JP2006033472A - Unauthorized access detecting device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an unauthorized access detecting device capable of detecting even a step attack or a new kind of virus or an unknown virus. <P>SOLUTION: In the unauthorized access detecting device 1, a TCP PUSH packet (reception) extracting part 402 extracts a TCP PUSH packet Pin which has a destination IP of a host computer and where a PUSH flag is set. A TCP PUSH packet (transmission) extracting part 403 extracts a TCP PUSH packet Pout, having a transmission source IP of the host computer. An unauthorized access detection part 404 refers to the TCP PUSH packets extracted by the extraction parts 402 and 403 and decides that transmission and reception of the TCP PUSH packets are unauthorized access, when TCP PUSH packets whose at least data between destination port numbers and data match each other are sent and received within a specified time. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an unauthorized access detection device that detects unauthorized access to a computer, and more particularly to an unauthorized access detection device suitable for detecting a step attack or intrusion of a new or unknown computer virus.

  A stepping attack is known in which an intruder illegally intrudes into a computer with poor security measures in order to conceal his identity, and then enters another computer from this computer. FIG. 15 is a diagram schematically showing an example of a step attack, and a host computer that has been used as a step can be an accomplice of a fraud attack despite being a victim. Such a problem is not limited to the above-described step attack, but can also occur when a computer virus (hereinafter referred to as a virus) is infected.

  Regarding viruses, there are known techniques for preventing intrusion by using a firewall or IDS (Intrusion Detection System). However, new viruses cannot be detected until an IDS detection pattern is created. In the step attack, there was no effective preventive measure other than strictly managing the password in order for a malicious third party to obtain a legitimate password illegally and infiltrate the computer.

  In order to deal with such technical problems, Patent Document 1 discloses, as a technique for tracking an attacker, header information of packets flowing on a network is collected by a router, and when a target host detects an attack, each router receives an attack packet. There has been disclosed a technique for tracing a route by inquiring header information and returning to a router in which the same packet is recorded.

  In Patent Document 2, as a virus infection detection technique, TCP / IP communication using an exception port that is not normally used, incomplete packets, a large amount of communication, a large amount of error communication, etc. are monitored. A technique for determining a virus infection when detected is disclosed.

  Patent Document 3 discloses a technology that uses a virus detection apparatus installed on a network and a host access history in order to detect the movement of a virus. When the virus detection device detects a packet due to a virus, the access history of the corresponding host is referred to and a case where there is an access history to another host is determined to be a walk. In this case, the virus attached to the mail is targeted, and the movement of the virus is detected by paying attention to the behavior of the host after the mail enters the inside.

  Patent Document 4 discloses a technique for detecting a virus access by installing a detection device for a virus-infected packet on a network in order to protect against virus access.

In Patent Document 5, as intrusion detection technology, in order to increase the accuracy of intrusion detection, inbound traffic and outbound traffic are monitored in both directions, and the influence of unauthorized inbound traffic on the internal network is confirmed by outbound traffic. The technology to grasp the situation of damage is disclosed.
JP 2003-258910 A JP 2003-241989 JP 2004-86241 A JP-A-11-167487 JP 2004-302287 A

  Although the technique of Patent Document 1 can identify the source of the spoofed attack packet and its route, the detection of the attack depends on the existing IDS. Therefore, new or unknown viruses cannot be detected until an IDS detection pattern is created.

  In the technique of Patent Document 2, since virus detection is performed by focusing on only packets transmitted from a host computer inside the network, an operation by a correct user who has used it differently from normal may be erroneously detected as unauthorized access. There is sex.

  In the techniques of Patent Documents 3 and 5, since an existing virus detection device is used, a new or unknown virus cannot be detected. In addition, when there is a history of accessing a plurality of external host computers during normal use of the host computer, there is a possibility that it may be erroneously detected as unauthorized access.

  In the technique of Patent Document 4, since the virus packet detection device can only detect an existing virus packet, it cannot detect a new or unknown virus packet.

  An object of the present invention is to solve the above-described problems of the prior art and to provide an unauthorized access detection device capable of detecting a step attack and a new or unknown virus.

  In order to achieve the above-described object, the present invention is characterized in that the following measures are taken in an unauthorized access detection apparatus for detecting unauthorized access to a computer.

  (1) Transmission / reception packet monitoring means for monitoring a TCP PUSH packet transmitted / received by a computer, and a TCP having at least the same data among the packet, a destination port number and data within a predetermined time after the TCP PUSH packet is received An unauthorized access determination unit that determines transmission / reception of each TCP PUSH packet as an unauthorized access when the PUSH packet is transmitted is included.

  (2) The unauthorized access determination means collects data pieces distributed and registered in each TCP PUSH packet to be transmitted / received to construct transmission / reception data of a predetermined length, and compares the data pieces. .

  (3) Transmission / reception packet monitoring means for monitoring TCP packets transmitted / received by the computer, and transmission / reception of each TCP packet as unauthorized access if a TCP SYN packet is transmitted within a predetermined time after the reception of the TCP PUSH packet. And unauthorized access determining means for determining.

  (4) Transmission / reception packet monitoring means for monitoring the ICMP echo request packet transmitted / received by the computer, and when the ICMP echo request packet is transmitted within a predetermined time after the ICMP echo request packet is received, And unauthorized access determination means for determining transmission / reception as unauthorized access.

  (5) Transmission / reception packet monitoring means for monitoring a TCP SYN packet transmitted / received by a computer, and a TCP SYN whose destination port number is the same as the received TCP SYN packet within a predetermined time after the reception of the TCP SYN packet It includes an unauthorized access determination means that determines transmission / reception of each TCP SYN packet as unauthorized access when a packet is transmitted.

  (6) Transmission / reception packet monitoring means for monitoring a UDP packet transmitted / received by a computer, and a UDP packet having the same destination port number and data as the UDP packet is transmitted within a predetermined time after the UDP packet is received. And unauthorized access determination means for determining transmission / reception of each UDP packet as unauthorized access.

  (7) The transmission / reception packet monitoring means monitors the packet on a path connecting the network and the computer.

  (8) The transmission / reception packet monitoring means monitors the packet between the MAC layer and the IP layer in the computer.

  (9) The transmission / reception packet monitoring means monitors the packet between the application layer and the TCP / UDP layer in the computer.

  (10) The information processing apparatus further includes means for registering identification information of a reliable computer, and the unauthorized access determination means does not determine that access from a trusted computer is unauthorized access.

According to the present invention, the following effects are achieved.
(1) According to the invention of claim 1, since it is possible to detect unauthorized access based on a TCP PUSH packet used for port scanning in a step attack, it becomes possible to detect a step attack.
(2) According to the invention of claim 2, it is possible to prevent erroneous detection of unauthorized access regarding a packet transmitted and received by an application that distributes data into a plurality of packets.
(3) According to the invention of claim 3, the TCP PUSH packet used for the port scan in the step attack and the TCP SYN packet transmitted to establish a session from the intrusion destination host to the next intrusion destination Since unauthorized access can be detected based on this, a step attack can be detected.
(4) According to the invention of claim 4, since unauthorized access can be detected based on an echo request packet transmitted by a Ping command or the like when an intruder confirms the presence of the destination host, a step attack or a new type or unknown Viruses can also be detected.
(5) According to the invention of claim 5, it is a start packet of a three-way handshake when constructing a TCP communication path, and is used when a malicious intruder or virus searches for an attack target service port. Because unauthorized access can be detected based on the SYN packet, it is possible to detect a step attack and a new or unknown virus.
(6) According to the invention of claim 6, since unauthorized access can be detected based on scanning to a predetermined UDP port or transmission of an attack packet, it is possible to detect a stepping attack or a new or unknown virus.
(7) According to the invention of claim 7, unauthorized access can be detected based on packets transmitted and received on the network.
(8) According to the inventions of claims 8 and 9, unauthorized access can be detected based on packets transmitted and received on the host computer. In particular, according to the invention of claim 8, unauthorized access can be detected even when the communication path is encrypted by SSL or TLS.
(9) According to the invention of claim 10, since an access from a reliable host computer is not determined as an unauthorized access, false detection can be reduced.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram of a first embodiment of an unauthorized access detection device according to the present invention. In this embodiment, an echo request packet transmitted by a Ping command or the like when an intruder confirms the presence of a destination host is shown. Based on this, unauthorized access is detected.

  The unauthorized access detection device 1 is connected to a network gateway that connects a network and a host computer. In the unauthorized access detection device 1, the packet capture unit 101 operates in the promiscuous mode (all frame collection mode), and captures all packets on the network gateway regardless of whether the destination is a host computer. An ICMP (Internet Control Message Protocol) received packet extraction unit 102 extracts an ICMP received packet Pin whose destination IP is a host computer. The ICMP transmission packet extraction unit 103 extracts an ICMP transmission packet Pout whose transmission source IP is a host computer.

  FIG. 2 is a diagram showing the structure of an ICMP packet. An 8-bit “type (function code)” field, an 8-bit “code (auxiliary function code)” field, and a 16-bit “checksum” are shown. The variable length data is registered for each ICPM type in the “data” field after the field.

  The unauthorized access detection unit 104 refers to the ICMP packet extracted by each of the extraction units 102 and 103, and receives an echo request packet of type “8 (Echo Request)” and code “0 (Network Unreachable)”. If an echo request packet of the same type “8” and code “0” is transmitted from the host computer within a predetermined time, the transmission / reception of each echo request packet is determined as unauthorized access.

  FIG. 3 is a flowchart showing the operation of this embodiment, and mainly shows the operation of the unauthorized access detection unit 104.

  In step S1, it is determined whether or not an ICMP reception packet is extracted by the ICMP reception packet extraction unit 102. When the ICMP received packet is extracted, in step S2, the type and code of the received packet are referred to, and it is determined whether or not the type is “8” and the code is “0”. If the echo request packet has been received, the process proceeds to step S3, where the unauthorized access determination timer T is started.

  In step S4, it is determined whether the ICMP transmission packet extraction unit 103 has extracted an ICMP transmission packet. When the ICMP transmission packet is extracted, in step S5, the type and code of the packet are referred to, and it is determined whether or not the packet is an echo request packet of type “8” and code “0”. If it is not an echo request packet, the process proceeds to step S8, where it is determined whether or not the unauthorized access determination timer T has timed out, and the process returns to step S4 and repeats the above-described processes until time-out. When the unauthorized access determination timer T times out, the unauthorized access determination timer T is reset in step S9, and then the process returns to step S1.

  On the other hand, if it is determined in step S5 that the ICMP transmission packet is an echo request packet, in step S6, the destination IP of the transmitted packet is compared with the transmission source IP of the received packet. . If the two match, this is a normal packet exchange between the pair of host computers, and the process proceeds to step S8. If they do not match, the process proceeds to step S7, and transmission / reception of each echo request packet is determined to be unauthorized access.

  FIG. 4 is a block diagram of a second embodiment of the unauthorized access detection apparatus according to the present invention, and the same reference numerals as those described above represent the same or equivalent parts. In this embodiment, unauthorized access is made based on a TCP SYN packet used when a malicious intruder or virus searches for a target service port, which is a start packet of a three-way handshake when constructing a TCP communication path. Detected.

  A TCP (Transmission Control Protocol) received packet extraction unit 202 extracts a TCP received packet Pin whose destination IP is a host computer. The TCP transmission packet extraction unit 203 extracts a TCP transmission packet Pout whose transmission source IP is a host computer.

  FIG. 5 is a diagram showing the header structure of a TCP packet. The “source port number” field for identifying the TCP packet transmission source application, and the “destination port number” on which the destination application is waiting. A 6-bit flag field is included together with a field, and a “SYN (synchronize) flag” and “FUSH flag” field set when a TCP connection is requested is secured in this flag field.

  The unauthorized access detection unit 204 refers to the TCP packet extracted by each of the extraction units 102 and 103, sets a SYN plug, and receives a TCP reception packet and a TCP transmission packet whose destination port numbers match each other. If extracted within a predetermined time, transmission / reception of each TCP packet is determined as unauthorized access.

  FIG. 6 is a flowchart showing the operation of the present embodiment, and mainly shows the operation of the unauthorized access detection unit 204.

  In step S11, it is determined whether or not a TCP reception packet is extracted by the TCP reception packet extraction unit 202. When the TCP received packet is extracted, in step S12, it is determined whether or not the SYN flag of the received packet is set. If the SYN flag is set, the process proceeds to step S13, where the destination port number of the received packet is extracted and temporarily stored. In step S14, the unauthorized access determination timer T starts.

  In step S15, it is determined whether the TCP transmission packet extraction unit 203 has extracted a TCP transmission packet. When the TCP transmission packet is extracted, in step S16, it is determined whether or not the SYN flag of the transmission packet is set. If the SYN flag is set, the process proceeds to step S17, where the destination port number of the transmission packet is compared with the destination port number of the received packet stored temporarily.

  If the determinations in steps S15, S16, and S17 are negative, the process proceeds to step S20, where it is determined whether or not the unauthorized access determination timer T has timed out. Repeated. When the unauthorized access determination timer T times out, the unauthorized access determination timer T is reset in step S21, and then the process returns to step S11.

  On the other hand, if it is determined in step S17 that the destination port number of the transmission packet matches the destination port number of the received packet, the destination IP of the transmitted TCP SYN packet is received in step S18. The source IP of the TCP SYN packet is compared. If they do not match, the process proceeds to step S19, where transmission / reception of each TCP packet is determined to be unauthorized access.

  FIG. 7 is a block diagram of a third embodiment of the unauthorized access detection apparatus according to the present invention, and the same reference numerals as those described above represent the same or equivalent parts. In this embodiment, unauthorized access is detected based on the presence or absence of scanning to a predetermined UDP port or transmission of an attack packet.

  A UDP (User Datagram Protocol) received packet extraction unit 302 extracts a UDP received packet whose destination IP is a host computer. The UDP transmission packet extraction unit 303 extracts a UDP transmission packet whose transmission source IP is a host computer.

  FIG. 8 is a diagram showing a header structure of a UDP packet. A “source port number” field for identifying a UDP packet transmission source application, and a “destination” on which a destination application of the UDP packet is waiting. It includes a “port number” field, a “UDP data length” field indicating the length of the UDP packet, a “UDP checksum” field for checking the integrity of the UDP packet, and a “data” field.

  The unauthorized access detection unit 304 refers to the UDP packet extracted by each of the extraction units 102 and 103, and extracts a UDP reception packet and a UDP transmission packet in which both the destination port number and data match within a predetermined time. Then, transmission / reception of each UDP packet is determined as unauthorized access.

  FIG. 9 is a flowchart showing the operation of this embodiment, and mainly shows the operation of the unauthorized access detection unit 304.

  In step S31, it is determined whether or not the UDP reception packet extraction unit 302 has extracted a UDP reception packet. When the UDP received packet is extracted, in step S32, the destination port number and data of the received packet are extracted and temporarily stored. In step S33, the unauthorized access determination timer T starts.

  In step S34, it is determined whether the UDP transmission packet extraction unit 303 has extracted a UDP transmission packet. When the UDP transmission packet is extracted, in step S35, the destination port number and data of the transmission packet are compared with the destination port number and data of the temporarily stored reception packet.

  If the determinations in steps S34 and S35 are negative, the process proceeds to step S38, where it is determined whether or not the unauthorized access determination timer T has timed out. . When the unauthorized access determination timer T times out, the unauthorized access determination timer T is reset in step S39, and then the process returns to step S31.

  In contrast, if it is determined in step S35 that the destination port number and data of the transmission packet match the destination port number and data of the reception packet, respectively, the destination IP number of the UDP transmission packet is determined in step S36. And the source IP of the UDP received packet are compared. If they do not match, the process proceeds to step S37, where transmission / reception of each UDP packet is determined as unauthorized access.

  FIG. 10 is a block diagram of a fourth embodiment of the unauthorized access detection device according to the present invention. In this embodiment, for example, a port scan is transmitted to the TCP port No. 23 in the case of a step attack using telnet. Unauthorized access is detected based on the TCP PUSH packet.

  The TCP PUSH packet (reception) extraction unit 402 extracts a TCP PUSH packet Pin in which the destination IP is a host computer and the PUSH flag is set. The TCP PUSH packet (transmission) extraction unit 403 extracts a TCP PUSH packet Pout whose transmission source IP is a host computer.

  The unauthorized access detection unit 404 refers to each TCP PUSH packet extracted by each of the extraction units 402 and 403, and among the destination port number and the data, at least a TCP PUSH packet whose data match each other is within a predetermined time. When transmission / reception is performed, transmission / reception of each TCP PUSH packet is determined as unauthorized access.

  FIG. 11 is a flowchart showing the operation of this embodiment, and mainly shows the operation of the unauthorized access detection unit 404.

  In step S41, it is determined whether or not the TCP PUSH packet (reception) extraction unit 402 has extracted the TCP PUSH packet. When the TCP PUSH packet is extracted, in step S42, the destination port number and data of the received packet are extracted and temporarily stored. In step S43, the unauthorized access determination timer T starts.

  In step S44, it is determined whether or not the TCP PUSH packet (transmission) extraction unit 403 has extracted the TCP PUSH packet. When the TCP PUSH packet is extracted, in step S45, the destination port number and data of the transmission packet are compared with the destination port number and data of the temporarily stored reception packet.

  If the determination in steps S44 and S45 is negative, the process proceeds to step S48, where it is determined whether or not the unauthorized access determination timer T has timed out, and the process returns to step S44 and repeats the above-described processes until time-out. . When the unauthorized access determination timer T times out, the unauthorized access determination timer T is reset in step S49, and then the process returns to step S41.

  On the other hand, if it is determined in step S45 that the destination port number and data of the transmission packet match the destination port number and data of the reception packet, respectively, in step S46, the transmitted TCP SYN packet Is compared with the destination IP of the received TCP SYN packet. If they do not match, the process proceeds to step S47, where transmission / reception of each TCP packet is determined to be unauthorized access.

  When a character string input from the keyboard is stored in the data part of a packet that is different from character to character as in the telnet application and transmitted and received, it is difficult to detect unauthorized access by comparing data in units of packets. . In such a case, each of the packet extraction units 402 and 403 or the unauthorized access detection unit 404 collects a transmission data piece and a reception data piece distributed in a plurality of packets, respectively, and transmits a predetermined length of transmission data and reception data. It is desirable to construct and compare the two.

  Further, in the above-described embodiment, it is determined that unauthorized access is made on the condition that both the destination port number and the data match in step S45. However, the data is intentionally stored in fear of an unauthorized intruder. Since they may be different, it may be determined that unauthorized access is made only on the condition that the destination port numbers match.

  FIG. 12 is a block diagram of the fifth embodiment of the unauthorized access detection device according to the present invention. In this embodiment, if a TCP PUSH packet is received in the case of a step attack, the host computer receives the next intrusion destination. Focusing on the fact that a TCP connection establishment request is transmitted within a short time, unauthorized access is detected based on the reception of a TCP PUSH packet and the transmission of a TCP SYN packet.

  That is, as in the fourth embodiment, when it is determined that unauthorized access is performed only when the destination port number and data of the transmitted and received TCP PUSH packets match, for example, the intruder enters the first host by telnet, and then If you walk around the host while changing applications one after another, such as intruding into the next host with SSH encrypted communication, unauthorized access cannot be detected because the data changes. Therefore, in this embodiment, even when an intruder walks around the host while changing the application one after another, this can be detected.

  The TCP PUSH packet (reception) extraction unit 502 extracts a TCP PUSH packet Pin in which the destination IP is a host computer and the PUSH flag is set. A TCP SYN packet (transmission) extraction unit 503 extracts a TCP SYN packet Pout whose transmission source IP is a host computer.

  When the TCP PUSH packet and the TCP SYN packet extracted by the extraction units 102 and 103 are extracted within a predetermined time, the unauthorized access detection unit 504 determines that transmission / reception of each TCP packet is unauthorized access.

  FIG. 13 is a flowchart showing the operation of the present embodiment, and mainly shows the operation of the unauthorized access detection unit 204.

  In step S51, it is determined whether or not the TCP PUSH packet (reception) extraction unit 502 has extracted a TCP PUSH packet. When the TCP PUSH packet is extracted, an unauthorized access determination timer T is started in step S52. In step S53, it is determined whether the TCP SYN packet (transmission) extraction unit 503 has extracted a TCP SYN packet. If no TCP SYN packet is extracted, the process proceeds to step S56, where it is determined whether or not the unauthorized access determination timer T has timed out. When the unauthorized access determination timer T times out, the unauthorized access determination timer T is reset in step S57, and then the process returns to step S51.

  On the other hand, when the TCP SYN packet is extracted in step S53, the process proceeds to step S54, where the destination IP of the transmitted TCP SYN packet is compared with the source IP of the received TCP PUSH packet. If they do not match, the process proceeds to step S55, and transmission / reception of each TCP packet is determined to be unauthorized access.

  In each of the above embodiments, it has been described that unauthorized access is detected based on a packet captured from a network gateway connecting the network and the host computer. However, unauthorized access is detected based on a packet captured within the host computer. It can also be detected.

  FIG. 14 is a block diagram showing the configuration of the sixth embodiment of the present invention. In this embodiment, in order to monitor all packets in the host computer, the unauthorized access detection process 2 includes a MAC layer and an IP layer. Packets are taken in between and unauthorized access is detected in the same procedure as described above. However, when the communication path is encrypted by SSL or TLS, the packet cannot be referred to unless it is in the state before encryption. Therefore, as shown by the broken line in FIG. And packets must be captured between the TCP / UDP layer.

  In each of the above-described embodiments, it has been described that unauthorized access is detected based on a packet transmitted and received by a computer. However, in order to prevent misdetection of unauthorized access and improve reliability, a reliable host can be used. Even if the computer address is registered in advance in the unauthorized access detection unit 104 (204, 304...) And it is determined that the unauthorized access is based on the transmitted / received packet, the partner host is regarded as the trusted host. If it is already registered, it is desirable not to judge it as unauthorized access.

1 is a block diagram of a first embodiment of an unauthorized access detection device according to the present invention. FIG. It is the figure which showed the structure of the ICMP packet. It is the flowchart which showed operation | movement of 1st Embodiment. It is a block diagram of 2nd Embodiment of the unauthorized access detection apparatus which concerns on this invention. It is the figure which showed the header structure of a TCP packet. It is the flowchart which showed the operation | movement of 2nd Embodiment. It is a block diagram of 3rd Embodiment of the unauthorized access detection apparatus which concerns on this invention. It is the figure which showed the header structure of the UDP packet. It is the flowchart which showed the operation | movement of 3rd Embodiment. It is a block diagram of 4th Embodiment of the unauthorized access detection apparatus which concerns on this invention. It is the flowchart which showed the operation | movement of 4th Embodiment. It is a block diagram of 5th Embodiment of the unauthorized access detection apparatus which concerns on this invention. It is the flowchart which showed the operation | movement of 5th Embodiment. It is a block diagram of 4th Embodiment of the unauthorized access detection apparatus which concerns on this invention. It is the figure which expressed typically an example of the step attack.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Unauthorized access detection apparatus 101 ... Packet capture part 102 ... ICMP reception packet extraction part 103 ... ICMP transmission packet extraction part 104,204,304,404,504 ... Unauthorized access detection part 202 ... TCP reception packet extraction part 203 ... TCP Transmission packet extraction unit 302 ... UDP reception packet extraction unit 303 ... UDP transmission packet extraction unit 402,502 ... TCP PUSH packet (reception) extraction unit 403 ... TCP PUSH packet (transmission) extraction unit 503 ... TCP SYN packet (transmission) extraction unit

Claims (11)

In an unauthorized access detection device that detects unauthorized access to a computer based on packets transmitted and received by TCP (Transmission Control Protocol),
Transmission / reception packet monitoring means for monitoring TCP PUSH packets transmitted / received by the computer;
When a TCP PUSH packet having at least the same data among the packet and the destination port number and data is transmitted within a predetermined time after the TCP PUSH packet is received, transmission / reception of each TCP PUSH packet is regarded as unauthorized access. An unauthorized access detection device comprising unauthorized access determination means for determining.   The unauthorized access determination means collects data pieces distributed and registered in each of the TCP PUSH packets to be transmitted and received to construct transmission / reception data having a predetermined length, and compares the data pieces. The unauthorized access detection device according to 1. In an unauthorized access detection device that detects unauthorized access to a computer based on packets transmitted and received by TCP (Transmission Control Protocol),
Sending and receiving packet monitoring means for monitoring TCP packets sent and received by the computer;
An unauthorized access detection apparatus comprising: unauthorized access determination means for determining that transmission / reception of each TCP packet is unauthorized access when a TCP SYN packet is transmitted within a predetermined time after the TCP PUSH packet is received. In an unauthorized access detection device that detects unauthorized access to a computer based on packets transmitted and received by ICMP (Internet Control Message Protocol),
Transmission / reception packet monitoring means for monitoring an ICMP echo request packet transmitted / received by the computer,
An unauthorized access comprising: an unauthorized access judging means for judging, when an ICMP echo request packet is transmitted within a predetermined time after an ICMP echo request packet is received, to transmit / receive each echo request packet as an unauthorized access Detection device. In an unauthorized access detection device that detects unauthorized access to a computer based on packets transmitted and received by TCP (Transmission Control Protocol),
Transmission / reception packet monitoring means for monitoring TCP SYN packets transmitted / received by the computer;
When a TCP SYN packet having the same destination port number as the received TCP SYN packet is transmitted within a predetermined time after the TCP SYN packet is received, transmission / reception of each TCP SYN packet is determined to be unauthorized access. An unauthorized access detection device comprising unauthorized access determination means. In an unauthorized access detection device that detects unauthorized access to a computer based on a packet transmitted and received by UDP (User Datagram Protocol),
Transmission / reception packet monitoring means for monitoring UDP packets transmitted / received by the computer;
An unauthorized access determination means for determining that transmission / reception of each UDP packet is unauthorized access when a UDP packet having the same destination port number and data as the UDP packet is transmitted within a predetermined time after the UDP packet is received; An unauthorized access detection device comprising:   7. The unauthorized access detection apparatus according to claim 1, wherein the transmission / reception packet monitoring unit monitors packets on a route connecting a network and a computer.   7. The unauthorized access detection device according to claim 1, wherein the transmission / reception packet monitoring means monitors a packet between a MAC layer and an IP layer in a computer.   7. The unauthorized access detection apparatus according to claim 1, wherein the transmission / reception packet monitoring unit monitors packets between an application layer and a TCP / UDP layer in a computer. Further comprising means for registering trusted computer identification information;
The unauthorized access detection device according to claim 1, wherein the unauthorized access determination unit does not determine that access from the trusted computer is unauthorized access. Means for comparing a source address of the received packet with a destination address of the transmitted packet;
11. The unauthorized access detection device according to claim 1, wherein the unauthorized access determination unit does not determine that the transmission / reception of each packet is unauthorized access when the transmission source address matches the destination address. .

Images