JP2006237892A - DoS ATTACK DETECTION METHOD, SYSTEM, AND PROGRAM - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform the DoS attack detection with higher precision by preventing the incorrect detection of the DoS attach in response to the specification of a service. <P>SOLUTION: A method of detecting the DoS attack includes a first measuring step of counting the number of signals received in first monitor periods, a first distinction step of distinguishing whether the number of the counted signals exceeds the first threshold or not, a second measuring step of counting the number of the signals of the predetermined content of processing out the signal received in the second monitor periods when the number of the counted signals exceeds the first threshold, a second distinction step of distinguishing whether the number of the signals of the predetermined content of processing which performs the above count when the number of the counted signals exceeds the first threshold, and a DoS attack distinction step of distinguishing from the DoS attack when the number of the signals of the predetermined content of processing which performs the counting exceeds the second threshold. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technique for detecting a DoS attack.

Various DoS attack detection methods have been proposed for DoS (Denial of Services) attacks that send illegal data and make computer devices unusable. For example, Patent Document 1 describes a method for detecting a DoS attack based on the number of packets received per unit time.
JP 2004-140524 A

  By the way, even when a large amount of signals (packets, messages, data, etc.) are transmitted from a specific terminal, there are cases where the DoS attack does not apply. Specifically, in some service specifications, the terminal may be allowed to transmit a large amount of signals (for example, broadcast transmission to a large number of destination terminals). In such a case, in a method for detecting a DoS attack based on the number of signals (for example, Patent Document 1), there is a risk that a large number of legitimate signals that do not correspond to the DoS attack are erroneously recognized as a DoS attack.

  Moreover, even when there are few signals transmitted from a specific terminal, it may correspond to a DoS attack. Specifically, in some service specifications, it may be permitted to set a large number of processing contents (for example, data transmission processing for a large number of destination terminals) in one signal. Such a signal may correspond to a DoS attack depending on the processing content included in the signal even if the number of signals itself is small. For this reason, it is difficult to detect a DoS attack on such a signal in the method of detecting a DoS attack based on the number of signals.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to detect a DoS attack with higher accuracy in accordance with service specifications.

  In order to solve the above problem, for example, in the first invention, a DoS attack detection method performed by the information processing device, the information processing device counts the number of signals received within the first monitoring period. A first measurement step; a first determination step of determining whether or not the counted number of signals exceeds a first threshold; and a second determination when the counted number of signals exceeds a first threshold. A second measurement step of counting the number of signals of a predetermined processing content from signals received within the monitoring period, and determining whether or not the counted number of signals of the predetermined processing content exceeds a second threshold And a DoS attack determining step of determining a DoS attack when the counted number of signals of the predetermined processing content exceeds a second threshold.

  The second invention is a DoS attack detection method performed by the information processing apparatus, and the information processing apparatus counts the number of processing contents included in each of the signals received within the first monitoring period. A first determination step, a first determination step of determining whether or not the counted number of processing contents exceeds a first threshold, and a case where the counted number of processing contents exceeds a first threshold A second measurement step for counting the duplication number for each processing content, and determining whether any one of the duplication number for each processing content counted in the second measurement step exceeds a second threshold value And a DoS attack determination step of determining a DoS attack when the overlap of any one of the processing contents exceeds a second threshold value.

  The third invention is a DoS attack detection method performed by an information processing device, wherein the information processing device has a processing content for each of a plurality of processing contents included in each signal received within a predetermined monitoring period. An error determination step for determining whether or not there is an error, a measurement step for counting the number of processing contents determined to be an error in the error determination step, and whether the number of processing contents of the counted error exceeds a predetermined threshold A threshold determination step for determining whether or not, and a DoS attack determination step for determining a DoS attack when the number of error processing contents exceeds the threshold.

  According to the present invention, it is possible to prevent a false detection of a DoS attack and detect a DoS attack with higher accuracy according to the service specifications.

  Hereinafter, embodiments of the present invention will be described.

  FIG. 1 is an overall configuration diagram of a system to which an embodiment of the present invention is applied.

  In the system of the present embodiment, at least one terminal 1, a service control server 2, and an attached server 3 are connected by a network 9 such as the Internet. The network 9 has an edge router and a relay router (not shown).

  The service control server 2 controls services provided to each terminal 1. The service control server 2 includes a processing unit 21 that performs a DoS attack detection process, various counters 22 that count signals received from the terminal 1, and a storage unit 23. The storage unit 23 stores a non-target device list 24, a signal type table 25, and a terminal registration list 26.

  The non-target device list 24 is a list of devices that are not detected by the DoS attack. For example, for the attached server 3 and the specific terminal 1, it may be indispensable in terms of service specifications to transmit a large amount of signals to the service control server 2. Such devices are registered in advance in the non-target device list 24 in order to be excluded from the DoS attack detection target. It is assumed that identification information (for example, IP address) of each device to be excluded is set in the excluded device list 24.

  The signal type table 25 is a table in which a DoS attack detection method according to the type of service control signal is set. The signal type table 25 will be described later. In the terminal registration list 26, identification information (for example, IP address) of the terminal 1 that can receive the service provided by the service control server 2 is set. The attached server 3 provides a service to the terminal 1 based on the control of the service control server 2.

  In the present embodiment, the service control process of the service control server 2 starts when the terminal 1 transmits a service control signal. The service control signal is a packet, a message, or the like, and is data for performing a service request, notification, file transfer (transfer of media such as voice / image and file) from the terminal 1 to the service control server 2. Further, it is assumed that the service control signal includes a signal type to be described later, source terminal identification information (for example, IP address), destination terminal identification information (for example, IP address), and the like.

  In the present embodiment, it is assumed that there are five types of service control signals, service control signals A to E, according to the type of service.

  The service control signal A (hereinafter referred to as “signal A”) and the service control signal D (hereinafter referred to as “signal D”) can include only one processing content in one service control signal due to service specifications. To do. Further, it is assumed that the signal A and the signal D are prohibited (illegal act) from simultaneous transmission (broadcast transmission) for transmitting a plurality of signals all at once in accordance with service specifications.

  The processing content is a minimum unit of service control performed by the service control server 2 on the terminal 1. Examples of processing contents include communication processing to one destination terminal, one content download processing, one terminal status notification reception processing, and the like. In the present embodiment, it is assumed that communication processing to one destination terminal is used as the processing content, and identification information of the destination terminal is used to identify whether the processing content is the same.

  Service control signal B (hereinafter referred to as “signal B”) and service control signal E (hereinafter referred to as signal E) can include only one processing content in one service control signal due to service specifications. To do. Signal B and signal E are allowed to be transmitted simultaneously with a plurality of signals having different processing contents according to the service specifications, but a large number of signals having the same processing contents or illegal processing contents are simultaneously transmitted. Transmission is prohibited. That is, in the case of the present embodiment, in the signal B and the signal E, simultaneous transmission to a plurality of different destination terminals is permitted, but simultaneous transmission to the same destination terminal is prohibited (illegal act). . Further, it is assumed that simultaneous transmission to an unauthorized destination terminal is also prohibited.

  The service control signal C (hereinafter, “signal C”) can include a plurality of processing contents in one signal due to service specifications. However, a large amount of processing contents overlapped in one signal or a large amount It is forbidden to include illegal processing contents. That is, in this embodiment, the signal C can include operation instructions for a plurality of different destination terminals, but it is prohibited to include a large number of operation instructions for the same destination terminal or an illegal destination terminal. And

  Next, the signal type table 25 stored in the storage unit 23 will be described. The signal type table 25 is a table in which a DoS attack detection method according to the type of service control signal is set.

  FIG. 2 is a diagram showing an example of the signal type table 25. As illustrated, the signal type table 25 includes a signal type 201, a DoS attack detection method 202, a first monitoring period 203, a first threshold value 204, a second monitoring period 205, a second monitoring period 205, and a second monitoring period 205. It has a threshold value 206, a third monitoring period 207, and a third threshold value 208. In the illustrated example, both the signal A and the signal D detect the DoS attack using the “pattern a” detection method 202. However, the first monitoring period 203 (“T1” and “T2”) and the first threshold value 204 (“S1” and “S2”) are different between the signal A and the signal D, respectively. Each item of the signal type table 25 will be described in the DoS detection process described later.

  The terminal 1, the service control server 2 and the attached server 3 described above all include, for example, a CPU 901, a memory 902, an external storage device 903 such as an HDD, and an input device such as a keyboard and a mouse as shown in FIG. It is possible to use a general-purpose computer system including 904, an output device 905 such as a display or a printer, a communication control device 906 for connecting to other devices, and a bus 907 for connecting these devices. it can.

  In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device. For example, the functions of the terminal 1, the service control server 2, and the attached server 3 are the CPU 901 of the terminal 1 in the case of the program for the terminal 1, and the CPU 901 of the service control server 2 in the case of the program for the service control server 2. However, in the case of the program for the attached server 3, the CPU 901 of the attached server 3 executes the program. Note that the memory 902 or the external storage device 903 of the service control server 2 is used for the storage unit 23 of the service control server 2. Further, it is assumed that the external storage device 903, the input device 904, and the output device 905 are provided as necessary by each device.

Next, DoS attack detection processing in the service control server 2 will be described.
FIG. 4 is an overall process flow diagram of the DoS attack detection process. First, the processing unit 21 of the service control server 2 receives a service control signal (hereinafter, “signal”) transmitted from the terminal 1, and determines whether or not the signal format is normal (S11). When the format is invalid (S11: NO), the processing unit 21 analyzes the header information of the received signal and identifies the source terminal (source IP address) of the signal.

  The illegal format counter counts the number of illegally formatted signals received from a specific source terminal within a predetermined monitoring time. That is, the illegal format counter refers to an illegal format monitoring table (not shown) in the storage unit 23, and counts up the number of illegally formatted signals received from the specified transmitting terminal. If there is no transmission terminal specified in the illegal format monitoring table, the new transmission terminal is newly added to the illegal format monitoring table, and the number of illegally formatted signals received from the present time within a predetermined monitoring time is calculated. Monitor. Further, when the predetermined monitoring time expires, the illegal format counter deletes the transmitting terminal whose monitoring time has expired from the illegal format monitoring table (or clears the number of signals to zero). Then, the processing unit 21 determines whether or not the number of signals counted by the illegal format counter exceeds a predetermined threshold (S12).

  When the number of illegally formatted signals is smaller than the threshold (S12: NO), the processing unit 21 does not regard the DoS attack and discards the signal received in S11 or transmits an error response to the source terminal (S13). . On the other hand, if the number of illegally formatted signals exceeds the threshold value (S12: YES), the processing unit 21 determines that the DoS attack and performs restriction processing for the DoS attack on the source terminal (S14). In addition, as a restriction | limiting process with respect to a DoS attack, the damage of the DoS attack to the service control server 2 etc. can be considered by discarding all the signals transmitted from the transmission origin terminal, for example. In order to notify the system maintainer that a DoS attack has been detected, it is conceivable to output an alarm message including information (such as an IP address) regarding the source terminal to the output device.

  Also, regarding the cancellation of the DoS attack restriction process, there are two methods: a timed release for releasing the restriction after a predetermined time has elapsed, and a manual release by a release command input by the system maintainer. Either method may be selected according to the security policy of the operator operating the network. For example, in the case of a server that has been operating continuously for 24 hours, or when the number of source terminals that release a DoS attack is large, the manual release method has a heavy workload on the system maintainer. For this reason, it is conceivable that the default is timed cancellation, and manual cancellation is used only when the DoS attack is clearly converged by the timed cancellation.

  On the other hand, when the signal format is normal (S11: YES), the processing unit 21 analyzes the header information of the signal and identifies the source terminal (source IP address) of the signal. Then, the processing unit 21 determines whether or not the identified source terminal is a DoS attack detection target (S15). That is, the processing unit 21 determines whether or not the source IP address of the source device exists in the non-target device list 24 of the storage unit 23.

  When the transmission source device is not the detection target, that is, when it exists in the non-target device list 24 (S15: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack and sets the signal. The normal process is performed (S16). For example, the processing unit 21 uses the attached server 3 to provide a predetermined service to the terminal.

  Further, when the transmission source device is a detection target, that is, when the transmission source device does not exist in the non-target device list 24 (S15: YES), the processing unit 21 specifies the signal type included in the signal received in S11. Then, the processing unit 21 refers to the signal type table 25 (see FIG. 2) in the storage unit 23 and distributes the processing to the detection method (detection pattern) corresponding to the identified signal (S17). In the illustrated example, the processing unit 21 performs pattern a (S18) for signal A and signal D, pattern b (S19) for signal B and signal E, and pattern c (S20) for signal C. Sort out.

  Next, processing of pattern a, pattern b, and pattern c will be described.

  FIG. 5 is a DoS attack detection process flow diagram of the pattern a (S18 in FIG. 3: signal A or signal D). First, the processing unit 21 determines whether or not the parameter of the signal received in S11 is normal (S31). When the parameter of the received signal is illegal (S31: NO), the illegal parameter counter counts the number of illegal parameter signals received from the source terminal within a predetermined monitoring time. The unauthorized parameter counter refers to the unauthorized parameter monitoring table (not shown) in the storage unit 23 by the same process as the aforementioned unauthorized format counter (FIG. 4: S12), and receives the unauthorized Count up the number of signals with various parameters. In addition to such a method of counting the number of illegal parameter signals, the number of error response signals transmitted by the service control server 2 in S33 described later may be counted. Then, the processing unit 21 determines whether or not the number of signals counted by the illegal parameter counter exceeds a predetermined threshold (S32).

  In addition, as a case where the parameter is invalid, for example, when a destination terminal that is not stored in the terminal registration list 26 of the storage unit 23 is set, or in a service that requires authentication of the source terminal, If a password different from the password is set, etc.

  When the number of illegal parameter signals is smaller than the threshold value (S32: NO), the processing unit 21 does not determine the DoS attack and transmits an error response to the source terminal (S33). On the other hand, when the number of illegal parameter signals exceeds the threshold value (S32: YES), the processing unit 21 determines that the DoS attack and performs the same restriction process (signal discarding, etc.) as S14 in FIG. (S34).

  On the other hand, when the signal parameter is normal (S31: YES), the signal number counter counts the number of normal signals received from the source terminal within a predetermined monitoring time. The signal number counter is received within the first monitoring period 203 set in the signal type table 25 (see FIG. 2) according to the signal type (signal A or signal D) of the signal received in S11. Count the number of normal signals. The signal number counter counts up the number of normal signals by the same processing as the above-described illegal format counter (FIG. 4: S12).

  Then, the processing unit 21 determines whether or not the number of normal signals counted by the signal number counter exceeds the first threshold value 204 of the signal type table 25 (see FIG. 2) (S35). For example, when the signal received in S11 is “signal A”, the signal number counter counts the number of normal signals received from the transmission source terminal during the first monitoring period 203 “T1”. Then, the processing unit 21 determines whether or not the number of normal signals exceeds the first threshold value 204 “S1”.

  When the number of normal signals is smaller than the threshold value (S35: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack, and performs normal processing set for the signal (S36). On the other hand, when the number of normal signals exceeds the threshold value (S35: YES), the processing unit 21 determines that the DoS attack, and performs the same restriction process (such as signal discarding) as S14 in FIG. Perform (S37).

  FIG. 6 is a DoS attack detection process flow diagram of pattern b (S19 in FIG. 3: in the case of signal B or signal E). First, the processing unit 21 determines whether or not the parameter of the signal received in S11 is normal, similarly to S31 described in FIG. 5 (S41). When the parameter is invalid (S41: NO), the processing unit 21 performs the same processing as S32 to S34 in FIG. 5 (S42 to S44).

  On the other hand, when the parameter is normal (S41: YES), the same processing as S35 of FIG. 3 is performed (S45). For example, when the signal received in S11 is “signal B”, the signal number counter counts the number of normal signals received from the transmission source terminal during the first monitoring period 203 “T1”. Then, the processing unit 21 determines whether or not the number of normal signals exceeds the first threshold value 204 “S1”.

  When the number of normal signals is smaller than the threshold (S45: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack, and performs normal processing set for the signal (S46). On the other hand, when the number of normal signals exceeds the threshold value (S45: YES), the processing unit 21 determines whether or not the processing contents overlap with respect to the signal from the source terminal received in S11 (that is, processing). Check if the contents are the same). Then, the processing content counter that is different for each processing content of the transmission source terminal counts the number of signals having the same processing content from the normal signals received from the transmission source terminal within a predetermined monitoring time. Note that the predetermined monitoring time is the second monitoring period 205 “T4” or “T6” set in the signal type table 25 according to the signal type (signal B or signal E) of the signal received in S11. is there. The processing content counter counts up the number of signals having the same processing content by the same processing as the above-described illegal format counter (FIG. 4: S12).

  Then, the processing unit 21 refers to the signal type table 25 and acquires the second threshold value 206 corresponding to the signal type received in S11. Then, the processing unit 21 determines whether or not the number of signals of the same processing content counted by the processing content counter exceeds the acquired second threshold value 206 (S47).

  In the present embodiment, the destination terminal is used to identify whether the processing contents from the specific source terminal are the same. For this reason, the processing content counter counts the number of signals for the same destination terminal as the destination terminal set in the signal received in S11. Then, the processing unit 21 determines whether or not the number of signals for the same destination terminal exceeds a threshold value.

  When the number of signals having the same processing content is smaller than the threshold (S47: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack, and performs normal processing set for the signal (S48). . On the other hand, when the number of signals having the same processing content exceeds the threshold value (S47: YES), the processing unit 21 determines that the DoS attack has occurred, and performs the same restriction processing (signal discarding, etc.) as S14 in FIG. ) Is performed (S49).

  In a service that allows simultaneous transmission (for example, broadcast transmission) from a terminal by the DoS attack detection process shown in FIG. 6, simultaneous transmission to a plurality of different destination terminals is not determined as a DoS attack and is performed on the same destination terminal. Only a large number of simultaneous transmissions can be detected as a DoS attack.

  FIG. 7 is a DoS attack detection process flow diagram of the pattern c (S20 in FIG. 3: signal C). First, the processing unit 21 determines whether or not the parameter of the processing content included in the signal received in S11 is normal (S51). If any parameter is illegal (S51: NO), the illegal parameter counter counts the number of processing contents including the illegal parameter from signals having the illegal parameter received within a predetermined monitoring time from the transmission source terminal. To do. Note that the predetermined monitoring time is the third monitoring period 207 “T7” set in the signal type table 25 in accordance with the signal type (signal C) of the signal received in S11. The illegal parameter counter counts up the number of illegal parameter processes by the same process as the illegal format counter (FIG. 4: S12).

  Then, the processing unit 21 determines whether or not the number of processing contents counted by the illegal parameter counter exceeds the third threshold value 208 of the signal type table 25 (S52). In this embodiment, the destination terminal is used to identify the identity of the processing contents. Therefore, the signal C can set a plurality of destination terminals in one signal. Therefore, for example, when at least one unauthorized destination terminal that is not set in the terminal registration list 26 is set in the signal, the processing unit 21 passes information on the number of processing contents of the unauthorized destination to S52. Information on the number of normal processing contents is passed to S55.

  In S51, parameters other than the destination terminal are also checked, and if the parameter is associated with the destination terminal, the processing content is determined to be illegal even if it is a correct destination (S51: NO). If the common parameter that is not associated is invalid, the number of illegal processing contents is determined as “1”, and the number of legal processing contents is determined as “0”.

  When the number of processing contents of the illegal parameter is smaller than the threshold (S52: NO), the processing unit 21 does not determine the DoS attack and transmits an error response to the source terminal (S53). On the other hand, when the number of processing contents of the illegal parameter exceeds the threshold value (S52: YES), the processing unit 21 determines that the DoS attack and performs the same restriction process (signal discarding) as S14 in FIG. Etc.) (S54).

  On the other hand, when the parameter of the received signal is normal (S51: YES), the processing content counter counts the total number of processing content included in each normal signal received from the transmission source terminal within a predetermined monitoring time. The predetermined monitoring time is the first monitoring period 203 “T1” set in the signal type table 25 according to the signal type (signal C) of the signal received in S11. The processing content counter counts up the number of processing contents by the same processing as the above-described illegal format counter (FIG. 4: S12).

  Then, the processing unit 21 determines whether or not the counted number of processing contents exceeds the first threshold value 204 of the signal type table 25 (S55). When the number of processing contents is smaller than the threshold (S55: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack, and performs normal processing set in the signal (S56). On the other hand, when the number of processing contents exceeds the threshold (S55: YES), the duplication counter further counts the duplication number of normal processing contents of the transmission source terminal counted in S55. In this embodiment, the destination terminal is used to identify the identity of the processing contents. Therefore, the duplication number counter counts the duplication number of each destination terminal included in each normal signal of the transmission source terminal received within the first monitoring period.

  Then, the processing unit 21 determines whether or not the overlap of any of the processing contents exceeds the second threshold value 206 of the signal type table 25 (S57).

When the overlap number of all the processing contents is smaller than the threshold (S57: NO), the processing unit 21 determines that the signal received in S11 is not a DoS attack, and performs normal processing set in the signal (S58). ). On the other hand, when the duplication number of any of the processing contents exceeds the threshold (S57: YES), the processing unit 21 determines that the DoS attack and performs the same restriction process (signal signal) as S14 in FIG. Disposal) (S59)
In a service in which a plurality of processing contents (for example, destination terminals) can be included in one signal by the DoS attack detection process shown in FIG. 7, the same processing contents (for example, the same destination terminal or an illegal destination terminal) are included. A DoS attack caused by a large amount of signals can be detected.

  The embodiment of the present invention has been described above.

  In the present embodiment, in a service capable of simultaneous transmission (broadcast transmission) to a plurality of different destination terminals (processing contents) (see FIG. 6), the service control server 2 transmits a signal transmitted within a predetermined monitoring time. It is determined whether or not the number exceeds a predetermined threshold. If the number exceeds the threshold, whether or not the number of signals transmitted to the same destination terminal within the predetermined monitoring time of the source terminal exceeds the predetermined threshold. Is determined. Thus, the service control server 2 can efficiently detect only a large number of simultaneous transmissions to the same destination terminal as a DoS attack without distinguishing a simultaneous transmission to a plurality of different destination terminals as a DoS attack. .

  In the present embodiment, in a service in which a plurality of destination terminals (processing contents) can be included in one signal (see FIG. 7), the service control server 2 transmits each signal transmitted within a predetermined monitoring time. It is determined whether or not the total number of destination terminals (total number of processing contents) included in the number exceeds a predetermined threshold. If the number exceeds the threshold, the duplication number for each destination terminal of the source terminal further exceeds the predetermined threshold It is determined whether or not. Thereby, the service control server 2 can efficiently detect a DoS attack caused by a signal including a large amount of the same destination terminal.

  In the present embodiment, in a service in which a plurality of destination terminals (processing contents) can be included in one signal (see FIG. 7), the service control server 2 transmits each signal transmitted within a predetermined monitoring time. It is determined whether or not the number of unauthorized destination terminals (number of unauthorized processing contents) included in the number exceeds a predetermined threshold. As a result, the service control server 2 can efficiently detect a DoS attack caused by a signal including a large number of unauthorized destination terminals.

  In the present embodiment, a DoS attack detection method (detection pattern), a monitoring time, and a threshold are set for each signal type using the signal type table 25. Thereby, it is possible to detect a flexible DoS attack according to the service characteristics and specifications according to the type of the service control signal.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary. For example, the present invention can be applied to an instant message service using a SIMPLE (SIP for Instant Messaging and Presence Leveraging Extensions) protocol which has recently attracted attention. That is, the service control signal A is used as a terminal registration request signal for registering a terminal in the presence server so that the instant message service can be provided, and the service control signal B is used to monitor the presence status of a specific terminal. When the request signal and the service control signal D are a state request change signal for changing a user state or a presence state such as an application, and the service control signal E is a messaging control signal for transmitting a message to a specific terminal, the presence server The invention can be applied to detect a DoS attack.

  In the instant message service, in the conventional DoS attack detection method, the simultaneous broadcast of the status monitoring request signal or the messaging control signal to many destination terminals may be erroneously determined as a DoS attack. However, by applying the present invention, the simultaneous broadcast to different regular destination terminals is not regarded as a DoS attack even if it is a large amount, and normal processing is performed. On the other hand, mass transmission of signals to the same destination terminal or mass transmission of signals to an illegal destination terminal is determined as a DoS attack. This makes it possible to detect a DoS attack that is consistent with the service specification.

1 is an overall configuration diagram of a system to which an embodiment of the present invention is applied. The figure which shows an example of a signal classification table. The figure which shows the hardware structural example of each apparatus. The whole process flow figure of DoS attack detection processing. The DoS attack detection processing flowchart of pattern a. The DoS attack detection processing flowchart of pattern b. The DoS attack detection processing flowchart of pattern c.

Explanation of symbols

1: terminal, 2: service control server, 21: processing unit, 22: various counters, 23: storage unit, 24: non-target device list, 25: signal type table, 26: terminal registration list, 3: attached server, 9: Network

Claims (11)

A DoS attack detection method performed by an information processing apparatus,
The information processing apparatus includes:
A first measuring step for counting the number of signals received within a first monitoring period;
A first determination step of determining whether the counted number of signals exceeds a first threshold;
A second measurement step of counting the number of signals of a predetermined processing content from among signals received within a second monitoring period when the number of counted signals exceeds the first threshold;
A second determination step of determining whether the counted number of signals of the predetermined processing content exceeds a second threshold;
A DoS attack detection method comprising: performing a DoS attack discrimination step of discriminating a DoS attack when the counted number of signals of the predetermined processing content exceeds the second threshold value. A DoS attack detection method performed by an information processing apparatus,
The information processing apparatus includes:
A first measurement step for counting the number of processing contents included in each of the signals received within the first monitoring period;
A first determination step of determining whether or not the counted number of processing contents exceeds a first threshold;
A second measurement step of counting a plurality of overlaps for each processing content when the number of processing content counted exceeds the first threshold;
A second determination step of determining whether any of a plurality of overlapping values for each processing content counted in the second measurement step exceeds a second threshold;
A DoS attack detection method, comprising: performing a DoS attack determination step of determining a DoS attack when the overlap of any one of the processing contents exceeds the second threshold. A DoS attack detection method performed by an information processing apparatus,
The information processing apparatus includes:
For each of a plurality of processing contents included in each signal received within a predetermined monitoring period, an error determination step for determining whether or not the processing contents are errors;
A measurement step for counting the number of processing contents determined to be errors in the error determination step;
A threshold determination step for determining whether or not the number of error processing contents counted exceeds a predetermined threshold;
A DoS attack detection method comprising: performing a DoS attack determination step of determining a DoS attack when the number of error processing contents exceeds the threshold. A DoS attack detection method according to claim 1, claim 2 or claim 3, wherein
The signal includes signal type information indicating the type of signal,
The information processing apparatus includes:
A signal type storage unit storing a DoS attack detection method for each signal type information;
A DoS attack detection method, further comprising a selection step of selecting a DoS attack detection method corresponding to the signal type with reference to the signal type storage unit. A DoS attack detection method according to claim 1, claim 2 or claim 3, wherein
The DoS attack detection method, wherein the processing content includes destination information for identifying the processing content. A DoS attack detection system,
First measuring means for counting the number of signals received within the first monitoring period;
First discriminating means for discriminating whether or not the counted number of signals exceeds a first threshold;
A second measuring unit that counts the number of signals having a predetermined processing content from among signals received within a second monitoring period when the number of counted signals exceeds the first threshold;
Second determination means for determining whether the counted number of signals of the predetermined processing content exceeds a second threshold;
A DoS attack detection system, comprising: a DoS attack discrimination unit that discriminates a DoS attack when the counted number of signals of the predetermined processing content exceeds the second threshold value. A DoS attack detection system,
First measuring means for counting the number of processing contents included in each of the signals received within the first monitoring period;
First discriminating means for discriminating whether or not the counted number of processing contents exceeds a first threshold;
A second measuring unit that counts a plurality of overlaps for each processing content when the number of processing content counted exceeds the first threshold;
Second determination means for determining whether any of a plurality of overlapping values for each processing content counted by the second measurement means exceeds a second threshold;
A DoS attack detection system, comprising: a DoS attack discrimination unit that discriminates a DoS attack when the overlap of any one of the processing contents exceeds the second threshold value. A DoS attack detection system,
For each of a plurality of processing contents included in each signal received within a predetermined monitoring period, error determination means for determining whether or not the processing contents are errors;
Measuring means for counting the number of processing contents determined by the error determination means as an error;
Threshold determination means for determining whether or not the number of error processing contents counted exceeds a predetermined threshold;
A DoS attack detection system, comprising: a DoS attack determination unit that determines a DoS attack when the number of error processing contents exceeds the threshold. A DoS attack detection program executed by an information processing apparatus,
In the information processing apparatus,
A first measuring step for counting the number of signals received within a first monitoring period;
A first determination step of determining whether the counted number of signals exceeds a first threshold;
A second measurement step of counting the number of signals having a predetermined processing content from signals received within a second monitoring period when the number of counted signals exceeds the first threshold;
A second determination step of determining whether the counted number of signals of the predetermined processing content exceeds a second threshold;
A DoS attack detection program for executing a DoS attack determination step of determining a DoS attack when the counted number of signals of the predetermined processing content exceeds the second threshold value. A DoS attack detection program executed by an information processing apparatus,
In the information processing apparatus,
A first measurement step for counting the number of processing contents included in each of the signals received within the first monitoring period;
A first determination step of determining whether or not the counted number of processing contents exceeds a first threshold;
A second measurement step of counting the number of duplicates for each processing content when the number of processing content counted exceeds the first threshold;
A second determination step of determining whether any of a plurality of overlapping values for each processing content counted in the second measurement step exceeds a second threshold;
A DoS attack detection program for executing a DoS attack determination step of determining a DoS attack when the overlap of any one of the processing contents exceeds the second threshold. A DoS attack detection program executed by an information processing apparatus,
In the information processing apparatus,
For each of a plurality of processing contents included in each signal received within a predetermined monitoring period, an error determination step for determining whether or not the processing contents are errors;
A measurement step for counting the number of processing contents determined to be errors in the error determination step;
A threshold determination step for determining whether or not the number of error processing contents counted exceeds a predetermined threshold;
A DoS attack detection program for executing a DoS attack determination step of determining a DoS attack when the number of error processing contents exceeds the threshold.

Images