JP2009118138A - Method for detecting route hijacking, route monitor and system and program for detecting route hijack - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect a route hijack without depending upon an IRR database. <P>SOLUTION: A PING test result to a route to be hijacked is received from route monitors 100A to 100C in a network by a route monitor 100E. When a degree of similarity of the PING test results in the route monitors 100A to 100C detecting the route to be hijacked and the PING test result detecting no route to be hijacked is lowered to a specified threshold or smaller by comparing both PING test results in this case, the occurrence of the route hijack is decided. Then, when the degree of similarity exceeds the specified threshold, no occurrence of the route hijack is decided. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a path hijack detection technique.

  The Internet is an organic connection of 10,000 or more ASs (autonomous systems) operated by ISPs (commercial providers, Internet service providers) and different organizations such as companies and universities. The ASs are connected by a dedicated line or IX (Internet eXchange).

  AS route control devices (routers) exchange each other's route information by BGP (Border Gateway Protocol), and based on the exchanged route information, determine a route for transferring data to a predetermined network. To do. This route information includes a prefix and a path attribute. This prefix is also called a route, and is information indicating an IP (Internet Protocol) address space as a destination by a network address and a netmask length of the network address (hereinafter also referred to as a route length). The path attribute is attribute information of the route added to the route information, and includes, for example, an AS path (AS path attribute), a next hop (next hop attribute), and the like. This AS path is a list of AS AS numbers that are routed to reach the destination AS, and the next hop is the next router (node) when sending a packet to the IP address space (prefix) that is the destination. ) Is an information indicating the IP address.

  BGP is a path vector type routing protocol, and route information advertised by a certain AS propagates each AS hop-by-hop and spreads throughout the Internet. For example, in the process of propagation of this route information, each AS router adds the AS number of its own AS to the AS path attribute. By using the AS number added to the route information in this way, each router can know which AS the packet having the prefix should reach via which AS.

  However, incorrect route information may be advertised due to operator setting mistakes or malicious settings, and the incorrect route information may be propagated throughout the Internet. A specific example of this incorrect route information advertisement is route hijacking. This route hijacking means that an AS that is not originally assigned a network address advertises the network address or part of the route information from its own AS. When this route hijacking occurs and incorrect route information propagates throughout the Internet, the packet for that network address is forwarded to the AS that advertised the incorrect route information. Therefore, a failure occurs in communication with the AS to which the network address is properly assigned.

  This path hijack will be described in detail with reference to the drawings. FIG. 6 is a diagram conceptually illustrating the path hijacking.

  Here, the network is AS-A (AS number “65010”), AS-B (AS number “65020”), AS-C (AS number “65030”), AS-D (AS number “65040”) and AS. An example in which -E (AS number “65050”) is included will be described. Each AS exchanges route information with each other and creates a route table. For example, a router (not shown) of AS-E (AS number “65050”) transmits route information of “10.0.0.0/16” to each AS (AS-A, AS-B, AS-C, When advertising to the AS-D router, the AS-A, AS-B, AS-C, and AS-D routers create route tables 1001 (1001A, 1001B, 1001C, and 1001D), respectively. That is, the original advertisement route indicated by reference numeral 1002 (1002A, 1002B, 1002C, 1002D) is added to the route table 1001 (1001A to 1001D).

  Each AS router transfers a packet based on the route table 1001 created in this way. For example, a packet addressed to “10.0.0.0/16” is assigned to AS (AS-B) with AS number “65020” → AS number “65050” based on the route information indicated by reference numeral 1002A in route table 1001A. It is transferred via a route called AS (AS-E). That is, first, the AS-A router transfers the packet addressed to “10.0.0.0/16” to the AS-B router based on the route information indicated by reference numeral 1002A in the route table 1001A. Next, the AS-B router that has received this packet transfers the packet to the AS (AS-E) having the AS number “65050” based on the route information indicated by reference numeral 1002B in the route table 1001B.

  Here, (1) when the AS-D router advertises the route information of a part of the AS-E prefix (“10.0.0.0/24”), AS-A, AS-B, AS Information that the advertisement source of the route information of the prefix “10.0.0.0/24” is the AS number “65040” is written in the route table 1001 (1001A, 1001B, 1001C) of the −C router ( (Refer to the hijack path indicated by reference numerals 1003A, 1003B, and 1003C).

  (2) Thus, a packet addressed to “10.0.0.0/16” that should be transferred to AS-E (AS number “65050”) is sucked into AS-D (AS number “65040”). As a result, the packet does not reach AS-E. That is, since the router of AS-B determines the transfer destination of the packet by referring to the route information of the hijack route 1003B, not the route information of the original advertisement route 1002B, the packet is AS-D (AS number “ 65040 ").

  When each AS router transfers a packet, the hijacking route (“10.0” shown in reference numeral 1003B) is used instead of the original advertising route (“10.0.0.0/16”) shown in reference numeral 1002B. .0.0 / 24 ") is selected because when the route table 1001 includes a plurality of route information including the destination address, the router uses the longest match rule for selecting route information having a longer netmask length. is there.

  Conventionally, as a technology for detecting such route hijacking, each route monitoring device distributed in each AS collates data of IRR database (Internet Routing Registry database) with route information to detect route hijacking. There exists a technique to do (refer patent document 1). The IRR database is a database showing route information (IP address space) on the Internet and a valid AS number assigned to the route. This technique will be described with reference to FIG.

FIG. 7 is a diagram illustrating a technique as a comparative example of the present invention. As shown in FIG. 7, a path monitoring device that monitors path information exchanged between the ASs is installed in each AS. Here, for example, the (0) AS-E route monitoring device monitors “10.0.0.0/16” for other route monitoring devices (AS-A, AS-B, AS-C, AS- (1) Each route monitoring device starts monitoring “10.0.0.0/16”. (2) Here, when the route information “10.0.0.0/24” is received from another AS, (3) the AS number of the route and the origin of the route information in this route information Is compared with data in the IRR database to determine whether or not this route “10.0.0.0/24” has been hijacked. (4) Then, the route monitoring device notifies the determination result to AS-E (AS-E route monitoring device) which is the monitoring request source. (5) Thereafter, if the determination result is a route hijack, an alarm is notified to the operator. For example, when the AS-E route monitoring device receives a notification that “10.0.0.0/24” has been hijacked, an alarm for the occurrence of a route hijacking is sent to the operator who manages the AS-E route. Will be notified.
JP 2006-25088 A

  However, the path hijack detection with reference to the IRR database is based on the premise that the data is registered without omission in the data of the IRR database. For this reason, if there is omission of registration in the data of the IRR database, the following problems may occur. This problem will be described with reference to FIG. FIG. 8 is a diagram for explaining a problem in the technique of FIG. Constituent elements similar to those in FIG. Here, the case where the monitoring target route in each route monitoring device is “10.0.0.0/16” will be described as an example.

  (0) For example, first, AS-E allocates “10.0.0.0/24” to the customer network. That is, the AS-E allocates “10.0.0.0/24”, which is a part of the IP address “10.0.0.0/16” that is legally owned, to the customer network. The AS-E is connected to this customer network through a static route. (1) Thereafter, the customer network connects to AS-D to ensure redundancy, and connects to AS-D via a static route. (2) Then, AS-D advertises “10.0.0.0/24”, which is legitimately held by the customer network, from AS-D. (3) After that, when the route information of “10.0.0.0/24” advertised from this AS-D is received by the route monitoring device of each AS, this route becomes the monitoring target route “10.0.0.0”. 0.04 ”, (4) collate with IRR database. (5) Here, in the IRR database, if there is no data of origin “AS number 65040 (AS-D)” for route “10.0.0.0/24”, each route monitoring device has a route hijack. It determines with having generate | occur | produced and notifies AS-E of this determination result. That is, if there is omission of data registration in the IRR database, there is a possibility that the AS-E is notified to that effect even though the route is not hijacked.

  Accordingly, an object of the present invention is to solve the above-described problems and enable detection of a path hijack without depending on an IRR database.

  In order to solve the above-mentioned problem, the invention according to claim 1 detects a hijack route by monitoring route information exchanged by BGP (Border Gateway Protocol) in each AS (Autonomous System) by a plurality of route monitoring devices. When the route monitoring device in the route hijack detection system receives suspected hijack detection information indicating the IP address space of the suspected hijacking route that may be the hijacking route, the other route monitoring device Requesting each to execute a PING test on the IP address space indicated by the suspected hijack detection information, and each IP address of the IP address space indicated by the suspected hijacking route information in its own route monitoring device Performing a PING test on the other route monitoring device; Receiving the result of the PING test from each of them, recording the result of the PING test executed by the path monitoring device and the result of the received PING test in the storage unit, and the recorded PING Of the test results, the degree of similarity between the PING test result in the route monitoring device that transmitted the suspected hijack detection information and the PING test result in the route monitoring device that did not transmit the suspected hijack detection information. A step of calculating, a step of determining that there is a high possibility that a path hijack has occurred in the IP address space indicated by the suspected hijack detection information when the calculated similarity is equal to or less than a predetermined threshold a; And a step of outputting the determination result via an output unit. It was the detection method.

  The invention according to claim 6 is a route hijack detection system in which route information exchanged by BGP (Border Gateway Protocol) in each AS (Autonomous System) is monitored by a plurality of route monitoring devices and a route hijack is detected. The suspected hijacking detection information indicating the IP address space of the suspected hijacking route that may be the hijacking route and the input / output unit that controls input / output of various data. A hijack information receiving unit, a test requesting unit that requests each of the other route monitoring devices to execute a PING test on the IP address space indicated in the suspected hijack detection information, and a suspected hijack detection information A test to record the result of the PING test in the storage unit. A test result receiving unit that receives the result of the PING test from each of the row unit and each of the other path monitoring devices and records the result of the PING test in the storage unit, and among the recorded results of the PING test, Calculating the similarity between the PING test result in the path monitoring device that has transmitted the suspected hijack detection information and the PING test result in the path monitoring device that has not transmitted the suspected hijack detection information; When the similarity is equal to or lower than a predetermined threshold value, a hijack determination unit that determines that there is a high possibility that a path hijack has occurred in the IP address space indicated by the suspected hijack detection information, and outputs the determination result And a determination result notifying unit.

  According to an eighth aspect of the present invention, there is provided a path hijack detection system including a plurality of path monitoring devices according to the seventh aspect.

  In this way, when a suspected hijacking route is detected, the route monitoring device requests each AS route monitoring device to perform a PING test on the suspected hijacking route. The result of the PING test in the route monitoring device in which the suspected hijacking path is detected is not similar to the result of the PING test in the other route monitoring device (that is, the suspected hijacking route has not been detected). If there is, there is a high possibility that the IP address space reached by each PING test is a different IP address space, so it can be determined that there is a high possibility that a path hijack has actually occurred in the suspected hijack path. That is, the route monitoring device can detect a route hijack without depending on the IRR database.

  According to a second aspect of the present invention, in the path hijack detection method according to the first aspect, the PING test result in the path monitoring apparatus in which the path monitoring apparatus has transmitted the suspected hijack detection information, and the suspected high jack The PING test result in the route monitoring device that did not transmit the jack detection information is described as a vector, the vector of the PING test result in the route monitoring device that transmitted the suspected hijack detection information is added, and the suspected A step of adding the vectors of the PING test results in the route monitoring device that did not transmit hijack detection information, calculating an angle θ formed by the added vectors, and an absolute value of the calculated angle θ is a predetermined value. When larger than the threshold value b, the IP address shown in the suspected hijack detection information is empty. A step of determining that there is a high possibility that a path hijack has occurred in between.

  By doing in this way, the route monitoring device makes a vector the degree of similarity between the result of the PING test in the route monitoring device in which the suspected hijacking route is detected and the result of the PING test in the other route monitoring devices. It can be calculated by the angle θ. Here, as the result of the PING test in the path monitoring device in which the suspected hijacking path is detected is not similar to the result of the PING test in the path monitoring apparatus in which the suspected hijacking path is not detected, the absolute angle θ The larger the value, the smaller the absolute value of the angle θ. That is, as the absolute value of the angle θ increases, the IP address space reached by each PING test is more likely to be a different IP address space, so the route monitoring device determines that the possibility that a route hijack has occurred is higher. it can. For example, if the IP address space of the suspected hijacking path is 256 (that is, “/ 24”), the vector X of the result of the PING test in the path monitoring device may be OK for each PING test result. For example, “1” and “−1” for NG are described as a vector X = [x0, x1, x2,..., X255].

  According to a third aspect of the present invention, in the path hijack detection method according to the second aspect, an average value of vectors of the PING test results in the path monitoring apparatus in which the path monitoring apparatus transmits the suspected hijack detection information. And calculating the average value of the vectors of the PING test result in the path monitoring device that did not transmit the suspicious hijack detection information, and between the end points when the respective starting points of the calculated vectors are matched And a step of determining that there is a high possibility that a path hijack has occurred in the IP address space indicated by the path information of the suspected hijack when the calculated distance is greater than a predetermined threshold c. And executing.

  By doing so, the similarity between the result of the PING test in the route monitoring device in which the suspected hijacking route is detected and the result of the PING test in the route monitoring device in which the suspected hijacking route is not detected is calculated between the vectors. It can be calculated by distance.

  According to a fourth aspect of the present invention, in the route hijack detection method according to any one of the first to third aspects, the route monitoring device has the calculated similarity exceeding the predetermined threshold a. When the absolute value of the calculated angle θ is less than or equal to the predetermined threshold value b, or when the calculated distance is less than or equal to the predetermined threshold value c, the IP address space indicated in the suspected hijack detection information is The step of determining that the possibility that a path hijacking has occurred is low is executed.

  By doing in this way, when the result of the PING test in the route monitoring device in which the suspected hijacking path is detected is similar to the result of the PING test in the route monitoring device in which the suspected hijacking route is not detected, Since the IP address space reached by each PING test is highly likely to be the same IP address space, the route monitoring device can determine that the possibility that a route hijack has occurred is low. Thereby, the path monitoring device can prevent erroneous detection of path hijacking.

  According to a fifth aspect of the present invention, in the route hijack detection method according to any one of the first to third aspects, the storage unit of the route monitoring device is an IP of the monitoring target route in the route monitoring device. The monitoring target route information indicating the address space, the legitimate AS number assigned to the IP address space, and the identification information of the destination route monitoring device of the monitoring result of the IP address space, and the route control device of its own AS The route monitoring device stores the route information about the route information included in the IP address space indicated by the monitoring target route information in the IP address space indicated by the route information of the storage unit. Whether the AS number of the IP address space indicated in the information has route information of a suspected hijack route different from the AS number of the route to be monitored is monitored. When it is determined that there is route information of the suspected hijacking route different from the AS number of the route to be monitored, the suspected hijacking detection information indicating the IP address space of the suspected hijacking route is stored in the IP address space. When a request for a PING test indicating the IP address space to be subjected to the PING test is received from another path monitoring device, the step of transmitting the monitoring result to the destination route monitoring device, and the IP address of the IP address space A step of executing a PING test for each of them, and a step of transmitting the executed PING test to a path monitoring apparatus that is a request source of the PING test are performed.

  The invention according to claim 7 is the route monitoring device according to claim 6, wherein the storage unit is an IP address space of a route to be monitored in the route monitoring device, and a valid AS number assigned to the IP address space. And the monitoring target route information indicating the identification information of the destination route monitoring device of the monitoring result of the IP address space, and the route information held by the own AS route control device, the test execution unit, When a request for a PING test indicating an IP address space to be subjected to a PING test is received from another path monitoring device, the PING test is executed for each IP address in the IP address space. Among the route information, the route information included in the IP address space indicated in the monitoring target route information is the IP indicated in the route information. When it is determined whether there is route information of the suspected hijack route different from the AS number of the monitored route, and the AS number of the dress space is determined to have route information different from the AS number of the monitored route, A route monitoring unit that transmits the suspected hijack detection information indicating the IP address space of the suspected hijacking route to a route monitoring device that is a transmission result of the monitoring result of the IP address space, and a result of the executed PING test. And a test result transmission unit for transmitting to the route monitoring device that is the request source of the PING test.

  By doing in this way, each path | route monitoring apparatus can acquire the result of the PING test with respect to this suspicious hijack path | route from the path | route monitoring apparatus which detected the suspicious hijack path | route.

  According to a ninth aspect of the present invention, there is provided a path hijack detection program that causes a path monitoring device that is a computer to execute the path hijack detection method according to any one of the first to fifth aspects. It was.

  According to such a program, it is possible to cause a general computer to execute the path hijack detection method according to any one of claims 1 to 5.

  According to the present invention, the route monitoring device can detect a route hijack without depending on the IRR database.

  Hereinafter, the best mode for carrying out the present invention (hereinafter referred to as an embodiment) will be described.

  First, the outline of the operation of the path hijack detection system will be described with reference to FIGS. 1 and 2. FIG. 1 and FIG. 2 are diagrams illustrating a path hijack detection system (hereinafter abbreviated as a system) including a path monitoring apparatus according to the present embodiment. The system is similar to FIG. 8 described above, and includes AS-A (AS number “65010”), AS-B (AS number “65020”), AS-C (AS number “65030”), AS-D (AS number). "65040") and AS-E (AS number "65050"). Then, each AS router exchanges route information with each other by BGP, and creates a route table 1001 (1001A, 1001B, 1001C, 1001D). The number of ASs and the number of route tables 1001 are not limited to the numbers shown in FIGS.

  For example, AS-E (AS number “65050”) has route information of “10.0.0.0/16” to each AS (AS-A, AS-B, AS-C, AS-D). When advertising, the router of each AS adds route information indicated by reference numerals 1002A, 1002B, 1002C, and 1002D to the route table 1001.

  Here, when “10.0.0.0/24” is hijacked by AS-D, the following occurs. That is, the AS-D advertises the route information related to “10.0.0.0/24”, which is originally a part of the AS-E prefix, and the routers of the AS-A, AS-B, and AS-C. Information indicating that the advertisement source of the prefix “10.0.0.0/24” route information is AS (AS-D) with the AS number “65040” is written in the route tables 1001A, 1001B, and 1001C (reference numerals 1004A, 1001). 1004B and 1004C refer to route information).

  In the following description, it is assumed that each AS router performs filtering so as not to receive route information related to a route in its own AS from another AS. For example, an AS-E router receives an advertisement of route information “10.0.0.0/16” or “10.0.0.0/24” of its own AS from another AS. Also discard.

  In addition, this system is comprised including the path | route monitoring apparatus 100 (100A, 100B, 100C, 100E). Then, each of the route monitoring devices 100 (100A to 100C, 100E) monitors the route table 1001 in the router in its own AS, and determines whether there is route information of the suspected hijack route. Note that whether or not the route table 1001 has route information of the suspected hijack route is determined as follows.

  That is, the route monitoring apparatus 100 sets monitoring route information (information indicating a route to be monitored (IP address space) and a valid AS number assigned to the route) in advance. Then, out of the route information of the route table 1001 in the own route monitoring device 100, the route (prefix) is included in the monitored route, and the route information different from the AS number assigned to the route in the monitored route information. Is detected as a suspected hijacking route (a route that may be a hijacking route). Here, the AS-E route monitoring device 100E that may have been hijacked may request the PING test to the route monitoring devices 100A to 100C that have detected the suspected hijacking route, and the suspected hijacking route may be An example will be described in which it is determined whether or not there is a high possibility of a hijack route.

  For example, when the (0-0) route monitoring devices 100A to 100C detect the suspected hijacking route "10.0.0.0/24", the route information is transmitted to the AS-E route monitoring device 100E. That is, when the route monitoring devices 100A to 100C monitor the route tables 1001A to 1001C and detect the suspicious hijacking routes 1004A to 1004C, the route information (suspected hijacking detection information) is changed to the valid AS (to which the route belongs). (AS-E) to the route monitoring apparatus 100E.

  (0-1) The route monitoring device 100E that has received such information requests each route monitoring device 100 (100A to 100C) to perform a PING test on the suspected hijacking route. That is, a PING test to “10.0.0.0/24” of AS-D is requested. The route monitoring device 100E also performs a PING test on the suspected hijack route “10.0.0.0/24”. That is, the path monitoring apparatus 100E executes the PING test to “10.0.0.0/24” of AS-E, and the PING reaches the original network.

  (1-0) The path monitoring apparatus 100 (100A to 100C) that has received the PING test request from the path monitoring apparatus 100E executes the PING test on the suspected hijack path “10.0.0.0/24”. . As a result, the PING reaches the network (AS-D “10.0.0.0/24”) that has been hijacked.

  (1-1) Thereafter, the route monitoring device 100 (100A to 100C) transmits the PING test result to the AS-E route monitoring device 100E.

  (1-2) Then, the route monitoring device 100E collects (receives) the PING test results from the route monitoring devices 100 (100A to 100C).

  (2-0) Next, the route monitoring device 100E determines the PING test result in the route monitoring device 100 (100A to 100C) that has detected the suspected hijacking route, and the route monitoring device 100 that has not detected the suspected hijacking route ( 100E) PING test results are compared.

  (2-1) When the route monitoring apparatus 100E determines that the suspected hijacking route is a hijacking route (high possibility of being a hijacking route) based on the comparison result, the route monitoring device 100E notifies the operator or the like. For example, the similarity between the PING test result in the route monitoring device 100 (100A to 100C) that detected the suspicious hijack route and the PING test result in the route monitoring device 100 (100E) that did not detect the suspicious hijack route If it is low, it is determined that there is a high possibility that the suspected hijacking route is a hijacking route. On the other hand, if the similarity between the PING test result in the route monitoring device 100 that detected the suspicious hijacking route and the PING test result in the route monitoring device 100 that did not detect the suspicious hijacking route is high, the suspicious hijacking route Is determined to be unlikely to be a hijack route.

  For example, as shown in FIG. 2, a customer network to which an IP address “10.0.0.0/24” is assigned by AS-E (AS number “65050”) is assigned to AS-E in addition to AS-E. In the case of a network configuration in which a static route is established with D (AS number “65040”), the route table 1001 of AS-A, AS-B, AS-C, and AS-D has reference numerals 1002A to 1002D as shown in FIG. The route information of “10.0.0.0/16” with the AS number “65050” as the advertisement source, and “10.0.0.0/16” with the AS number “65040” as indicated by reference numerals 1004A to 1004C. 0.0 / 24 "route information is registered. Thereby, the suspicious hijack route is detected in the route monitoring devices 100A to 100C. However, in the route monitoring device 100E, if it can be confirmed that the PING test results from each route monitoring device 100 to the suspected hijacking route “10.0.0.0/24” are substantially the same, as shown in FIG. It can be inferred that the network configuration. Therefore, the route monitoring device 100E determines that the possibility that the suspected hijacking route is a hijacking route is low, and can prevent misreporting of the route hijacking.

  In FIG. 1 and FIG. 2, only one route monitoring device 100 is installed in each AS, but a plurality of route monitoring devices 100 may be installed in each AS.

  Next, the route monitoring apparatus 100 will be described in detail with reference to FIG. FIG. 3 is a functional block diagram of the route monitoring apparatus of FIG. The route monitoring device 100 detects a suspicious hijack route from the route table 1001 and executes a PING test, and when the suspicious hijack route detection information is received from another route monitoring device 100. And a function for determining whether or not the suspected hijacking route is highly likely to be a hijacking route.

  As shown in FIG. 3, such a route monitoring device 100 includes an input / output unit 11 that controls input / output of various data of route information and route hijack detection information, and whether or not the suspected hijack route is a hijack route. A processing unit 12 that performs determination and the like, and a storage unit 13 that stores a route table 1001 and monitoring target route information 131 are provided.

  The input / output unit 11 includes an input / output interface that controls data input / output with a router or the like in the AS. The processing unit 12 is realized by a program execution process by a CPU (Central Processing Unit) included in the route monitoring apparatus 100, a dedicated circuit, or the like. Further, the storage unit 13 includes a storage medium such as a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), and a flash memory. When the route monitoring device 100 is realized by program execution processing, a route hijack detection program for realizing the function of the route monitoring device 100 is recorded in the storage unit 13.

<Input / output unit>
The input / output unit 11 receives route information from a router connected to the route monitoring device 100, suspected hijack detection information (details will be described later), and a PING test result from another route monitoring device 100. Further, when a suspected hijacking path is detected in its own route monitoring device 100, suspected hijacking detection information and a PING test result are transmitted.

<Processing unit>
The processing unit 12 controls the entire route monitoring device 100, and mainly includes a hijack determination processing unit 120 that determines whether or not the suspected hijacking route is a hijacking route, and a route table 1001 of its own route monitoring device 100. And a suspicious hijack detection unit 127 for detecting a suspicious hijacking route.

  The hijack determination processing unit 120 includes a suspicious hijack detection information reception unit 121, a test request unit 122, a test execution unit 123, a test result reception unit 124, a hijack determination unit 125, and a determination result notification unit 126. It is comprised including.

  The suspicious hijack detection information receiving unit 121 receives suspicious hijack detection information from another route monitoring apparatus 100. The suspicious hijack detection information includes, as illustrated in Table 1 below, the identification information of the suspicious hijack path (IP address space of the suspicious hijack path) and the path monitoring device 100 that is the transmission source of the suspicious hijack detection information. (IP address, etc.), and the AS number of the AS of the advertisement source of the suspected hijack route. For example, the suspected hijack detection information shown in Table 1 detects the suspected hijacking route “10.0.0.0/24” in the route monitoring device 100 (100C) whose identification information is “C”. It indicates that the AS number of the advertisement source AS on the suspected hijacking route is “65040”. The suspicious hijack detection information receiving unit 121 records the identification information of the route monitoring apparatus 100 that is the transmission source of the suspicious hijack detection information in a RAM or the like of the storage unit 13.

  The test request unit 122 requests each of the other route monitoring devices 100 to execute a PING test on the route (for example, “10.0.0.0/24”) indicated in the suspicious hijack detection information.

  The test execution unit 123 executes a PING test for the route (for example, “10.0.0.0/24”) indicated in the suspicious hijack detection information in its route monitoring device 100. The test execution unit 123 executes the PING test also by a request from the test requesting unit 122 of its own route monitoring device 100, and the PING test also by a request from the test requesting unit 122 of another route monitoring device 100. Execute. The PING test result at this time is recorded in the RAM of the storage unit 13 or the like.

  The test result receiving unit 124 receives the PING test result of the suspected hijack path (for example, “10.0.0.0/24”) from each of the other path monitoring devices 100. The PING test result received at this time is recorded in the RAM or the like of the storage unit 13 together with the identification information of the path monitoring device 100 that is the transmission source of the PING test result.

  The hijack determination unit 125 compares the PING test result from the route monitoring device 100 that detected the suspicious hijack route with the PING test result from the route monitoring device 100 that did not detect the suspicious hijack route. It is determined whether or not there is a high possibility that the jack path is a hijack path.

  For example, the hijack determination unit 125 is similar to the result of the PING test from the path monitoring device 100 that detected the suspected hijacking path and the result of the PING test from the path monitoring apparatus 100 that did not detect the suspected hijacking path. Calculate the degree. When the similarity is equal to or less than the predetermined threshold value a, the path monitoring device 100 is likely to have performed a PING test in a different IP address space, so the suspicious hijack path is likely to be a hijack path. Is determined. On the other hand, when the degree of similarity exceeds a predetermined threshold value a, it is highly likely that the route monitoring devices 100 have performed a PING test in the same IP address space, so it is determined that the possibility that the suspected hijacking route is a hijacking route is low. To do. Details of the determination processing at this time will be described later using a flowchart.

  In the hijack determination unit 125, among the PING test results recorded on the RAM of the storage unit 13, which PING test result is transmitted from the route monitoring device 100 that detects the suspected hijacking route, The determination is made based on the identification information of the path monitoring device 100 that is the transmission source of the suspected hijack detection information recorded on the RAM of the storage unit 13.

  The determination result notification unit 126 outputs the determination result by the hijack determination unit 125 to the outside.

  Next, the suspicious hijack detection unit 127 will be described. The suspected hijack detection unit 127 includes a route information update unit 128, a route monitoring unit 129, and a test result transmission unit 130.

  When the route information (not shown) in the route table of the router (not shown) connected to the route monitoring device 100 is updated, the route information update unit 128 updates the route table in the storage unit 13 based on this update information. 1001 is updated. That is, the route information update unit 128 creates the same route table 1001 as the route table of the router in the storage unit 13.

  The route monitoring unit 129 refers to the monitoring target route information 131 and monitors whether there is a suspected hijack route in the route information of the route table 1001. As illustrated in Table 2 below, the monitoring target route information 131 includes an IP address space (prefix) to be monitored, an AS number assigned to the IP address space, and a suspicious high in this IP address space. This is information indicating identification information and the like of the route monitoring device 100 as a notification destination (a transmission destination of suspected hijack detection information) when a jack route is detected.

  When the route monitoring unit 129 detects a suspected hijacking route from the route table 1001, suspected hijacking detection information indicating a prefix (IP address space) of the suspected hijacking route is indicated in the monitoring target route information 131. To the path monitoring device 100 of the transmission destination of the suspicious hijack detection information).

  For example, the route monitoring unit 129 monitors the route information as follows based on the monitoring target route information 131 illustrated in Table 2. First, the route monitoring unit 129 is included in the IP address space (for example, “10.0.0.0/16”) indicated by the monitoring target route information 131 in Table 2 among the route information in the route table 1001. Is monitored for whether there is an AS number (for example, “65050”) indicated in the monitoring target route information 131. Here, when the route information of the prefix “10.0.0.0/24” and the AS number “65040” is registered in the route table 1001, the route monitoring unit 129 indicates that the prefix of this route information is the route to be monitored. Although it is included in the prefix shown in the information 131, it is different from the AS number shown in the monitoring target route information 131, so this route is detected as a suspected hijack route. Then, the route monitoring unit 129 uses the route monitoring device 100 (route monitoring device) of the identification information “E” that is the transmission destination indicated in the monitoring target route information 131, based on the detected suspicious hijack detection information regarding the detected suspicious hijack route. 100E). Thereby, the route monitoring device 100E can know that the suspected hijacking route is detected in the other route monitoring devices 100A to 100C.

  The test result transmission unit 130 transmits the PING test result (test result) executed by the test execution unit 123 of its own route monitoring device 100 to the route monitoring device 100 that requested the PING test.

<Storage unit>
The storage unit 13 stores a route table 1001 and monitoring target route information 131. As shown in FIG. 1, the route table 1001 includes one or more pieces of route information, and each route information includes a prefix and an AS path of the prefix. The monitoring target route information 131 is information indicating the IP address space (prefix) to be monitored as described above and the AS number of the AS assigned to the IP address space. The monitoring target route information 131 is set via the input / output unit 11.

<Operation procedure>
Next, the operation procedure of the route monitoring apparatus 100 will be described with reference to FIGS. FIG. 4 is a flowchart showing an operation procedure of the route monitoring apparatus of FIG. Here, a case where the path monitoring device 100E receives suspected hijack detection information related to the suspected hijacking path detected in the path monitoring device 100C will be described as an example. Although the description is omitted in FIG. 4, it is assumed that the route monitoring device 100 (100C, 100E) collects router route information and updates the route table 1001 as needed.

  First, the route monitoring unit 129 (see FIG. 3) of the route monitoring device 100C in FIG. 1 refers to the monitoring target route information 131 and detects the suspected hijack route from the route table 1001C (S101). Then, the route monitoring unit 129 transmits the suspected hijack detection information indicating the route information of the suspected hijacking route to the route monitoring device 100E (S102). The transmission destination of the suspicious hijack detection information is specified with reference to the monitoring target route information 131.

  When the suspicious hijack detection information receiving unit 121 of the route monitoring device 100E receives the suspicious hijack detection information from the route monitoring device 100C, the storage unit stores the identification information of the route monitoring device 100 that is the transmission source of the suspicious hijack detection information. Record in 13. Then, the test request unit 122 requests the other route monitoring devices 100 (100A to 100C) to perform a PING test for the suspected hijacking route (for example, “10.0.0.0/24”) (S103). ).

  Thereafter, the test execution unit 123 of the route monitoring device 100E executes a PING test to the suspected hijack route (for example, “10.0.0.0/24”) in its AS (AS-E) ( S104). That is, the test execution unit 123 executes a PING test for the original network.

  In addition, the path monitoring apparatus 100C that has received the PING test request from the path monitoring apparatus 100E executes a PING test for the suspected hijack path (for example, “10.0.0.0/24”) (S105). That is, the test execution unit 123 of the route monitoring device 100E executes a PING test on the AS-D suspected hijack route (for example, “10.0.0.0/24”).

  Then, the test result transmission unit 130 of the path monitoring apparatus 100C that has executed the PING test transmits the PING test result to the path monitoring apparatus 100E (S106). Although not described here, the path monitoring apparatuses 100A and 100B that have received the PING test request from the path monitoring apparatus 100E are also suspected hijack paths (for example, “10.0.0.0/24”). The PING test is executed, and the PING test result is transmitted to the path monitoring device 100E.

  When the test result receiving unit 124 of the route monitoring device 100E receives the PING test result from each route monitoring device 100, the test result receiving unit 124 records the PING test result in the storage unit 13. In addition, when the PING test result from the path monitoring devices 100A and 100B is received, the PING test result is also recorded in the storage unit 13. Then, the hijack determination unit 125 of the path monitoring device 100E determines the PING test result from the path monitoring device 100 that detected the suspected hijacking path and the suspected hijacking path from among the PING test results stored in the storage unit 13. A hijack determination process is performed by calculating the similarity with the PING test result from the route monitoring device 100 that has not been detected (S107). Details of the hijack determination process will be described later.

  Then, the determination result notification unit 126 of the route monitoring device 100E notifies the determination result in S107 to the operator or the like (S108). For example, the determination result notification unit 126 notifies the operator's terminal device by e-mail or the like that there is a high possibility that the suspected hijacking route “10.0.0.0/24” has been hijacked by AS-D. Notice.

  By doing in this way, this system can detect the path | route with high possibility of being a hijack path | route, without depending on the data of an IRR database.

  Next, the hijack determination process of FIG. 4 will be described using FIG. 5 with reference to FIGS. FIG. 5 is a flowchart illustrating the hijack determination process of FIG. Here, the similarity of the PING test results is shown using a vector. That is, the similarity between the PING test result in the route monitoring device 100 (100A to 100C) that detected the suspicious hijack route and the PING test result of the route monitoring device 100 (100E) that has not detected the suspicious hijack route, respectively. The PING test results are described as vectors, and the angle θ between the vectors is calculated. Then, the hijack determination unit 125 determines whether or not the suspected hijack route is highly likely to be a hijack route based on the absolute value of the angle θ. The case where the PING test result handled here is the result of the PING test for the route “10.0.0.0/24” will be described as an example.

  First, the hijack determination unit 125 of the route monitoring device 100 (100E) determines that the PING test result in each route monitoring device 100 (100A to 100C, 100E) recorded in the RAM or the like of the storage unit 13 is OK. If “1” or NG, replace with “−1” and describe as vector X. For example, 256 of “10.0.0.0/24” is set such that the PING test result of “10.0.0.0” is x0 and the PING test result of “10.0.0.1” is x1. A sequence of PING test results for each of the IP addresses is described as a vector X = [x0, x1, x2,..., X255].

  Then, the hijack determination unit 125 adds the vector X of the PING test result in the path monitoring device 100 (100A to 100C) that has detected the suspected hijack path to obtain Xdetect (S201). For example, the hijack determination unit 125 performs the PING test result (Xas65010 = [1, -1,..., -1]) of the path monitoring device 100A of the AS-A (AS number “65010”) that detected the suspected hijacking path. And the PING test result (Xas65020 = [− 1, −1,..., −1]) of the path monitoring device 100B of AS-B (AS number “65020”) and AS-C (AS number “65030”) The PING test result (Xas65030 = [1, -1,..., -1]) of the route monitoring device 100C is added. Then, a vector Xdetect = Xas65010 + Xas65020 + Xas65030 = [1, −3,..., −3] indicating the PING test result of the route monitoring device 100 that detected the suspected hijacking route is obtained.

  Next, the hijack determination unit 125 obtains a vector of the PING test result in the route monitoring device 100 (100E) that did not detect the suspicious hijacking route among the PING test results recorded in the RAM or the like of the storage unit 13. Add X and obtain Xnondetect (S202). For example, when no suspicious hijacking route is detected other than its own route monitoring device 100 (100E), the route monitoring device 100 (100E) directly uses the PING test result in its own route monitoring device 100 (100E) as a vector. Let Xnondetect.

  Then, the hijack determination unit 125 obtains cos θ when the angle formed by the vector Xdetect and the vector Xnondetect is θ by the following equation (1) (S203). Note that −π / 2 <θ <π / 2 or −90 ° <θ <90 °.

  cos θ = (Xdetect · Xnondetect) / (| Xdetect | × | Xnondetect |) (1)

  Then, the hijack determination unit 125 obtains the absolute value | θ | of this θ, and determines whether or not | θ | exceeds the threshold value (threshold value b) (S204). Here, when | θ | exceeds the threshold value (threshold value b) (Yes in S204), it is determined that the suspected hijacking route “10.0.0.0/24” is likely to be a hijacking route ( S205).

  That is, when the angle θ formed by the vector X of the PING test result of the path monitoring devices 100A to 100C and the vector X of the PING test result of the path monitoring device 100E is large, the similarity is small. Therefore, it can be estimated that there is a high possibility that the path on which the path monitoring apparatuses 100A to 100C have performed the PING test and the path on which the path monitoring apparatus 100E has performed the PING test are actually different. Accordingly, the route monitoring device 100E can determine that there is a high possibility that a route hijack has occurred in the suspected hijack route “10.0.0.0/24” notified from the route monitoring devices 100A to 100C. .

  On the other hand, when | θ | is equal to or smaller than the threshold value (threshold value b) (No in S204), the hijack determination unit 125 determines that the suspected hijacking route “10.0.0.0/24” is a hijacking route. Is determined to be low (S206).

  That is, when the angle θ formed by the vector Xdetect and the vector Xnondetect is small, the path on which the path monitoring apparatuses 100A to 100C have performed the PING test is the same as the path on which the path monitoring apparatus 100E has performed the PING test. The possibility is considered high. Therefore, it is considered that the route monitoring device 100E is unlikely to cause a route hijack in the suspected hijack route “10.0.0.0/24” notified from the route monitoring devices 100A to 100C. For example, as shown in FIG. 2, in a customer network to which an IP address “10.0.0.0/24” is assigned by AS-E (AS number “65050”), AS-D (AS number “65040”). )), Since the static route is established, it is considered that only the route information having the same route and the different AS number as the advertisement source is advertised. Therefore, there is a possibility that the route monitoring device 100E has a route hijacking. Can be determined to be low.

  In this embodiment, the PING test result from the path monitoring device 100 (100A to 100C) that detected the suspected hijacking path and the PING from the path monitoring apparatus 100 (100E) that did not detect the suspected hijacking path. When the test results are compared, the angle θ formed by the vector Xdetect and the vector Xnondetect is determined, but the present invention is not limited to this. For example, in the route monitoring device 100, the vector X of the PING test result from the route monitoring device 100 (100A to 100C) that detected the suspected hijacking route and the PING of the route monitoring device 100 (100E) that detected the suspected hijacking route. The degree of similarity with the test result vector X is obtained by a method other than the angle θ described above, and the route monitoring apparatus 100 is highly likely that the suspected hijacking route is a hijacking route when the similarity is equal to or less than the threshold value a. When the similarity exceeds the threshold a, it may be determined that the suspected hijacking route is unlikely to be a hijacking route.

  Further, the vector X of the PING test result from the route monitoring device 100 (100A to 100C) that detected the suspected hijacking route and the vector of the PING test result of the route monitoring device 100 (100E) that did not detect the suspected hijacking route. The correlation coefficient with X is calculated. When the correlation coefficient is smaller than the predetermined threshold d, the path monitoring device 100 determines that the suspected hijacking path is likely to be a hijacking path, and when the correlation coefficient is equal to or higher than the predetermined threshold d, the suspected hijacking path is suspected. You may make it determine with a low possibility that a hijack path | route is a hijack path | route.

  Furthermore, the route monitoring device 100 did not detect the average value of the vector X (coordinate position) of the PING test result from the route monitoring device 100 (100A to 100C) that detected the suspected hijacking route, and the suspected hijacking route. The average value of the vector X (coordinate position) of the PING test result of the route monitoring device 100 (100E) is calculated, and the distance between the end points when the start points of these vectors are matched is calculated. Then, when the calculated distance is greater than the predetermined threshold c, the path monitoring device 100 determines that the suspected hijack path is likely to be a hijack path, and when the calculated distance is equal to or less than the predetermined threshold c. It may be determined that there is a low possibility that the suspected hijacking route is a hijacking route.

  In addition, the similarity between the PING test result from the route monitoring device 100 (100A to 100C) that detected the suspicious hijack route and the PING test result of the route monitoring device 100 (100E) that did not detect the suspicious hijack route The method is not limited to the above-described method as long as it can be determined.

  In the above-described embodiment, the system may include an IRR database, and may be used for detecting omission of registration in the IRR database. For example, when the suspected hijack route is detected by the route monitoring device 100, the route monitoring device 100 detects the suspected hijack route with reference to data in the IRR database. When the path monitoring device 100 that has received the suspicious hijack detection information determines that the suspicious hijack path is unlikely to be a hijack path by comparing the PING test results described above, The route information is transmitted to the terminal device of the operator who manages the IRR database. This makes it easier to check for omissions in the IRR database registration.

  In the above-described embodiment, when describing the PING test result as the vector X, the path monitoring apparatus 100 is described by replacing “1” when the PING test result is OK and “−1” when NG. However, the present invention is not limited to this as long as the OK value and the NG value are different from each other. For example, the path monitoring apparatus 100 may describe the vector X instead of “1” when the PING test result is OK and “−0.1” when it is NG.

  Further, in the above-described embodiment, the path monitoring apparatus 100 performs the PING test using the Internet Control Message Protocol (ICMP) for confirming the communication of the network. However, the present invention is not limited to this. For example, the path monitoring apparatus 100 is configured to confirm UDP-PING for confirming communication at a specific UDP (User Datagram Protocol) port or TCP-PING for confirming communication at a specific TCP (Transmission Control Protocol) port. For example, another network communication test may be performed.

  In the above-described embodiment, the route monitoring device 100 has a PING test result in the route monitoring device 100 that has detected the suspicious hijack route and a PING test result in the route monitoring device 100 that has not detected the suspicious hijack route. However, the present invention is not limited to this.

  For example, each path monitoring device 100 performs a PING test on its own monitoring target path every predetermined period, and records the PING test result in the storage unit 13. When the path monitoring device 100 detects the suspicious hijack path (for example, “10.0.0.0/24”), the PING test result recorded in the storage unit 13 is used as a ping to the suspected hijack path. Read test results. That is, the PING test result to the suspected hijacking path before the suspected hijacking path detection is read out. Then, the route monitoring apparatus 100 calculates the similarity between the read PING test result and the PING test result after the suspected hijacking route is detected. When the similarity between the PING test result before detection of the suspicious hijack and the PING test result after detection of the suspicious hijack is equal to or less than a predetermined value, the route monitoring apparatus 100 detects the suspected hijack route (for example, , “10.0.0.0/24”), it may be determined that there is a high possibility that a path hijacking has occurred.

  In addition, each of the route monitoring devices 100 that have detected the suspicious hijacking route uses the PING test result before detecting the suspicious hijacking route and the PING test result after detecting the suspicious hijacking route to monitor the route of the AS being hijacked In the path monitoring apparatus 100 that has transmitted to the apparatus 100 and received the PING test result, there is a possibility that path hijacking has occurred in the suspected hijack path (for example, “10.0.0.24”). You may make it determine whether it is high. In other words, the determination as to whether or not there is a high possibility that a path hijacking has occurred in the suspected hijacking path may be performed by the path monitoring apparatus 100 that has detected the suspected hijacking path, or other path monitoring apparatuses. 100 may be performed.

  The route monitoring apparatus 100 according to the present embodiment can be realized by a route hijack detection program for executing the processing as described above, and this program is stored in a computer-readable storage medium (CD-ROM or the like). Can be provided. It is also possible to provide the program through a network such as the Internet.

It is the figure which illustrated the path hijack detection system containing the path | route monitoring apparatus of this Embodiment. It is the figure which illustrated the path hijack detection system containing the path | route monitoring apparatus of this Embodiment. It is a functional block diagram of the path | route monitoring apparatus of FIG. 4 is a flowchart illustrating an operation procedure of the route monitoring apparatus in FIG. 3. It is the flowchart which illustrated the hijack determination process of FIG. It is the figure which demonstrated path hijacking notionally. It is a figure explaining the technique used as the comparative example of this invention. It is the figure explaining the problem in the technique of the comparative example of FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Input / output part 12 Processing part 13 Storage part 100 (100A, B, C, E) Path monitoring device 120 Hijack determination processing part 121 Suspicious hijack detection information receiving part 122 Test requesting part 123 Test execution part 124 Test result receiving part 125 hijack determination unit 126 determination result notification unit 127 suspected hijack detection unit 128 route information update unit 129 route monitoring unit 130 test result transmission unit 131 monitoring target route information

Claims (9)

The route monitoring device in a route hijack detection system that monitors route information exchanged by BGP (Border Gateway Protocol) in each AS (Autonomous System) by a plurality of route monitoring devices and detects a hijack route,
When receiving the suspected hijack detection information indicating the IP address space of the suspected hijacking route that may be the hijacking route,
Requesting each of the other route monitoring devices to execute a PING test on the IP address space indicated in the suspicious hijack detection information;
Performing a PING test on each IP address in the IP address space indicated in the route information of the suspected hijack in its own route monitoring device;
Receiving the result of the PING test from each of the other path monitoring devices;
Recording the result of the PING test executed in the own route monitoring device and the result of the received PING test in the storage unit;
Of the recorded PING test results, the PING test result in the route monitoring device that has transmitted the suspicious hijack detection information, and the PING test result in the route monitoring device that has not transmitted the suspicious hijack detection information; Calculating the similarity of
When the calculated similarity is less than or equal to a predetermined threshold a
Determining that there is a high probability that a path hijack has occurred in the IP address space indicated in the suspected hijack detection information;
And a step of outputting the determination result via an input / output unit. The route monitoring device includes:
The PING test result in the route monitoring device that has transmitted the suspicious hijack detection information and the PING test result in the route monitoring device that has not transmitted the suspicious hijack detection information are described as vectors, respectively.
Adding the vector of the PING test result in the route monitoring device that transmitted the suspected hijack detection information, adding the vector of the PING test result in the route monitoring device that did not transmit the suspected hijack detection information, and Calculating an angle θ between the added vectors;
When the absolute value of the calculated angle θ is larger than a predetermined threshold value b,
The path hijack detection method according to claim 1, further comprising: determining that there is a high possibility that a path hijack has occurred in the IP address space indicated by the suspected hijack detection information. The route monitoring device includes:
An average value of the PING test result vectors in the path monitoring apparatus that has transmitted the suspected hijack detection information is calculated, and an average value of the PING test result vectors in the path monitoring apparatus that has not transmitted the suspected hijack detection information. Calculating the distance between the end points when the start points of the respective vectors for which the average value has been calculated are matched, and
When the calculated distance is greater than a predetermined threshold c,
The path hijack detection method according to claim 2, further comprising: determining that there is a high possibility that a path hijack has occurred in the IP address space indicated by the path information of the suspected hijack. The route monitoring device includes:
When the calculated similarity exceeds the predetermined threshold a, the absolute value of the calculated angle θ is equal to or smaller than the predetermined threshold b, or the calculated distance is equal to or smaller than the predetermined threshold c.
The step of determining that the possibility that a path hijack has occurred in the IP address space indicated by the suspected hijack detection information is low is executed. Path hijack detection method. The storage unit of the route monitoring device is
Monitoring target route information indicating the IP address space of the monitoring target route in the route monitoring device, the legitimate AS number assigned to the IP address space, and the identification information of the destination route monitoring device of the monitoring result of the IP address space And the route information held by the own AS route control device,
The route monitoring device includes:
Among the IP address spaces indicated in the route information of the storage unit, for the route information included in the IP address space indicated in the monitoring target route information, the AS number of the IP address space indicated in the route information is the monitoring target. When monitoring whether there is route information of a suspected hijack route different from the AS number of the route, and determining that there is route information of a suspected hijack route different from the AS number of the monitored route,
Transmitting the suspected hijack detection information indicating the IP address space of the suspected hijacking route to a route monitoring device that is a transmission destination of the monitoring result of the IP address space;
Executing a PING test for each IP address in the IP address space when a request for a PING test indicating an IP address space to be subjected to the PING test is received from another path monitoring device;
4. The path hijack detection method according to claim 1, further comprising: transmitting the executed PING test to a path monitoring apparatus that is a request source of the PING test. 5. The route monitoring device in a route hijack detection system for monitoring route information exchanged by BGP (Border Gateway Protocol) in each AS (Autonomous System) by a plurality of route monitoring devices and detecting a route hijack,
An input / output unit that controls input / output of various data;
A suspected hijack information receiving unit for receiving suspected hijack detection information indicating an IP address space of a suspected hijacking path that may be the hijacking path;
A test requesting unit that requests each of the other route monitoring devices to execute a PING test on the IP address space indicated in the suspected hijack detection information;
A test execution unit that performs a PING test on the IP address space indicated in the suspected hijack detection information and records a result of the PING test in a storage unit;
A test result receiving unit that receives the result of the PING test from each of the other path monitoring devices and records the result of the PING test in the storage unit;
Of the recorded PING test results, the PING test result in the route monitoring device that has transmitted the suspicious hijack detection information, and the PING test result in the route monitoring device that has not transmitted the suspicious hijack detection information; Hijack determination that determines that there is a high probability that a path hijack has occurred in the IP address space indicated by the suspected hijack detection information when the similarity is calculated to be equal to or less than a predetermined threshold. And
A route monitoring apparatus comprising: a determination result notifying unit that outputs the determination result. The storage unit
Monitoring target route information indicating the IP address space of the monitoring target route in the route monitoring device, the legitimate AS number assigned to the IP address space, and the identification information of the destination route monitoring device of the monitoring result of the IP address space And the route information held by the own AS route control device,
The test execution unit includes:
When a request for a PING test indicating an IP address space to be subjected to a PING test is received from another path monitoring device, the PING test is executed for each IP address in the IP address space,
The route monitoring device includes:
Among the route information, for the route information included in the IP address space indicated by the monitoring target route information, the AS number of the IP address space indicated by the route information is different from the AS number of the monitoring target route. Whether or not there is route information of the route is monitored, and when it is determined that there is route information different from the AS number of the route to be monitored, the suspected hijack detection information indicating the IP address space of the suspected hijack route is A route monitoring unit for transmitting the monitoring result of the IP address space to a destination route monitoring device;
The path monitoring apparatus according to claim 6, further comprising: a test result transmission unit that transmits a result of the executed PING test to a path monitoring apparatus that is a request source of the PING test.   A route hijack detection system comprising a plurality of route monitoring devices according to claim 7.   A route hijack detection program that causes a route monitoring device that is a computer to execute the route hijack detection method according to any one of claims 1 to 5.

Images