JP2008022498A - Network abnormality detection apparatus, network abnormality detecting method, and network abnormality detection system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect traffic abnormality caused by a worm, without depending on the use environment of a computer such as an OS, even when an unknown virus or the worm intrudes the computer. <P>SOLUTION: A network abnormality detection apparatus includes a first input/output section 110 for inputting/outputting data to/from an internal network, a second input/output section 120 for inputting/outputting data to/from an external network, and a data totalizing section 130 for totalizing data for detecting traffic abnormality from input data. Furthermore, the network abnormality detection apparatus includes an index data holding section 140 for holding data totalized during a fixed period of time in the past by the data totalizing section 130 as index data to be used as an index when calculating a traffic abnormality degree, and an abnormality degree calculating section 150 for calculating the traffic abnormality degree using evaluation data totalized at an abnormality degree calculation time by the data totalizing section 130 and the index data acquired from the index data holding section 140. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a network abnormality detection device, a network abnormality detection method, and a network abnormality detection system, and more particularly to a network abnormality detection device, a network abnormality detection method, and a network abnormality detection system that detect an abnormality in traffic flowing on a network.

  Conventionally, various techniques for protecting computers and networks from viruses and worms, detecting intrusions at an early stage, and preventing the spread of infection have been studied. In recent years, a number of worms called bots that cause various damages by exploiting infected terminals have appeared. Intrusion of such bots into the network, spam mail transmission by invaded bots, DDoS (DDoS: Distributed Denial) of Service) It is necessary to be able to detect activities such as attacks as soon as possible.

  Generally, software called anti-virus software that detects a virus on a computer connected to a network is used as a countermeasure against viruses including bots. The antivirus software detects a virus that has entered the computer by pattern matching using a virus detection pattern prepared in advance. Virus detection patterns are regularly updated, and many of the latest pattern files are provided to users via the Internet or the like.

  In addition, personal firewalls installed and used on individual terminals on the network also have an anti-virus effect. Since the personal firewall monitors the input / output packets of the network interface of the installed computer and permits only the communication of the program approved by the administrator, it can prevent the invasion of viruses and worms. Even when a worm is infected, spreading can be prevented by preventing communication by the worm.

  On the other hand, there is a method called an intrusion detection system (IDS) as a method of detecting an abnormality on the network side, not on an individual computer. IDS is a system that analyzes a payload portion of a packet passing on a network and detects a packet that seems to be an unauthorized access by matching with a registered pattern. For example, Patent Document 1 verifies the detection information of unauthorized intrusion detected from inbound traffic received from an external network and the response signal for unauthorized intrusion detected from outbound traffic transmitted from the internal network. Thus, a bidirectional IDS with improved detection accuracy is disclosed.

JP 2004-30287 A

  When using the conventional technology as described above, there are several problems at present.

  First, the virus detection method based on pattern matching used in anti-virus software is basically for known viruses, and cannot detect unknown viruses that do not correspond to patterns. In addition, in the current situation where viruses are becoming open source, subspecies viruses emerge at an unprecedented speed, making it more difficult to prepare patterns corresponding to all subspecies viruses. Another problem of the anti-virus software is that the software is provided only for a specific OS (OS: Operating System). In addition, there are cases where the viruses that can be detected differ depending on the type of antivirus software, and there is a problem that the availability of virus detection depends on the user's usage environment. Furthermore, since there are viruses and worms that stop the activity of anti-virus software itself, it may become impossible to detect viruses without the user's knowledge.

  Also, personal firewalls, like anti-virus software, have a problem that they are dependent on the OS and a virus that stops the firewall function. In addition, since the setting items and detection items are difficult for the user to understand and are difficult to set, the function may not be used effectively. Furthermore, with the advancement of Internet protocols, many protocols have been developed that communicate by avoiding the limitations of firewalls, and there is a problem that it is difficult to block communication using such protocols.

  Further, IDS as disclosed in Patent Document 1 also has a problem that it is difficult to cope with a new pattern because a method using pattern matching is used in the same way as antivirus software. In addition, in the method of Patent Document 1, after detecting an unauthorized intrusion by monitoring inbound traffic, intrusion detection is performed depending on whether a response signal is returned within a predetermined time. It can only be used when it operates as specified.

  Therefore, the present invention has been made in view of the above problems, and the object of the present invention is a case where an unknown virus or worm has entered without depending on the operating environment of a computer such as an OS. It is another object of the present invention to provide a new and improved network abnormality detection device, network abnormality detection method, and network abnormality detection system capable of detecting an abnormality in traffic.

  In order to solve the above-described problem, according to an aspect of the present invention, there is provided a network abnormality detection device for detecting an abnormality of traffic flowing on a network, wherein the first input / output performs data input / output with respect to an internal network. A second input / output unit for inputting / outputting data to / from an external network, and data for detecting traffic anomalies based on data input from the first input / output unit and the second input / output unit. A data totaling unit that aggregates data, an index data holding unit that stores data aggregated during a certain period in the past by the data totaling unit as index data used as an index when calculating the degree of traffic abnormality, and a traffic abnormality Evaluation data collected at the time of abnormality calculation by the data aggregation unit for detection, and index data acquired from the index data holding unit Characterized in that it comprises an abnormality calculating unit for calculating a degree of abnormality traffic, the use, the network anomaly detector is provided.

  With this configuration, it is possible to know whether an abnormality has occurred at a point to be monitored on the network, regardless of the operating environment such as the OS. Further, by displaying the calculated level of traffic anomaly on a display or LED (LED: Light Emitting Diode), the user or administrator can immediately determine whether normal communication is being performed at the monitoring point. Can be recognized.

  Further, the data totaling unit transmits data input from the first input / output unit to the second input / output unit, and transmits data input from the second input / output unit to the first input / output unit. Good. Alternatively, the first input / output unit replicates data input from the internal network and transmits one of the data to the second input / output unit, and the second input / output unit replicates data input from the external network. Then, one of the data may be transmitted to the first input / output unit. In the latter case, the load on the data totaling unit can be reduced as compared with the former case, and it becomes possible to cope with a large volume of traffic. Furthermore, since direct data transfer is performed between the first input / output unit and the second input / output unit, there is an effect that the influence on the communication speed can be reduced.

  The switch unit further includes one or more first input / output units and a switch unit connected to the second input / output unit, and the switch unit receives data input from the one or more first input / output units respectively. The first input / output unit corresponding to the destination of the data input from the second input / output unit may be determined, and the data may be transmitted to the first input / output unit. . The switch unit may be a layer 2 switch, a layer 3 switch, or a software switch, a so-called router device. As a result, an effect of detecting an abnormality in traffic can be obtained by replacing an existing device such as a switch, and there is an effect that installation and management are easier than installing a new device.

  In addition, an external interface unit that transmits the calculation result data calculated by the abnormality degree calculation unit to an external device may be further included. As a result, it becomes possible to analyze the traffic abnormality in more detail in an external device such as a PC or a server. Furthermore, when an abnormality is confirmed, it is possible to take measures such as notifying the user by e-mail and instructing countermeasures.

  Further, it further includes a result data holding unit that holds the calculation result data calculated by the abnormality degree calculation unit, and the external interface unit, in response to a request from the external device, calculation result data acquired from the result data holding unit, The index data acquired from the index data holding unit and used for calculating the calculation result data may be transmitted to the external device. Thereby, a user or an administrator can connect a PC or a server at an arbitrary timing to see the cause of the abnormality in detail. Further, a network administrator or the like can make a certain guess about the traffic abnormality based on the transmitted data and examine the countermeasure.

  The data totaling unit passes a part or all of the input data input from the first input / output unit or the second input / output unit to the index data holding unit, and the index data holding unit receives the input data in the data totaling unit. You may make it hold | maintain by matching the index data obtained by totaling, and a part or all of input data. Further, the external interface unit may transmit a part or all of the input data associated with the index data to the external device together with the calculation result data and the index data. Thereby, it becomes possible to monitor and analyze packet data flowing on the network by an external device. In addition, packet data is sent in association with traffic anomaly data, so you can not only monitor packets, but also analyze the anomaly data you want to check and the corresponding packets, which is very efficient There is a merit that is good.

  The packet filter unit further includes a packet filter unit connected to the first input / output unit, the second input / output unit, and the external interface unit, the packet filter unit responding to a filtering request from an external device received through the external interface unit. The filtering of data input / output by the first input / output unit and the second input / output unit may be performed. As a result, as a result of analyzing the traffic abnormality in the external device, the portion that is determined to require immediate countermeasures is used to control the packet filter from the external device, so that the network can be immediately infected with the worm or DDoS attack. Can defend against. Since the time required for spreading the worm is very short, the method of notifying the user by e-mail or the like is very effective when the response cannot be made in time.

  In order to solve the above problem, according to another aspect of the present invention, there is provided a network abnormality detection method for detecting an abnormality of traffic flowing on a network, based on data input from an internal network and an external network. A data aggregation stage that aggregates data for detecting traffic anomalies, and an index data retention stage that retains the data aggregated in the data aggregation stage as index data used as an index when calculating the degree of traffic abnormality An index data acquisition stage for acquiring index data aggregated during a certain period in the past, index data acquired in the index data acquisition stage, and evaluation data aggregated in the data aggregation stage at the time of traffic abnormality calculation An anomaly calculation stage that calculates traffic anomalies using And, the network anomaly detection method is provided.

  With this configuration, it is possible to know whether an abnormality has occurred at a point to be monitored on the network, regardless of the operating environment such as the OS. Further, by displaying the calculated level of traffic anomaly on a display or LED, the user or administrator can immediately recognize whether or not normal communication is being performed at the monitoring point.

  Further, a result data transmission step of transmitting calculation result data, which is a result calculated in the abnormality degree calculation step, to an external device may be further included. As a result, it becomes possible to analyze the traffic abnormality in more detail in an external device such as a PC or a server. Furthermore, when an abnormality is confirmed, it is possible to take measures such as notifying the user by e-mail and instructing countermeasures.

  In addition, a result data holding stage that holds the result calculated in the degree of abnormality calculation stage as calculation result data, and in response to an inquiry from an external device, calculation result data, and index data used to calculate the calculation result data; And a result data acquisition step of acquiring. Furthermore, in the result data transmission stage, the index data acquired in the result data acquisition stage may be transmitted together with the calculation result data to the external device. Thereby, a user or an administrator can connect a PC or a server at an arbitrary timing to see the cause of the abnormality in detail. Further, a network administrator or the like can make a certain guess about the traffic abnormality based on the transmitted data and examine the countermeasure.

  The method further includes a packet data holding step for holding a part or all of input data input from the internal network and the external network in association with index data obtained by aggregating the input data, and a result data transmission step , Part or all of the input data associated with the index data may be transmitted to the external device together with the calculation result data and the index data. Thereby, it becomes possible to monitor and analyze packet data flowing on the network by an external device. In addition, packet data is sent in association with traffic anomaly data, so you can not only monitor packets, but also analyze the anomaly data you want to check and the corresponding packets, which is very efficient There is a merit that is good.

  In addition, a filtering control step for performing filtering control of input / output data in response to a filtering request from an external device may be further included. As a result, as a result of analyzing the traffic abnormality in the external device, the portion that is determined to require immediate countermeasures is used to control the packet filter from the external device, so that the network can be immediately infected with the worm or DDoS attack. Can defend against. Since the time required for spreading the worm is very short, the method of notifying the user by e-mail or the like is very effective when the response cannot be made in time.

  In order to solve the above problem, according to another aspect of the present invention, a plurality of network abnormality detection devices that aggregate data input from a network and calculate a traffic abnormality degree from the aggregated data; Including an analysis server connected to a plurality of network abnormality detection devices via a network and detecting a traffic abnormality by comparing a plurality of abnormality degree data respectively transmitted from the plurality of network abnormality detection devices. Is a network anomaly detection system, characterized in that when there is a plurality of anomaly data in which anomalies are detected from the same element among a plurality of anomaly data, it is determined that an anomaly has occurred in traffic. Is provided.

  With this configuration, when a worm is generated in a wide area and abnormal traffic is generated, the same kind of abnormality is detected by multiple network abnormality detection devices, so that the data on the degree of abnormality of multiple network abnormality detection devices is compared. By doing so, it becomes possible to detect anomalies with high accuracy as soon as possible.

  As described above, according to the present invention, it is possible to detect a traffic abnormality caused by an unknown virus or worm, regardless of the operating environment of a computer such as an OS.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

(First embodiment)
First, based on FIG.1 and FIG.2, the network abnormality detection apparatus concerning the 1st Embodiment of this invention is demonstrated. Here, FIG. 1 is a block diagram illustrating a schematic configuration of the network abnormality detection device 100 according to the first embodiment of the present invention, and FIG. 2 is a schematic diagram illustrating the network abnormality detection device 100 according to the present embodiment. is there.

  As shown in FIG. 1, the network abnormality detection device 100 according to the present embodiment includes a first input / output unit 110, a second input / output unit 120, a data totaling unit 130, an index data holding unit 140, an abnormality degree calculating unit 150, and The result output unit 160 is configured. Further, as shown in FIGS. 1 and 2, the network abnormality detection apparatus 100 is connected to an internal network such as a LAN (LAN: Local Area Network) 170 through a first input / output unit 110 and a second input / output unit. 120 is connected to an external network such as the Internet 190 through 120. Here, the internal network is a network in which a computer used by a user exists, and the external network is located on the opposite side of the internal network as viewed from the network abnormality detection device 100 according to the present embodiment.

  Next, each part of the network abnormality detection device 100 will be described.

  The first input / output unit 110 is a functional unit that is connected to the internal network LAN 170 and inputs / outputs data to be transmitted / received to / from the user terminal 180 connected to the LAN 170. The first input / output unit 110 receives traffic (referred to as outbound traffic) transmitted from the user terminal 180 within the LAN 170 and transmitted to an external network such as the Internet 190. Conversely, traffic transmitted from the Internet 190 and transmitted to the user terminal 180 (referred to as inbound traffic) is output. The first input / output unit 110 passes the input outbound traffic to the data totaling unit 130, receives inbound traffic from the data totaling unit 130, and transmits it to the LAN 170. In the present embodiment, description is made assuming that the terminal is connected to the user terminal 180 or the like via the LAN 170. However, the terminal may be directly connected to a computer such as the user terminal 180 to perform data input / output. .

  The second input / output unit 120 is a functional unit that is connected to an external network such as the Internet 190 and inputs / outputs data to / from the Internet 190. In contrast to the first input / output unit, the second input / output unit 120 receives inbound traffic transmitted from an external network such as the Internet 190 and passes it to the data totaling unit 130, and the outbound traffic input from the data totaling unit 130 Is transmitted to the Internet 190.

  The data totaling unit 130 is a functional unit that receives both inbound and outbound traffic, and extracts and aggregates data for calculating the degree of network abnormality from the packet data. The data totaling unit 130 is connected to the first input / output unit 110 and the second input / output unit 120, receives outbound traffic from the first input / output unit 110, and sends the outbound traffic to the second input / output unit 120. The inbound traffic is received from 120 and sent to the first input / output unit 110. That is, the input traffic passes through the data totaling unit 130 and is input / output through the first input / output unit 110 and the second input / output unit 120. Further, the data aggregation unit 130 detects and aggregates the values of predetermined parameters of the input traffic, and sends the aggregation results to the index data holding unit 140 and the abnormality degree calculation unit 150.

  The index data holding unit 140 accumulates the data of the aggregation results sent from the data aggregation unit 130, and calculates the abnormality level from the data (hereinafter referred to as evaluation data) that is the target of the abnormality level calculation aggregated at the time of abnormality level calculation. It is a storage unit that holds data as an index for calculation (hereinafter referred to as index data). When there is a data request from the abnormality degree calculation unit 150, the index data holding unit 140 searches for the requested data among the held index data and passes it to the index data holding unit 140.

  The abnormality level calculation unit 150 is a functional unit that calculates the degree of traffic abnormality and determines whether an abnormality has occurred. When the evaluation data, which is the totalization result, is passed from the data totaling unit 130, the abnormality degree calculating unit 150 requests the index data for a certain period of time stored in the index data holding unit 140 for the total data. The required index data may be, for example, seven pieces of index data acquired at the same time in the past week of the acquisition date of evaluation data. After acquiring the index data, the abnormality level calculation unit 150 calculates the traffic abnormality level by using a predetermined calculation method using the evaluation data and the index data, and passes the calculation result data to the result output unit 160.

  The result output unit 160 is a functional unit for outputting the value of the traffic abnormality level calculated by the abnormality level calculation unit 150. The result output unit 160 is for notifying the user of the result calculated by the abnormality degree calculation unit 150, and may be a display unit such as an LED or a display, a printer, an e-mail, a buzzer, or the like. For example, each parameter value of the calculation result data is displayed step by step with the LED to indicate the level of abnormality, or the normal level is displayed with green and the abnormal level is displayed with red LED. You may comprise so that abnormality can be recognized more intuitively.

  The configuration of the network abnormality detection device 100 according to the present embodiment has been described above. Next, the network abnormality detection processing according to the present embodiment will be described based on FIG. Here, FIG. 3 is a flowchart showing a flow of processing for detecting a traffic abnormality from packet data transmitted from the LAN 170 and the Internet 190.

  As shown in FIG. 3, first, in step S <b> 101, packet data transmitted from the Internet 190 to the LAN 170 or packet data transmitted from the LAN 170 to the Internet 190 is input to the network abnormality detection device 100.

  Next, in step S102, parameters used for calculating the degree of abnormality are aggregated from the data included in the input packet data. As parameters used for calculating the degree of abnormality, upper layer protocol types (IP, ARP, RARP, TCP, UDP, ICMP, etc.), TCP packet URG, ACK, PSH, SYN, RST and FIN flags are used. However, parameters other than those described above, such as traffic volume, transmission source address, transmission destination address, etc. may be used.

  Next, in step S103, the data aggregated in step S102 is stored for use as index data when calculating the degree of abnormality after the next time.

  Next, in step S104, index data used for calculating the degree of abnormality is acquired. The index data to be acquired may be, for example, seven index data acquired at the same time in the past week when calculating the degree of abnormality.

  Next, in step S105, the degree of difference between the evaluation data collected in step S102 and the index data (also referred to as teacher data) acquired in step S104 is calculated by a predetermined calculation method. The value calculated here is called the degree of abnormality.

  Further, for example, a method as described below can be used as the degree of abnormality calculation method used in step S105.

  First, normalization is performed using, for example, the average value and variance of each parameter in order to eliminate the difference in value between the parameters of the index data using Equation (1). Next, the value of the evaluation data is calculated by Equation (2) using the average value and the variance of each parameter used in normalizing the index data. A value obtained by this calculation is called an abnormal value of each parameter. The value obtained by calculating the sum of the absolute values of the abnormal values of the parameters obtained in this way is defined as the traffic abnormality level. The value of the degree of abnormality approaches 0 when the value of each parameter of the evaluation data is small compared to the index data, and takes a value greater than 0 when the parameter value differs greatly from the index data.

（ｘ：指標データ、ｘ：ｘの平均、Ｓ_ｘ：ｘの分散、ｙ：正規化値）

(X: index data, x: average of _x , S _x : variance of x, y: normalized value)

（ａ：評価データ、ｚ：異常値）

(A: evaluation data, z: abnormal value)

  Next, in step S106, the calculation result of step S105 is output, and the calculation result is notified to the user. As an output method, various means such as a display unit such as an LED or a display, a printer, an e-mail, a buzzer, and the like can be used.

  The network abnormality detection method according to the present embodiment has been described above. With this method, it is possible to know whether or not an abnormality has occurred in traffic at a point to be monitored on the network regardless of the operating environment such as the OS. Furthermore, by displaying the calculation result on a display, LED, or the like, the user or administrator can immediately recognize whether or not normal communication is performed at the monitoring point.

(Second Embodiment)
Next, a network abnormality detection device 200 according to the second embodiment of the present invention will be described with reference to FIG. FIG. 4 is a block diagram showing a schematic configuration of a network abnormality detection device 200 according to the second embodiment of the present invention.

  As shown in FIG. 4, the network abnormality detection apparatus 200 according to the present embodiment includes a first input / output unit 210, a second input / output unit 220, a data totaling unit 230, an index data holding unit 240, an abnormality degree calculating unit 250, The result output unit 260, the result data holding unit 270, and the external interface unit 280 are configured. As shown in FIG. 4, the network abnormality detection device 200 is connected to an external device 290 such as a PC through the external interface unit 280. Further, although not shown, as in the first embodiment (see FIG. 1) described above, the first input / output unit 210 is connected to an internal network such as a LAN, and the second input / output unit 220 is connected to the Internet or the like. Assume that it is connected to an external network. The present embodiment is characterized in that the calculation result of the degree of abnormality is held, and calculation result data and index data used for the calculation are output in response to an external inquiry.

  The first input / output unit 210, the second input / output unit 220, the data totaling unit 230, the index data holding unit 240, the abnormality degree calculating unit 250, and the result output unit of the network abnormality detection device 200 according to the second embodiment. 260, the first input / output unit 110, the second input / output unit 120, the data totaling unit 130, the index data holding unit 140, the abnormality degree calculating unit 150, and the network anomaly detection apparatus 100 according to the first embodiment described above, respectively. Since it has substantially the same configuration as the result output unit 160, detailed description thereof will be omitted. Hereinafter, the result data holding unit 270 and the external interface unit 280 of the network abnormality detection device 200 according to the present embodiment will be described.

  The result data holding unit 270 is a storage unit for holding calculation result data related to the degree of abnormality calculated by the degree of abnormality calculation unit 250. The result data holding unit 270 outputs the held calculation result data in response to an inquiry from the outside. The calculation result data to be held may be only the latest data, or new data may be added while the old data is held, and the data may be stored sequentially.

  The external interface unit 280 is a functional unit for transmitting data to the external device 290 and receiving a request from the external device 290. The external interface unit 280 includes, for example, an interface such as RC-232C, USB, and RJ45, and can be connected to an external device 290 such as a computer to transmit and receive data. When the external interface unit 280 receives the data request signal from the external device 290, the external interface unit 280 sends a data request to the index data holding unit 240 or the result data holding unit 270 and transmits the acquired data to the external device 290. Further, at the time of transmission, in order to increase the safety of data, the data may be transmitted after performing an encryption process.

  The data transmitted from the external interface unit 280 to the external device 290 includes at least abnormality level calculation result data held in the result data holding unit 270. In addition, for example, the index data used for calculating the degree of abnormality and the data of all or part of the packet used when generating the index data may be included. In order to transmit the packet data that is the source of the index data, the data totaling unit 230 duplicates part or all of the packet data that is the source of the index data and sends it to the index data holding unit 240, and the index data holding unit 240 May hold the received packet data in association with the index data.

  Next, the network abnormality detection process according to the present embodiment will be described with reference to FIG. Here, FIG. 5 is a flowchart showing a flow of processing for detecting a traffic abnormality from packet data transmitted from the internal and external networks. 5, S201 to S209 indicate processing in the network abnormality detection device 200 according to the present embodiment, and S291 to S292 are processing in the external device 290 such as a PC connected to the network abnormality detection device 200 according to the present embodiment. Indicates processing.

  As shown in FIG. 5, first, in step S <b> 201, packet data transmitted from an external network such as the Internet or an internal network such as a LAN is input to the network abnormality detection apparatus 200.

  Next, in step S202, the parameters used for calculating the degree of abnormality are tabulated from the data included in the input packet data. Parameters used for calculating the degree of abnormality include, for example, higher layer protocol types (IP, ARP, RARP, TCP, UDP, ICMP, etc.), TCP packet URG, ACK, PSH, SYN, RST and FIN flags, etc. However, parameters other than those described above, for example, traffic volume, transmission source address, transmission destination address, etc. may be used.

  Next, in step S203, the data accumulated in step S202 is stored in the storage area for use as index data in the next and subsequent calculation of the degree of abnormality. Further, part or all of the packet data used for generating the index data may be copied and stored together with the index data. At this time, the index data and the packet data may be stored in association with each other so that the packet data related to the index data can be retrieved from the index data.

  Next, in step S204, index data used for calculating the degree of abnormality is acquired. The index data to be acquired may be, for example, seven index data acquired at the same time in the past week when calculating the degree of abnormality.

  Next, in step S205, how much the evaluation data collected in step S202 differs from the index data acquired in step S204 is calculated by a predetermined calculation method. The value calculated here is called the degree of abnormality. As a method for calculating the degree of abnormality used here, a method similar to that used in the first embodiment described above can be used.

  Next, in step S206, the calculation result of step S205 is output to notify the user of the calculation result. As an output method, various means such as a display unit such as an LED or a display, a printer, an e-mail, a buzzer, and the like can be used.

  In step S207, the calculation result data of the degree of abnormality calculated in step S205 is stored in the storage area.

  From the external device 290, a request signal for requesting calculation result data is transmitted to the network abnormality detection device 200 at an arbitrary timing by a user operation or the like (step S291).

  When receiving the data request signal from the external device 290, the network abnormality detection device 200 acquires the requested data from the storage area in which the data is stored (step S208). Here, the acquired data includes at least the abnormality degree calculation result data stored in step S207. In addition, the index data used for calculating the degree of abnormality and the packet used when generating the index data are used. All or part of the data may be included.

  Next, in step S209, the data acquired in step S208 is transmitted to the external device 290. Further, at the time of transmission, an encryption process may be performed in order to increase the safety of data.

  When the external device 290 receives the data, it analyzes the abnormality degree data and determines whether there is an abnormality to be detected (step S292). Further, if necessary, the data may be displayed in a graph, or a user may be notified of a coping method when it is determined to be abnormal by means such as e-mail.

  The network abnormality detection method according to the present embodiment has been described above. With this method, data for a user or administrator to investigate the cause of an abnormality in detail at an arbitrary timing can be acquired from a PC or server connected to the network abnormality detection device according to the present embodiment. Further, a network administrator or the like can take measures such as making a certain guess about traffic abnormality based on the transmitted data, examining countermeasures, and notifying the user.

(Third embodiment)
Next, a network abnormality detection device 300 according to the third embodiment of the present invention will be described with reference to FIGS. FIG. 6 is a block diagram showing a schematic configuration of a network abnormality detection device 300 according to the third embodiment of the present invention, and FIG. 7 shows a schematic configuration of a modified example of the network abnormality detection device 300 according to the present embodiment. FIG.

  As shown in FIG. 6, the network abnormality detection apparatus 300 according to the present embodiment includes a first input / output unit 310, a second input / output unit 320, a data totaling unit 330, an index data holding unit 340, an abnormality degree calculating unit 350, and The external interface unit 360 is configured. As shown in FIG. 6, the network abnormality detection device 300 is connected to an external device 390 such as a PC through the external interface unit 360. Further, although not shown in the figure, as in the first embodiment (see FIG. 1) described above, the network abnormality detection device 300 is connected to an internal network such as a LAN through the first input / output unit 310, and the second input Assume that the output unit 320 is connected to an external network such as the Internet. The present embodiment is characterized in that the network abnormality detection device 300 is configured to transmit the calculation result to the external device 390 when the abnormality degree calculation is completed.

  The first input / output unit 310, the second input / output unit 320, the data totaling unit 330, the index data holding unit 340, and the abnormality degree calculating unit 350 of the network abnormality detection device 300 according to the third embodiment are each described above. The first input / output units 110 and 210, the second input / output units 120 and 220, the data totaling units 130 and 230, the index data holding unit 140, and the network abnormality detection devices 100 and 200 according to the first and second embodiments. 240 and the degree-of-abnormality calculation units 150 and 250 have substantially the same configuration, and thus detailed description thereof is omitted. Hereinafter, the external interface unit 360 of the network abnormality detection device 300 according to the present embodiment will be described.

  Similar to the external interface unit 280 according to the second embodiment described above, the external interface unit 360 is a functional unit for transmitting data to the external device 390 and receiving a request from the external device 390. The external interface unit 360 includes, for example, an interface such as RC-232C, USB, and RJ45, and can be connected to an external device 390 such as a computer to transmit and receive data. The external interface unit 360 receives the calculation result of the abnormality level calculated by the abnormality level calculation unit 350 and transmits the result data to the connected external device 390. The data transmitted by the external interface unit 360 includes at least abnormality degree calculation result data, and in addition to that, index data used for calculating the degree of abnormality, and all or part of the packet used for generating the index data May also be included. Further, at the time of transmission, encryption processing may be performed in order to increase the safety of data.

  Further, as in the modification shown in FIG. 7, the network abnormality detection device 300 according to the present embodiment may be configured to include a packet filter unit 370 in addition to the configuration described above.

  The packet filter unit 370 is connected to the external interface unit 360, and functions to perform input / output data filtering settings for the first input / output unit 310 and the second input / output unit 320 in accordance with a filtering request from the external device 390. Part. A filtering request from the external device 390 is transmitted to the packet filter unit 370 through the external interface unit 360. When the packet filter unit 370 receives a filtering request signal from the external interface unit 360, the packet filter unit 370 transmits filtering information to the first input / output unit 310 and the second input / output unit 320. The filtering information includes information for determining whether or not the data should be permitted or blocked by the protocol, the transmission source address, the transmission destination address, or the port number.

  The first input / output unit 310 and the second input / output unit 320 perform filtering of input / output data based on the filtering information passed from the packet filter unit 370. Specifically, information such as the protocol to be permitted or blocked for transmission, the source address, the destination address or the port number is referenced from the filtering information to determine whether or not the input data is applicable. , Allow or block transmission. When transmission of data is permitted, input / output is performed by the first input / output unit 310 and the second input / output unit 320. Further, when data is blocked, it may be notified to the transmission source or the input data may be discarded.

  Although not shown, the network abnormality detection device 300 according to the present embodiment further includes a result output unit for outputting the calculation result of the degree of abnormality as in the first and second embodiments described above. It may be configured. Further, similarly to the second embodiment, a result data holding unit for holding calculation result data may be further included so that the calculation result data can be transmitted to the outside at an arbitrary timing.

  Next, the network abnormality detection processing according to the present embodiment will be described based on FIG. Here, FIG. 8 is a flowchart showing a flow of processing for detecting a traffic abnormality from packet data transmitted from the internal and external networks. 8, S301 to S307 indicate processing in the network abnormality detection device 300 according to the present embodiment, and S391 to S393 are in the external device 390 such as a PC connected to the network abnormality detection device 300 according to the present embodiment. Indicates processing.

  Of the network abnormality detection processes according to the present embodiment, the processes of S301 to S305 are the same as S101 to S105 and S201 to S205 of the network abnormality detection processes according to the first and second embodiments described above (FIG. 3 and FIG. 5), the detailed description is omitted. Hereinafter, the processes of S306 to S307 and S391 to S393 will be described.

  In step S306, the data of the abnormality degree calculation result calculated in step S305 is transmitted to the external device 390. The transmitted data includes at least the calculation result data of the degree of abnormality. Besides that, the index data used for calculating the degree of abnormality, all or part of the data of the packet used to generate the index data, etc. May be included. Further, at the time of transmission, an encryption process may be performed in order to increase the safety of data.

  When the external device 390 receives the data, it analyzes the abnormality level data and determines whether there is an abnormality to be detected (step S391). Further, if necessary, the data may be displayed in a graph, or a user may be notified of a coping method when it is determined to be abnormal by means such as e-mail.

  In step S392, if it is determined that there is an abnormality, whether to perform packet filtering is determined based on whether the abnormality is highly urgent.

  When performing packet filtering, in step S393, a signal requesting packet filtering is transmitted from the external device 390 to the network abnormality detection device 300.

  Upon receiving the packet filtering request signal from the external device 390, the network abnormality detection device 300 performs setting for performing filtering control in the input / output unit (step S307).

  The network abnormality detection method according to the present embodiment has been described above. With this method, as a result of analyzing the traffic abnormality in the external device, the part that is determined to require immediate countermeasures can immediately control the network by performing packet filter control from the external device. Can defend against attacks. Since the time required for spreading the worm is very short, the method of notifying the user by e-mail or the like is very effective when the response cannot be made in time.

(First modification)
Next, based on FIG. 9, the 1st modification of the network abnormality detection apparatuses 100-300 concerning the 1st-3rd embodiment is demonstrated. In the present modification, a network abnormality detection apparatus 400 that is configured to prevent data passing through the network abnormality detection apparatus from passing through the data totaling unit will be described. Here, FIG. 9 is a block diagram illustrating a first modification of the network abnormality detection devices 100 to 300 according to the first to third embodiments. In addition, about each component which comprises the network abnormality detection apparatus 400, since it is the same as that of 1st-3rd embodiment, detailed description of each component is abbreviate | omitted.

  In the present modification, the configuration of the network abnormality detection device other than the modified portion will be described as being the same as the configuration of the network abnormality detection device according to the first embodiment (FIG. 1). The configuration of the embodiment may be used.

  In the network abnormality detection device 400 according to this modification, the first input / output unit 410 and the second input / output unit 420 are connected, and input / output to / from the device through the first input / output unit 410 and the second input / output unit 420. Data is directly transmitted between the first input / output unit 410 and the second input / output unit 420.

  More specifically, the first input / output unit 410 duplicates data input from the network, sends one to the second input / output unit 420, and sends the other to the data totaling unit 430. Similarly, the second input / output unit 420 duplicates data input from the network, sends one to the first input / output unit 410, and sends the other to the data totaling unit 430. The data totaling unit 430 outputs data only to the index data holding unit 440 and the abnormality degree calculating unit 450 and does not send data to the first input / output unit 410 and the second input / output unit 420.

  With such a configuration, it is possible to reduce the load on the data totaling unit, and it is possible to deal with large-capacity traffic. Furthermore, since direct data transfer is performed between the first input / output unit and the second input / output unit, there is an effect that the influence on the communication speed can be reduced.

(Second modification)
Next, a second modification of the network abnormality detection devices 100 to 300 according to the first to third embodiments will be described with reference to FIG. In this modification, a network abnormality detection apparatus 500 having a configuration in which a switch unit that distributes the destination of traffic passing through the network abnormality detection apparatus will be described. Here, FIG. 10 is a block diagram illustrating a second modification of the network abnormality detection devices 100 to 300 according to the first to third embodiments. In addition, about each component which comprises the network abnormality detection apparatus 500, since it is the same as that of 1st-3rd embodiment, detailed description of each component is abbreviate | omitted.

  Note that, in the present modification as well, the configuration of the network abnormality detection device other than the modification is the same as the configuration of the network abnormality detection device according to the first embodiment (FIG. 1). However, the configurations of the second and third embodiments may be used.

  The network abnormality detection device 500 according to this modification includes a switch unit 570 connected to the first input / output units 510 and 511 and the second input / output unit 520. The switch unit 570 transmits data input from the first input / output units 510 and 511 to the second input / output unit 520. In addition, the switch unit 570 extracts a transmission destination from the data input from the second input / output unit, selects a corresponding one of the first input / output units 510 and 511, and selects the selected first Data is transmitted to one input / output unit. The switch unit 570 may be a layer 2 switch, a layer 3 switch, or a software switch, a so-called router device.

  In addition, here, in order to simplify the description, the first input / output unit is described as being two, but may be three or more.

  With such a configuration, an effect of detecting a traffic abnormality can be obtained by replacing an existing device such as a switch, and there is an effect that installation and management are easier than installing a new device.

(Fourth embodiment)
Next, a network abnormality detection system according to a fourth embodiment of the present invention will be described based on FIG. FIG. 11 is a block diagram showing a schematic configuration of a network abnormality detection system 600 according to the fourth embodiment of the present invention.

  As shown in FIG. 11, the network abnormality detection system 600 according to the fourth embodiment of the present invention includes network abnormality detection devices 610 to 630 and an analysis server 660. The network abnormality detection devices 610 to 630 and the analysis server 660 are connected via a network 650. The network abnormality detection device may be directly connected to the network like the network abnormality detection devices 610 and 620, or may be connected to the network via an information processing device such as the PC 640 like the network abnormality detection device 630.

  The network abnormality detection system 600 according to the present embodiment has a degree of abnormality obtained from a plurality of devices by installing network abnormality detection devices capable of detecting a traffic abnormality at a plurality of monitoring points on the network. By using data mutually, anomaly detection with higher accuracy is performed. Hereinafter, each of the network abnormality detection devices 610 to 630 and the analysis server 660 will be described.

  The network abnormality detection devices 610 to 630 have the same configuration as the network abnormality detection devices 200 to 300 according to the second to third embodiments of the present invention described above, and detailed descriptions of the components are omitted. . The network abnormality detection devices 610 to 630 transmit calculation result data relating to the degree of traffic abnormality to the analysis server 660 via the network 650. The timing at which the data is transmitted may be transmitted immediately after the network abnormality detection devices 610 to 630 perform the calculation process or automatically at predetermined time intervals. It may be transmitted in response to the request signal. The transmitted data includes at least the calculation result data of the degree of abnormality. Besides that, the index data used for calculating the degree of abnormality, all or part of the data of the packet used to generate the index data, etc. May be included.

  The analysis server 660 analyzes the abnormality degree data transmitted from the network abnormality detection devices 610 to 630, and performs abnormality determination based on the transition of the parameter value of each data. For example, when two or more network abnormality detection devices detect an abnormality at the same time, determine whether the cause of each abnormality is occurring in the same type of element. Judge that there is a high possibility of an abnormality caused by the same cause, such as the same type of worm.

  Thus, when a worm is generated in a wide area and abnormal traffic is generated, the same kind of abnormality is detected by a plurality of network abnormality detection devices, thereby comparing the abnormality degree data of the plurality of network abnormality detection devices. This makes it possible to detect anomalies with high accuracy as soon as possible.

  The network abnormality detection system 600 according to the present embodiment has been described above. In the present embodiment, the description has been given assuming that there are three network abnormality detection devices and one analysis server, but the number may be more than that.

  As mentioned above, although preferred embodiment of this invention was described referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to the example which concerns. It will be apparent to those skilled in the art that various changes and modifications can be made within the scope of the claims, and these are naturally within the technical scope of the present invention. Understood.

It is a block diagram which shows schematic structure of the network abnormality detection apparatus concerning the 1st Embodiment of this invention. It is the schematic which shows the network abnormality detection apparatus concerning the embodiment. It is a flowchart which shows the network abnormality detection process concerning the embodiment. It is a block diagram which shows schematic structure of the network abnormality detection apparatus concerning the 2nd Embodiment of this invention. It is a flowchart which shows the network abnormality detection process concerning the embodiment. It is a block diagram which shows schematic structure of the network abnormality detection apparatus concerning the 3rd Embodiment of this invention. It is a block diagram which shows the modification of the network abnormality detection apparatus concerning the embodiment. It is a flowchart which shows the network abnormality detection process concerning the embodiment. It is a block diagram which shows schematic structure of the 1st modification of the network abnormality detection apparatus concerning the 1st-3rd embodiment of this invention. It is a block diagram which shows schematic structure of the 2nd modification of the network abnormality detection apparatus concerning the 1st-3rd embodiment of this invention. It is a block diagram which shows schematic structure of the network abnormality detection system concerning the 4th Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Network abnormality detection apparatus 110 1st input / output part 120 2nd input / output part 130 Data totaling part 140 Index data holding part 150 Abnormality degree calculation part 160 Result output part 170 LAN
180 User terminal 190 Internet

Claims (14)

A network anomaly detection device that detects anomalies in traffic flowing on the network,
A first input / output unit for inputting / outputting data to / from the internal network;
A second input / output unit for inputting / outputting data to / from an external network;
A data totaling unit for totaling data for detecting traffic abnormality based on data input from the first input / output unit and the second input / output unit;
An index data holding unit that holds data aggregated during a certain period in the past by the data aggregation unit as index data used as an index when calculating the degree of traffic abnormality;
Abnormality calculation for calculating traffic abnormality using the evaluation data collected at the abnormality degree calculation time by the data aggregation unit to detect traffic abnormality and the indicator data acquired from the indicator data holding unit And
A network abnormality detection device comprising:   The data totaling unit transmits data input from the first input / output unit to the second input / output unit, and transmits data input from the second input / output unit to the first input / output unit. The network abnormality detection device according to claim 1, wherein:   The first input / output unit duplicates data input from the internal network and sends one of the data to the second input / output unit, and the second input / output unit receives data input from the external network. The network abnormality detection device according to claim 1, wherein one of the data is duplicated and sent to the first input / output unit. A switch unit connected to one or more of the first input / output unit and the second input / output unit;
The switch part is
Transmitting data input from each of the one or more first input / output units to the second input / output unit;
The first input / output unit corresponding to a destination of data input from the second input / output unit is determined, and data is transmitted to the first input / output unit. The network abnormality detection device according to any one of the above.   The network abnormality detection device according to claim 1, further comprising an external interface unit that transmits calculation result data calculated by the abnormality degree calculation unit to the external device. A result data holding unit that holds calculation result data calculated by the abnormality degree calculation unit;
The external interface unit is used to calculate the calculation result data acquired from the result data holding unit and the calculation result data acquired from the index data holding unit in response to a request from the external device. The network abnormality detection device according to claim 5, wherein index data is transmitted to the external device. The data totaling unit passes a part or all of input data input from the first input / output unit or the second input / output unit to the index data holding unit,
The index data holding unit holds the index data obtained by totaling the input data in the data totaling unit and a part or all of the input data in association with each other,
The external interface unit transmits part or all of the input data associated with the index data together with the calculation result data and the index data to the external device. Network error detection device. A packet filter unit connected to the first input / output unit, the second input / output unit, and the external interface unit;
The packet filter unit performs filtering control of data input / output by the first input / output unit and the second input / output unit in response to a filtering request received from the external device through the external interface unit. The network abnormality detection device according to claim 5, wherein: A network anomaly detection method for detecting an anomaly in traffic flowing on a network,
A data aggregation stage for aggregating data for detecting traffic anomalies based on data input from internal and external networks;
An index data holding stage for holding the data aggregated in the data aggregation stage as index data used as an index when calculating the degree of traffic abnormality;
An index data acquisition stage for acquiring the index data aggregated during the past certain period;
An anomaly degree calculation step of calculating an anomaly degree of traffic using the index data acquired in the indicator data acquisition stage and the evaluation data aggregated in the data aggregation stage at a traffic anomaly degree calculation time;
A network abnormality detection method comprising:   The network abnormality detection method according to claim 9, further comprising a result data transmission step of transmitting calculation result data, which is a result calculated in the abnormality degree calculation step, to an external device. A result data holding step for holding the result calculated in the abnormality degree calculation step as calculation result data;
In response to an inquiry from the external device, a result data acquisition step of acquiring the calculation result data and the index data used for the calculation of the calculation result data;
Further including
The network abnormality detection method according to claim 10, wherein in the result data transmission step, the index data acquired in the result data acquisition step is transmitted to the external device together with the calculation result data. A packet data holding step of holding a part or all of input data input from the internal network and the external network in association with the index data obtained by aggregating the input data;
12. The result data transmission step, wherein a part or all of the input data associated with the index data is transmitted to the external device together with the calculation result data and the index data. The network abnormality detection method described.   The network abnormality detection method according to claim 10, further comprising a filtering control step of performing filtering control of input / output data in response to a filtering request from the external device. A plurality of network anomaly detection devices that aggregate data input from the network and calculate traffic anomalies from the aggregated data;
An analysis server connected to the plurality of network abnormality detection devices via a network and detecting a traffic abnormality by comparing a plurality of abnormality degree data respectively transmitted from the plurality of network abnormality detection devices;
Including
The analysis server determines that an abnormality has occurred in traffic when there is a plurality of abnormality degree data in which an abnormality is detected from the same element among the plurality of abnormality degree data. Network anomaly detection system.

Images