JP2006201951A - Network defence system, network defence method, monitoring manager and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network defence system, a network defence method, a monitoring manager, and a program, capable of receiving substantially instantaneously receiving information for an attack or illicit access which has been generated in a place having no relation from a fire wall side, and taking a measure to the same illicitness. <P>SOLUTION: A detection system 20 detects illicit information and forms detection information. The fire wall 10 analyzes the detection information. The monitoring manager 30 develops illicit information to network equipment located in the other network monitored by an own apparatus based on the received detection information. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network defense system, a network defense method, a monitoring manager, and a program linked with an unauthorized access detection system.

  In recent years, attacks via the network and unauthorized access such as falsification of homepages have continued, and many companies and groups have suffered great damage.

  For example, a management server is placed in a local area network (LAN), and the log of each server in the LAN is checked to find the fraud. Further, the fact that the fraud has occurred is notified. There is an example of putting a host server.

  However, in this system, it is a method of checking the log to detect fraud, and there is a problem that it takes a certain amount of time to take countermeasures after fraud occurs, and the host server also has a management server It has only functions such as forwarding notifications of sent frauds and receiving management server logs, and does not perform particularly effective operations in terms of defense measures.

  On the other hand, in response to external attacks, etc., the detection system in the LAN quickly feeds back unauthorized information to the firewall in the local network, and the next unauthorized access is blocked by the firewall. The system is closed to the defense of only its own network (own LAN).

  Considering the current situation where many people can easily use the Internet environment, and money and other valuable information such as e-commerce are flowing on the network as a matter of course, only the network that they are using If it is safe, there will be no problem, and this will hinder future network environment development.

  Also, above all, if the other party's network environment is not secure, the information sent by him / her will also be the target of unauthorized persons, and eventually he / she will not be protected.

Here, a plurality of border routers in the communication network monitor the TCP-SYN packets, count and count the TCP-SYN packets for each destination, and exchange these summation results between the plurality of border routers. TCP-SYN packets that flow into the communication network via the border router are monitored, and TCP-SYN packets that flow in an abnormal number for the same destination are used for TCP for the purpose of distributed denial-of-service attacks. -Suppressing this inflow by determining that it is a SYN packet, it is possible to detect a sophisticated attack from a malicious user such as a distributed denial-of-service attack, and to limit or stop malicious calls from entering the network A technique has been proposed (see, for example, Patent Document 1).
JP 2003-289337 A

  However, the conventional example described above has the following problems.

  In the conventional network defense, when a server in one network is attacked, the detection information is not notified to other networks and the deployment is slow, and so on other networks before setting defense measures. There was a problem that there was a high possibility of being damaged by attacks and unauthorized access.

  Accordingly, the present invention provides a network defense system that can receive information almost instantaneously and take countermeasures against similar frauds, regarding attacks and unauthorized access that occurred at all points of view from the firewall side, An object is to provide a network defense method, a monitoring manager, and a program.

  The invention described in claim 1 is a network defense system including a detection system, a firewall, and a monitoring manager connected to the firewall via a network. The detection system detects fraudulent information and detects the detection information. The firewall includes detection information analysis means for analyzing the detection information, and the monitoring manager uses the received detection information to connect to network devices in other networks monitored by the own device. A network defense system comprising a transmission means for developing unauthorized information.

  According to a second aspect of the present invention, in the network defense system according to the first aspect, when the monitoring manager receives the detection information, the other network monitored by the own device based on the management table information held by the own device There is further provided means for automatically changing the setting of the network device in order to be secure.

  The invention described in claim 3 is a network defense method using a detection system, a firewall, and a monitoring manager connected to these via a network, wherein the detection system detects unauthorized information by unauthorized information detection means. And detecting the detection information, and the firewall has a step of analyzing the detection information by the detection information analysis means, and the monitoring manager uses the detection information received by the transmission means, A network defense method comprising the step of deploying unauthorized information to a network device in another network to be monitored.

  According to a fourth aspect of the present invention, in the network defense method according to the third aspect, when the monitoring manager receives the detection information, another network monitored by the own device based on the management table information held by the own device The network device further includes a step of automatically changing the setting of the network device so as to be secure.

  The invention according to claim 5 is characterized in that, based on detection information of unauthorized information received from a firewall connected via a network, the unauthorized information is deployed to a network device in another network monitored by the own device. It is a monitoring manager.

  According to the sixth aspect of the present invention, in the monitoring manager according to the fifth aspect, when the detection information is received, the network device in another network monitored by the own device based on the management table information held by the own device. Automatically change settings to be secure.

  The invention according to claim 7 causes the detection system to detect illegal information by the illegal information detection means and execute the step of creating detection information, and causes the firewall to execute the step of analyzing the detection information by the detection information analysis means. A program for causing a monitoring manager to execute a step of deploying unauthorized information to a network device in another network monitored by the own device based on detection information received by a transmission unit via the network .

  The invention described in claim 8 is in the other network monitored by the self-machine based on the management table information held by the self-machine when the detection information is received by the monitoring manager. A step of automatically changing the network device settings to be secure is further executed.

  According to the network defense system, the network defense method, the monitoring manager, and the program of the present invention, information can be received almost instantaneously regarding attacks and unauthorized accesses that have occurred at all points of view from the firewall side. Measures can be taken.

  Next, the configuration of the first exemplary embodiment of the present invention will be described with reference to the drawings.

  Referring to FIG. 1, the network defense system according to the present embodiment monitors a network device such as a firewall managed by itself through a firewall 10, a detection system 20 in the server, and a network 100 such as the Internet. And a monitoring manager 30. The network 100 may be any network, and may be, for example, an optical fiber, the Internet, a public line, a LAN (Local Area Network), an ADSL (Asymmetric Digital Subscriber Line), or the like. The communication method may be wired or wireless.

  Referring to FIG. 2, the firewall 10 includes a detection information receiving unit 11 from the detection system 20, an authentication unit 12 that authenticates received data, a detection information analysis unit 13 that analyzes received detection information, and a detection information analysis unit. A detection information transmission unit 14 that transmits information analyzed in step 1 to the monitoring manager 30, a firewall control unit 15 that controls a so-called firewall function such as packet filtering, and a manager information reception unit 16 that receives information from the monitoring manager 30. ing.

  The detection system 20 includes an unauthorized access detection unit 21 that detects an attack through a network, unauthorized access, and a program that performs unauthorized behavior, changes information detected by the unauthorized access detection unit 21 to a notification format, and other IP It includes a notification control unit 22 having a function of managing necessary information as detection information such as an address and determining a transmission destination, and a detection information transmission unit 23 that transmits detection information created by the notification control unit 22.

  The monitoring manager 30 includes an input interface 31 that receives input from a keyboard and the like, a receiving unit 32 that receives detection information from the firewall 10 and other network devices, analysis of the received detection information, and which network is being monitored, etc. A detection information control unit 33 that performs management, information on network devices that perform defensive measures, a management table 34 that manages levels such as whether protection settings are actually performed or only notifications, and authentication that authenticates received information The transmission part 36 which transmits the defense setting information produced | generated by the part 35 and the detection information control part 33 to the firewall 10 other than the firewall 10 which is the transmission origin of the original detection information is provided.

  Next, with reference to FIGS. 2-4, the flow of the network defense process in this Embodiment is demonstrated in detail.

  Referring to FIG. 3, first, network information to be monitored is registered in the monitoring manager 30 via the input interface 31 (step A00). This is the IP address of the firewall 10, the mail address of the administrator of the network to which the firewall 10 belongs, the level information indicating whether the setting is changed or notification only. Multiple network information may be registered. Here, the monitoring manager 30 is assumed to monitor a plurality of networks separated by firewalls and networks of different companies and groups, assuming a business operator that performs a monitoring service, for example. The input interface is, for example, input from a keyboard or reading from another storage medium, and specific means are not specified here.

  Next, the detection system detects unauthorized access (step A10) and creates detection information (step 20). As a means for detecting unauthorized access, there is, for example, JP-A-2004-304752. Here, specific detection means will not be mentioned. The detection information may be, for example, illegal contents such as “Falsification has been performed” or “Access to an access-prohibited file”, the time when the fraud was performed, and the IP address of the access source.

  Next, the created detection information is notified to the firewall 10 (step A30). When the firewall 10 receives the detection information from the detection system 20, the firewall 10 authenticates whether the information is legitimate (steps A40 and A50). The authentication method here is not particularly specified. If authentication is NG, the process ends.

  On the other hand, if the authentication is OK, the detection information analysis unit 13 analyzes the detection information (step A60). Here, information such as the IP address included in the detection information is extracted and prepared for the next step. When the analysis is completed, for example, the firewall control unit 15 is notified of the IP address extracted from the detection information (step A70). The firewall control unit refers to a so-called normal firewall function, and can be set such that access from the notified source IP address is not permitted. Moreover, the detection information analysis part 13 transmits detection information to the monitoring manager 30 via the detection information transmission part 14 (step A80).

  When the monitoring manager 30 receives the detection information from the firewall 10, the authentication unit 35 authenticates whether the information is legitimate (steps A90 and A100). The authentication method here is not particularly specified. If authentication is NG, the process ends.

  On the other hand, if the authentication is OK, the detection information control unit 33 analyzes the detection information (step A110). The detection information control unit manages the management table generated in step A00. Based on the received detection information, the setting information of the firewall 10 is automatically created based on the information such as the IP address of the unauthorized access, and the detection information is sent first according to the management table as the defense setting and detection information. Automatically sent to the firewall 10 under monitoring other than. At this time, only detection information may be notified to a firewall that does not require defense setting. At the same time, an e-mail can be sent to the administrator of each network and firewall 10 to notify that there is a possibility of fraud or that the firewall settings have been changed.

  Next, with reference to FIG. 4, an operation when the firewall 10 ′ receives defense setting information and detection information from the monitoring manager 30 will be described.

  First, the monitoring manager 30 transmits defense setting and detection information to the firewall 10 '(step B10).

  When the firewall 10 ′ receives the defense setting and detection information from the monitoring manager 30, the firewall 10 ′ authenticates whether the information is genuine (steps B 20 and B 30). The authentication method here is not particularly specified. If authentication is NG, the process ends.

  On the other hand, if the authentication is OK, the detection information analysis unit 13 analyzes the detection information (step B40). Here, the firewall controller 15 is notified of a defense setting that denies access from the unauthorized access source IP address, and the firewall setting such as packet filtering is automatically performed.

  As described above, according to the present embodiment, as viewed from the side of the firewall 10, information is delivered almost instantaneously with respect to an attack or unauthorized access that has occurred at all points, and measures against similar unauthorized actions are taken It is to be able to take. The reason is that the information detected by the detection system is immediately sent to the monitoring manager, the monitoring manager sends the necessary information to the network under its management, and the firewall 10 that has received the information sets based on the information. This is because the countermeasure is taken and defense measures are taken.

  In addition, it is possible to shorten the time from when the fraud is first detected until the firewall setting of another network is changed. The reason for this is that everything is automated from detection of fraud until the firewall 10 of another network is set up for defense, the detection information is communicated to each administrator as in the past, and the administrator manually changes the setting. This is because there is no need for work.

  In addition, a wide range of fraud protection on a network basis is instantly performed. This is because the monitoring manager 30 can block fraud at the firewall 10 by sending information to a plurality of firewalls 10 under management. In other words, it means that servers in the network (LAN) inside the firewall are protected. For example, in FIG. 1, detection information is sent to the firewalls 10 of the network B and the network C by notifying the monitoring manager 30 of the illegal information generated in the network A. As a result, the servers in the network B and the network C Is protected.

  In the conventional technology, the detection system prevented fraud, notified the firewall of its own network (for example, network A in FIG. 1), and automatically defended. For example, network B and network C) in FIG. 1 could not be protected.

  Furthermore, the present invention is intended for a business in the form of a monitoring service, for example, and the monitoring manager places a firewall and a detection system in a network of customers owned by the monitoring service provider and contracted for monitoring. .

  After the detection system detects fraud, it sends detailed information via the firewall or directly from the detection system to the monitoring manager. The monitoring manager also collects information on fraud and the management table it owns For the first time, unauthorized information and access control setting information are sent to a firewall or detection system under management. This is because, for example, it is possible to cope with a case where the customer side does not want (automatically) to change the firewall access settings.

  Also, from a business perspective, the monitoring service provider can only notify alert information that there is a possibility of unauthorized access, and can automatically change the firewall settings before being attacked. There is an advantage that it is possible to build a business model by making a difference in the charge when the measure can be taken.

  Also, when directly linking firewalls, or adding a new firewall that you want to link, you must register new link information on all currently running firewalls. However, if the monitoring manager is managing all at once, it is possible to send the necessary information to the newly added firewall and detection system just by adding it to the monitoring manager management table information. Is done.

  Next, a second embodiment of the present invention will be described with reference to the drawings.

  Since the basic configuration of the network defense system according to the present embodiment is the same as that of the first embodiment described above, redundant description is omitted.

  Referring to FIG. 5, the firewall 10 shown in FIG. 2 is different from the above-described first embodiment in that the detection unit 40 includes the receiving unit 16 from the manager. For example, in the case of a server that is open to the outside (Internet) such as a Web server, it is possible to transmit detection information directly from the monitoring manager to the detection system. Therefore, once the detection information from the monitoring manager 30 is received by the detection system and authenticated, the detection information is notified to the firewall 10 in the same manner as when the detection of fraud is performed, and the firewall setting is automatically set. Change to

  Next, with reference to FIG. 6, the flow of the network defense process in this Embodiment is demonstrated in detail.

  The steps from the detection of unauthorized access by the detection system to the step (step A120) in which the monitoring manager 30 transmits detection information are the same as those in the first embodiment.

  The monitoring manager 30 transmits defense setting and detection information to the detection system 40 (step C10).

  Upon receiving the defense setting and detection information from the monitoring manager 30, the detection system 40 authenticates whether the information is legitimate (steps C20 and C30). The authentication method here is not particularly specified. If authentication is NG, the process ends.

  On the other hand, if the authentication is OK, the notification control unit 42 analyzes the detection information (step C40).

  Next, the created detection information is notified to the firewall 10 in the local network (step C50). Thereafter, the operation of the firewall 10 (Step C60 to Step C90) is the same as Step B20 to Step B50 of the above-described first embodiment.

  Next, a third embodiment of the present invention will be described with reference to the drawings.

  Since the basic configuration of the network defense system according to the present embodiment is the same as that of the first embodiment described above, redundant description is omitted.

  Referring to FIG. 7, the detection system 20 is different from the first embodiment described above in that there is a router that notifies the detection information.

  Next, a fourth embodiment of the present invention will be described with reference to the drawings.

  Since the basic configuration of the network defense system according to the present embodiment is the same as that of the first embodiment described above, redundant description is omitted.

  Referring to FIG. 8, after the monitoring manager A receives the detection information, the above-mentioned first information is transmitted (transferred) not only to the firewall 10 under its own monitoring but also to other monitoring managers B. This is different from the embodiment.

  According to the present embodiment, detection information can be notified not only to the monitoring of a certain monitoring manager but also to the firewall 10 under the monitoring of another monitoring manager having the same configuration. Can expand the range that can be taken.

  Here, the monitoring manager 30 can use the reception unit 32 and the transmission unit 36 in FIG. 2 to transmit and receive detection information to and from other monitoring managers.

  Each of the above-described embodiments is a preferred embodiment of the present invention, and various modifications can be made without departing from the scope of the present invention. For example, the processing for realizing the functions of the present system may be performed by causing each device to read and execute a program for realizing the functions of the firewall 10, the detection system 20, and the monitoring manager 30 in the above embodiment. . Further, the program is transmitted to another computer system by a transmission wave via a CD-ROM or a magneto-optical disk that is a computer-readable recording medium, or via the Internet or a telephone line that is a transmission medium. Also good.

  In each of the above-described embodiments, the system configuration in which the firewall 10, the detection system 20, and the monitoring manager 30 are connected as separate devices has been described, but the configuration in which each function is realized as one computer system, Of course, the present invention can be applied to a configuration in which a plurality of server devices and the like are added for each function.

It is a figure which shows schematic structure of the network defense system in the 1st Embodiment of this invention. It is a figure which shows the functional block of the firewall in the 1st Embodiment of this invention, a detection system, and the monitoring manager. It is a flowchart which shows the operation | movement of the network defense process in the 1st Embodiment of this invention. It is a flowchart which shows the operation | movement of the network defense process in the 1st Embodiment of this invention. It is a figure which shows the functional block of the firewall in the 2nd Embodiment of this invention, a detection system, and the monitoring manager. It is a flowchart which shows the operation | movement of the network defense process in the 2nd Embodiment of this invention. It is a figure which shows the functional block of the firewall in the 3rd Embodiment of this invention, a detection system, and the monitoring manager. It is a figure which shows schematic structure of the network defense system in the 4th Embodiment of this invention.

Explanation of symbols

10 Firewall 20 Detection System 30 Monitoring Manager 100 Network

Claims (8)

A network defense system including a detection system, a firewall, and a monitoring manager connected to these via a network,
The detection system includes fraud information detecting means for detecting fraud information and creating detection information,
The firewall includes detection information analysis means for analyzing the detection information,
The network protection system according to claim 1, wherein the monitoring manager includes a transmission unit that expands unauthorized information to a network device in another network monitored by the own device based on the received detection information.   When the monitoring manager receives the detection information, the monitoring manager automatically changes the settings of the network device in another network monitored by the own device to be secure based on the management table information held by the own device. The network defense system according to claim 1, further comprising: A network defense method using a detection system, a firewall, and a monitoring manager connected to these via a network,
The detection system includes a step of detecting fraud information by fraud information detection means and creating detection information;
The firewall includes a step of analyzing the detection information by detection information analysis means;
A network defense method, comprising: a step in which the monitoring manager deploys unauthorized information to a network device in another network monitored by the own device based on the detection information received by the transmission unit.   When the monitoring manager receives the detection information, it automatically changes the settings of the network device in another network monitored by the own device based on the management table information held by the own device to be secure. The network defense method according to claim 3, further comprising the step of:   A monitoring manager characterized in that, based on detection information of illegal information received from a firewall connected via a network, the illegal information is deployed to a network device in another network monitored by the own device.   When the detection information is received, the setting of the network device in another network monitored by the own device is automatically changed based on the management table information held by the own device so as to be secure. The monitoring manager according to claim 5. Let the detection system detect unauthorized information by unauthorized information detection means, and execute a step of creating detected information,
Causing the firewall to execute a step of analyzing the detection information by detection information analysis means;
A program that causes a monitoring manager to execute a step of deploying unauthorized information to a network device in another network monitored by the own device based on the detection information received by the transmission unit via the network.   When the detection information is received by the monitoring manager, the setting of the network device in another network monitored by the own device is automatically changed based on the management table information held by the own device to be secure 8. The program according to claim 7, further comprising the step of:

Images