JP2007049352A - Intrusion detector - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an intrusion detector capable of automatically determining a necessary signature only by itself and a management apparatus automatically detecting a change of the intrusion detector to another network even when the management apparatus does not know the constitution of networks. <P>SOLUTION: A signature optimizing part requests the transmission of an inspection packet to an inspection packet processing part for transmitting the inspection packet to a protection server specified from a signature sent from the management apparatus, the inspection packet processing part confirms whether another intrusion detector exists on a route or not from the inspection packet returned from the server, and when the other intrusion detector exists, attaches an identifier expressing the existence of the other intrusion detector to the inspection packet. The signature optimizing part invalidates the signature when the other intrusion detector exists, but when the other intrusion detector does not exist, validates and optimizes the signature and registers the optimized signature in an optimized signature DB part. A detection engine part inspects illegal intrusion about a packet received from a packet transmitting/receiving part by the signature registered in the optimized signature DB part and transmits the packet from the packet transmitting/receiving part when the signature is OK, but when the packet is NG, rejects the packet. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an intrusion detection apparatus that detects an intrusion for unauthorized access such as an intrusion into a computer network in a network management system and discards an unauthorized intrusion packet.

  In a conventional network intrusion detection system, an intrusion detection device does not inspect packets using all signatures, but only inspects necessary signatures based on network configuration information passed from the management device. (For example, Patent Document 1).

Japanese Patent Laid-Open No. 2003-92603

The conventional network intrusion detection system has a problem that the management device needs to grasp the configuration information of the network including the intrusion detection device in advance. Further, when the intrusion detection apparatus is connected to another network, there is a problem that the management apparatus needs to change the network configuration information and notify the intrusion detection apparatus.
The present invention has been made to solve the above-described problems, and the management device can automatically determine a necessary signature using only the intrusion detection device without knowing the network configuration, and can further detect the intrusion detection device. The purpose is to automatically detect that the network has changed to another network.

Intrusion detection device according to the present invention,
A packet transceiver for transmitting and receiving packets from the network,
Signature DB part that receives and stores signatures from management devices connected to the network,
A signature optimization unit that identifies a server to be protected connected to the network from the signature of the signature DB unit, and outputs a request to send a test packet to the server,
An inspection packet processing unit that receives a transmission request signal from the signature optimization unit and sends an inspection packet to a designated server through the packet transmission / reception unit;
The inspection packet processing unit checks whether there is another intrusion detection device on the route from the inspection packet returned from the server, and if there is another intrusion detection device, that there is another intrusion detection device in the inspection packet. With an identifier indicating
If another intrusion detection device is in the middle of the server, the signature optimization unit invalidates the corresponding signature, and if not, activates and optimizes the signature.
An optimized signature DB section for registering the optimized signature;
Receives the packet received from the packet transceiver unit, conducts an intrusion inspection of the packet using the signature registered in the optimization signature DB unit, and if the inspection is OK, transmits the packet from the packet transceiver unit, When the inspection is NG, a detection engine unit for discarding the packet is further provided.

  In the intrusion detection device according to the present invention, by checking whether there is any other intrusion detection device on the path between the intrusion detection device and the server to be protected by the inspection packet, the signature of only the intrusion detection device, not the management device. Optimization can be realized and management costs can be reduced. In addition, since the signature engine is not subjected to redundant signature inspection in the detection engine unit, the processing load of the intrusion detection device can be reduced. Further, the processing load of the intrusion detection device is reduced, so that the delay of the packet is reduced, and the operability when the user performs processing for sending the packet from the terminal to the server is improved.

  Furthermore, since redundant searches are not performed, even if the intrusion detection device has a test result of NG, the alert (warning) information sent to the management device is reduced, reducing the load on the network, and the administrator is important. It is possible to reduce the burden on the administrator because it is easy to find the alert.

Embodiment 1 FIG.
First, the configuration of a network to which the intrusion detection apparatus of the present invention is applied will be described with reference to FIG.
In FIG. 2, a management device 203, an intrusion detection device A 201, and an intrusion detection device B 202 are connected through a router 207. Similarly, the server B 205 is connected to the management device 203, the intrusion detection device A 201, and the intrusion detection device B 202 by the router 207. A server A 204 is connected to the intrusion detection device B 202, and a terminal 206 is connected to the tip of the intrusion detection device A 201 through a router 208.

Next, the configuration of the intrusion detection device (intrusion detection device A201 and intrusion detection device B202) of the present invention will be described based on the configuration diagram of FIG.
In FIG. 1, a packet transmission / reception unit A101 and a packet transmission / reception unit B102 transmit and receive packets from the outside, and processing determined by each unit such as the management communication unit 103, the inspection packet processing unit 105, and the detection engine unit 107 according to the destination and type of the packet And send the packet to the outside. The management communication unit 103 receives the signature 301 shown in FIG. 3 sent from the management device 203 through the packet transmission / reception unit A 101 or the packet transmission / reception unit B 102, and stores the signature 301 in the signature DB unit 104. The signature DB unit 104 stores the signature 301 sent from the management device 203.

  The inspection packet processing unit 105 sends the inspection packets from the packet transmission / reception unit A101 and the packet transmission / reception unit B102 to the designated server, and determines whether there is another intrusion detection device on the route from the contents of the inspection packet that has returned. To do. The signature optimizing unit 106 identifies a server to be protected from the signature DB unit 104, requests the inspection packet processing unit 105 to transmit an inspection packet to the server, and another intrusion detection apparatus exists between the servers. If the corresponding signature is invalidated and there is no other intrusion detection device in the middle, the signature that is validated and optimized is registered in the optimized signature DB unit 108. The detection engine unit 107 receives a packet received from the packet transmission / reception unit A101 or the packet transmission / reception unit B102, inspects the packet using the signature stored in the optimization signature DB unit 108, and when the inspection is OK Transmits the packet to the packet transmitting / receiving unit A101 or the packet transmitting / receiving unit B102 which is not the receiving side, and discards the packet when the inspection result is NG. The optimized signature DB unit 108 stores an optimized signature that is referenced by the detection engine 107.

Next, the operation will be described.
The signature 301 shown in FIG. 3 is periodically distributed and distributed from the management device 203 to the intrusion detection device A201 and the intrusion detection device B202.
Intrusion detection device A 201 stores signature 301 from management device 203 in signature DB 104 through packet transmission / reception unit B 102 and management communication unit 103. Similarly, the intrusion detection apparatus B 202 stores the signature 301 from the management apparatus 203 in the signature DB 104 from the packet transmission / reception unit A 101 through the management communication unit 103.

  Next, each intrusion detection device transmits an inspection packet to investigate adjacent intrusion detection devices. In the intrusion detection device A201, the signature optimizing unit 106 refers to the signature 301 of the signature DB unit 104, and identifies the server A204 and the server B205 to be protected. The signature optimization unit 106 requests the inspection packet processing unit 105 to transmit the inspection packet to the server A 204. The inspection packet processing unit 105 transmits an ICMP (Internet Control Message Protocol) echo request packet to the server A 204 through the packet transmission / reception unit B102. As indicated by 401 in FIG. 4, at this time, an identifier unique to the inspection packet is added to the head of the data portion of the ICMP echo request packet, and an identifier unique to each intrusion detection device is added to the tail.

  The ICMP echo request packet passes through the router 207 and enters the packet transmission / reception unit A101 of the intrusion detection apparatus B202. The packet transmitting / receiving unit A101 refers to the head of the data part of the ICMP echo request packet, confirms that the packet is a test packet from the identifier unique to the test packet, and sends the packet to the test packet processing unit 105. The inspection packet processing unit 105 adds a unique identifier of the intrusion detection device B202 to the end of the data portion of the ICMP echo request packet as shown by 402 in FIG. 4 and sends the packet to the packet transmission / reception unit B102.

  The ICMP echo request packet in which the unique identifier of the intrusion detection device B202 is added to the end of the data part in the intrusion detection device B202 is transmitted from the packet transmitting / receiving unit B102 of the intrusion detection device B202 and received by the server A204. The ICMP echo request packet received by the server A204 is transmitted from the server A204 this time with an ICMP echo reply packet addressed to the intrusion detection apparatus A201 having the same data portion as the received packet. In the intrusion detection device B202, the ICMP echo reply packet is received by the packet transmission / reception unit B102, and the packet identifier is recognized as the inspection packet by the identifier at the head of the data portion, but the destination is not addressed to the intrusion detection device B202. A packet is transmitted through A101.

  The ICMP echo reply packet transmitted from the intrusion detection device B202 is sent to the intrusion detection device A201 through the router 207. The packet transmission / reception unit B102 of the intrusion detection apparatus A201 recognizes that it is an inspection packet transmitted by itself from the identifier at the head of the data portion and the destination, and sends an ICMP echo reply packet to the inspection packet processing unit 105. The inspection packet processing unit 105 recognizes that there is an intrusion detection device B202 between the routes of its own intrusion detection device A201 and the server A204 by the last identifier of the ICMP echo reply packet, and routes it to the signature optimization unit 106. Returns the inspection result with another intrusion detection device above. The signature optimization unit 106 invalidates the signature addressed to the server A 204 of the signature DB unit 104 and does not register it in the optimization signature DB 108 because there is another intrusion detection device on the path between its own intrusion detection device A 201 and server A 204.

  The signature optimization unit 106 finds the next server B 205 to be protected from the signature DB unit 104, and checks whether there is another intrusion detection device in the middle of the path between the own intrusion detection device A 201 and the server B 205. In the same manner as described above, the inspection packet processing unit 105 is requested to transmit the inspection packet to the server B 205.

The inspection packet processing unit 105 sends an ICMP echo request packet having an identifier unique to the inspection packet at the beginning of the data portion and an identifier unique to the intrusion detection device A201 to the server B205 through the packet transmitting / receiving unit B102, as described above. send.
The ICMP echo request packet is received by the server B 205 through the router 207, and an ICMP echo reply packet addressed to the intrusion detection device A 201 having the same data portion as the received packet is transmitted from the server B 205.

The ICMP echo reply packet is sent to the intrusion detection apparatus A201 through the router 207. The ICMP echo reply packet received by the packet transmission / reception unit B102 of the intrusion detection apparatus A201 is recognized as an inspection packet transmitted from the head identifier of the data part and the destination, and the inspection packet processing unit 105 transmits the ICMP echo reply packet. send. The inspection packet processing unit 105 recognizes that there is no other intrusion detection device between the route to the server B 205 from the last identifier of the ICMP echo reply packet, and the signature optimization unit 106 detects another intrusion on the route. Returns the inspection result without equipment. The signature optimization unit 106 registers the signature addressed to the server B 205 of the signature DB unit 104 in the optimization signature DB unit 108 because there is no other intrusion detection device on the path to the server B 205.
In this way, the intrusion detection apparatus A101 registers only the signature addressed to the server B205 in the optimized signature DB unit 108.

Similarly, intrusion detection apparatus B202 also sends inspection packets to server A204 and server B205 to check whether there is any other intrusion detection apparatus on the route, and confirms that both are not present. The signatures addressed to server A 204 and server B 205 are registered.
When a packet is transmitted from the terminal 206 to the server A 204, the packet is transmitted to the intrusion detection device A 201 through the router 208. The packet transmission / reception unit A101 of the intrusion detection apparatus A201 receives the packet, confirms that it is not an inspection packet, and sends it to the detection engine unit 107. The detection engine unit 107 refers to the optimized signature DB unit 108, and since there is no signature addressed to the server A 204 that matches the condition, the packet is directly transmitted from the packet transmitting / receiving unit B102.

  The packet transmitted from the intrusion detection device A201 is sent to the intrusion detection device B202 through the router 207. The packet transmission / reception unit A101 of the intrusion detection device B202 confirms that the received packet is not an inspection packet, and sends the packet to the detection engine unit 107. This time, since the signature for the server A 204 that matches the conditions is registered in the optimization signature DB unit 108, the packet is inspected by using the signature (confirmation of whether the packet is illegally intruded or not). )I do. If the inspection result is OK, the packet is sent to the server A 204 through the packet transmitting / receiving unit B102. If the inspection result is NG, the packet is discarded.

As described above, according to the present invention, by checking whether there is any other intrusion detection device on the path on the server to be protected with the intrusion detection device by using the inspection packet, the signature of only the intrusion detection device, not the management device. Optimization can be realized and management costs can be reduced.
In addition, since the signature engine is not subjected to redundant signature inspection in the detection engine unit, the processing load of the intrusion detection device can be reduced. Further, the processing load of the intrusion detection device is reduced, so that the delay of the packet is reduced, and the operability when the user performs the process of sending the packet from the terminal to the server is improved.

  Since redundant searches are not performed, even if the inspection result is NG on the intrusion detection device, the alert (warning) information sent to the management device will be reduced, reducing the load on the network, and the administrator will receive an important alert. Because it becomes easier to find, the burden on the administrator can be reduced.

Embodiment 2. FIG.
In the first embodiment, the inspection packet is periodically sent to optimize the signature. Next, when the arrangement of the intrusion detection device is changed in the connection to the network, An embodiment will be described in which an inspection packet is transmitted immediately after it is detected.
In this embodiment, the configurations of the intrusion detection apparatuses 201 and 202 and the network configuration are the same as the configuration diagram of the first embodiment shown in FIG. 1 and the network configuration diagram of the first embodiment shown in FIG. The packet transmission / reception units 101 and 102 detect network link information by connecting / disconnecting network cables, and when the link is disconnected and the link is up again, the network connection to the signature optimization unit 106 is made through the inspection packet processing unit 105. Notify that has changed. In response to this notification, the signature optimization unit 106 is additionally provided with processing for requesting the inspection packet processing unit 105 to transmit the inspection packet again.

Next, the operation will be described.
The parts of the intrusion detection device A201 and the intrusion detection device B202 that perform signature optimization are the same as those in the first embodiment. Next, the case where the connection of the intrusion detection apparatus A101 to the network is changed from the network configuration of FIG. 2 to the network configuration of FIG.
The network transmission / reception unit A101 of the intrusion detection apparatus A101 detects the connection / disconnection of the cable connected to the network, and notifies the signature optimization unit 106 through the inspection packet processing unit 105 that the network connection has been changed. In response to this notification, the signature optimization unit 106 requests the inspection packet processing unit 105 to transmit an inspection packet. Thereafter, signature optimization is performed in the same manner as in the first embodiment.

  As described above, by quickly recognizing a change in the network configuration only by an intrusion detection device and performing signature optimization, there is less possibility that a packet to be inspected will not be inspected due to a delay in signature optimization. And safety is improved.

Embodiment 3 FIG.
In the first and second embodiments described above, the inspection packet is sent from the intrusion detection device and the signature is optimized. However, the optimization is not performed on the packet that has been inspected. An embodiment in which redundant packets are not inspected by attaching an identifier will be described below.

FIG. 6 is a block diagram showing the intrusion detection device of this embodiment.
In FIG. 6, a packet transmission / reception unit A601 and a packet transmission / reception unit B602 transmit / receive a packet from the outside, perform processing determined by the management communication unit 603 and the packet-inspected check unit 605 according to the destination and type of the packet, and send the packet to the outside Send. The management communication unit 603 receives the signature transmitted from the management device 203 through the packet transmission / reception unit A601 or the packet transmission / reception unit B602, and stores the signature in the signature DB unit 604. The signature DB unit 604 stores a signature sent from the management device 203 and received via the management communication unit 603. The packet inspection completed check unit 605 analyzes the contents of the packet delivered from the packet transmission / reception unit A601 or the packet transmission / reception unit B602, and if the packet has already been inspected, the packet transmission / reception opposite to the delivered side is performed. If the packet is not yet inspected, the inspection engine unit 606 requests inspection. The detection engine unit 606 extracts from the signature DB unit 604 a signature whose condition matches that of the packet passed from the packet inspection completed check unit 605, performs packet inspection, and if the inspection is OK, it is not the receiving side. The packet is transmitted to the packet transmission / reception unit A601 or the packet transmission / reception unit B602. If the inspection result is NG, the packet is discarded.

  FIG. 2 is a block diagram showing the network of this embodiment, which is the same as that of the first embodiment, but is different from the first embodiment shown in FIG. 1 in the internal configuration of the intrusion detection device A201 and the intrusion detection device B202. 6 is configured.

Next, the operation will be described.
The signature 301 shown in FIG. 3 is distributed from the management device 203 to the intrusion detection device A201 and the intrusion detection device B202. Intrusion detection apparatus A 201 stores signature 301 in signature DB section 604 from packet transmission / reception section B 602 through management communication section 603. Similarly, the intrusion detection apparatus B202 stores the signature 301 in the signature DB unit 604 from the packet transmitting / receiving unit A601 through the management communication unit 603.

  Assume that the terminal 206 accesses the server A 204. A packet from the terminal 206 enters the intrusion detection device A 201 through the router 208. A packet is received from the packet transmitting / receiving unit A601 of the intrusion detection device A201. Since this packet is not a signature distribution packet from the management apparatus 203, it is sent to the packet inspection completed check unit 605. The packet inspected check unit 605 checks the contents of the packet header to check whether the inspected check has been performed. For example, whether a specific VLAN (Virtual Local Area Network) tag is set, a specific value is set in a TOS (Type of Service) field, or a specific IP (Internet Protocol) encapsulation is performed Investigate. In this case, since the packet inspection has not been checked, a packet is sent to the detection engine unit 606 to request an inspection as to whether or not it is an unauthorized intrusion. The detection engine unit 606 takes out a packet with matching conditions from the signature DB unit 604 and performs an unauthorized intrusion inspection of the packet. If the packet check result is OK, the packet is transmitted from the packet transmitting / receiving unit B602 opposite to the receiving side.

  Next, the packet is sent to the intrusion detection device B 202 through the router 207. Intrusion detection apparatus B202 receives a packet from packet transmitting / receiving unit A601. Since this packet is not a signature distribution packet from the management apparatus 203, it is sent to the packet inspection completed check unit 605. The packet inspected check unit 605 checks the contents of the packet header to check whether the inspected check has been performed. In this case, since the packet inspected check is performed by the intrusion detection apparatus A201, the result is that the packet has been checked by the packet inspected check unit 605, and there is no need to inspect the packet. The packet is transmitted through the reverse packet transmitting / receiving unit B602. The server A 204 receives the packet, and if necessary, removes the checked packet from the network driver and sends it to the application.

As described above, by putting a check on a packet inspected by an intrusion detection device, redundant packet inspection is eliminated without a management device, resulting in a low management cost. Furthermore, the elimination of redundant packet inspection reduces the processing load on the intrusion detection device and reduces packet delay.
In addition, since only the packets that have been inspected by the network driver of the server are received, it is possible to prevent uninspected packets from being processed by the server, and security is improved.
Even if the network configuration changes, it is not necessary to optimize the signature, so that the cost of signature management of the intrusion detection device can be reduced.

  The present invention is applied to an intrusion detection apparatus that detects an intrusion for unauthorized access such as an intrusion into a computer network in a network management system, can reduce the processing load of the intrusion detection apparatus, and can improve user operability. It is possible to reduce the management cost and the burden on the administrator.

It is a block diagram of the intrusion detection apparatus in Embodiment 1 of this invention. 1 is a configuration diagram of a network to which an intrusion detection device according to the present invention is applied. FIG. 4 is an explanatory diagram of a signature in Embodiment 1. FIG. It is explanatory drawing of an ICMP echo request packet. It is a block diagram after the connection change to the network of an intrusion detection apparatus. It is a block diagram which shows the intrusion detection apparatus of this Embodiment 3.

Explanation of symbols

  101, 601; Packet transmission / reception unit A, 102, 602; Packet transmission / reception unit B, 103, 603; Management communication unit, 104, 604; Signature DB unit, 105; Inspection packet processing unit, 106; Signature optimization unit, 107, 606; Detection engine unit 108; Optimization signature DB unit 201; Intrusion detection device A 202; Intrusion detection device B 203; Management device 204 204 Server A 205 205 Server B 206 206 Terminal 207 Router 208; Router 301; Signature 605; Checked packet check unit.

Claims (3)

A packet transceiver for transmitting and receiving packets from the network,
Signature DB part that receives and stores signatures from management devices connected to the network,
A signature optimization unit that identifies a server to be protected connected to the network from the signature of the signature DB unit, and outputs a request to send a test packet to the server,
An inspection packet processing unit that receives a transmission request signal from the signature optimization unit and sends an inspection packet to a designated server through the packet transmission / reception unit;
The inspection packet processing unit checks whether there is another intrusion detection device on the route from the inspection packet returned from the server, and if there is another intrusion detection device, there is another intrusion detection device in the inspection packet. With an identifier indicating
If another intrusion detection device is in the middle of the server, the signature optimization unit invalidates the corresponding signature, and if not, activates and optimizes the signature.
An optimized signature DB section for registering the optimized signature;
Receives a packet received from the packet transceiver unit, performs an intrusion inspection of the packet using the signature registered in the optimization signature DB unit, and if the inspection is OK, transmits the packet from the packet transceiver unit, An intrusion detection device further comprising a detection engine unit that discards the packet when the inspection is NG. In the packet transmission / reception unit, when the link information of the network is detected by connecting / disconnecting the network cable and the link is disconnected and the link is connected again, the signature optimization unit is notified of the connection change,
The intrusion detection apparatus according to claim 1, wherein the signature optimization unit requests the inspection packet processing unit to transmit the inspection packet again by the notification. A packet transceiver for transmitting and receiving packets from the network,
Signature DB part that receives and stores signatures from management devices connected to the network,
Check whether or not a packet other than for managing its own device received from the packet transmitting / receiving unit has an inspected check. Provided with a packet inspection check part to be sent to the detection engine part,
The detection engine unit performs an intrusion inspection of the packet sent from the packet inspection check unit using the signature registered in the signature DB unit, and if the inspection is OK, transmits the packet from the packet transmission / reception unit. Intrusion detection device configured to discard packets if inspection is NG.

Images