JP2008098766A - Intrusion detector and intrusion detection program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent attack detection processing from getting saturated even against a large number of attacks. <P>SOLUTION: The intrusion detector has a processing load control means of performing control for: monitoring a data state associated with the processing load on an attack monitoring means; increasing or decreasing the attack detection degree of a selected detection item of a signature being used at present in a signature file according to change in data state; updating the signature by renewing a version number; restarting a read of the updated signature into the attack monitoring means each time the signature is updated; counting detection logs output by the attack monitoring means; and outputting one corresponding detection log each time the counted value exceeds a threshold set based upon the attack detection degree of each detection item of the updated signature. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an intrusion detection system (IDS) that detects unauthorized access to a computer or the like, and more particularly to an unauthorized intrusion detection device and an unauthorized intrusion detection program that enable load control during a large amount of attack detection processing. Is.

As is well known, a firewall is widely known as one of security means for protecting an organization's network. On the other hand, an unauthorized intrusion detection device (for example, see Patent Document 1) that has been used in combination with this firewall and that monitors and detects communication packets that reach an organization's network has recently appeared. The reason is that the function of the conventional firewall only performs whether the communication is allowed to pass or the communication is discarded based on the setting contents. Specifically, only information about the transmission source, destination, and requested service type in communication is inspected. On the other hand, the unauthorized intrusion detection device has a function of judging whether it is normal communication or an attack by looking at the content of the request.
For example, assume a case where a port scan is started by a cracker. In the case of a firewall, access to a user port for which the user is not authorized is naturally recorded in log information as an abnormal event. However, the system administrator determines whether the abnormal event is actually a port scan. For this reason, the system administrator is required to detect that there is an event that is rejected by using consecutive port numbers, and to determine that the content is a port scan. (Rule base) is required to be constantly updated.

  On the other hand, the unauthorized intrusion detection device has a function of automatically determining that a port scan is performed when a communication packet that is accessed by sequentially changing the port number is detected. Therefore, when combined with a firewall, the work cost of the system administrator can be greatly reduced. In other words, the intrusion detection device automatically determines whether the communication is normal or an attack, thereby greatly reducing the work of the system administrator who changes the rule base of the firewall necessary for defense. can do. In addition, the unauthorized intrusion detection apparatus is also designed to extract from the transmitted / received communication packet what seems to be abnormal as a detection log and record it in a form that can be easily queried later.

  Since communication called an attack always includes pattern information for performing an attack, the unauthorized intrusion detection apparatus creates detection logic describing these known attack patterns and registers them in data called a signature. When a communication packet is acquired from the network, matching is performed using a signature for each communication packet, an attack determination is made as to whether the communication is attack communication or normal communication, and a detection log is detected for the packet determined to be an attack. Create and output. Therefore, there is a problem that the processing load of the unauthorized intrusion detection device increases when the amount of communication packets that are illegally intruded per unit time increases. Therefore, in general, as an introduction form of the unauthorized intrusion detection device, after most attacks are narrowed down by the firewall, the unauthorized intrusion detection device determines and detects communication packets passing through the firewall. However, it is no longer possible to deal with attacks that send a large number of illegal packets as described below.

  By the way, recently, unauthorized access to computers, etc. has been rampant, but in particular, unauthorized access through the network, that is, attacks, sending unauthorized data to the other computer or router etc., making it unusable, There is a so-called DDoS attack (Distributed Denial of Service Attack) that increases traffic and paralyzes the other party's network. In the case of this DDoS attack, an attack program is set on a third party machine to be used as a platform, and a large number of packets are simultaneously transmitted from a large number of machines as the platform to a target machine. As a result, when there are a plurality of attack sources and a single target computer as described above, the load for defense on the target computer becomes enormous. At present, there is no way to prevent DDoS attacks at least completely even though some countermeasures can be taken, and this is a threat to the fundamentals of the Internet.

There is also an evaluation program called STICK for evaluating the processing performance of the network type unauthorized intrusion detection apparatus. This is a free software tool that sends a large amount of “information to be detected” defined in the rule set of a network-type intrusion detection device and generates many false warning notifications from the intrusion detection device. is there. This is because it is possible to generate a large number of pseudo-attack packets in a short period of time, so that the attacker generates many false warning notifications using STICK for concealing the attack, and DDoS There is a problem of creating a state similar to an attack and reducing or disabling the performance of the intrusion detection device.
There are several countermeasures against the DDoS attack as described above, but in any case, it has to be relied on by the system administrator and is often overlooked.

Japanese Patent Laying-Open No. 2005-210601 (FIG. 1)

  As described above, according to the conventional network-type unauthorized intrusion detection apparatus, when the network traffic increases due to the DDoS attack, the system administrator is likely to miss out and the analysis process cannot follow. In particular, in the case of an attack that far exceeds the analysis capability of the unauthorized intrusion detection device, the analysis processing of the attack detection log is saturated, and in the worst case, the function of the unauthorized intrusion detection device itself is forced to stop. There was a problem.

  The present invention has been made to solve the above problems, and obtains an unauthorized intrusion detection apparatus and an unauthorized intrusion detection program that can prevent saturation of attack detection processing even for a large number of attacks. With the goal.

  The unauthorized intrusion detection apparatus according to the present invention performs an attack determination by matching a communication packet information acquired from a network with a signature in which a detection logic describing a pattern of an unauthorized intrusion technique is registered, and a detection log determined as an attack. In the intrusion detection device equipped with the attack monitoring means that creates and outputs the attack detection frequency is set for each of the various detection items described in the detection logic used by the attack monitoring means, and the version number is The signature file that stores one attached signature and the data state related to the processing load of the attack monitoring means are monitored, and the signature that is currently used for the signature file is selected according to the change in the data state. The detection number of detected items is increased or decreased, and the version number is changed. And the signature is updated every time the update is performed, the reading of the updated signature into the attack monitoring means is restarted, the detection log output by the attack monitoring means is counted, and the count value is updated. And a processing load control means for controlling to output one corresponding detection log every time a threshold set based on the attack detection frequency for each detection item is exceeded.

  According to the present invention, even when a large amount of communication packets intended for an attack are acquired and attack determination / detection processing is executed, an abnormal increase in processing load in attack determination / detection processing of the attack monitoring means can be suppressed. As a result, it is possible to suppress an increase in CPU (Central Processing Unit) load and to prevent the apparatus from being stopped.

Embodiment 1 FIG.
FIG. 1 is a block diagram showing a functional configuration of a network system including an unauthorized intrusion detection device according to Embodiment 1 of the present invention.
An unauthorized machine 401, a normal machine 402, a server 403, and the like are appropriately connected to the network 400 to which the unauthorized intrusion detection apparatus 100 is connected, and a communication packet flows on the network 400.
In the configuration of the unauthorized intrusion detection apparatus 100, a packet capture unit 101, an attack monitoring unit (consisting of an attack determination unit 102 and an attack detection unit 103) 120, a signature reading unit 110, a signature file 110a, a detection log output availability determination unit 105, a detection The log output unit 106 and the signature update unit 109 are functions substantially corresponding to the conventional configuration. In particular, the attack monitoring unit 120 is a part corresponding to the unauthorized intrusion detection apparatus 200 in FIG. The signature update unit 109 is a part that has been manually operated by a system administrator.
On the other hand, the processing load control unit 121 surrounded by a broken line is a main component for achieving the object of the present invention, and includes the signature update unit 109 and the detection log output availability determination unit 105, and includes detection attack information management. Unit 104, detection attack history file 104a, CPU load monitoring unit 107, signature update content creation unit 108, version number file 109a, signature history file 109b, and version number extraction unit 112.

  The packet capture unit 101 is a means for acquiring a communication packet from the network 400, connecting related packets into continuous information, storing it in a memory area (not shown), and reading and outputting it to the attack monitoring unit 120. is there. The attack determination unit 102 is a unit that performs attack determination by matching the communication packet information acquired by the packet capture unit 101 with the signature. The attack detection unit 103 is a unit that creates and outputs a detection log for communication packet information identified as a specific attack as a result of the attack determination. The detection log output availability determination unit 105 is a unit that determines whether the detection log output from the attack detection unit 103 should be output to the subsequent stage based on a threshold value. The detection log output unit 106 is a unit that outputs the detection log and the alert from the detection log output permission determination unit 105 to the management unit 200 side. The signature file 110a is a means for storing a signature to be used for attack determination matching. Here, a detection logic describing a known illegal intrusion technique pattern is registered in the signature. For example, the protocol type, port number, and character string (eg, SQL SLAMMR, Ping Sweep) are registered in this detection logic. ) And other detection items for detecting the target attack. The signature describes the attack name, the degree of attack detection set for each detection item (the number of attack detections per unit time), the signature version number, and the like. As will be described later, in the present invention, one feature is that the attack detection frequency and the version number of the selected detection item are changed and controlled.

  The signature reading unit 110 is a unit that reads a signature used for matching when the attack monitoring unit 120 determines an attack from the signature file 110a. The CPU load monitoring unit 107 is means for constantly monitoring whether the CPU load of the process including the unauthorized intrusion detection device 100 exceeds a predetermined threshold. The version number file 109a is a means for storing the version number of the signature used in the current attack determination by the attack monitoring unit 120. The version number extraction unit 112 is a means for acquiring the version number of the signature currently in use from the version number file 109a according to the monitoring result of the attack monitoring unit 120. The detection attack information management unit 104 extracts the detection items and detection dates described in the detection log output by the attack monitoring unit 120, stores them in the detection attack history file 104a, and detects the detection described in the signature used for matching This is means for extracting the attack detection frequency of an item and outputting predetermined data in response to a request from another means. When the CPU load exceeds a predetermined threshold, the signature update content creation unit 108 obtains the detection items whose detection number is larger than the predetermined value and the detection number from the detection attack information management unit 104, and sets the detection frequency of each detection item. It is a means for creating a new attack detection frequency for each detection item by calculating and multiplying each detection frequency by a coefficient that decreases at a predetermined rate. The signature update unit 109 detects the signature to be updated while changing the version number between old and new and changing the attack detection frequency of the detection item selected for the signature corresponding to the version number acquired by the version number extraction unit 112 This is means for storing the item, version number, and date / time as signature history in the signature history file 109b, and restarting reading of the updated signature into the attack monitoring unit 120 for each update.

First, an operation corresponding to an attack determination / detection process by a conventional component will be described.
In FIG. 1, when the packet capture unit 101 acquires a communication packet from the network 400, the packet capture unit 101 reconstructs communication data having one meaning (hereinafter referred to as “communication packet information”) to reconstruct the attack monitoring unit. 120 is output. Upon receiving the communication packet information, the attack determination unit 102 activates the signature reading unit 110, reads the signature from the signature file 110a, performs matching between the communication packet information and the signature, and the communication packet information is the data of unauthorized intrusion. Perform an attack determination process. Specifically, after processing such as analysis of the IP header part, IP defragmentation, header part for each protocol, and session management for TCP communication, there is data that matches the detection items included in the signature. If there is a match, it is determined as abnormal or attack communication.

Next, the attack detection unit 103 executes an attack detection process on the communication packet information determined as an attack by the attack determination unit 102 according to the detection logic described in the signature. Specifically, the detection logic described in the signature for the analysis data performed by the attack determination unit 102, for example, “the protocol is TCP, the port is 80, and the data part includes ***. Is checked according to a known attack pattern such as “*** Attack on WEB”, and various detection items specified by the signature used in the matching are detected. In this case, the detection item detection method is performed according to the attack detection frequency of each detection item set in the signature. For example, if a detection item is detected once every 10 seconds, a detection log is output, or if a detection item is detected 10 times in 10 seconds, the detection log is output for the first time. The contents of the detection log output in this case include an attack name, an alert, a transmission source IP address, a detection item, a detection date and time, and the like.
In the case of the conventional detection log output availability determination unit 105, the detection log output from the attack detection unit 103 is counted, and every time the count value exceeds a preset threshold or a threshold that can be manually changed. One corresponding detection log is output. When the detection log is output from the detection log output permission determination unit 105, the detection log output unit 106 extracts an alert from the detection log, and outputs the data together with the detection log to the management unit 200.

Next, the signature update processing by the processing load control unit 121 according to the present invention will be described according to the flow of FIG.
Here, it is assumed that an initial version number (default value, for example, “0”) is first described in the signature to be used stored in the signature file 110a. It is assumed that the version number file 109a stores the initial version number of the signature to be used. The signature reading unit 110 reads the signature to be used into the attack monitoring unit 120 when the first attack determination process is activated.
Further, in a state where the attack monitoring unit 120 is performing the attack determination / detection process, the detected attack information management unit 104 extracts the detection item and the detection date / time from the detection log output by the attack monitoring unit 120 as needed to detect the detected attack history. It is assumed that the attack detection frequency of the detection item described in the signature used correspondingly and stored in the file 104a is extracted and output to the detection log output permission determination unit 105.

  The CPU load monitoring unit 107 constantly monitors the CPU load state (data state related to the processing load of the attack monitoring unit 120) that controls the operation including the unauthorized intrusion detection apparatus 100 (step ST1). Here, when it is detected that the CPU load has continuously exceeded a predetermined threshold (for example, 90%) for a certain period of time, that is, the load is likely to become abnormal. (Step ST2), the CPU load monitoring unit 107 outputs the load detection information to the version number extraction unit 112. When receiving the detection information, the version number extraction unit 112 reads the version number of the signature currently in use from the version number file 109a and passes it to the signature update content creation unit 108 together with the load detection information (step ST3). When the received load detection information indicates an increase in CPU load, the signature update content creation unit 108 requests predetermined data used to create signature update content from the detected attack information management unit 104. In response to this request, the detection attack information management unit 104 extracts a plurality of detection items whose detection number is larger than a predetermined value and the detection number in a predetermined period retroactive from the present time, and passes them to the signature update content creation unit 108. The signature update content creation unit 108 calculates the detection frequency from the acquired detection numbers of the plurality of detection items, and multiplies the calculated detection frequency by a coefficient (for example, uniform ½) that decreases at a predetermined rate. A new attack detection frequency for each detection item is created and passed to the signature update unit 109 together with the load detection information, attack name, and initial version number given from the version number extraction unit 112 (step ST6).

  When the received load detection information indicates an increase in CPU load, the signature update unit 109 reads the signature corresponding to the initial version number from the signature file 110a and changes the signature to the new version number with the initial version number set to +1. In addition, based on the new attack detection frequency of each detection item created by the signature update content creation unit 108, the attack detection frequency of the corresponding detection item described in the signature is changed, and the signature file is used as a signature to be used. The signature reading unit 110 is restarted so as to read the updated signature into the attack monitoring unit 120. Also, the new version number of the signature changed at this time is recorded in the version number file 109a as the version number of the signature currently in use (step ST8).

As a result of the signature update process described above, the attack monitoring unit 120 performs matching using a signature having a new version number, and generates and outputs a detection logic determined to be an attack. In this case, the detection processing of various detection items performed in the attack detection unit 103 depends on the attack detection frequency of the detection item set in the signature, and therefore, these attack detection frequencies are lower than those of the initial version number. The processing load is also reduced. This series of signature update processing is repeated in the direction in which the version number increases until the CPU load settles to a safe state below the threshold.
In step ST8, when the signature update unit 109 updates the signature as described above, the detection item, version number, and date / time of the updated signature are stored in the signature history file 109b as a signature history. This is because it is necessary to grasp the attack detection frequency at the update time when analyzing the frequency of attack detection.

On the other hand, contrary to the above case, when the CPU load monitoring unit 107 detects that the CPU load has become lower than the threshold for a certain time (step ST2), the CPU load monitoring unit 107 changes the load detection information to the version. The number is output to the number extraction unit 112. When receiving the detection information, the version number extraction unit 112 reads the version number of the signature currently in use from the version number file 109a and passes it to the signature update content creation unit 108 together with the load detection information (step ST4). If the received load detection information indicates a decrease in CPU load, signature update content creation section 108 checks whether or not the obtained version number is an initial value (step ST5). If it is not the initial value, the version number is passed to the signature update unit 109 together with the load detection information (step ST7). In the signature update unit 109, when the load detection information indicates a decrease in CPU load, the version number received from the signature update content creation unit 108 is set to -1 to be the version number of the next signature to be used, and this reduction is performed. The signature corresponding to the version number is changed from the signature history file 109b to the signature having the latest date, and the signature reading unit 110 is restarted so that the updated signature is read into the attack monitoring unit 120. At this time, the signature update unit 109 records the reduced version number in the version number file 109a as the version number of the signature currently in use (step ST8). In other words, this update data is a signature in which the attack detection frequency of the detection item is set one generation before, that is, the update contents one generation before.
Therefore, since the attack detection frequency of the detection item set in the signature is higher than that of the current version number, the processing load on the attack detection unit 103 also increases. The signature update process in this case is repeated until the signature currently used is the initial version number. The subsequent operation of the processing load control unit 121 shifts to an operation in which the CPU load monitoring unit 107 lowers the attack detection frequency again when the CPU load exceeds the threshold value.

  As described above, it has been described that a series of signature update processing is automatically performed and control / control of attack determination / detection processing according to the load status of the entire apparatus is executed. However, in this case, the output frequency of the detection log output from the attack monitoring unit 120 is changed by the attack determination / detection process. For this reason, if the threshold used in the detection log output enable / disable determination unit 105 is constant as in the prior art, the output frequency of the detection log output to the detection log output unit 106 also changes. Therefore, it is necessary to regulate the detection log output processing by adjusting the threshold value of the detection log output permission determination unit 105 to stabilize the detection log output frequency.

  The detection log output propriety determination unit 105 of the present invention automatically changes the setting of the output propriety threshold based on the attack detection frequency of each detection item described in the signature currently in use that is always acquired by the detection attack information management unit 104. To do. For example, the average value of the attack detection frequency of each detection item is taken and the value is set as a threshold value. As a result, the threshold value for whether or not output is possible can be set high when the output frequency of the detection log increases, and conversely when the output frequency of the detection log decreases. That is, the detection log output availability determination unit 105 calculates the output frequency by counting the number of detection log outputs output by the attack monitoring unit 120, and adds one corresponding detection log each time the output frequency exceeds this threshold. Thus, the output frequency of the detection log given to the detection log output unit 106 can be stabilized.

  The processing by the unauthorized intrusion detection apparatus 100 described above can be executed by a computer using a program. In this case, the program performs an attack determination by matching the communication packet information acquired from the network with the signature currently used read from the signature file 110a, and creates and outputs a detection log determined as an attack. The attack monitoring step, and the detection items and the detection date and time are extracted from the detection log output in this attack monitoring step, stored in the detection attack history file 104a, and the attack detection frequency of the detection items described in the signature used correspondingly A detection attack history information acquisition step for extracting information, a load monitoring step for constantly monitoring whether the CPU load for controlling the operation of the computer exceeds a predetermined threshold, and a version number file according to the monitoring result in the load monitoring step Signature version currently in use since 109a A version number extracting step for acquiring a number, a detection item in which the number of detections in a predetermined period retroactive to the present from the data of the detection attack history file 104a when the CPU load exceeds a predetermined threshold, A detection item / detection number extraction step for extracting the number of detections, and a detection frequency for each extracted detection item are calculated, and a new factor for each detection item is calculated by multiplying the calculated detection frequency by a factor that decreases at a predetermined rate. The signature corresponding to the version number acquired in the attack detection frequency creation step and the version number extraction step for creating the attack detection frequency is read from the signature file 110a and changed to the next version number obtained by increasing the version number of the signature, And new attacks for each detection item created in the attack detection frequency creation step Based on the knowledge number, the attack detection degree of the corresponding detection item described in the signature is changed and stored in the signature file 110a as the signature to be used, and at the same time, the updated signature is read to restart the execution of the attack monitoring step. A signature update step of storing the version number of the updated signature in the version number file 109a as a number currently in use, and storing the detection item, version number, and date / time of the signature to be updated in the signature history file 109b as a signature history; , Set the threshold of whether or not to output based on the attack detection frequency of each detection item described in the signature currently in use obtained in the detection attack history information acquisition step, count the detection log output in the attack monitoring step, Numerical value is this threshold A detection log output availability determination step for outputting one corresponding detection log each time the number exceeds.

  Further, the signature update step of this program changes the version number acquired in the version number extraction step to the previous version number used in the past when the CPU load is equal to or less than the threshold value in the load monitoring step, The signature history file 109b with the latest version number used in the past and the signature of the latest date is read, the execution of the attack monitoring step is restarted, and the version number of the signature targeted for activation is currently being used. The number is stored in the version number file 109a as a number.

  As described above, according to the first embodiment, the detection items described in the signature used for matching of the attack determination / detection process are matched according to the state of the CPU load that performs the operation control including the attack determination / detection process. Since signature update processing that changes and adjusts the setting of attack detection frequency is performed, even when a large amount of communication packets for attack are acquired and attack determination / detection processing is executed, the processing load increases abnormally As a result, it is possible to prevent an increase in CPU load and prevent the apparatus from being stopped. In addition, the threshold used in the detection log output enable / disable determination process is changed and adjusted based on the attack detection frequency of the detection item described in the signature changed by the signature update process. It is possible to stabilize the output frequency of the output detection log.

Embodiment 2. FIG.
FIG. 3 is a block diagram showing a functional configuration of a network system including an unauthorized intrusion detection device according to Embodiment 2 of the present invention. In the figure, portions corresponding to those in FIG. 1 are denoted by the same reference numerals, and description thereof will be omitted in principle. The configuration of FIG. 3 is different in that the CPU load monitoring unit 107 of FIG. 1 is not provided and a detection log output monitoring / update content creation unit 111 is provided instead of the signature update content creation unit 108. In the first embodiment, the CPU load state is constantly monitored. In the second embodiment, the detection log output frequency (data state related to the processing load of the attack monitoring unit 120) is periodically monitored. There is a feature in this point. Therefore, the detection log output monitoring / update content creation unit 111 has a function of monitoring the processing load in the attack monitoring unit 120 in addition to the processing performed by the signature update content creation unit 108 shown in FIG. 1 of the first embodiment. .

Next, the signature update processing in the second embodiment will be described according to the operation flow shown in FIG.
In FIG. 3, the detection log output monitoring / update content creation unit 111 periodically obtains the same detection log of the detection items output from the attack monitoring unit 120 to the detection attack information management unit 104 and calculates the output frequency. The output frequency is monitored by periodically obtaining a detection log for each signature item from the detection attack information management unit 104 (step ST11). For this reason, in the detection log output monitoring / update content creation unit 111, a threshold (for example, 20 times in a fixed time) regarding the output frequency of the detection log of the same detection item is set in advance. When the output frequency of the detection log acquired in a certain time exceeds this threshold (step ST12), the detection log output monitoring / update content creation unit 111 stores the current number stored in the version number file 109a with respect to the version number extraction unit 112 Request the version number of the signature in use and get the version number. Next, the detection log output monitoring / update content creation unit 111 requests the detection attack information management unit 104 for predetermined data used to create signature update content. In response to this request, the detection attack information management unit 104 extracts a plurality of detection items whose detection number is larger than a predetermined value and the detection number in a predetermined period retroactive to the present, and outputs the detection number to the detection log output monitoring / update content creation unit 111 hand over. The detection log output monitoring / update content creation unit 111 calculates a detection frequency from the acquired detection numbers of a plurality of detection items, and a coefficient that decreases the calculated detection frequency at a predetermined rate (for example, uniform 1/2). And a new attack detection frequency for each detection item is created and passed to the signature update unit 109 together with the initial version number and output frequency detection information given from the version number extraction unit 112 (step ST13).

In the signature update unit 109, when the received detection information of the output frequency indicates an increase in processing load, the signature corresponding to the initial version number is read from the signature file 110a, and the initial version number of the signature is set to +1. And change the attack detection degree of the corresponding detection item described in the signature based on the new attack detection degree of each detection item created by the detection log output monitoring / update content creation unit 111 to be used The signature reading unit 110 is restarted so as to read the updated signature into the attack monitoring unit 120 (step ST16). Also, the new version number of the signature changed at this time is recorded in the version number file 109a as the version number of the signature currently in use.
In addition, when the signature is updated as described above, the signature update unit 109 stores the detection item, version number, and date / time of the updated signature in the signature history file 109b as a signature history.

On the other hand, contrary to the above case, when the output frequency of the detection log acquired in a certain time is lower than the threshold (step ST12), the detection log output monitoring / update content creating unit 111 is similar to the above. The version number of the signature currently in use is acquired from the version number file 109a via the version number extraction unit 112 (step ST14), and it is checked whether or not the acquired version number is an initial value (step ST15). If it is not the initial value, the version number is passed to the signature update unit 109 together with the output frequency detection information (step ST15). In the signature update unit 109, if the detection information of the output frequency indicates a reduction in processing load, the version number received from the detection log output monitoring / update content creation unit 111 is set to −1, and the version of the signature to be used next The signature corresponding to the reduced version number is changed from the signature history file 109b to the signature having the latest date, and the signature reading unit 110 is restarted to read the updated signature into the attack monitoring unit 120. At this time, the signature update unit 109 records the reduced version number in the version number file 109a as the version number of the signature currently in use (step ST16). That is, this update data becomes a signature in which the attack detection frequency of the detection item is set one generation before.
Thereafter, control of detection log output processing by the detection log output permission determination unit 105 is performed in the same manner as in the first embodiment.

  The program for causing the computer to perform the processing of the second embodiment described above makes an attack determination by matching the communication packet information acquired from the network with the signature of the current use target read from the signature file 110a. An attack monitoring step for generating and outputting a detection log determined to be an attack, extracting a detection item and a detection date and time from the detection log output in the attack monitoring step, and storing them in the detection attack history file 104a. The detection attack history information acquisition step for extracting the attack detection frequency of the detection item described in the signature used in this way, and the number of outputs of the same detection log collected in this detection attack history information acquisition step are periodically acquired for a certain period of time, Monitors whether the output frequency of the acquired detection log exceeds a preset threshold An intelligent log output frequency monitoring step, a version number extracting step for acquiring a version number of a signature currently in use having the same detection item from the version number file 109a according to the monitoring result in the detection log output frequency monitoring step, and a detection log output In the frequency monitoring step, when the output frequency of the detection log exceeds a preset threshold value, the detection number in the detection attack history file 104a is detected with a detection number greater than a predetermined value from a current period. The detection item / detection number extraction step for extracting the item and its detection number, the detection frequency is calculated for each extracted detection item, and each detection item is multiplied by a coefficient that reduces the calculated detection frequency at a predetermined rate. An attack detection frequency creation step for creating a new attack detection frequency for A signature corresponding to the version number acquired in the number extraction step is read from the signature file 110a, changed to the next version number obtained by increasing the version number of the signature, and new detection items created in the attack detection frequency creation step The attack detection frequency of the corresponding detection item described in the signature is changed based on the specific attack detection frequency and stored as a signature to be used in the signature file 110a. At the same time, the updated signature is read to execute the attack monitoring step. The version number of the updated signature is stored in the version number file 109a as a currently used number, and the signature history file 10 is used with the signature detection item, version number, date and time to be updated as a signature history. A threshold value for whether or not to output is set based on the attack detection frequency of each detection item described in the signature currently in use obtained in the signature update step stored in 9b and the detected attack history information acquisition step, and is output in the attack monitoring step A detection log output availability determination step for counting the detection log and outputting one corresponding detection log each time the count value exceeds a set threshold value.

  Further, the signature update step of this program changes the version number acquired in the version number extraction step to the previous version number used in the past when the detection information of the output frequency indicates a reduction in processing load, Read the signature of the previous date and the latest date used in the past from the history file 109b, restart the execution of the attack monitoring step, and use the version number of the signature as the activation target that is currently in use Is stored in the version number file 109a.

  As described above, according to the second embodiment, the attack detection frequency of the detection item described in the signature used for matching is set according to the state of the output frequency of the detection log output in the attack determination / detection process. As in the first embodiment, even when a large amount of communication packets intended for an attack are acquired and the attack determination / detection process is executed, the processing load An abnormal increase can be suppressed, and as a result, an increase in CPU load can also be suppressed to prevent the apparatus from being stopped. In addition, the threshold used in the detection log output enable / disable determination process is changed and adjusted based on the attack detection frequency of the detection item described in the signature changed by the signature update process. It is possible to stabilize the output frequency of the output detection log. In the case of the second embodiment, since the output frequency of the detection log is monitored, the configuration is more advantageous than the first embodiment in which the CPU load is monitored.

It is a block diagram which shows the function structure of the network system containing the unauthorized intrusion detection apparatus by Embodiment 1 of this invention. It is a flowchart explaining the signature update process of the processing load control part which concerns on Embodiment 1 of this invention. It is a block diagram which shows the function structure of the network system containing the unauthorized intrusion detection apparatus by Embodiment 2 of this invention. It is a flowchart explaining the signature update process of the processing load control part which concerns on Embodiment 2 of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 unauthorized intrusion detection apparatus, 101 packet capture part, 102 attack determination part, 103 attack detection part, 104 detection attack information management part, 104a detection attack history file, 105 detection log output availability determination part, 106 detection log output part, 107 CPU Load monitoring unit, 108 signature update content creation unit, 109 signature update unit, 109a version number file, 109b signature history file, 110 signature reading unit, 110a signature file, 111 detection log output monitoring / update content creation unit, 112 version number extraction Unit, 120 attack monitoring unit, 121 processing load control unit.

Claims (9)

Attack monitoring means that performs attack determination by matching the communication packet information acquired from the network with the signature registered detection logic describing the pattern of unauthorized intrusion, and creates and outputs a detection log determined as an attack Intrusion detection device equipped with
A signature file that stores one signature with a version number and an attack detection frequency for each of the various detection items described in the detection logic used in the attack monitoring means;
The data state related to the processing load of the attack monitoring means is monitored, and the attack detection frequency of the selected detection item of the signature currently used in the signature file is increased or decreased according to the change in the data state In addition, the signature is updated by changing the version number between old and new, and for each update, reading of the updated signature into the attack monitoring unit is restarted, and the detection log output by the attack monitoring unit is displayed. A processing load control unit that counts and controls to output one corresponding detection log each time the counted value exceeds a threshold set based on the attack detection frequency for each detection item of the updated signature An intrusion detection device characterized by The processing load control means
A version number file that stores the version number described in the signature used by the attack monitoring means for the current attack determination;
Detection attack history file,
A signature history file,
Extract detection items and detection date and time from the detection log output by the attack monitoring means, store them in the detection attack history file, extract the attack detection frequency of the detection items described in the signature used correspondingly, etc. Detection attack information management means for outputting predetermined data in response to a request from the means;
Load monitoring means for constantly monitoring whether or not the CPU load for executing processing including the device exceeds a predetermined threshold;
Version number extraction means for obtaining a version number of a signature currently in use from the version number file according to the monitoring result of the load monitoring means;
When the version number acquired when the CPU load exceeds a predetermined threshold value from the version number extraction unit, a request is made to the detection attack information management unit, and the data is stored in the detection attack history file. The number of detection items and the number of detections that have been extracted within a predetermined period that extends from the present are collected, and the detection frequency of each detection item is calculated, and the detection frequency is decreased by a predetermined rate. Signature update content creation means for creating a new attack detection frequency for each detection item by multiplying each by a coefficient that gives
The detection corresponding to the version number acquired by the version number extraction unit is read from the signature file, changed to the next version number obtained by increasing the version number of the signature, and each detection created by the signature update content creation unit Based on the new attack detection frequency of the item, the attack detection frequency of the corresponding detection item described in the signature is changed and stored as a target signature in the signature file, and at the same time, the updated signature is read into the attack monitoring means The version number of the updated signature is stored in the version number file as a currently used number, and the signature history file includes the updated signature detection item, version number, and date / time as a signature history. And signature updating means for storing,
Based on the attack detection frequency of each detection item described in the signature currently in use obtained from the detection attack information management means, set a threshold value of whether to output, count the detection log output by the attack monitoring means, The unauthorized intrusion detection apparatus according to claim 1, further comprising: a detection log output permission determination unit that outputs one corresponding detection log every time the count value exceeds a set threshold value.   The signature update means changes the version number acquired by the version number extraction means to the previous version number used in the past when the CPU load is less than or equal to the threshold value by the load monitoring means, Reboot to read the signature with the latest version number and the latest date used in the past into the attack monitoring means, and use the version number of the signature as the activation target as the currently used number in the version number file. The unauthorized intrusion detection apparatus according to claim 2, wherein the unauthorized intrusion detection apparatus is stored. The processing load control means
A version number file that stores the version number of the signature used by the attack monitoring means for the current attack determination;
Version number extraction means for obtaining the version number of the signature currently in use from the version number file in response to a request from another;
Detection attack history file,
A signature history file,
Extract detection items and detection date and time from the detection log output by the attack monitoring means, store them in the detection attack history file, extract the attack detection frequency of the detection items described in the signature used correspondingly, etc. Detection attack information management means for outputting predetermined data in response to a request from the means;
Whether the same detection log output by the attack monitoring unit from the detection attack information management unit is periodically acquired for a certain period of time to calculate the output frequency of the detection log, and whether the calculated output frequency exceeds a preset threshold value Is constantly monitored, and if it exceeds, the version number extracting means obtains the version number of the signature currently in use from the version number file, and sends a request to the detected attack information management means to detect the detected attack history file. The number of detection items and the number of detections that have been extracted from the data, and the number of detections in the predetermined period retroactive from the present time is greater than the predetermined value, and the detection frequency of each detected detection item is calculated individually. Detection log output monitoring / update that creates a new attack detection frequency for each detection item by multiplying each by a factor that gives a decrease at a predetermined rate And the contents creation means,
The signature of the version number acquired by the version number extraction unit is read from the signature file, changed to the next version number obtained by increasing the version number of the signature, and created by the detection log output monitoring / update content creation unit Based on the new attack detection frequency of each detection item, the attack detection frequency of the corresponding detection item described in the signature is changed and stored as a signature to be used in the signature file. At the same time, the updated signature is stored in the attack monitoring unit. And the version number of the updated signature is stored in the version number file as a currently used number, and the signature history file includes the updated signature detection item, version number and date / time as a signature history. And signature updating means for storing,
Based on the attack detection frequency of each detection item described in the signature currently in use obtained from the detection attack information management means, set a threshold value of whether to output, count the detection log output by the attack monitoring means, The unauthorized intrusion detection apparatus according to claim 1, further comprising: a detection log output permission determination unit that outputs one corresponding detection log every time the count value exceeds a set threshold value.   The signature update means uses the version number acquired from the version number file in the past when the output frequency of the detection log calculated by the detection log output monitoring / update content creation means falls below a preset threshold value. Change to the previous version number, restart from the signature history file so that the signature with the latest version number and the latest date used in the past is read into the attack monitoring means. 5. The unauthorized intrusion detection apparatus according to claim 4, wherein the version number is stored in the version number file as a number currently in use. A signature file that stores one signature with a version number and an attack detection frequency for each of the various detection items described in the detection logic describing the pattern of unauthorized intrusion, and a signature history Installed on a computer with a signature history file that stores the signature history, a version number file that stores the version number of the signature used for the current attack determination, and a detected attack history file, and acquired from the network Is an unauthorized intrusion detection program that executes an attack monitoring step that executes an attack determination step by creating a detection log that is determined to be an attack and outputting the detected log by matching the currently used target signature read from the signature file. There,
A detection attack that extracts a detection item and a detection date and time from the detection log output in the attack monitoring step, stores the detection item in the detection attack history file, and extracts an attack detection frequency of the detection item described in the correspondingly used signature History information acquisition step;
A load monitoring step of constantly monitoring whether or not the CPU load for controlling the operation of the computer exceeds a predetermined threshold;
A version number extraction step for obtaining the version number of the signature currently in use from the version number file according to the monitoring result in the load monitoring step;
When the CPU load exceeds a predetermined threshold, a detection item in which the number of detections in a predetermined period retroactive from the present time is larger than a predetermined value and a detection item for extracting the detection number from the data of the detection attack history file A detection number extraction step;
An attack detection frequency creation step of calculating a detection frequency for each of the extracted detection items and creating a new attack detection frequency for each detection item by multiplying the calculated detection frequency by a coefficient that gives a decrease at a predetermined rate, and
The signature corresponding to the version number acquired in the version number extraction step is read from the signature file, changed to the next version number obtained by increasing the version number of the signature, and each detection created in the attack detection frequency creation step Based on the new attack detection frequency of the item, the attack detection frequency of the corresponding detection item described in the signature is changed and stored as a target signature in the signature file, and at the same time, the updated signature is read and the attack monitoring step Is executed, the version number of the updated signature is stored in the version number file as a currently used number, and the detected items and version number of the updated signature are stored in the signature history file as a signature history. And signature updating step of,
Based on the attack detection frequency of each detection item described in the signature currently in use obtained in the detection attack history information acquisition step, a threshold value for output availability is set, the detection log output in the attack monitoring step is counted, An unauthorized intrusion detection program comprising: a detection log output availability determination step for outputting one corresponding detection log each time a numerical value exceeds a set threshold value.   The signature update step changes the version number acquired in the version number extraction step to the previous version number used in the past when the CPU load is equal to or less than the threshold value in the load monitoring step, and the signature history file The signature with the latest version number used in the past and the latest date is read, the execution of the attack monitoring step is restarted, and the version number of the signature as the activation target is set as the currently used number. 7. The unauthorized intrusion detection program according to claim 6, which is stored in a file. A signature file that stores one signature with a version number and an attack detection frequency for each of the various detection items described in the detection logic describing the pattern of unauthorized intrusion, and a signature history Installed on a computer with a signature history file that stores the signature history, a version number file that stores the version number of the signature used for the current attack determination, and a detected attack history file, and acquired from the network Is an unauthorized intrusion detection program that executes an attack monitoring step that executes an attack determination step by creating a detection log that is determined to be an attack and outputting the detected log by matching the currently used target signature read from the signature file. There,
A detection attack that extracts a detection item and a detection date and time from the detection log output in the attack monitoring step, stores the detection item in the detection attack history file, and extracts an attack detection frequency of the detection item described in the correspondingly used signature History information acquisition step;
A detection log that periodically acquires the number of detections of the same detection log of the detection items collected in the detection attack history information acquisition step for a certain period of time and monitors whether the output frequency of the acquired detection log exceeds a preset threshold value Output frequency monitoring step;
A version number extracting step of acquiring a version number of a signature currently in use from the version number file according to a monitoring result in the detection log output frequency monitoring step;
In the detection log output frequency monitoring step, when the detection frequency of the detection log exceeds a preset threshold value, a predetermined retroactive data from the detection attack history file data based on the detection item A detection item / detection number extraction step for extracting a detection item whose detection number in the period is larger than a predetermined value and the detection number,
An attack detection frequency creation step of calculating a detection frequency for each of the extracted detection items and creating a new attack detection frequency for each detection item by multiplying the calculated detection frequency by a coefficient that gives a decrease at a predetermined rate, and
The signature corresponding to the version number acquired in the version number extraction step is read from the signature file, changed to the next version number obtained by increasing the version number of the signature, and each detection created in the attack detection frequency creation step Based on the new attack detection frequency of the item, the attack detection frequency of the corresponding detection item described in the signature is changed and stored in the signature file as a target signature, and at the same time, the updated signature is read and the attack monitoring step Is executed, the version number of the updated signature is stored in the version number file as a currently used number, and the detected items and version number of the updated signature are stored in the signature history file as a signature history. And signature updating step of,
Based on the attack detection frequency of each detection item described in the signature currently in use obtained in the detection attack history information acquisition step, set a threshold value of whether to output, count the detection log output in the attack monitoring step, An unauthorized intrusion detection program comprising: a detection log output permission determination step for outputting one corresponding detection log each time the count value exceeds a set threshold value.   In the signature update step, the version number acquired in the version number extraction step is changed to the previous version number used in the past, and the signature having the latest version number in the past from the signature history file is used. 9. The unauthorized intrusion according to claim 8, wherein the execution of the attack monitoring step is restarted, and the version number of the signature to be activated is stored in the version number file as a currently used number. Detection program.

Images