the behavior monitoring system 2 in FIG. 1, and FIG. 11 shows the operation of the storage device 3 in FIG. It is a flowchart to show. With reference to FIGS. 8 to 11, operations of the relay device 1, the behavior monitoring system 2, and the storage device 3 will be described.

  When the relay device 1 receives a packet flowing on the network 100, 200 from the adjacent network 100, 200 or the behavior monitoring system 2 (step S1 in FIG. 8), the relay device 1 is a mirroring condition addition message transmitted from the behavior monitoring system 2 or not. Whether or not is checked (step S2 in FIG. 8).

  When the relay apparatus 1 is a mirroring condition addition message, the relay apparatus 1 adds a condition for a packet to be mirrored according to the content of the message (step S3 in FIG. 8). If the relay apparatus 1 is not a mirroring condition addition message, the relay apparatus 1 checks whether the packet is an inspected packet from the behavior monitoring system 2 (step S4 in FIG. 8).

  If the packet is a packet from the behavior monitoring system 2, that is, if the packet has already been inspected by the behavior monitoring system 2, the relay device 1 checks whether the packet meets the mirroring condition (step in FIG. 9). S10).

  When the packet satisfies the mirroring condition, the relay device 1 copies a part or all of the packet, and uses the port where the storage device 3 which is not the original output port exists or the original destination by using the encapsulation. The copied packet is transmitted to the storage device 3 not present (step S11 in FIG. 9), and the packet is transmitted to the original destination (step S12 in FIG. 9).

  On the other hand, when the packet does not satisfy the mirroring condition, the relay device 1 transmits the packet to the original destination (step S12 in FIG. 9).

  If the packet is not a packet from the behavior monitoring system 2, that is, if the packet is not yet inspected by the behavior monitoring system 2, the relay device 1 checks whether the packet meets the mirroring condition (see FIG. 8 step S5).

  When the packet does not meet the mirroring condition, the relay apparatus 1 uses the port where the behavior monitoring system 2 which is not the original destination exists or the encapsulation to the behavior monitoring system 2 which is not the original destination. The packet is transmitted constantly or timely (step S9 in FIG. 8).

  When the packet satisfies the mirroring condition, the relay apparatus 1 checks whether the mirroring condition has exceeded the mirroring deadline (step S6 in FIG. 8).

  When the mirroring time limit has not been exceeded, the relay device 1 copies a part or all of the packet, and is not the original destination by using the port where the storage device 3 that is not the original output port exists or by using the encapsulation. The copied packet is transmitted to the storage device 3 (step S11 in FIG. 9), and the packet is transmitted to the original destination (step S12 in FIG. 9).

  When the mirroring expiration date has been exceeded, the relay device 1 checks whether the mirroring condition has exceeded the mirroring duration determination time limit (step S7 in FIG. 8).

  If the relay device 1 has not exceeded the mirroring expiration date, the packet is sent to the port where the behavior monitoring system 2 which is not the original destination exists, or to the behavior monitoring system 2 which is not the original destination using encapsulation. Is always or timely transmitted (step S9 in FIG. 8).

  If the relay device 1 has exceeded the mirroring expiration date, the relay device 1 deletes the condition that exceeded the mirroring duration determination time limit from the mirroring condition list (step S8 in FIG. 8), and the presence of the behavior monitoring system 2 that is not the original destination of the packet The packet is always or timely transmitted to the behavior monitoring system 2 that is not the original destination using the port to be used or encapsulation (step S9 in FIG. 8).

  When the behavior monitoring system 2 receives a packet from the relay device 1 (step S21 in FIG. 10), the behavior monitoring system 2 detects whether the behavior is a specific behavior or a sign of the specific behavior (step S22 in FIG. 10).

  When the behavior monitoring system 2 detects a specific behavior or a sign of the specific behavior from the packet, the behavior monitoring system 2 transmits an appropriate mirroring condition, a mirroring time limit, and a mirroring duration determination time limit to the relay device 1 as a mirroring condition addition message (step in FIG. 10). S23).

  The behavior monitoring system 2 transmits a mirroring condition addition message to the relay device 1, and then returns the packet received from the relay device 1 to the relay device 1 (step S24 in FIG. 10).

  When the behavior monitoring system 2 does not detect the specific behavior or the sign of the specific behavior from the packet, the behavior monitoring system 2 returns the packet received from the relay device 1 to the relay device 1 (step S24 in FIG. 10).

  When the storage device 3 receives the packet copied by the relay device 1 (step S31 in FIG. 11), it records the packet received from the relay device 1 (step S32 in FIG. 11).

  As described above, in this embodiment, by recording only the packets related to the specific action in the storage device 3, it is possible to reduce the use capacity of the recording medium, and it is possible to efficiently analyze the occurrence status of the specific action and the log. Can be done well.

  In this embodiment, since the packet is recorded in the storage device 3 regardless of the presence or absence of the specific action during the mirroring period, the load on the action monitoring system 2 for the specific action can be reduced. When the behavior monitoring system 2 can sufficiently withstand the load, it is possible to record only the specific behavior while monitoring all accesses by setting the mirroring deadline to “0”.

  Furthermore, in this embodiment, all or part of the mirroring target packet can be mirrored, so that the used capacity of the recording medium can be further reduced and the storage capacity can be used efficiently. .

  FIG. 12 is a block diagram showing the configuration of a communication recording system according to another embodiment of the present invention. 12, in another embodiment of the present invention, the configuration is the same as that of the embodiment of the present invention shown in FIG. 1 except that the relay device 4 includes the relay function 41 and the behavior monitoring system 42. The same components are denoted by the same reference numerals. The operation of the same component is the same as that of the above-described embodiment of the present invention.

  The relay function 41 has the same configuration and operation as the relay device 1 shown in FIG. 2, and the behavior monitoring system 42 has the same configuration and operation as the behavior monitoring system 2 shown in FIG.

  FIG. 13 is a block diagram showing the configuration of a communication recording system according to another embodiment of the present invention. 13, another embodiment of the present invention is the same as the embodiment of the present invention shown in FIG. 1 except that the relay device 5 is provided with a relay function 51, an action monitoring system 52, and a storage function 53. The same components are denoted by the same reference numerals. The operation of the same component is the same as that of the above-described embodiment of the present invention.

  The relay function 51 has the same configuration and operation as the relay device 1 shown in FIG. 2, and the behavior monitoring system 52 has the same configuration and operation as the behavior monitoring system 2 shown in FIG.

It is a block diagram which shows the structure of the communication recording system by one Example of this invention. It is a block diagram which shows the structure of the relay apparatus of FIG. It is a block diagram which shows the structure of the action monitoring system of FIG. It is a figure which shows the structure of the mirroring condition addition message used in one Example of this invention. FIG. 6 is a Shi prefecture steamer showing the operation of the communication recording system according to one embodiment of the present invention. FIG. 6 is a Shi prefecture steamer showing the operation of the communication recording system according to one embodiment of the present invention. FIG. 6 is a Shi prefecture steamer showing the operation of the communication recording system according to one embodiment of the present invention. It is a flowchart which shows operation | movement of the relay apparatus of FIG. It is a flowchart which shows operation | movement of the relay apparatus of FIG. It is a flowchart which shows operation | movement of the action monitoring system of FIG. 3 is a flowchart showing an operation of the storage device of FIG. 1. It is a block diagram which shows the structure of the communication recording system by the other Example of this invention. It is a block diagram which shows the structure of the communication recording system by another Example of this invention.

Explanation of symbols

1 Relay device 2, 42, 52 Behavior monitoring system
3 Recording device
11 Packet relay function
12 Copy function
13 Encapsulation function
21 Packet monitoring function 41, 51 Relay function
53 Memory function 100,200 Network

Claims (12)

A communication recording system including a relay device that relays a packet on a network, and records a packet passing through the network on a storage medium,
Detecting means for detecting at least one of a specific action set in advance from the packet and a sign of the specific action; and storing at least a part of the packet in which either the specific action or the sign of the specific action is detected A communication recording system comprising means for recording on a medium.   The communication recording system according to claim 1, wherein the detection unit detects either the specific action or a sign of the specific action in a packet transferred from the relay device. When the detection means detects any one of the specific action and a sign of the specific action, the detection means transmits the detection information to the means for recording in the storage medium,
The means for recording in the storage medium mirrors at least a part of the packet in which any one of the specific action and a sign of the specific action is detected when the detection information is received to the storage medium. The communication recording system according to claim 1 or 2.   The means for recording on the storage medium records at least a part of the packet on the recording medium regardless of whether or not the specific action or a sign of the specific action is detected during a mirroring period to the recording medium. The communication recording system according to any one of claims 1 to 3, wherein A relay device that relays packets on a network,
A relay apparatus comprising: a storage medium that records at least a part of a packet in which at least one of a specific action set in advance and a sign of the specific action is detected from the packet.   The relay apparatus according to claim 5, wherein the packet is transferred to a detection unit that performs either the specific action or a sign of the specific action.   The means for recording in the storage medium is one of the specific action and the sign of the specific action when receiving detection information indicating that either the specific action or the sign of the specific action has been detected from the detection means. The relay apparatus according to claim 6, wherein at least a part of the detected packet is mirrored to the storage medium.   The means for recording on the storage medium records at least a part of the packet on the recording medium regardless of whether or not the specific action or a sign of the specific action is detected during a mirroring period to the recording medium. The relay device according to claim 5, wherein the relay device is a relay device.   In a system including a relay device that relays a packet on a network, a communication recording method for recording a packet passing through the network on a storage medium, wherein at least a specific action preset from the packet on the relay device side and A communication recording method comprising a step of recording at least a part of a packet in which any one of the signs of the specific action is detected on a storage medium.   The communication recording method according to claim 1, wherein either the specific action or a sign of the specific action is detected in a packet transferred from the relay apparatus.   The step of recording in the storage medium is a packet in which either the specific action or the sign of the specific action is detected when detection information indicating that either the specific action or the sign of the specific action is detected is received. 11. The communication recording method according to claim 9, wherein mirroring is performed on at least a part of the storage medium. The step of recording on the storage medium records at least a part of the packet on the recording medium regardless of whether or not the specific action and a sign of the specific action are detected during a mirroring period to the recording medium. 12. The communication recording method according to claim 9, wherein the communication recording method is any one of claims 9 to 11.

Images