JP2007164313A - Illegal access detection device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To automatically prepare filter conditions according to set information in order to solve the problem that it is difficult for an illegal access detection device which monitors a packet running through a network, and detects illegal access to a device to be monitored to properly set filter conditions while technologies using the Internet are made variable. <P>SOLUTION: This illegal access detection device is provided with: a filter condition setting part; an illegal access detection part for detecting illegal access based on filter conditions outputted by the filter condition setting part and a filter condition converting part for automatically converting set information inputted from the outside into filter conditions, and for outputting it to the filter condition setting part. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to an unauthorized access detection device called Intrusion Detection System (IDS) that monitors packets flowing through a network and detects unauthorized access to the monitored device or unauthorized access from the monitored device. In particular, the present invention relates to a method for setting a filter to reduce erroneous detection in which the apparatus determines normal communication as unauthorized access.

  Conventionally, an IDS classified as a network type is installed so as to acquire a communication packet passing over a monitored network, and the data contained in the packet is compared with a detection condition called a signature, and unauthorized access is detected. I have determined if there is a possibility. The IDS does not block the communication itself, but if it is determined that there is unauthorized access, it notifies the user in the form of a log or the like so that the user can take appropriate measures.

  Unauthorized access is performed mainly for vulnerable parts caused by software design mistakes, etc., so that communication packets that are normal depending on the purpose of use of the device and the network configuration may be illegal communication packets only in a specific configuration. There is a case. For this reason, the signature that defines the detection condition includes a condition that should be applied only in a specific configuration, and when used in an unexpected configuration, it is a factor that erroneously detects normal communication as unauthorized access. It has become.

  As described above, since the validity of the signature depends on the monitoring target, various schemes for narrowing the effective range are being studied. For example, for each signature used on the IDS device, a policy method for switching the setting of whether to enable or disable collectively, an anomaly that defines normal communication and determines other communication as illegal The detection method is an example of the countermeasure.

  The general-purpose system described above is required for large-scale networks in which connected devices are unspecified, such as Internet service providers and housing services. However, in many cases, for example, companies that have a large number of employees and have built their own networks can limit the monitoring targets. For this reason, as a method of narrowing down the range more reliably, it is possible to prevent erroneous detection by registering communication to be monitored and communication not to be targeted in IDS as filter conditions in advance and narrowing down communication to which a signature is applied. Although the setting items of the filter are different, this filter method is introduced in many IDS products.

  As an example of filtering at the time of acquisition of communication packets for this filter method, a filter is provided in the lower layer where communication packets are acquired, and instructions based on the filter by MAC address or the result of detecting unauthorized access in the upper layer (See, for example, Patent Document 1).

JP 2004-140618 A (page 6)

  However, although the filter method disclosed in Patent Document 1 has been successful in reducing false detection of IDS, it is appropriate to set the filter as the technology using the Internet is diversifying in recent years. A new problem has arisen. Since the number of signatures of a general IDS product exceeds several thousand, it has become difficult to understand the conditions under which individual signatures are valid. In spite of this situation, the filter to be specified depends on the monitoring target, so the filter setting cannot be automated, and the side that operates unauthorized access monitoring with IDS performs trial and error to set the filter. Inevitably, there were problems such as stopping normal communication and overlooking unauthorized access.

  The present invention has been made to solve the above-described problems, and provides an unauthorized access detection apparatus capable of automatically setting an effective filter by using only an IDS without requiring understanding of a large number of signatures. For the purpose.

The present invention is an unauthorized access detection device for detecting unauthorized access that enters a monitored device on a network,
Based on a filter condition setting unit for setting a filter condition for suppressing detection of unauthorized access to a monitored device, and a filter condition output from the signature and the filter condition setting unit for acquiring a communication packet flowing to the monitored device An unauthorized access detection unit for detecting unauthorized access;
A filter condition conversion unit that automatically converts setting information input from the outside into a filter condition and outputs it to the filter condition setting unit is provided.

  An unauthorized access detection apparatus according to the present invention is based on a filter condition setting unit that sets a filter condition for suppressing detection of unauthorized access, a communication packet, and a filter condition output from a signature and the filter condition setting unit And an unauthorized access detector that detects unauthorized access and a filter condition converter that automatically converts setting information input from the outside into a filter condition and outputs it to the filter condition setting unit. It is possible to set the filter condition without performing it, and it is possible to reduce the load on the operator and to reduce the factor of false detection of unauthorized access despite normal communication.

Embodiment 1 FIG.
Embodiment 1 of the present invention will be described below with reference to FIGS.
In FIG. 1, an unauthorized access detection device (IDS) 100 is included in an unauthorized access detection unit 1, an alert storage unit 2, a signature 3 and a filter condition setting unit 4, and a monitoring target system 900 which is setting information input from the outside. And a filter condition conversion unit 5 that converts a device list 6 defining devices to be converted into filter conditions. The unauthorized access detection device (IDS) 100 monitors a monitoring target system 900 including a server 901 and a server 902 which are monitoring target devices. The monitoring target system 900 is connected to an external network 904 by a router / firewall 903. Yes.

  The device list 6 is defined in the table shown in FIG. Since the monitoring target system 900 includes a server 901 and a server 902, an IP address and a purpose of use are defined for these servers. Here, for the purpose of use, it is assumed that a predetermined classification that simply indicates how to use the server is designated. For example, the server 901 designates a Web server, and the server 902 designates a file server. In this case, a plurality of inputs can be made.

  The operation of the filter condition conversion unit 5 is performed according to the operation flowchart shown in FIG. 3, is activated every time the device list 6 is provided by the operator, and ends when the output to the filter condition setting unit 4 is completed. Each step of the operation in FIG. 3 is as shown in step numbers S501 to S508 given in the order of the operation. Hereinafter, the operation of the filter condition conversion unit 5 will be described in the order of the step numbers.

(1) In step S501, the process of the filter condition conversion unit 5 starts.
(2) In step S502, one piece of device information (server information) is acquired from the device list 6.
(3) In step S503, one of the read usage purposes is converted into the record of the filter condition setting unit. This step S503 is composed of steps S504, S505, S506, and S507. In S503, usage purpose = purpose n indicates a usage purpose other than the Web server and the file server.
(4) In step S504, one usage purpose of the device information is read, and the process proceeds to a process predetermined according to the usage purpose. If the purpose of use is a Web server, the process proceeds to S505. If the purpose of use is a file server, the process proceeds to S506.

(5) In step S505, the information in the device list 6 is converted into filter conditions according to a predetermined conversion procedure when the purpose of use is a Web server.
(6) In step S506, the information in the device list 6 is converted into filter conditions according to a predetermined conversion procedure when the purpose of use is a file server.
(7) In step S507, the filter condition converted from the device list 6 is output as a record of the filter condition setting unit 4. At this time, one usage purpose may be converted into a plurality of records. Also, if the record is the same as the already output record, it is not output. Furthermore, if there are records with overlapping filter conditions, these records are integrated so that the communication that should not be filtered is not filtered. Output to the setting unit 4.
(8) If all the usage purposes included in the device information being processed are output to the filter condition setting unit 4 in step S508, the process proceeds to S509, and if there is an unprocessed usage purpose, the process proceeds to S504.
(9) If processing of all device information is completed in step S509, the process proceeds to S510. If there is unprocessed device information, the process proceeds to S502.
(10) In step S510, the process of the filter condition conversion unit 5 is terminated.

The unauthorized access detection device (IDS) 100 according to the first embodiment of the present invention has the above-described configuration and function, and operates based on the filter conditions generated by the operation flow as described above.
That is, the unauthorized access detection device (IDS) 100 inputs a device list 6 that defines device information of the monitored system 900 that is setting information input from the outside, thereby setting filter conditions for reducing false detections. It is possible to output to the unauthorized access detection unit 1 using the unit 4. Since the unauthorized access detection device (IDS) 100 includes the filter condition conversion unit 5 that converts the device list 6 into the filter condition setting unit 4, the monitored system 900 is monitored by the unauthorized access detection device (IDS) 100. There is an effect that the operator who performs the operation can reduce false detections only by inputting the grasped device information as the device list 6 without having the skill to set the filter condition.

  The device list 6 which is setting information input from the outside by the unauthorized access detection device (IDS) 100 according to the first embodiment is used when the unauthorized access detection device (IDS) 100 is newly provided to a user. When entered by the operator, or when a server is added after being installed in the system, it is entered by the operator to the corresponding server. Not limited to this, the setting information is entered as needed. May be.

  In other words, the unauthorized access detection device (IDS) 100 according to the first embodiment has a filter configuration that reduces false detections for determining unauthorized access even when newly installing or adding monitored devices in the system with a simple configuration. It is easy to monitor the packet flowing through the system via the filter condition setting unit 4 and the unauthorized access detection unit 1.

Embodiment 2. FIG.
A second embodiment of the present invention will be described with reference to FIGS.
In the first embodiment described above, the filter condition conversion unit 5 converts the output into the filter condition using the usage purpose of the monitoring target device included in the system defined in the device list 6, and outputs the filter condition. Then, filter conditions are generated based on components such as an OS and installed software additionally defined in the device list 6 and output to the filter condition setting unit 4.

  In the second embodiment, the device list 6 is shown as a table including component information as shown in FIG. In the example of FIG. 4, the server 901 is composed of an A company OS and C company software, and the server 902 is composed of a B company OS and a D company software.

  In the second embodiment, the operation of the filter condition conversion unit 5 is performed according to the operation flowchart shown in FIG. 5 and is activated every time the device list 6 is provided, and the output to the filter condition setting unit 4 is completed. End with. Each step in the operation in FIG. 5 is the same as that in FIG. Hereinafter, operations of the filter condition conversion unit 5 different from those in FIG. 3 will be described in the order of step numbers. In S703, the component = element n indicates a component other than the company A OS and the company C software.

(1) In step S703, one of the read constituent elements in the device information is converted into a record of the filter condition setting unit 4. This step 703 is composed of steps S704, S705, S706, and S707.
(4) In step S704, one component of the device information is read, and the process proceeds to a process predetermined according to the component. If the component is the company A OS, the process proceeds to S705. If the component is the company C software, the process proceeds to S706.
(5) In step S705, the information in the device list 6 is converted into filter conditions according to a predetermined conversion procedure when the component is the company A OS.
(6) In step S706, the information in the device list 6 is converted into the filter condition according to a predetermined conversion procedure when the component is the C company software.

(7) In step S707, the filter condition converted from the device list 6 is output as a record of the filter condition setting unit 4. At this time, one component may be converted into a plurality of records. Also, if the record is the same as the already output record, it is not output. Furthermore, if there are records with overlapping filter conditions, these records are integrated so that the communication that should not be filtered is not filtered. Output to the setting unit 4.
(8) If all the components included in the device information being processed are output to the filter condition setting unit 4 in step S708, the process proceeds to S509, and if there is an unprocessed component, the process proceeds to S704.

  The unauthorized access detection device (IDS) 100 according to the second embodiment of the present invention has the above-described configuration and function, and performs an operation based on the filter condition generated by the operation flow as described above, thereby enabling the OS. In addition, it is possible to reduce false detection of unauthorized access that depends on installed software.

  For example, when a device included in the monitoring target system 900 uses an A company OS, it is clearly a false detection to detect unauthorized access using a signature prepared for the company B OS for communication with the device. . Further, when the apparatus uses the C company software, it is clear that detecting unauthorized access to the D company software is also a false detection.

  In addition, the components in the setting information input from the outside include the OS and the installed software, the network segment including the device, and the type of data held by the device. Since these pieces of information are included in the device list 6 and the filter condition conversion unit 5 capable of outputting filter conditions based on the information is provided, a filter condition that can further reduce false detection is output. The packet flowing through the network can be monitored via the filter condition setting unit 4 and the unauthorized access detection unit 1.

  According to the second embodiment, an operator who monitors the monitoring target system 900 defines the elements constituting the monitoring target device by using an unauthorized access detection device having a simple configuration in addition to the purpose of use of the device. As a result, it is possible to save labor by reducing the erroneous detection more finely than in the first embodiment without being conscious of the filter condition converted by the filter condition conversion unit.

Embodiment 3 FIG.
Embodiment 3 of the present invention will be described.
The purpose of using the server has been subdivided along with recent advances in communication technology, and the signature update frequency has become very high. With the increase in unauthorized access, signature update several times a day It can be done. At that time, it was made in order to reduce the load of updating the filter condition of the operator.
The unauthorized access detection device (IDS) 100 according to the third embodiment will be described with reference to FIGS. FIG. 6 shows the configuration of the unauthorized access detection device (IDS) 100. Note that the alert storage unit 2 shown in FIG. 1 is not shown in FIG. As shown in FIG. 6, similarly to the first and second embodiments, the unauthorized access detection unit 1 that operates based on the signature 3 and the filter condition is provided. The device list 6 is converted into filter conditions by the device list conversion unit 51 based on the conversion rule 53 provided together with the signature 3 or the conversion rule database 52 storing the conversion rule 54 uniquely defined by the operator. Done. Here, the conversion rule database 52 and the device list converter 51 constitute a filter condition converter 5a.

  The conversion rule 53 provided with the signature 3 or the conversion rule 54 uniquely defined by the operator is defined by the conversion rule table 55 and the variable table 56 shown in FIG. 7, merged and stored in the conversion rule database 52. .

  The device list conversion unit 51 as the filter condition conversion unit 5a reads the conversion rule database 52 in the operation step S503 or S703 of the operation flowchart shown in FIGS. The corresponding conversion rules 53 and 54 are acquired using the element as a search key. Based on the conversion rules 53 and 54, the device list 6 is converted into a filter condition.

  Some information defined in the conversion rule table 55 in FIG. 7 is indicated by a variable name such as HTTP_PORTS, which is a customized variable name, for example. In the conversion rule 53 and the conversion rule 54, specific values of variables such as HTTP_PORTS are defined as in the variable table 56.

  According to the third embodiment of the present invention, the unauthorized access detection device (IDS) 100 converts the conversion rule database 52 into the conversion rule database 52 instead of the predetermined filter condition conversion unit 5 as in the first and second embodiments. By adding the rule 53 or the conversion rule 54, it is possible to obtain the filter condition conversion unit 5a that can convert the filter condition by the device list conversion unit 51.

  For example, when the signature provider provides the conversion rule 53 together with the signature 3, the device list conversion unit 51 can convert the device list 6 into a filter condition corresponding to the latest signature. Accordingly, even if the signature 3 is updated, a filter condition reflecting the update can be generated and output to the filter condition setting unit 4.

  In addition, it is possible for an operator to add a conversion method that is not assumed by the signature provider by defining the conversion rule 54 independently. In particular, when a system device using a unique port number such as 8080 is to be monitored, such as when a proxy is being built instead of the general port number of 80, instead of 80 in HTTP_PORTS of the variable table 56 By specifying 8080, the variable HTTP_PORTS in the conversion rule is replaced with 8080, and it is possible to obtain the filter condition conversion unit 5a that performs appropriate filter condition conversion without reviewing each conversion rule.

According to the third embodiment of the present invention, the unauthorized access detection device (IDS) 100 reduces false detections even when the signature 3 is updated or in the case of a monitored system that operates based on a unique variable. Filter conditions that can be generated are generated, and packets flowing through the system can be monitored via the filter condition setting unit 4 and the unauthorized access detection unit 1.
As described above, also in the third embodiment, it is possible to set the filter condition without blocking the communication packet by an inexpensive apparatus having a simple configuration, thereby reducing the load on the operator and saving labor.

Embodiment 4 FIG.
In the fourth embodiment, in order to reduce the load on the operator when the signature is updated several times a day as described in the third embodiment, the filter condition is automatically updated using the signature and conversion rule update as a trigger. Is.
Embodiment 4 of the present invention will be described with reference to FIG.
In FIG. 8, the unauthorized access detection device (IDS) 100 includes a device list conversion unit 51 and a device list database 61. Others are the same as those in FIG. 6 described above, and the device list conversion unit 51, the conversion rule database 52, and the device list database 61 constitute the filter condition conversion unit 5b.

  In the fourth embodiment, the device list 6 is stored in the device list database 61. Each time the conversion rule 53 provided together with the signature is input from the signature provider to the conversion rule database 52, the device list conversion unit 51 as the filter condition conversion unit 5b converts the device list database 61 into a filter condition, Output to the condition setting unit 4.

  In the fourth embodiment, each time the signature is changed by the signature provider and the signature 3 and the conversion rule 53 are provided, the filter condition is generated. The frequency of new unauthorized access is much higher than the frequency of configuration change of the monitored system, and the signature update frequency is also high. By using the unauthorized access detection device (IDS) 100 according to the fourth embodiment, even if the signature update frequency is high, the operator always generates a filter condition suitable for the latest signature, and the filter condition setting unit 4, unauthorized access detection It is possible to monitor a packet flowing through the system via the unit 1, and there is an effect that the filter condition can be automatically updated by an inexpensive apparatus having a simple configuration.

Embodiment 5 FIG.
The fifth embodiment of the present invention will be described below with reference to FIG.
The fifth embodiment is provided with a function of outputting a filter condition for filtering an operation for notifying whether or not to deal with unauthorized access.

In FIG. 9, an unauthorized access detection device (IDS) 100 is provided with an unauthorized access countermeasure unit 8 in place of the alert storage unit 2 shown in FIG.
Here, the filter condition conversion unit 5 may be based on the device list conversion unit 51 and the conversion rule database 52 similar to those shown in FIG. Moreover, the filter condition conversion part comprised by the apparatus list conversion part 51 similar to FIG. 8 shown in Embodiment 4, the conversion loose database 52, and the apparatus list database 61 may be sufficient.

  In FIG. 9, the unauthorized access detection unit 7 notifies the unauthorized access handling unit 8 of the detection result of what is determined to be abnormal in consideration of the filter condition. The unauthorized access handling unit 8 issues an instruction to the firewall device 903 provided outside the unauthorized access detection device (IDS) 100, changes the firewall settings, and blocks the corresponding communication packet.

  When the unauthorized access detecting unit 7 determines that the access is normal in consideration of the filter condition, the unauthorized access handling unit 8 does not instruct the firewall 903 to block the communication packet.

  In the fifth embodiment of the present invention, since the unauthorized access detection device (IDS) 100 is automatically handled by the unauthorized access handling unit 8, it is possible to reduce the trouble of handling the erroneous detection of the operator, which is normal. Issues such as hindering communication can be avoided. The firewall 903 described above may be an external device, or may be provided in the unauthorized access detection device (IDS) 100.

  Further, the means included in the unauthorized access countermeasure unit 8 may be a means for outputting an alarm by sound, display, vibration, or mail transmission to the operator in addition to an instruction to block the communication packet. Since the operator selects an action to be taken according to the above-described alarm, it is possible to avoid generation of useless work due to reduction of false detection.

  Such an unauthorized access detection device (IDS) 100 according to the fifth embodiment can update the filter condition with an inexpensive device with a simple configuration, as well as the fourth embodiment described above. Generation of useless work due to reduction can be suppressed.

  Embodiments 1 to 5 of the present invention can be used for an unauthorized access detection device that monitors packets flowing through the system and detects unauthorized access to a device to be monitored.

It is a block diagram which shows the unauthorized access detection apparatus of Embodiment 1 of this invention. It is explanatory drawing which shows the example of the apparatus list of Embodiment 1 of this invention. It is an operation | movement flowchart of the filter condition conversion part of Embodiment 1 of this invention. It is explanatory drawing which shows the example of the apparatus list of Embodiment 2 of this invention. It is an operation | movement flowchart of the filter condition conversion part of Embodiment 2 of this invention. It is a block diagram which shows the unauthorized access detection apparatus of Embodiment 3 of this invention. It is explanatory drawing which shows the conversion rule in Embodiment 3 of this invention. It is a block diagram which shows the unauthorized access detection apparatus of Embodiment 4 of this invention. It is a block diagram which shows the unauthorized access detection apparatus of Embodiment 5 of this invention.

Explanation of symbols

1 Unauthorized access detector, 2 Alert accumulator, 3 Signature,
4 filter condition setting unit, 5, 5a, 5b filter condition conversion unit, 6 device list,
8 unauthorized access countermeasure unit, 51 device list conversion unit, 52 conversion rule database,
53 Conversion rule, 54 Conversion rule, 100 Unauthorized access detection device.

Claims (7)

An unauthorized access detection device that detects unauthorized access that enters a monitored device on a network,
A filter condition setting unit that sets a filter condition for suppressing detection of unauthorized access to the monitored device, and a filter that obtains a communication packet that flows to the monitored device and outputs the signature and the filter condition setting unit An unauthorized access detector for detecting unauthorized access based on the conditions;
An unauthorized access detection apparatus comprising: a filter condition conversion unit that automatically converts setting information input from the outside into a filter condition and outputs the filter condition to the filter condition setting unit. The unauthorized access detection apparatus according to claim 1, wherein the setting information input from the outside to the filter condition conversion unit is a device list defining devices to be monitored. The unauthorized access detection apparatus according to claim 2, wherein the device list defines a purpose of use of the device. The unauthorized access detection apparatus according to claim 2, wherein the device list defines components of the device. The filter condition conversion unit includes a conversion rule database that stores a conversion rule defined by a conversion rule table that defines a variable name and a variable table that defines a specific value of the variable;
From the device list defining at least one of the usage purpose and component of the device, the conversion rule is acquired from the conversion rule database using the usage purpose and component as a search key, and based on the conversion rule The unauthorized access detection apparatus according to claim 1, further comprising: a device list conversion unit that automatically converts to a filter condition and outputs the filter condition to the filter condition setting unit. 6. The unauthorized access detection apparatus according to claim 5, wherein the device list conversion unit is activated when the signature or the conversion rule is input. 2. The unauthorized access detection device according to claim 1, further comprising an unauthorized access countermeasure unit that outputs to block a corresponding communication packet when the unauthorized access detection unit detects unauthorized access.

Images