JP2010218462A - Information processor, information processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To appropriately detect a DoS (denial of service) attack even if throughput is low. <P>SOLUTION: An SNMP (simple network management protocol) request is once held in a queue prior to carrying out processing for the received SNMP request. Whether SNMP requests from an optional remote host were made the fixed number of times or more is examined prior to carrying out processing for the head SNMP request in the queue. As a result, if the SNMP requests from the same remote host were made the fixed number of times or more, they are detected as the DoS attack from the remote host. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program for detecting a DoS attack.

  DoS that delays the processing of the information processing device by transmitting a large amount of packets to the target information processing device (such as a computer) via the network, thereby hindering the use of the information processing device. (Denial of Service) attacks are known. For this reason, the information processing apparatus that can be a target needs to detect a DoS attack by some means and take measures to continuously provide other services by the information processing apparatus.

  Patent Document 1 discloses a configuration that detects a DoS attack when there is an access exceeding a threshold value within a predetermined time, for the purpose of preventing both a password crack and a DoS attack.

  By the way, as one of the DoS attacks, an information processing apparatus having an SNMP (Simple Network Management Protocol) agent function is wasteful of processing power of the information processing apparatus by transmitting a large number of SNMP requests via the network. There are attacks that make it impossible to provide other services.

  That is, according to SNMP, an information processing apparatus that has received an SNMP request generally performs a predetermined process in response to the SNMP request and returns a response. For this reason, when a large number of continuously transmitted SNMP requests are received, processing capacity is consumed for generating a response to the received SNMP request, and only a small processing capacity can be allocated to other services. .

  Conventionally, the number of times an SNMP request sent from a specific remote host is received and responded to is measured, and this number is specified when the measured number reaches a threshold value within a predetermined time (for example, 1 second). It has been detected that the transmission of an SNMP request from the remote host is a DoS attack. After the DoS attack is detected, a process of reading and discarding the SNMP request from the remote host has been performed.

  In this method, in an information processing apparatus having a low processing capability and a small number of SNMP requests that can be processed per predetermined time, it is determined whether the current access by the SNMP request is a normal access or a DoS attack. There was a problem that it was difficult.

  For example, if the information processing apparatus in which the above-described threshold is set to 1000 times or more can process only 100 SNMP requests within a predetermined time, it may be impossible to detect despite being subjected to a DoS attack. On the other hand, if the threshold is lowered, normal access may be detected as a DoS attack.

  In addition, the above-described Patent Document 1 includes a problem that a DoS attack may not be detected by a computer with low processing capability because user authentication is performed every time there is an access from another computer.

  The present invention has been made in view of the above, and an object of the present invention is to provide an information processing apparatus, an information processing method, and a program capable of appropriately detecting a DoS attack even when processing capability is low.

  In order to solve the above-described problems and achieve the object, the present invention is an information processing apparatus that receives a request transmitted from a host device via a network and performs predetermined processing on the request. A holding unit that temporarily holds a received request, a determination unit that determines whether a DoS attack has been received based on the request held in the holding unit, and a holding unit that holds the request according to the determination by the determination unit And processing means for performing predetermined processing on the received request.

  In addition, the present invention is an information processing method for receiving a request transmitted from a host device via a network and performing a predetermined process on the request, and temporarily holding the received request in a holding unit A holding step, a determination step for determining whether or not a DoS attack has been received based on the request held in the holding unit by the holding step, and a request held in the holding unit according to the determination by the determination step. And a processing step for performing the above processing.

  According to the present invention, when a request transmitted from a host device via a network is received and predetermined processing is performed on the request, the received request is temporarily held in the holding unit, and the holding unit Since it is determined whether or not a DoS attack has been received based on the request held in the server, and a predetermined process is performed on the request held in the holding unit according to the determination, even if the processing capability is low There is an effect that a DoS attack can be appropriately detected.

FIG. 1 is a block diagram showing a configuration of an example of an information processing apparatus applicable to each embodiment of the present invention. FIG. 2 is a functional block diagram illustrating an example of the functions of the information processing apparatus applicable to each embodiment of the present invention. FIG. 3 is a sequence diagram illustrating an example of processing when the information processing apparatus normally processes an SNMP request. FIG. 4 is a sequence diagram illustrating an example of processing when a DoS attack is detected in the information processing apparatus. FIG. 5 is a sequence diagram illustrating an example of processing when an unprocessed SNMP request is included up to the maximum queue size.

  Exemplary embodiments of an information processing apparatus according to the present invention will be explained below in detail with reference to the accompanying drawings. First, the present invention will be conceptually described. A remote host that transmits an SNMP (Simple Network Management Protocol) request generally transmits one SNMP request and waits for a response to transmit the next SNMP request. On the other hand, a remote host intended for a DoS (Denial of Service) attack continuously transmits an SNMP request without waiting for a response to the transmitted SNMP request. In other words, an SNMP request from a remote host that has launched a DoS attack is continuously transmitted before the information processing apparatus returns a response to the SNMP request transmitted from the remote host.

  The present invention pays attention to this point, and temporarily holds the SNMP request in the queue before processing the received SNMP request. Then, before processing the SNMP request at the head of the queue, it is checked whether or not an SNMP request from an arbitrary remote host has occurred a predetermined number of times or more. As a result, when there are SNMP requests from the same remote host more than a certain number of times, it is detected as a DoS attack by the remote host.

  As described above, according to the present invention, since it is possible to determine the presence or absence of a DoS attack based on the number of received SNMP requests instead of the number of processed SNMP requests, it is possible to detect a DoS attack regardless of the processing capability of the information processing apparatus. Become.

  In the following, a DoS attack uses a system that returns a response to a request transmitted via a network, and transmits requests to information processing devices one after another without waiting for a corresponding response. It is assumed that the attack is a waste of the processing capability of the information processing apparatus.

<Configuration common to each embodiment>
FIG. 1 shows an exemplary configuration of an information processing apparatus 100 applicable to each embodiment of the present invention. In the information processing apparatus 100, a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a network I / F 14, a hard disk 15, an input / output I / F 16 and a drive are connected to the bus 10. A device 17 is connected. Each unit connected to the bus 10 can exchange data with each other via the bus 10.

  The CPU 11 controls the overall operation of the information processing apparatus 100 using the RAM 13 as a work memory in accordance with a program stored in advance in the ROM 12 or the hard disk 15. In the present embodiment, a protocol such as TCP / IP (Transmission Control Protocol / Internet Protocol) or SNMP (Simple Network Management Protocol) is implemented in the program executed by the CPU 11.

  The hard disk 15 stores a program for operating the above-described CPU 11 and various data. The hard disk 15 can also temporarily store data generated when the CPU 11 executes the program.

  The input / output I / F 16 controls data input / output with respect to the information processing apparatus 100. For example, an input device such as a keyboard and a mouse is connected to the input / output I / F 16. Control signals corresponding to user operations on these input devices are output from the input / output I / F 16 and supplied to the CPU 11 via the bus 10. The input / output I / F 16 may correspond to a serial interface such as USB (Universal Serial Bus) or IEEE (Institute Electrical and Electronics Engineers) 1394.

  The drive device 17 reads data from a disk storage medium 20 such as a CD (Compact Disk) or a DVD (Digital Versatile Disk). However, the storage medium corresponding to the drive device 17 may be a non-volatile semiconductor memory. The above-described program for operating the CPU 11 is provided by being stored in a storage medium such as a CD, a DVD, or a nonvolatile semiconductor memory, and is read from the drive device 17 and stored in the hard disk 15 in a predetermined manner. . The display control unit 18 is connected to the display 21, converts the display control signal generated by the CPU 11 into a signal in a format that can be displayed on the display 21, and outputs the converted signal.

  The network I / F 14 corresponds to TCP / IP and can communicate with an external information device via a network 200 such as the Internet or a LAN (Local Area Network). The above-described program for operating the CPU 11 can be provided from an external server device or the like via the network 200, received by the network I / F 14, and stored in the hard disk 15 in a predetermined manner.

  FIG. 2 is a functional block diagram illustrating an example of functions of the information processing apparatus 100 that can be applied to each embodiment of the present invention. The information processing apparatus 100 includes a network I / F 101, an SNMP request processing unit 102, a DoS attack determination unit 103, an SNMP request management unit 104, and an SNMP request holding unit 105.

  Among these, the network I / F 101 corresponds to the network I / F 14 described above, and controls communication with the remote hosts 210A, 210B,... Via the network 200. The SNMP request processing unit 102, the DoS attack determination unit 103, and the SNMP request management unit 104 are realized by a program operating on the CPU 11. For example, each of the SNMP request processing unit 102, the DoS attack determination unit 103, the SNMP request management unit 104, and the SNMP request holding unit 105 is configured to be expanded on the RAM 13 by the CPU 11 as a module on the program.

  The SNMP request processing unit 102 receives and processes an SNMP request transmitted from the remote hosts 210A, 210B,. The SNMP request management unit 104 receives and manages all SNMP requests transmitted from the remote hosts 210A, 210B,... Before the SNMP request processing unit 102 executes processing. The SNMP request holding unit 105 holds SNMP requests transmitted from the remote hosts 210A, 210B,... In a queue. Specifically, the queue is configured using, for example, a predetermined area of the RAM 13. The DoS attack determination unit 103 has a threshold for determining a DoS attack, and whether or not any remote host 210A, 210B,... Has performed a DoS attack is determined based on, for example, the number of received SNMP requests and the threshold. Judgment based on.

<Embodiment>
The DoS attack detection process according to the embodiment of the present invention will be described below using the sequence diagrams of FIGS. FIG. 3 is a sequence diagram illustrating an example of processing when the DoS attack is not performed on the information processing apparatus 100 and the information processing apparatus 100 normally processes an SNMP request.

  First, in SEQ1, the SNMP request processing unit 102 receives an SNMP request transmitted from, for example, the remote host 210A. In other words, the SNMP request transmitted from the remote host 210 </ b> A is received by the network I / F 101 via the network 200. The network I / F 101 passes the received SNMP request to the SNMP request processing unit 102. The SNMP request includes identification information for identifying the transmission source device and information indicating the content of the SNMP request.

  When receiving the SNMP request from the remote host 210A, the SNMP request processing unit 102 passes this SNMP request to the SNMP request management unit 104 in SEQ2. When receiving the SNMP request, the SNMP request management unit 104 holds information indicating the time at which the SNMP request was received (SEQ3), and passes the SNMP request to the SNMP request holding unit 105 (SEQ4). The SNMP request holding unit 105 adds the received SNMP request to the queue and holds it.

  The processes of SEQ1 to SEQ4 described above are repeated while the information processing apparatus 100 continuously receives SNMP requests. For example, the SNMP request management unit 104 determines whether or not a predetermined time has elapsed since the time when the SNMP request was received immediately before the current time, and if it is determined that the predetermined time has elapsed, It is determined that the reception is finished with the previous reception.

  When it is determined that the reception of the SNMP request has been completed, the SNMP request management unit 104 requests the DoS attack determination unit 103 to determine whether or not the information processing apparatus 100 has been subjected to the DoS attack ( SEQ5). In response to this request, the DoS attack determination unit 103 requests the SNMP request holding unit 105 for a list of SNMP requests held in the queue (SEQ6). In response to this request, a list of SNMP requests held in the queue is passed from the SNMP request holding unit 105 to the DoS attack determination unit 103. The DoS attack determination unit 103 determines whether or not the information processing apparatus 100 has been subjected to a DoS attack based on the list of SNMP requests acquired from the SNMP request holding unit 105.

  In the present embodiment, this determination is made based on whether or not SNMP requests equal to or greater than a predetermined threshold value are received from the same remote host. As an example, the DoS attack determination unit 103 counts the number of SNMP requests for each remote host based on the list of SNMP requests acquired from the SNMP request holding unit 105. Then, the threshold value and the count result of each remote host are respectively compared, and the remote host that is the source of the SNMP request that has received a number greater than or equal to the threshold value is detected.

  As a result, if it is determined that SNMP requests equal to or greater than the threshold are received from the same remote host, the DoS attack determination unit 103 determines that the information processing apparatus 100 has been subjected to a DoS attack. The processing when it is determined that the DoS attack has been received will be described later with reference to FIG.

  On the other hand, if the number of SNMP requests received from each remote host is less than the threshold, it is determined that the information processing apparatus 100 has not been subjected to a DoS attack. In this case, the DoS attack determination unit 103 notifies the SNMP request management unit 104 of a determination result indicating that the DoS attack has not been received (SEQ7). In response to the notification that the DoS attack is not received, the SNMP request management unit 104 requests the SNMP request processing unit 102 to process the SNMP request held in the queue (SEQ8).

  In response to this request, the SNMP request processing unit 102 requests one SNMP request held in the queue from the SNMP request management unit 104. In response to this request, the SNMP request management unit 104 requests the SNMP request holding unit 105 to read out the SNMP request held at the head of the queue (SEQ10). The SNMP request holding unit 105 reads the head SNMP request from the queue and passes it to the SNMP request management unit 104.

  Subsequently, the SNMP request processing unit 102 confirms the reception time of the SNMP request passed to the SNMP request management unit 104 (SEQ12), and the confirmed reception time is constant from the reception time confirmed by the current time. If it is determined that the time has passed, it is determined that the SNMP request is an old request, the SNMP request is discarded without being processed, and the process proceeds to the next SNMP request.

  On the other hand, if it is determined that the predetermined time has not elapsed from the confirmed reception time, the SNMP request processing unit 102 acquires the SNMP request from the SNMP request management unit 104 (SEQ13), and acquires the acquired SNMP. Processing corresponding to the request, for example, response generation processing is performed (SEQ14).

  The processes of SEQ9 to SEQ14 described above are repeated so as to be performed for all SNMP requests held in the queue. Further, in the processes of SEQ9 to SEQ14, when a new SNMP request is received, the process is returned to SEQ1.

  Next, an example process when a DoS attack is detected in the information processing apparatus 100 will be described with reference to FIG. In FIG. 4, the same processes as those in FIG. 3 described above are denoted by the same reference numerals, and detailed description thereof is omitted. In the following, in order to avoid complexity, the description will focus on differences from the example in the case where the DoS attack according to FIG. 3 is not made.

  While the SNMP request from the remote host is continuously received, the processing of SEQ1 to SEQ4 is repeated, and the received SNMP request is sequentially held in the queue by the SNMP request holding unit 105. When a predetermined time has elapsed since the reception of the last SNMP request, the SNMP request management unit 104 requests the DoS attack determination unit 103 to determine whether or not there is a DoS attack by SEQ5. In response to this request, the DoS attack determination unit 103 acquires a list of SNMP requests held in the queue from the SNMP request holding unit 105 (SEQ6), and the information processing apparatus 100 receives a DoS attack based on the acquired list. It is determined whether or not.

  If the SNMP request has been received from the same remote host a number of times greater than or equal to the threshold, the DoS attack determination unit 103 determines that the information processing apparatus 100 has received a DoS attack from the remote host. The DoS attack determination unit 103 notifies the SNMP request management unit 104 of a determination result indicating that the DoS attack has been received (SEQ7).

  In response to the notification indicating that the DoS attack has been received, the SNMP request management unit 104 collects from the queue SNMP requests received from the remote host determined to have performed the DoS attack to the SNMP request holding unit 105. A request is made to the SNMP request holding unit 105 to be deleted (SEQ20). In response to this request, the SNMP request holding unit 105 collectively deletes SNMP requests received from the remote host from the queue.

  The SNMP request management unit 104 requests the SNMP request processing unit 102 to process the SNMP request held in the queue after the collective deletion request by SEQ20 described above (SEQ8). Thereafter, in the processes of SEQ9 to SEQ14, the SNMP request remaining in the queue by the batch deletion described above is processed.

  Thus, according to this embodiment, the SNMP request received from the remote host is temporarily held in the queue before processing. Then, the presence / absence of a DoS attack is determined based on the number of SNMP requests received from the same remote host among the SNMP requests held in the queue. Therefore, even if the processing capability of the information processing apparatus 100 is low, a DoS attack can be detected appropriately, and other services provided by the information processing apparatus 100 are prevented from being stopped due to the DoS attack.

  Further, when it is determined that the DoS attack has been received, the SNMP requests from the DoS attack source among the SNMP requests held in the queue are collectively deleted, so that the process for the SNMP request is not performed unnecessarily.

  It is more preferable that the information processing apparatus 100 not accept the SNMP request transmitted from the remote host when the DoS attack determination unit 103 determines that the DoS attack is received from the remote host. As an example, based on identification information indicating the source device of the SNMP request included in the SNMP request by the DoS attack, a filter for the SNMP request from the source device is set for the network I / F 101, It is conceivable to prohibit acceptance of an SNMP request transmitted from the remote host.

  By the way, in this embodiment, since the SNMP request from the remote host is temporarily held in the queue before processing, the processing up to the maximum size of the queue is not processed while the processing of SEQ1 to SEQ4 in FIG. 3 and FIG. 4 is repeated. May be entered. The SNMP request newly received in this state cannot be held in the queue and is discarded.

  An example method for preventing a newly received SNMP request from being discarded when there is an unprocessed SNMP request up to the maximum queue size will be described with reference to FIG. In FIG. 5, the processes common to those in FIG. 3 described above are denoted by the same reference numerals, and detailed description thereof is omitted. In the following, in order to avoid complexity, the description will focus on differences from the example in the case where the DoS attack according to FIG. 3 is not made.

  While the SNMP request from the remote host is continuously received, the processing of SEQ1 to SEQ4 is repeated, and the received SNMP request is sequentially held in the queue by the SNMP request holding unit 105.

  Here, when the SNMP request holding unit 105 receives a request to add an SNMP request to the queue from the SNMP request management unit 104 in SEQ4, is it possible to add and hold the SNMP request to be added to the queue? Determine whether or not. If it is determined that it can be added and held, the SNMP request is added to the queue and held.

  On the other hand, if it is determined that the SNMP request is already held up to the maximum size of the queue and a new SNMP request cannot be added and held, the SNMP request holding unit 105 displays the SNMP request held in the queue. Among them, the SNMP request overlapping with the new SNMP request is deleted (SEQ30).

  As an example, the SNMP request holding unit 105 searches for an SNMP request received from the remote host that is the transmission source of the new SNMP request, from the SNMP requests held in the queue. Further, an SNMP request whose content matches that of the new SNMP request is searched from the searched SNMP request. The SNMP request searched here is deleted.

  If there is no SNMP request in the queue that overlaps with the new SNMP request, the new SNMP request is discarded.

  The processes of SEQ1 to SEQ30 described above are repeated while the information processing apparatus 100 continuously receives SNMP requests.

  When a predetermined time has elapsed since the reception of the last SNMP request, the SNMP request management unit 104 requests the DoS attack determination unit 103 to determine whether or not there is a DoS attack by SEQ5. In response to this request, the DoS attack determination unit 103 determines the presence or absence of a DoS attack as described above. If it is determined that the DoS attack has not been received, the SNMP request held in the queue is processed (SEQ9 to SEQ14). On the other hand, if it is determined that the DoS attack has been received, the SNMP requests received from the remote host determined to have performed the DoS attack are collectively deleted from the SNMP requests held in the queue by SEQ20 in FIG. The remaining SNMP request is processed (SEQ9 to SEQ14).

<First Modification>
Next, a first modification of the embodiment of the present invention will be described. In the above-described embodiment, the presence / absence of a DoS attack is determined by comparing the number of received SNMP requests for each remote host with a threshold value, but this is not limited to this example. In the first modified example, the number of SNMP requests received for each remote host is counted, and when a reception of SNMP requests equal to or greater than the threshold value is detected from the same remote host within a predetermined time, a DoS attack is detected. judge. In other words, in the first modification, the presence / absence of a DoS attack is determined based on the reception speed of the SNMP request from the remote host.

  As an example, the DoS attack determination unit 103, similar to the above-described embodiment, receives SNMP requests held in a queue with respect to the SNMP request holding unit 105 after a predetermined time has elapsed since the last SNMP request was received. A list is requested (SEQ6). In response to this request, the SNMP request holding unit 105 requests the SNMP request management unit 104 for the reception time of each SNMP request.

  The SNMP request holding unit 105 associates the reception time of each SNMP request acquired in response to this request and the list of SNMP requests held in the queue with each SNMP request and passes it to the DoS attack determination unit 103. Based on the SNMP request reception time and the list received from the SNMP request holding unit 105, the DoS attack determination unit 103 determines the SNMP request reception speed, that is, the same SNMP request within a predetermined time, for each remote host. Ask if it was received once. The number of SNMP requests received within the predetermined time is greater than or equal to the threshold value, and it is determined that a DoS attack has been received from the source of the SNMP request, and that fact is notified to the SNMP request management unit 104.

  Not limited to this, the DoS attack determination unit 103 can always monitor whether the SNMP request is held in the queue by the SNMP request holding unit 105, and can determine the presence or absence of the DoS attack in substantially real time. As an example, the DoS attack determination unit 103 obtains the average number of receptions (reception speed) per unit time for each remote host based on the reception time of the SNMP request held in the queue. It is conceivable to determine the presence or absence of a DoS attack by comparing the average number of receptions per unit time with a threshold value. When it is determined that the DoS attack is received, the DoS attack determination unit 103 notifies the SNMP request management unit 104 to that effect.

  The SNMP request management unit 104 is said to be performing a DoS attack among the SNMP requests held in the queue with respect to the SNMP request holding unit 105 in response to the notification that the SNMP request has been received. Requests that SNMP requests from remote hosts be deleted at once.

  According to the first modification, even if the number of SNMP requests due to the DoS attack is small, it can be determined whether or not the information processing apparatus 100 is subjected to the DoS attack.

<Second Modification>
Next, a second modification of the embodiment of the present invention will be described. In the above-described embodiment and the first modification of the embodiment, the presence / absence of a DoS attack is determined by counting the number of accepted SNMP requests for each remote host. However, this is not limited to this example. Absent. In the second modification, the status of the queue is monitored, and when the SNMP request is added to the maximum queue size by the SNMP request from the same remote host, the information processing apparatus 100 is subjected to a DoS attack. It is determined that

  As an example, when a new SNMP request is added to the queue in SEQ4, the SNMP request holding unit 105 determines whether the SNMP request has been added up to the maximum size of the queue. If it is determined that the SNMP request has not been added up to the maximum size of the queue, it waits for a request for adding the next SNMP request.

  On the other hand, if it is determined that the SNMP request has been added up to the maximum size of the queue, the SNMP request holding unit 105 notifies the SNMP request management unit 105 to that effect. In response to this notification, the SNMP request management unit 105 requests the DoS attack determination unit 103 to determine the DoS attack (SEQ5).

  In response to this determination request, the DoS attack determination unit 103 requests a list of SNMP requests held in the queue from the SNMP request holding unit 105 (SEQ6), and enters the queue based on the list acquired in response to this request. It is checked whether the held SNMP request is from the same remote host. As a result, if the SNMP request held in the queue is from the same remote host, it is determined that the information processing apparatus 100 has been subjected to the DoS attack, and the fact is notified to the SNMP request management unit 104. Notification is made (SEQ7).

  The SNMP request management unit 104 is said to be performing a DoS attack among the SNMP requests held in the queue with respect to the SNMP request holding unit 105 in response to the notification that the SNMP request has been received. Requests that SNMP requests from remote hosts be deleted at once.

  In the above description, when all the SNMP requests held in the queue are from the same remote host, it is determined that a DoS attack has occurred, but this is not limited to this example. For example, it is possible to determine that a DoS attack has been received when a predetermined ratio or more of the SNMP requests held in the queue are from the same remote host.

  As described above, according to the second modification, since the presence / absence of the DoS attack is determined by monitoring the queue state, the presence / absence of the DoS attack can be determined without increasing the load on the information processing apparatus 100. It can be detected in a state close to real time.

  In the above description, the present invention has been described as applied to a DoS attack using an SNMP request, but this is not limited to this example. That is, the present invention can be applied to other types of DoS attacks as long as it is a DoS attack using a system that processes a received request and returns a response.

  In the above description, the embodiment, the first modification example, and the second modification example of the embodiment have been described as being independently used. However, this is not limited to this example. That is, the above-described embodiment, the first modification example and the second modification example of the embodiment can be used in combination with each other. In this case, it is conceivable to combine two or all of the embodiments, the first modification and the second modification of the embodiment as a logical sum.

100 Information processing apparatus 101 Network I / F
102 SNMP request processing unit 103 DoS attack determination unit 104 SNMP request management unit 105 SNMP request holding unit

JP 2008-310677 A

Claims (9)

An information processing device that receives a request transmitted from a host device via a network and performs predetermined processing on the request,
Holding means for temporarily holding the received request;
Determination means for determining whether or not a DoS attack has been received based on the request held in the holding means;
An information processing apparatus comprising: processing means for performing the predetermined processing on the request held in the holding means in response to the determination by the determination means. The determination means includes
2. The information processing apparatus according to claim 1, wherein when it is determined that the DoS attack has been received, a request due to the DoS attack is deleted from the holding unit among the requests held in the holding unit. The determination means includes
3. The method according to claim 1, wherein when the number of requests from the same host device held in the holding unit is equal to or greater than a first threshold, it is determined that the DoS attack has been received. Information processing device. The determination means includes
The determination as to whether or not the DoS attack has been received when the holding means holds requests from the same number of host devices equal to or greater than a second threshold value within a predetermined time. The information processing apparatus according to claim 3. The determination means includes
The information according to any one of claims 1 to 4, wherein when the request from the same host device is held up to the maximum size of the holding means, it is determined that the DoS attack has been received. Processing equipment. The determination means includes
When it is determined that the DoS attack has been received, a setting is made for a receiving unit that receives a request so as to prohibit reception of a request from a host device that is a transmission source of the request transmitted as the DoS attack. The information processing apparatus according to any one of claims 1 to 5. The holding means is
When a new request is added in a state where the request is held up to the maximum size of the holding unit, the request transmitted from the host apparatus that is the transmission source of the new request among the held requests, The information processing apparatus according to any one of claims 1 to 6, wherein a request that overlaps with a new request is deleted. An information processing method for receiving a request transmitted from a host device via a network and performing predetermined processing on the request,
A holding step for temporarily holding the received request in a holding means;
A determination step of determining whether or not a DoS attack has been received based on the request held in the holding means by the holding step;
And a processing step of performing the predetermined processing on the request held in the holding unit in response to the determination in the determination step.   A program for causing a computer to function as each unit of the information processing apparatus according to any one of claims 1 to 7.

Images