JP2007142664A - Firewall device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily set a device for reduced wasteful traffic. <P>SOLUTION: A firewall device comprises a first communication means for communicating with a network; a second communication means for communicating with equipment to be attacked, a memory means; and a calculation control means which acquires an originator IP address of the packet that has been received by the first communication means and determined to be of unnatural access, to shut off the transfer of the packet from that IP address to the equipment for a specified period, while the packets are classified and information is recorded in the memory means. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a firewall device that protects a network device connected to a network from a DDos attack (hereinafter simply referred to as “DDos”) and the like, and in particular, it is easy to set up the device and reduce wasteful traffic. It relates to possible firewall devices.

  Prior art documents related to a firewall device that protects network devices connected to a conventional network from a DDos attack include the following.

JP 2003-273936 A JP 2004-054488 A JP 2005-215935 A

  Also, as a DDos attack to a server such as a Web server, it is abused that the server side waits for a response until the last ACK (ACKnowledgement) packet is received in the procedure for establishing a connection by TCP (Transmission Control Protocol) There are SYN flood attacks, attacks that repeatedly reload, attacks that continue to send data to the upload form using the POST method, and the like.

  FIG. 4 is a configuration block diagram showing an example of a network system in which a firewall device that prevents such an attack is installed. In FIG. 4, 1 is an intrusion detection system (IDS: Intrusion Detection System) that detects unauthorized access on the network, 2 is a firewall device that restricts communication, 3 is a server such as a Web server to be attacked, and 100 is the Internet. A general-purpose network 101, etc., is a network installed in a DMZ (DeMilitarized Zone) located between an external network and an internal network.

  The intrusion detection device 1 is connected to the network 100 and the output of the intrusion detection device 1 is connected to the firewall device 2. One communication input / output terminal of the firewall apparatus 2 is mutually connected to the network 100, and the other communication input / output terminal of the firewall apparatus 2 is mutually connected to the network 101. The servers 3 are connected to the network 101.

  Here, the operation of the conventional example shown in FIG. 4 will be described. The conventional example shown in FIG. 4 has a configuration in which the intrusion detection device 1 and the firewall device 2 cooperate.

  The intrusion detection device 1 monitors the presence or absence of an attack packet transmitted on the network 100 and transmitted to the server 3. If the intrusion detection device 1 detects an attack packet, the IP (Internet Protocol) of the attack packet source is detected. ) Notify the firewall device 2 of the address.

  In this way, the firewall device 2 that has received the notification of the IP address of the attack packet transmission source from the intrusion detection device 1 blocks the transfer of the packet having the IP address to the server 3, and the packet is transmitted to the network 101. Control is performed so as not to propagate to the connected server 3.

  As a result, the intrusion detection device 1 monitors the attack packet, and when an attack packet is detected, the forwarding of the packet having the same IP address as the attack packet detected by the firewall device 2 to the server 3 is blocked. This makes it possible to defend against attack packets against the server 3.

  FIG. 5 is a configuration block diagram showing another example of the network system in which the firewall device is installed. In FIG. 5, 4 is a firewall device that restricts communication, 5 is a reverse proxy server that relays communication to a specific server as a proxy for the specific server, 6 is a server such as a Web server to be attacked, and 100a is a general-purpose device such as the Internet. The network 101a is a network installed in the DMZ located between the external network and the internal network.

  One communication input / output end of the firewall device 4 is connected to the network 100a, and the other communication input / output end of the firewall device 4 is connected to the network 101a. The reverse proxy server 5 is connected to the network 101a, and the reverse proxy server 5 is connected to the server 6.

  Here, the operation of the conventional example shown in FIG. 5 will be described. In the conventional example shown in FIG. 5, the reverse proxy server 5 is configured to relay communication to the server 6 as a proxy for the server 6.

  Packets that propagate on the network 100a pass through the firewall device 4 and are temporarily stored in the reverse proxy server 5 via the network 101a. At this time, a connection is once established with a client (not shown).

  Then, the reverse proxy server 5 inspects the contents of the stored packets, transfers only normal packets to the server 6, and establishes a connection with the client (not shown).

  As a result, the reverse proxy server 5 temporarily accumulates transmitted packets, inspects the contents of the accumulated packets, and forwards only normal packets to the server 6 to prevent attack packets against the server 6. It becomes possible.

  However, the conventional example shown in FIG. 4 requires various setting operations such as setting what packet is detected as an attack packet by the intrusion detection apparatus 1 and setting the firmware for performing the operation when the attack packet is detected. However, since the setting work requires skill, there is a problem that the setting work is complicated.

  In addition, when an incorrect setting operation is performed, there is a problem that a normal packet is erroneously detected, an attack packet is not detected, and the like, and thus does not function normally.

  In the conventional example shown in FIG. 5, the reverse proxy server 5 temporarily accumulates transmitted packets, and therefore cannot operate when the capacity of the accumulated packets exceeds the storage capacity of the reverse proxy server 5. There was a problem that said.

In addition, since the connection is once established with the client (not shown) when the packet is temporarily stored, not only the normal packet but also the communication associated with the establishment of the connection (waste traffic) for the attack packet. There was a problem saying that there would be a charge.
Therefore, the problem to be solved by the present invention is to realize a firewall device that can be easily set up and can reduce useless traffic.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In the firewall device,
The first communication means that communicates with the network, the second communication means that communicates with the attack target device, the storage means, and the unnatural received by the first communication means An arithmetic control unit that acquires a source IP address of a packet determined to be accessed, blocks transfer of the packet from the IP address to the device for a certain period, classifies the packet, and records information in the storage unit; By providing the device, it is easy to set up the apparatus, and it is possible to reduce useless traffic.

The invention according to claim 2
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. In addition, by measuring the data amount of the packets to the WWW port and the packets classified as data packets, and recording the data amount in the storage means, it is easy to set up the device and reduce unnecessary traffic. become.

The invention described in claim 3
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. By recording the transmission source IP address of the packet classified as a packet to the WWW port in the storage unit, it is possible to easily set the apparatus and reduce useless traffic.

The invention according to claim 4
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. Then, by recording the response code of the packet from the WWW port and the packet classified as the HTTP reply packet in the storage means, it is possible to easily set the apparatus and reduce unnecessary traffic.

The invention according to claim 5
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. In addition, by determining the method of the packet to the WWW port and the packet classified as the HTTP reply packet and recording the method in the storage unit, it is possible to easily set the apparatus and reduce unnecessary traffic. Become.

The invention described in claim 6
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. By determining the version of the packet sent to the WWW port and the packet classified as the HTTP reply packet and recording the version in the storage unit, it is possible to easily set the apparatus and reduce unnecessary traffic. Become.

The invention described in claim 7
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. Then, the SUM value of the ASCII character of the URL targeted by the packet to the WWW port and the packet classified as the HTTP reply packet is calculated, and the SUM value is recorded in the storage unit, so that the setting of the device can be performed. Easy and useless traffic can be reduced.

The invention described in claim 8
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. The method determines the method and version of the packet to the WWW port and the packet classified as the HTTP reply packet, and the ASCII character of the URL targeted by the packet to the WWW port and the packet classified as the HTTP reply packet. SUM value of the method, the method, By applying a hash function to the version and the SUM value, a hash value is generated and recorded in the storage means in association with the corresponding transmission source IP address, so that it is easy to set up the apparatus and reduce unnecessary traffic. become.

The invention according to claim 9
In the firewall device according to claim 1,
The arithmetic control means is
Obtaining a transmission source IP address of a packet received by the first communication means and determined to be unnatural access, blocking transfer of the packet from the IP address to the server for a certain period, and determining that it is unnatural access The packet is classified into a packet to the WWW port, a packet from the WWW port, or any other packet, and a packet to the WWW port and a packet from the WWW port are classified into data packets or HTTP reply packets. And measuring the data amount of the packet to the WWW port and the packet classified as the data packet, recording the data amount in the storage means, and the source IP address of the packet classified as the packet to the WWW port Is stored in the storage means, the packet from the WWW port, and the HTTP reply A response code of the packet classified as a packet is recorded in the storage means, a method and a version of the packet classified as a packet to the WWW port and a packet classified as an HTTP reply packet are determined, a packet to the WWW port, and A packet classified as an HTTP reply packet calculates the SUM value of the ASCII character of the URL targeted, and generates a hash value by applying a hash function to the method, the version, and the SUM value, and the corresponding source IP By recording in the storage means in association with the address, it is easy to set up the apparatus and reduce unnecessary traffic.

The invention according to claim 10 provides:
In the firewall device according to any one of claims 1 to 9,
The arithmetic control means is
When the same URL is repeatedly accessed from a specific IP address using a method other than the POST method, it is possible to reduce the wasteful traffic by setting the device easily by determining that the access is unnatural.

The invention according to claim 11
In the firewall device according to any one of claims 1 to 9,
The arithmetic control means is
When a large amount of data is transmitted from the specific IP address to the same URL by the POST method, it is possible to reduce the wasteful traffic because it is easy to set the apparatus by determining that the access is unnatural.

The invention according to claim 12
In the firewall device according to any one of claims 1 to 9,
The arithmetic control means is
When a large number of accesses are made from a specific IP address to an appropriate URL, it is determined that the access is unnatural, so that the setting of the apparatus is easy and wasteful traffic can be reduced.

The present invention has the following effects.
According to the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, tenth, eleventh and twelfth aspects, the firewall device (specifically, the arithmetic control means) is unnatural. Obtain the source IP address of the packet determined to be accessed and filter (block) the transfer of the packet from the IP address to the server for a certain period of time, and classify the packet determined to be unnatural access as appropriate By recording information, it is easy to set up the apparatus and reduce unnecessary traffic.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration block diagram showing an embodiment of a network system in which a firewall apparatus according to the present invention is installed.

  In FIG. 1, 7 is a firewall device that restricts communication, 8 is a server such as a Web server that is an attack target device, and 100b is a general-purpose network such as the Internet. One communication input / output terminal of the firewall device 7 is connected to the network 100b, and the other communication input / output terminal of the firewall device 7 is connected to the server 8.

  FIG. 2 is a configuration block diagram showing a specific example of the firewall device 7. In FIG. 2, 9 is a communication means for communicating with the network 101b, 10 is an arithmetic control means for controlling the entire firewall device such as a CPU (Central Processing Unit), 11 is a RAM (Random Access Memory), a flash memory, a hard disk Reference numeral 12 denotes a communication means for performing communication with the server 8.

  In addition, 9, 10, 11 and 12 constitute a firewall device 50. Further, the storage unit 11 stores a program for controlling the firewall device 50 as a whole.

  The communication input / output terminals of the communication means 9 are mutually connected to a network 101b (not shown), and the input / output of the communication means 9 is mutually connected to the arithmetic control means 10. The communication input / output terminal of the communication unit 12 is connected to a communication unit (not shown) of the server 8, and the input / output of the communication unit 12 is connected to the arithmetic control unit 10. The storage means 11 is also connected to the arithmetic control means 10.

  The operation of the embodiment shown in FIGS. 1 and 2 will be described with reference to FIG. FIG. 3 is a flowchart for explaining the operation of the arithmetic control means 10 constituting the firewall device 50.

In “S001” in FIG. 3, the arithmetic control unit 10 monitors communication from the network 100b to the server 8 received by the communication unit 9, and determines whether or not there is an unnatural access to the server 8. For example, specifically, unnatural access assumes the following three patterns.
(1) The same URL (Uniform Resource Locator), URI (Uniform Resource Identifier), etc. (hereinafter simply referred to as URL) are repeatedly accessed from a specific IP address by a method other than the POST method.
(2) A large amount of data is transmitted from a specific IP address to the same URL by the POST method.
(3) Access a large number of URLs from a specific IP address.

  When it is determined that there is an unnatural access to the server 8 in “S001” in FIG. 3, the operation control means 10 transmits the source of the packet that is determined to be unnatural access in “S002” in FIG. The IP address is acquired, and the arithmetic control unit 10 filters (blocks) the transfer of packets from the IP address to the server 8 for a certain period.

  Then, in “S003” in FIG. 3, the arithmetic control unit 10 classifies the type of packet determined to be unnatural access. Specifically, the arithmetic control unit 10 determines that a packet determined to be unnatural access is “a packet to a WWW (World Wide Web) port”, “a packet from a WWW port”, or “other packet”. Classify into:

  Further, the arithmetic control unit 10 classifies the previously classified “packets to the WWW port” and “packets from the WWW port” into “data packets” or “HTTP (HyperText Transfer Protocol) reply packets”. .

  In “S004” in FIG. 3, the arithmetic control unit 10 measures the data amount of the packet classified as “packet to WWW port” and “data packet” and records the data amount in the storage unit 11.

  In “S005” in FIG. 3, the arithmetic control unit 10 records the transmission source IP address of the packet classified as “packet to WWW port” in the storage unit 11, “packet from WWW port” and “HTTP reply packet”. The response code of the packet classified as “” is recorded in the storage means 11.

  In “S006” in FIG. The method and version of the packet classified as “packet to WWW port” and “HTTP reply packet” are determined.

  For example, the arithmetic control unit 10 determines that a packet classified as “packet to WWW port” and “HTTP reply packet” is “POST method”, “GET method”, “HEAD method”, or “other method”. Determine if there is any.

  In addition, for example, the arithmetic control unit 10 determines that packets classified as “packet to WWW port” and “HTTP reply packet” are “HTTP 0.9”, “HTTP 1.0”, “HTTP 1.1”, or “ It is determined whether it is “other version”.

  In “S007” in FIG. 3, the arithmetic control means 10 calculates the SUM value of the ASCII character string of the URL targeted by the packet classified as “packet to WWW port” and “HTTP reply packet”.

  Finally, in “S008” in FIG. 3, the arithmetic control means 10 applies a hash function to the determined method, version, and SUM value of the packets classified as “packet to WWW port” and “HTTP reply packet”. A hash value is generated and recorded in the storage unit 11 in association with the corresponding transmission source IP address.

  Here, the hash function is a function that generates a fixed-length pseudo-random number (hash value) from the original text, and since this hash function includes an irreversible one-way function, the original text is generated from the generated hash value. It cannot be reproduced. Also, it is extremely difficult to create different data with the same hash value.

  As described above, by recording a plurality of pieces of information such as the method, version, and SUM value as hash values, the storage capacity of the storage unit 11 can be saved. Further, if the hash value generated from a plurality of pieces of information such as the method, version, and SUM value of the newly acquired packet matches the hash value stored in the storage means 11, it can be determined that they are the same packet. it can.

  That is, the firewall device 50 (specifically, the arithmetic control unit 10) acquires the transmission source IP address of the packet determined to be unnatural access and transfers the packet from the IP address to the server 8 for a certain period. Are filtered (blocked), and packets classified as unnatural access are appropriately classified and information is recorded.

  Information stored in this manner can be uploaded and provided to an information collection server or the like of an ISP (Internet Service Provider) as needed, and can be used for dealing with attack packets.

  Also, since no reverse proxy server is used, there is no need to once establish a connection with the client when packets are temporarily stored, and wasteful traffic can be reduced.

  As a result, the firewall device 50 (specifically, the arithmetic control unit 10) acquires the transmission source IP address of the packet determined to be unnatural access, and sends the packet from the IP address to the server 8 for a certain period. By filtering (blocking) forwarding and appropriately classifying packets determined to be unnatural access and recording information, it is easy to set up the apparatus and reduce unnecessary traffic.

  In the description of the embodiment shown in FIG. 1, it is described that a hash value is generated by applying a hash function to the determined method, version, and SUM value of the classified packet. A hash value may be generated by applying a hash function to each SUM value.

  Further, if the storage capacity of the storage unit 11 is sufficient, the information may be recorded as it is without being converted into a hash value.

  In the description of the embodiment shown in FIG. 1, information stored in the storage unit 11 is exemplified by a data amount, a transmission source IP address, a response code, and a hash value (specifically, a method, a version, and a SUM value). However, it is of course not limited to this, and at least one of the data amount, the transmission source IP address, the response code, or the hash value may be recorded in the storage unit 11.

1 is a configuration block diagram showing an embodiment of a network system in which a firewall device according to the present invention is installed. It is a block diagram showing a specific example of a firewall device. It is a flowchart explaining operation | movement of the calculation control means which comprises a firewall apparatus. 1 is a configuration block diagram illustrating an example of a network system in which a firewall device is installed. It is a configuration block diagram showing another example of a network system in which a firewall device is installed.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Intrusion detection apparatus 2, 4, 7, 50 Firewall apparatus 3, 6, 8 Server 5 Reverse proxy server 9,12 Communication means 10 Arithmetic control means 11 Storage means 100,100a, 100b, 101,101a Network

Claims (12)

In the firewall device,
A first communication means for communicating with a network;
A second communication means for communicating with an attack target device;
Storage means;
Obtain a source IP address of a packet received by the first communication means and determined to be unnatural access, and block transfer of the packet from the IP address to the device for a certain period and classify the packet A firewall apparatus, comprising: an arithmetic control unit that records information in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The firewall apparatus according to claim 1, wherein the amount of data of a packet to a WWW port and a packet classified as a data packet is measured and the amount of data is recorded in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The firewall apparatus according to claim 1, wherein a source IP address of a packet classified as a packet to a WWW port is recorded in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The firewall apparatus according to claim 1, wherein a response code of a packet classified as an HTTP reply packet and a packet from a WWW port is recorded in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The firewall apparatus according to claim 1, wherein a method of a packet to a WWW port and a packet classified as an HTTP reply packet is determined and the method is recorded in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The firewall apparatus according to claim 1, wherein a version of a packet to a WWW port and a packet classified as an HTTP reply packet is determined, and the version is recorded in the storage unit. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
2. The SUM value of an ASCII character of a URL targeted by a packet to a WWW port and a packet classified as an HTTP reply packet is calculated, and the SUM value is recorded in the storage means. Firewall equipment. The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
Determine the method and version of the packet to the WWW port and the packet classified as an HTTP reply packet,
The SUM value of the ASCII character of the URL targeted by the packet to the WWW port and the packet classified as the HTTP reply packet is calculated,
The firewall apparatus according to claim 1, wherein a hash value is generated by applying a hash function to the method, the version, and the SUM value, and is recorded in the storage unit in association with a corresponding source IP address. . The arithmetic control means is
Acquiring a source IP address of a packet received by the first communication means and determined to be unnatural access, and blocking transfer of the packet from the IP address to the server for a certain period;
Classifying the packet determined to be unnatural access into a packet to the WWW port, a packet from the WWW port, or any other packet;
Classify packets to the WWW port and packets from the WWW port into data packets or HTTP reply packets,
Measuring the data amount of the packet to the WWW port and the packet classified as the data packet and recording the data amount in the storage means;
Record the source IP address of the packet classified as a packet to the WWW port in the storage means,
Record the response code of the packet from the WWW port and the packet classified as the HTTP reply packet in the storage means,
Determine the method and version of the packet to the WWW port and the packet classified as an HTTP reply packet,
The SUM value of the ASCII character of the URL targeted by the packet to the WWW port and the packet classified as the HTTP reply packet is calculated,
The firewall apparatus according to claim 1, wherein a hash value is generated by applying a hash function to the method, the version, and the SUM value, and is recorded in the storage unit in association with a corresponding source IP address. . The arithmetic control means is
10. The firewall apparatus according to claim 1, wherein when the same URL is repeatedly accessed from a specific IP address by a method other than the POST method, it is determined that the access is unnatural. . The arithmetic control means is
The firewall apparatus according to any one of claims 1 to 9, wherein when a large amount of data is transmitted from a specific IP address to the same URL by the POST method, it is determined that the access is unnatural. The arithmetic control means is
The firewall apparatus according to any one of claims 1 to 9, wherein when a large amount of access is made from a specific IP address to an appropriate URL, it is determined that the access is unnatural.

Images