JP2011035932A - Network controller and controlling method thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve a problem wherein, in a network wherein a large volume of traffic flows, it is necessary to install a plurality of traffic analyzers to detect an abnormal traffic such as worms, DDoS, or the like. <P>SOLUTION: A network controller 10 includes a traffic statistical analysis processing part 13 to detect the abnormal traffic. When the abnormal traffic is detected, a filter is set to a packet transfer processing part 11 to stop transferring operation of the abnormal traffic. At the same time, information about abnormal detection is superimposed on a statistical information packet, and the resulting statistical information packet is sent to the traffic analyzer. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a network control device and a control method thereof, and more particularly to a network control device and a control method thereof related to detection of abnormal traffic.

  Various services including telephone and broadcasting have begun to be provided through the IP network, and quality control technology for traffic flowing through the IP network is rapidly developing. Standardization of traffic detection technology and monitoring technology is also being promoted by standardization organizations such as IETF. A communication quality control function using traffic analysis technology has also been commercialized.

  First, a traffic monitoring method called sFlow, which is being standardized by IETF and the like, will be described (Non-Patent Document 1). In sFlow, a router (or switch: the same applies below) creates a corresponding sFlow packet by sampling a packet (traffic) being transferred and cutting out the sampled packet. The sFlow packets output from the router are sent to a traffic analysis device called a collector or analyzer, and the traffic analysis device accumulates and statistically analyzes these sFlow packets and displays the results to the administrator. The sFlow technology is mainly packet measurement technology, and mainly describes information elements of sFlow packets sent from the router to the traffic analysis device. The analysis function is left to the implementation of the traffic analysis device of each vendor (some display products are also available), and the sFlow technology does not have an analysis function inside the router device.

  Next, a traffic monitoring method called CLEAR-Flow will be described as an example of a product having a traffic analysis technology in a router (or switch: the same applies below) (Non-patent Document 2). The operation flow of CLEAR-Flow consists of three stages: “monitoring”, “analysis”, and “response”. The traffic analysis technique corresponds to the “monitoring” stage performed in the router. In the “monitoring” stage, focusing on packets that match the monitoring criteria, finding a matching packet (step 1 -filter), tracking the occurrence using an event counter (step 2 -count), and setting a preset threshold If it exceeds, the set action is executed (step 3—threshold). When the corresponding traffic is detected as a result of the “monitoring” stage, the process proceeds to the “analysis” stage. In the “analysis” stage, an operation is performed when further analysis is necessary, and the router sends the traffic packet data to an external device having a more advanced analysis function. There are three methods for transferring traffic data: a mirror method, a tunnel method, and an sFlow method. The external device uses this information to perform more advanced traffic analysis. CLEAR-Flow requires an operator to specify in advance a monitoring standard for a monitoring target in a CLEAR-Flow classifier built in the switch. For example, as described in Non-Patent Document 2, a setting is made to count the number of SYN packets sent to a specific port. In response to this setting, the router / switch performs “monitoring”. As a result of the detection, the traffic data sent to the external device becomes traffic data that matches a preset detection condition.

  Although not yet disclosed, there is Japanese Patent Application No. 2005-109744 as an application related to the present invention.

P. Phaal, 2 others, “A Method for Monitoring Traffic in Switched and Routed Networks”, [online], September 2001, IETF, [April 19, 2005 search], Internet <URL: http: / /www.ietf.org/rfc/rfc3176.txt> “WHITE PAPER CLEAR-Flow”, [online], 2004, [searched February 19, 2006], Internet <URL: http://www.extremenetworks.co.jp/download/Whitepaper/CLEAR-Flow_WP. pdf>

  In the sFlow technology described in Non-Patent Document 1, a router creates a traffic data packet by sampling a traffic (packet) being transferred and cutting out the sampled packet. The traffic data packet output from the router is cut-out information of each sampled packet. In the router device, information accumulation and statistical analysis processing for packet header information are not performed. For this reason, when detecting a characteristic traffic phenomenon such as a worm hidden in a large volume of traffic, DDoS (Distributed Denial Of Service), etc., the traffic data packet output from the router is also proportionally large in capacity. SFlow packet generation load, transfer load toward the traffic analysis device, and load on the network bandwidth increase.

  In the CLEAR-Flow technology described in Non-Patent Document 2, a “monitoring” processing function is provided in the router, and the target traffic is narrowed down. The traffic target to be detected must be specified in advance by the operator in the CLEAR-Flow classifier, and traffic that is prominent as corresponding traffic is detected from traffic that matches the set classifier conditions (step 1-filter). It does not have a function of extracting characteristic traffic from the entire traffic as executed by the traffic statistical analysis processing unit 13 of the present invention, or a function of aggregating minute traffic to raise the characteristic traffic.

  Also, the router performs forwarding only when the corresponding traffic is detected (“analysis” stage), and there is no need to always forward to the traffic analysis device. As a result, the generation load of the relevant traffic information to be transferred, the transfer load toward the traffic analysis device, and the load on the network bandwidth are reduced. However, since the corresponding traffic information to be transferred is a copy of each packet, there is a problem that the transfer amount at the time of transfer is still large. In the CLEAR-Flow technology, the traffic analysis device has a function for collecting feature information.

  The object of the present invention is to solve the problems of Non-Patent Document 1 and Non-Patent Document 2, analyze traffic with a network control device (router or switch), aggregate it into feature information, and reduce transfer load and cost. To provide a network control device.

  In order to achieve the above object, according to the present invention, a traffic statistical analysis processing unit is provided in a network control device (router or switch), and characteristic traffic is monitored by the traffic statistical analysis processing unit 13. When the traffic statistical analysis processing unit detects characteristic traffic, it incorporates information on the characteristic elements and flow rate (time interval and the amount of traffic transferred during that time) into the packet, and forwards this aggregated information to the traffic analysis device. The configuration to adopt was adopted. In addition, the setting of the analysis range (what information element of the packet is analyzed, etc.) for the traffic control analysis processing of the network control device can be changed from the higher-level device (traffic analysis device, etc.) with parameters in the control information The configuration is adopted.

  According to the present invention, since abnormal traffic is analyzed / detected by the network control device, the load of the traffic analysis device can be reduced, the packet transfer load of the network control device 10 toward the traffic analysis device 20, and the network The load on the band can be reduced.

  Further, according to the present invention, in a system that authenticates a PC via a network control device, static authentication is performed by transmitting abnormal traffic detection information for each PC from the network control device to the authentication server at the time of authentication / re-authentication. Since dynamic traffic information is added in addition to information (password, digital signature information, etc.), it becomes possible to perform traffic control of the corresponding PC in addition to the authentication function.

It is a block diagram explaining the structure of the traffic monitoring system. It is a block diagram of a network control apparatus. It is a block diagram of a traffic analysis device. It is a figure explaining a packet count table. It is a figure explaining a threshold value table. It is a figure explaining an abnormality detection information table. It is a figure explaining the packet of the flow statistics information which detected the abnormal flow. It is a processing flow figure of a traffic analysis processing part. It is an abnormality determination processing flowchart of a traffic analysis processing unit. It is a figure explaining the control information packet which a traffic analysis apparatus transmits to a network control apparatus. It is a figure explaining the packet of the flow statistics information which detected the abnormal flow of the other Example. It is a figure explaining the structural example of the abnormal flow detection information of the packet of the flow statistics information which detected the abnormal flow. It is a block diagram explaining the structure of the traffic monitoring system containing the traffic analysis apparatus with the authentication function of another Example. It is a figure which shows the structural example of the authentication packet containing abnormal flow detection information. It is a figure which shows the other example of a packet count table. It is a figure which shows the example of an item field structure in the abnormal flow detection information of the packet of the flow statistics information which detected the abnormal flow.

  Hereinafter, embodiments of the present invention will be described using examples with reference to the drawings.

  A first embodiment of the present invention will be described with reference to FIGS. 1 to 10 and FIGS. 12, 15, and 16. FIG. Here, FIG. 1 is a block diagram illustrating the configuration of a traffic monitoring system. FIG. 2 is a block diagram of the network control device. FIG. 3 is a block diagram of the traffic analysis apparatus. 4 and 15 are diagrams for explaining the packet count table. FIG. 5 is a diagram for explaining the threshold value table. FIG. 6 is a diagram for explaining the abnormality detection information table. 7, 12 and 16 are diagrams for explaining a packet of flow statistical information in which an abnormal flow is detected. FIG. 8 is a processing flowchart of the traffic analysis processing unit. FIG. 9 is a flowchart of abnormality determination processing in the traffic analysis processing unit. FIG. 10 is a diagram for explaining a control information packet transmitted from the traffic analysis device to the network control device.

  1, a traffic monitoring system 100 includes a network control device 10-1 connected to a plurality of networks 1-11, 1-12,..., 1-1n, and a plurality of networks 1-k1, 1-k2, The network control device 10-k connected to 1-km and the traffic analysis device 20 are configured. The network control device 10 sends the flow statistical information to the traffic analysis device 20. Conversely, the traffic analysis device 20 sends control information (such as parameters) to the network control device 10.

  Here, the flow statistical information includes abnormality information detected by the network control device 10. The control information includes a counter reset and a threshold level change (threshold increase instruction) determined by the traffic analysis device 20 based on the abnormality information. Conversely, when there is little abnormal traffic, an instruction to reduce the threshold value is included. By configuring in this way, abnormal traffic is analyzed / detected by the network control device 10, so that the threshold level can be changed according to the status of abnormal traffic. As a result, the sensitivity can be set according to the status of abnormal traffic. The flow statistics information and the control information arrows between the traffic analysis device 20 and the network control device 10-k are omitted for the sake of simplicity.

  The network control device 10 shown in FIG. 2 includes a packet transfer processing unit 11, a statistical information acquisition / generation unit 12, and a traffic statistical analysis processing unit 13. The statistical information acquisition and generation unit 12 includes a sampling statistical processing unit 121 and a traffic abnormality detection information packet generation unit 122.

  The normal packet is transferred to the transfer destination by the packet transfer processing unit 11. A copy of the normal packet is transferred from the packet transfer processing unit 11 to the sampling statistics processing unit 121. The sampling statistics processing unit 121 samples at a predetermined rate, and cuts out N bytes including the header of the packet to be sampled. The sampling statistical processing unit 121 creates a packet (sFlow packet) in which a part of the extracted packet is superimposed and stored in the payload, and the statistical information packet is transmitted to the traffic analysis device 20 via the packet transfer processing unit 11. Forward.

  In addition, the sampling statistics processing unit 121 transfers the packet to be sampled to the traffic statistics analysis processing unit 13. The traffic statistical analysis processing unit 13 receives a control information packet from the traffic analysis device 20 via the packet transfer processing unit 11 in advance, and a threshold value is set. The traffic statistical analysis processing unit 13 detects a traffic abnormality using this threshold value. The traffic statistical analysis processing unit 13 that has detected the traffic abnormality transfers the abnormality detection information to the traffic abnormality detection information packet generation unit 122. The traffic anomaly detection information packet generator 122 generates an anomaly detection information packet based on the anomaly detection information and transfers it to the sampling statistics processor 121. The sampling statistical processing unit 121 that has received the abnormality detection information packet adds the abnormal flow detection information following the sFlow packet, and forwards the statistical information packet to the traffic analysis device 20 via the packet transfer processing unit 11.

  Since the network control device 10 of the present embodiment can vary the threshold value from the outside, it can be a network control device capable of detecting a traffic abnormality that can vary the control parameter.

  The traffic analysis device 20 illustrated in FIG. 3 includes a packet transfer processing unit 21, a statistical processing unit 22, an analysis processing unit 23, and a control information packet generation unit 24. The statistical information packet transferred from the network control device 10 is transferred to the statistical processing unit 22 via the packet transfer processing unit 21 and is subjected to statistical processing. The statistical processing unit 22 transfers the statistical processing result to the analysis processing unit 23. The analysis processing unit 23 performs analysis processing using the statistical processing result. Based on the analysis processing result, the analysis processing unit 23 resets a count value in a packet count table (to be described later) of the network control apparatus 10 that detected the traffic abnormality, and increases the threshold value of the count value. Specifically, the control information packet generation unit 24 generates a packet for controlling the reset of the count value and the change of the threshold value, and transfers the packet to the network control device 10 via the packet transfer processing unit 21. .

  A packet count table 200 illustrated in FIG. 4 is a table held in the traffic statistics analysis processing unit 13 of the network control device 10. The packet count table 200 includes an item number 1 table 201, an item number 2 table 202, an item number 3 table 203, and an item number 4 table 204. The item number 1 table 201 stores the number of packets counted by the traffic statistical analysis processing unit 13 corresponding to the type and value of item 1. Here, src ip is source ip, which means the source IP address. Further, dst port is a destination port, which means a destination port number.

  The item number 2 table 202 counts the number of packets according to the AND condition of the item 1 type and value and the item 2 type and value. Each of the item number 3 table 203 and the item number 4 table 204 counts the number of packets under the AND condition of the item number 3 or the item number 4. The number of packets in the packet count table is reset at predetermined intervals. The reset can also be performed based on control information transmitted by the traffic analysis device 20.

  The item column of the packet count table is selected from packet information. Examples of information include information included in headers such as an IP header, TCP header, UDP header, MPLS header, and MAC header, a hash value of payload data, and the like. In this sense, the packet count table counts the arrival number of packets based on the packet header information.

  A packet count table 1500 shown in FIG. 15 is another embodiment of the packet count table 200 shown in FIG.

  In this embodiment, there are four types of items for identifying traffic: a source IP address (src ip), a destination IP address (dst ip), a source port number (src port), and a destination port number (dst port). An arbitrary combination of n items (1 ≦ n ≦ 4) is generated from the four types of items. The item type is shown in an item field 1501.

  In the present embodiment, the four types of processing target items are described, but other items may be added or deleted depending on the characteristics of the traffic to be detected. For example, flag information in a TCP header may be included in order to extract traffic related to TCP session establishment / disconnection processing. Alternatively, in order to grasp traffic characteristics more accurately, the first several bytes of application data following the TCP header or UDP header may be included. Alternatively, when an MPLS label is attached, traffic analysis may be performed for each LSP including the value of the MPLS label. Alternatively, when a tunneling protocol such as L2TP is used, a tunnel identifier may be included so that traffic passing through each tunnel can be analyzed.

  The value field 1503 of the packet count table 1500 stores the value of the item if it is an item that is a component of the combination, and counts the packet having the combination if it is an item that is not a component of the combination. Stores the number of types of the value of the item that has appeared. Information indicating whether the numerical value stored in the value field 1503 is a value or the number of appearance types is stored in the attribute field 1502.

  For example, in the entry of entry number 4 in FIG. 15, 20 packets with the source IP address Z, the destination IP address Y, and the destination port number d appear, and the transmissions included in the 20 packets This indicates that there are 8 types of original port numbers.

  Further, each entry of the packet count table 1500 has a packet number field 1504 for counting the number of packets for each entry, an accumulated octet number field 1505 for accumulating the length of the packet to be counted in the entry, It has a count start time field 1506 that holds the time when the packet count starts in the entry.

  The difference from the packet count table 200 is that, when counting the number of packets focused on a combination of certain items, it is simultaneously counted how many different values appear for the items not included in the combination of the items.

  The threshold table shown in FIG. 5 is a table held in the traffic statistical analysis processing unit 13 of the network control device 10. The threshold value table 30 includes a flow type 31, a detection level 32, and a threshold value 33. Specifically, the flow type 31 is a traffic abnormality such as a worm or DDoS. Here, when a packet of flow X is detected exceeding 500, it is determined as detection level 1, and when it is detected exceeding 1000, it is determined as detection level 2. These threshold values are rewritten by the control information from the traffic analysis device 20.

  The abnormality detection information table illustrated in FIG. 6 is a table generated by the traffic statistical analysis processing unit 13 of the network control device 10 and transferred to the traffic abnormality detection information packet generation unit 122. The abnormality detection information table 80 is a table in which flow components are serially connected. Specifically, the detected flow type such as DDoS and worm, the detection level that is the suspect level of the detected flow, the source / destination address, and the source / destination port as TCP / IP header information Layer 4 protocol type and an interface which is network interface information of the network control device. In addition, layer 2 and application information may be entered.

  The packet (FIG. 7) of the flow statistical information in which the abnormal flow is detected is a packet generated by the sampling statistical processing unit 121 of the network control device 10. The flow information packet 40 includes a MAC header 41, an IP header 42, a UDP header 43, flow information 44, and abnormal flow detection information 45. A packet composed of the MAC header 41, the IP header 42, the UDP header 43, and the flow information 44 is an sFlow packet. However, abnormal flow detection information 45 is added to the flow information packet 40, which means that the network control device 10 has detected a traffic abnormality. A configuration example of the abnormal flow detection information 45 will be described with reference to FIGS. 12 and 16.

  The abnormal flow detection information 45 includes a flow type 1201, a sampling rate 1202, a threshold value 1203, an accumulated octet number 1204, an accumulated time 1205, an item number 1206, and a plurality of items 1207. The flow type 1201 indicates the type of the detected flow. The flow type value includes type information such as DDoS and worm. The sampling rate 1202 indicates the packet sampling rate at the time of flow detection, and stores the sampling rate held by the sampling statistical processing unit 121. The threshold value 1203 indicates the threshold value of the packet count number that triggered the notification of this message, and stores one of the threshold values 33 in the threshold value table 30. The total number of octets 1204 indicates the total number of octets of the packet length received until the packet count number exceeds the threshold, and the number of entries in the packet count table 1500 in which the packet number field 1504 exceeds the threshold. The value of the accumulated octet number field 1505 is stored.

  The entry integration time 1205 indicates the time from the start of counting the packet count number of the flow notified by this message until the threshold value is exceeded, and the packet count field 1504 in which the packet number field 1504 exceeds the threshold value The difference between the value of the entry count start time 1506 and the current time is stored. The item number 1206 indicates the number of items 1207 included in this message. In the example of the packet count table 1500, since one entry is composed of four items, the value of the item number 1206 is 4. An item 1207 indicates the contents of each item included in the entry of the packet count table 1500 in which the number of packets 1504 exceeds the threshold value.

  The item 1207 has a structure as shown in FIG. An item 1601 represents an item type, and specifically stores identification information such as src ip and dst ip shown in the item field 1501 of the packet count table 1500. The attribute 1602 stores “value” or “number of appearance types” indicated in the attribute field 1502 of the packet count table 1500. The value 1603 stores the value indicated in the value field 1503 of the packet count table 1500.

  When the network control device 10 detects an abnormal flow, it transmits a packet including the above information to the traffic analysis device 20, so that the traffic analysis device 20 can determine the type, scale, duration, etc. of the abnormal flow from the information. Can be grasped in a short time with a small processing load.

  Next, the operation of the traffic statistical analysis processing unit 13 of the network control device 10 will be described with reference to FIG. The traffic statistical analysis processing unit 13 receives the packet sampled by the sampling statistical processing 121 (S501). The traffic statistical analysis processing unit 13 uses the packet header information to increment the number of packets in the corresponding entry (generally present in the packet counter table 200 shown in FIG. 4) (S502). If the corresponding entry does not exist, a new entry is created. At this time, a combination of items in the header information to be newly created for entry can be set in advance, and can also be changed by the control information 54 of the control information packet 50. Next, with reference to the item number 2 table 202 and the threshold value table 30 shown in FIG. 5, it is checked whether or not there is an entry exceeding the detection level 1 threshold value in the combination of the items indicating the suspected flow (S503). When there is no (No), the process returns to Step 501, and when there is (Yes), the process proceeds to abnormality determination. If it is determined that there is an abnormality in the abnormality determination (S504) (Yes), the abnormality detection information table 80 shown in FIG. 6 is created by referring to the threshold value table again (S505). When it is determined that there is no abnormality (No), the process returns to step 501. The traffic statistical analysis processing unit 13 transfers the abnormality detection information table 80 to the traffic abnormality detection information generation unit 122 (S506).

Using FIG. 9, step 503 and step 504 in FIG. 8 will be described in more detail as a network worm and DDoS detection flow.
First, in the item number 2 table 202, the combination of the item type and value exceeding the threshold value is determined (S1001). In the case of a combination other than “scr ip” and “dst port” or “dst ip” and “dst port”, the detection flow ends.

  When the combination of the item type and value exceeding the threshold in the item number 2 table 202 is “scrip” and “dst port”, the item number 3 table is searched (S1002). In the table with three items, it is confirmed whether “scr ip” and “dst port” are the same, and there is an entry indicating communication between specific hosts (S1003). Here, “dst ip” is adopted as an item indicating communication between specific hosts. If the result is Yes, it is determined that it is not a worm and the process is terminated. On the other hand, if the result is No, it is determined as a worm (S1004).

  On the other hand, when the combination of the item type and value exceeding the threshold in the item number 2 table 202 is “dst ip” and “dst port”, the item number 3 table is searched (S1005). In the table with 3 items, it is confirmed whether “scr ip” and “dst port” are the same, and there is an entry indicating communication between specific hosts (S1006). Here, “scr ip” is adopted as the third item indicating communication between specific hosts. If this result is Yes, it is determined that the communication is P2P communication between two specific terminals and not DDoS, and the process is terminated. On the other hand, if the result is No, it is determined that the communication is DDoS from a plurality of transmission sources to a specific destination (S1007).

  Returning to FIG. 2, the traffic abnormality detection information generation unit 122 that has received the abnormality detection information table 80 generates the abnormality flow detection information 45 illustrated in FIG. 7 from the abnormality detection information table. The traffic abnormality detection information generation unit 122 transfers the abnormal flow detection information 45 to the sampling statistics processing unit 121. The sampling statistics processing unit 121 transfers the flow statistics information packet 40 in which the abnormal flow detection information 45 is added after the normal sFlow packet to the traffic analysis device 20.

  At the same time, the network control device 10 sets a filter (not shown) in the output unit of the packet transfer processing unit 11 and stops transferring abnormal packets.

  In FIG. 3, the traffic analysis device 20 that has received the flow statistics information packet 40 to which the abnormal flow detection information 45 has been added is analyzed by the analysis processing unit 23, and when the flow X in FIG. It is determined that no further detection is possible. As a result, in order to reset the packet count table and set the detection level 1 threshold of flow X to 1000 and the detection level 2 threshold to 2000, the control information packet 50 is sent via the control information creation unit 24. To the network control device 10.

  The control information packet that the traffic analysis device shown in FIG. 10 transmits to the network control device is generated by the control information packet generation unit 24 of the traffic analysis device 20. The control information packet 50 includes a MAC header 51, an IP header 52, a UDP header 53, and control information 54. The control information 54 includes a counter reset signal, parameters, and the like.

  In the above-described embodiment, sFlow has been described, but NetFlow or a mirrored packet may be used, and the present invention is not limited thereto. The control information 54 may include information for changing the combination setting information of items to be counted in the packet count table, or information for changing the flow type and detection level of the threshold table. Furthermore, instead of changing the threshold values of the detection levels 1 and 2 of the flow X, a new detection level 3 (threshold value: 2000) may be provided.

  In addition, when a traffic abnormality occurs, the destination of the abnormality notification is not limited to the traffic analysis device, but may be a higher-level network monitoring device.

  According to the present embodiment, the analysis of abnormal traffic and overload traffic can be performed by network control devices (routers or switches) arranged in a distributed manner. As a result, the analysis load of the traffic analysis device (collector or analyzer) can be reduced. Further, by adding the analysis information of abnormal traffic to the conventional sFlow statistical information, it is possible to expand using the function of the conventional Flow statistical calculation server. Furthermore, according to the present embodiment, it is possible to cope with a network attack newly generated in the future by changing the settings of the packet counter table and the threshold table according to the attack pattern.

  In the present embodiment, an algorithm with a small processing load is applied to the traffic statistical analysis processing unit 13 and incorporated in the network control device 10. When the network control device 10 performs traffic analysis and information aggregation, the network control device 10. The packet transfer load toward the traffic analysis device 20 and the load on the network bandwidth can be reduced.

  Furthermore, since the traffic analysis can be performed by being distributed to each network control device 10, the processing load and cost of the traffic analysis device 20 can be reduced.

  Next, a second embodiment will be described with reference to FIG. The system configuration of this embodiment is the same as that of the first embodiment. FIG. 11 is a diagram for explaining a packet of flow statistical information in which an abnormal flow is detected according to another embodiment.

  11 is a packet generated by the sampling statistics processing unit 121 of the network control device 10. The flow information packet 60 includes a MAC header 61, an IP header 62, a UDP header 63, and abnormal flow detection information 64.

  In this embodiment, only abnormal flow detection information is transferred to the traffic analysis device 20. Therefore, the processing of the sampling statistical processing unit 121 is simple.

  In addition, when a traffic abnormality occurs, the destination of the abnormality notification is not limited to the traffic analysis device, but may be a higher-level network monitoring device. Moreover, you may notify to a network administrator's PC via a network like a normal packet.

  Next, a third embodiment will be described with reference to FIGS. FIG. 13 shows an authentication system using an authentication server having an authentication function such as a RADIUS protocol as a traffic analysis apparatus. The authentication system shown in FIG. 13 includes a plurality of networks connected to a plurality of PCs, a network control device connected to the plurality of networks, and an authentication server. The PC is authenticated by the authentication server via the network control device. The network control device transmits the abnormal traffic detection information of the corresponding PC to the authentication server at the authentication / re-authentication timing. The authentication server performs authentication using the authentication information, and performs traffic control of the corresponding PC using the abnormal traffic detection information.

  As shown in FIG. 14, abnormal traffic detection information is added between the network control apparatus and the authentication server in addition to the original authentication information.

  DESCRIPTION OF SYMBOLS 1 ... Network, 10 ... Network control apparatus, 11 ... Packet transfer process part, 12 ... Statistical information generation process part, 13 ... Traffic statistical analysis process part, 20 ... Traffic analysis apparatus, 21 ... Packet transfer process part, 22 ... Statistical process , 23 ... analysis processing unit, 24 ... control information generation unit, 30 ... threshold value table, 40 ... flow information packet, 50 ... control information packet, 60 ... flow information packet, 80 ... abnormality detection information table, 100 ... traffic Monitoring system 121, sampling statistics processing unit 122, traffic abnormality detection information generation unit 200, packet count table 201, item number 1 table 202, item number 2 table 203, item number 3 table 204, item Formula 4 table.

Claims (6)

A network control device that is arranged between a network and a traffic analysis device and transfers packets to and from the network,
A first entry for counting the number of arrivals of the packet based on a combination of first header information possessed by the packet and a number of arrivals of the packet based on a combination of second header information possessed by the packet A packet count table including a second entry;
When receiving a packet, based on header information of the received packet, update the packet arrival number in a plurality of entries including the first entry and the second entry,
Receiving the control information transmitted by the traffic analysis device;
The threshold value indicated by the control information is compared with the packet arrival number of the first entry. When the packet arrival number of the first entry exceeds the threshold value, the second entry To determine if the traffic is abnormal or not by referring to the entry
If it is determined that the traffic is abnormal, the network control device transmits abnormality information related to the traffic abnormality to the traffic analysis device. The network control device according to claim 1,
The network control device, wherein the number of arrivals in the packet count table is reset by the control information. The network control device according to claim 1 or 2,
When transmitting the abnormality information to the traffic analysis device, the network control device transmits the statistical information packet obtained by adding the abnormality information to an sFlow packet in which a part of the packet is superimposed to the traffic analysis device. . A network control device according to any one of claims 1 to 3,
The traffic abnormality is a DDoS or a worm. A network control device according to any one of claims 1 to 4,
The network control apparatus, wherein the received packet is a sampled packet. A network control device according to any one of claims 1 to 5,
The network control device according to claim 1, wherein the abnormality information transmitted to the traffic analysis device includes information on the threshold used when it is determined that the traffic is abnormal.

Images