JP2011205197A - P2p terminal detecting device, p2p terminal detection method, and p2p terminal detection system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a P2P terminal detecting device, a P2P terminal detection method and a P2P terminal detection system capable of controlling a P2P terminal that originally needs traffic control by detecting the P2P terminal without applying a load to a network.SOLUTION: The P2P terminal detecting device includes: a receiving unit for receiving packets that a terminal transmits and receives through a network; a packet determining unit for determining whether a packet received by the receiving unit is the first packet to be transmitted or received after establishing connection; a random determining unit for determining the existence/absence of the randomness of an initial packet when the packet determining unit determines to be an initial packet, and detecting that the terminal is a P2P terminal when determining that there is the randomness in the initial packet; and a control unit for controlling traffic of the detected P2P terminal when the random determination unit detects that the terminal is a P2P terminal.

Description

  The present invention relates to a technique for detecting a terminal performing P2P communication and performing control on the detected P2P terminal.

  One form of communication performed on the Internet is called peer-to-peer communication (hereinafter referred to as P2P communication). This is a usage form of the Internet in which an unspecified number of computers (nodes) are connected to each other and information such as files is transmitted and received via a router.

  While P2P communication provides users with great benefits such as file sharing, it is used for the distribution of data that infringes copyright, and the increase in traffic of P2P communication becomes a heavy load on communication networks. It is causing a problem. In addition, information leakage accidents due to viruses exploiting P2P software that performs P2P communication frequently occur, which is a social problem. Recently, in order to avoid traffic control by ISP (Internet Services Provider), P2P software that implements encryption processing MSE (Message Stream Encryption) using Diffie-Hellman key exchange has also appeared.

  In response to these movements, attempts have been made to detect P2P terminals on the network and control their traffic. For example, in Patent Document 1, a structural change of a payload (net data excluding management information (header information) such as transmission IP and reception IP in the total packet size) is represented as a change in a histogram of character code appearance probabilities. A technique related to a system for evaluating and detecting a P2P terminal is disclosed. Non-Patent Document 1 discloses a technique related to a P2P terminal detection method for detecting a P2P terminal by analyzing the contents of a packet.

JP 2008-141618 Gazette

S. Sen, O. Spatscheck, D. Wang, “Accurate, ScalableIn-Network Identification of P2P Trafic Using Application Signatures,” International World Wide Web Conference, May, 2004

  However, Patent Document 1 uses the payload structure change for P2P terminal detection, and there is a problem that at least two packets of data are required. Payload structure for each flow (a set of packets that have the same five elements of sending IP, sending port, receiving IP, receiving port, and protocol, and a set of packets that have the same protocol and the sending and receiving IP and sending and receiving ports are reversed) Since the change is stored, there is a problem that the load becomes high in a line having a large number of flows.

  Further, in Non-Patent Document 1, a specific character string included in the payload is used for P2P terminal detection, and in communication of a P2P terminal that performs encryption, the specific character string does not appear in the payload and cannot be detected. There was a problem. In other words, with these technologies, when a P2P terminal performs encrypted communication, the P2P terminal cannot be detected without imposing a load on the network, and as a result, for a P2P terminal that originally needs traffic control. There was a problem that it could not be controlled.

  The present invention has been made in view of the above points. A P2P terminal detection apparatus and a P2P terminal detection capable of detecting a P2P terminal and controlling a P2P terminal that originally needs traffic control without imposing a load on the network. It is an object to provide a method and a P2P terminal detection system.

  In order to achieve the above-described object, a P2P terminal detection apparatus according to the present invention is a P2P terminal detection apparatus that detects whether or not a terminal that transmits and receives packets via a network is a P2P terminal. Receiving means for receiving a packet to be transmitted / received via the network; packet determining means for determining whether the packet received by the receiving means is an initial packet to be transmitted / received first after connection establishment; When the packet determination means determines that the packet is the initial packet, it determines whether or not the initial packet is random. If the packet is determined to be random, the terminal is detected as a P2P terminal. Detecting when the random determination means detects that the terminal is the P2P terminal. It characterized in that it comprises a control means for controlling the traffic of the P2P terminals that.

  The present invention also provides a P2P terminal detection method and a P2P terminal detection system using the P2P terminal detection device.

  According to the present invention, a P2P terminal detection device, a P2P terminal detection method, and a P2P terminal detection system capable of detecting a P2P terminal and controlling a P2P terminal that originally needs traffic control without imposing a load on the network are provided. can do.

It is a figure which shows the structure of the P2P terminal detection system in 1st Embodiment. It is a figure which shows the structural example of a traffic control apparatus. It is a figure which shows the structural example of a P2P terminal detection apparatus. It is a figure which shows the example of connection management data. It is a figure which shows an example of detection information. It is a figure which shows the structural example of a P2P terminal control apparatus. It is a figure which shows an example of control policy data. It is a flowchart which shows the process sequence of a detection process. It is a flowchart which shows the process sequence of a control process. It is a figure which shows the structural example of the P2P communication terminal detection apparatus in 2nd Embodiment. It is a flowchart which shows the process sequence of a classification specific process. It is a flowchart which shows the process sequence of a connection trial process. It is a figure which shows the example of the key information of a Winny connection program.

  Exemplary embodiments of a P2P terminal detection system and a P2P terminal detection device according to the present invention will be described below in detail with reference to the accompanying drawings.

  In order to detect a P2P terminal, a method of monitoring packet data transmitted / received between P2P terminals is generally used. Packet data often contains information specific to P2P software, which is an effective method for such P2P software. However, depending on the P2P software, in order to avoid detection by the packet data, there is a software that encrypts the packet data and makes it appear as a random number sequence with no features.

In the present invention, a P2P terminal that performs encrypted communication is detected by examining the randomness of an initial packet (first packet after connection establishment) using this feature. In the first embodiment, paying attention to this point, detection of a P2P terminal and traffic control for the detected P2P terminal are described. Also, with the above method, it is not possible to specify the type of P2P software. Therefore, the terminal detected as the P2P terminal is connected according to the protocol of the P2P software, and the P2P software type is specified by whether or not the connection is possible. In the second embodiment, focusing on this point, the detection of the P2P terminal and the traffic control for the detected P2P terminal are described.
(First embodiment)
First, a P2P terminal detection system 1000 according to the first embodiment will be described with reference to FIGS. FIG. 1 is a diagram illustrating a configuration of a P2P terminal detection system 1000 according to the first embodiment. As shown in FIG. 1, the P2P terminal detection system 1000 includes a traffic control device 101, a P2P terminal detection device 102, and a P2P terminal control device 103.

  In the following description, it is assumed that the P2P terminal is detected and the traffic control for the detected P2P terminal is performed by each of the devices described above. For example, the detection and control described above are performed according to the traffic flowing through the network. It may be performed by one apparatus. First, the traffic control device 101 will be described.

  The traffic control apparatus 101 receives traffic flowing through the communication path 104, controls traffic based on a predetermined control policy, and transmits the controlled traffic to the communication path 108. The traffic control apparatus 101 refers to the traffic to be detected from the traffic on the communication path 104, for example, the IP address of the communication to be detected (communication to be analyzed), and the referenced IP address is set. The terminal is copying the traffic that is being transmitted / received, and the copied traffic is output to the communication path 105. The communication path 105, the communication path 106, and the communication path 107 are information transmission media such as buses and cables. It is assumed that the traffic copied by the traffic control apparatus 101 includes at least information on a transmission IP address, a transmission port, a reception IP address, and a reception port.

  The P2P terminal detection apparatus 102 receives traffic flowing through the communication path 105, detects P2P communication from the received traffic, and transmits detection information that is the detection result to the communication path 106. Specific contents of the detection information will be described later with reference to FIG.

  It is desirable that the P2P terminal detection apparatus 102 executes processing for detecting a P2P communication terminal for the traffic to be analyzed that is selected and copied by the traffic control apparatus 101. However, if the P2P terminal detection device 102 is a device having sufficient performance, the P2P terminal detection device 102 may execute these processes including the selection of traffic to be analyzed. By adopting such a configuration, it is possible to reduce the load related to the selection of traffic by the traffic control apparatus 101 and the copying of the selected traffic. In this case, in FIG. 1, the P2P terminal detection apparatus 102 is connected to the communication path 104 instead of the communication path 105, and the traffic control apparatus 101 is not connected to the P2P terminal detection apparatus 102 and conforms to a predetermined control policy. Based on this, traffic can be controlled, and the processing load on the traffic control apparatus 101 is reduced.

  The P2P terminal control apparatus 103 receives the detection information flowing through the communication path 106 and transmits control information indicating what kind of control is performed on the P2P terminal to the communication path 107 according to the received detection information. The specific contents of this control information will be described later with reference to FIG.

  The communication path 104 and the communication path 108 are, for example, a network such as an intranet or the Internet, or a communication network for connecting to these. One or more terminals are connected to the communication path 104 and the communication path 108 and perform communication such as web access and file transfer, for example. The P2P terminal control apparatus 103 may transmit control information to a plurality of traffic control apparatuses connected to other networks, and control traffic flowing on the other networks.

  FIG. 2 is a diagram illustrating a configuration example of the traffic control device 101. As shown in FIG. 2, the traffic control device 101 is a network device such as a router, for example, and includes a CPU (Central Processing Unit) 204 and a memory 206 for storing data necessary for the CPU 204 to execute processing. An IF (interface) 201, IF 202, IF 203, IF 205 for communicating with other devices, an input / output device 207 for performing input / output of a keyboard, a display, and the like, and a communication path for connecting these devices ( Bus) 208. In other figures, it is called an IF (interface), but it may be called a communication interface, an input / output interface, or a communication device, a receiving device, a transmitting device, an input / output device, etc., depending on the connection destination. .

  The CPU 204 executes a traffic control program 210 stored in the memory 206. The memory 206 stores a traffic control rule 209 for controlling traffic. The traffic control rule 209 includes information for controlling communication. For example, discarding communication packets passing through the traffic control apparatus 101, limiting the bandwidth, changing the destination route, copying traffic, and other IF Stores rules such as mirroring transmitted from.

  The traffic control rule 209 is rewritten or added by receiving a new rule via the IF 205 via the input / output device 207 or the communication path 107. The traffic control apparatus 101 transmits the traffic received from the communication path 104 to the communication path 105 and / or the communication path 108 via the IF 202 and / or IF 203 according to the traffic control rule 209.

  FIG. 3 is a diagram illustrating a configuration example of the P2P terminal detection apparatus 102. As described above, the P2P terminal detection device 102 detects a terminal performing P2P communication from traffic. As shown in FIG. 3, the P2P terminal detection device 102 includes a CPU 302, a memory 304, an IF 301, an IF 303, an input / output device 305, and a communication path (bus) that connects these devices. Computer.

  When the CPU 302 executes the P2P terminal detection program 307 stored in the memory 304, the terminal that performs P2P communication is detected. The memory 304 stores connection information management data 308 for determining an initial packet. The P2P terminal detection program 307 may be stored in the memory 304 in advance, or may be loaded (installed) from another device via the IF 301 or IF 303 when necessary.

  When the IF 301 of the P2P terminal detection apparatus 102 receives a TCP (Transmission Control Protocol) connection connection request packet (with the SYN flag in the TCP header turned ON), the P2P terminal detection program 307 performs connection management according to an instruction from the CPU 302. When the connection information 401 of the packet is registered in the data 308 and a packet having a payload of 1 byte or more is received, the connection information of the packet is deleted from the connection management data 308. The connection management data 308 includes information of connection information 401 as shown in FIG. Here, the connection information 401 is information for identifying a connection between communicating terminals, and is information calculated from, for example, a transmission IP address, a transmission port number, a reception IP address, and a reception port number.

  In general, a P2P terminal that performs encrypted communication uses a packet that appears to be a random number sequence with no features as an initial packet. In response to an instruction from the CPU 302, the P2P terminal detection program 307 performs a random test on the initial packet and determines whether the connection is communication by a P2P terminal. The P2P terminal detection apparatus 102 transmits this determination result as detection information to the communication path 106 via the IF 303.

  FIG. 5 is a diagram illustrating an example of detection information that the P2P terminal detection program 307 transmits to the communication path 106 in response to an instruction from the CPU 302. As shown in FIG. 5, the detection information includes at least terminal information 501 for identifying (specifying) a terminal, and a certainty factor 502 indicating a high possibility (size) that the terminal is a P2P terminal. And a P2P software type 503 indicating the type of P2P software used by the terminal. If the P2P software type 503 cannot be specified by the P2P terminal detection program 307, Any (an identifier indicating that it is some P2P software) is transmitted as the P2P software type 503.

  In addition, the terminal information 501 includes a transmission IP 504, a transmission port 505, a reception IP 506, and a reception port of a packet determined to have randomness (a packet having a randomness-like probability less than or equal to a certain threshold (or more than a threshold)). 507. Here, the probability of randomness represents a measure of how close to a true random number. In FIG. 5, a packet transmitted from the "10001" port with the IP address "192.168.0.1" to the "20000" port with the IP address "192.168.0.2" is some P2P communication (P2P software The result of detecting that the type 503 is “Any”) is shown. Specific processing by the P2P terminal detection program 307 will be described later with reference to FIG. Next, the P2P terminal control apparatus 103 will be described.

  FIG. 6 is a diagram illustrating a configuration example of the P2P terminal control apparatus 103. As described above, the P2P terminal control device 103 controls communication of the P2P terminal, and includes a CPU 603, a memory 602, a storage device 606 such as a hard disk or flash memory having a capacity for recording data, and other devices. And an IF 601 and IF 605 for communicating with each other, an input / output device 604, and a communication path 607 for connecting these devices.

  The CPU 603 controls the traffic of the P2P terminal by executing the P2P terminal control program 608 stored in the memory 602. The storage device 606 stores control policy data 609 that stores a control policy indicating how to control the traffic of the P2P terminal. The P2P terminal control program 608 and control policy data 609 may be stored in advance in the memory 602 or the storage device 606, or installed (loaded) from the input / output device 604 or from another device via the IF 601 or IF 605. May be.

  FIG. 7 is a diagram illustrating an example of the control policy data 609. As shown in FIG. 7, the control policy data 609 is information including a P2P software type 701, a certainty factor 702, and control information 703. These pieces of information are set in advance by an administrator or the like, and the P2P software type 701 and the certainty factor 702 of the control policy data 609 are standards for selecting the control information 703 that is the content of control. As shown in FIG. 7, the control information 703 is stored in association with the type of the P2P software type 701 and the level of confidence 702 (the magnitude of the numerical value).

  In response to an instruction from the CPU 603, the P2P terminal control program 608 compares the P2P software type 503 and the certainty factor 502 included in the received detection information with the P2P software type 701 and the certainty factor 702 of the control policy data 609, Control information 703 corresponding to the comparison result is transmitted to the communication path 107 via the IF 605. Specific processing of the P2P terminal control program 608 will be described later with reference to FIG.

  Subsequently, a process (hereinafter referred to as a detection process) in which the P2P terminal detection program 307 of the P2P terminal detection apparatus 102 detects a P2P terminal and transmits detection information will be described. FIG. 8 is a flowchart illustrating the processing procedure of the detection process.

  As shown in FIG. 8, the P2P terminal detection program 307 receives a packet flowing through the communication path 105 through the IF 301 in response to an instruction from the CPU 302 (step S801), and analyzes the header part of the received packet. Then, it is determined whether or not the received packet is a packet whose SYN flag is ON (SYN packet) (step S802).

  If the P2P terminal detection program 307 determines that the received packet is a packet (SYN packet) whose SYN flag is ON (step S802; Yes), it calculates connection information 401 from the received packet. The calculated connection information 401 is registered in the connection information management data 308 (step S803), and the detection process shown in FIG.

  As described above, the connection information 401 is 12-byte information obtained by combining a transmission IP, a transmission port, a reception IP, and a reception port, for example. Note that the calculation method of the connection information 401 is an example, and any method may be used as long as the information can identify communication between P2P terminals.

  On the other hand, when the P2P terminal detection program 307 determines that the received packet is not a packet (SYN packet) whose SYN flag is ON (step S802; No), the P2P terminal detection program 307 further receives the packet. It is determined whether or not the packet has a payload of 1 byte or more (step S804).

  If the P2P terminal detection program 307 determines that the received packet does not have a payload of 1 byte or more (step S804; No), the detection process shown in FIG.

  On the other hand, when the P2P terminal detection program 307 determines that the received packet has a payload of 1 byte or more (step S804; Yes), the connection information of the packet determined in step S804, transmission / reception IP, and The connection information of the packet in which the transmission / reception port is reversed is calculated in the same manner as in step S803, and one of the calculated two pieces of connection information is already registered in the connection information management data 308. It is determined whether or not (step S805).

  If the P2P terminal detection program 307 determines that one of the calculated two pieces of connection information is already registered in the connection information management data 308 (step S805; Yes), the connection information The corresponding connection information 401 is deleted from the data 308, the received packet is determined to be an initial packet, and the process proceeds to step S806.

  On the other hand, when the P2P terminal detection program 307 determines that one of the calculated two pieces of connection information is not already registered in the connection information management data 308 (step S805; No), FIG. The detection process shown in FIG.

  If the P2P terminal detection program 307 determines in step S805 that the received packet is an initial packet, the P2P terminal detection program 307 performs a random test on the packet (step S807). For the random test, for example, bias of a bit string of packet data is used. If the packet data is truly random, the number of zeros and the number of ones included in the packet data are likely to be equal. Therefore, the absolute value of (number of 0 minus 1) / (number of 0 and 1) is obtained, and if this value is smaller than a certain threshold (for example, 0.2), it is determined that there is randomness (according to the environment). To change the threshold).

  The above random test method is an example. For example, the random test described in “NIST Special Publication 800-22” or other random tests may be used, or a plurality of them may be combined, and all of them are below the threshold value. It may be determined that there is randomness when it is (or above a threshold) (or below a threshold (or above a threshold) only for a specific test). The P2P terminal detection program 307 performs the above-described random test every time an initial packet is received, and detects that the terminal is a P2P terminal every time it is determined that the initial packet has randomness.

  Then, the P2P terminal detection program 307 determines whether or not the packet subjected to the random test in step S806 has randomness (step S807), and determines that the packet has randomness (step S807; Yes). ), The packet is determined to be communication by the P2P communication terminal, and the determination result is transmitted as detection information to the communication path 106 via the IF 303 (step S808), and the detection process illustrated in FIG. 8 is terminated.

  The detection information includes the determined terminal information 501, the certainty factor 502 indicating the likelihood of the terminal being a P2P terminal, and the P2P software type 503 used by the terminal. In this embodiment, since the P2P software type cannot be specified, “Any”, which means some P2P software, is transmitted as the P2P software type. In addition, the certainty factor is obtained by {1- | (number of 0-1 number) | / (number of 0 and 1)}, for example. According to the exemplified formula, the certainty factor is 1 when the same number of 0s and 1s exist in the packet data, and becomes 0 when only 0 or only 1 exists in the packet data. The method of calculating the certainty factor is an example, and the randomness may be calculated using a random test to obtain the certainty factor.

  On the other hand, if the P2P terminal detection program 307 determines that the packet is not random (step S807; No), the detection process shown in FIG. 8 is terminated. When any one of steps S803 to S805, S807, and S808 is completed, all the detection processing shown in FIG. 8 is completed.

  Next, a process (hereinafter referred to as a control process) in which the P2P terminal control program 608 of the P2P terminal control apparatus 103 receives detection information from the P2P terminal detection apparatus 103 and transmits control information will be described. FIG. 9 is a flowchart illustrating the processing procedure of the control process.

  As shown in FIG. 9, the P2P terminal control program 608 receives detection information flowing through the communication path 106 via the IF 601 in response to an instruction from the CPU 603 (step S901), and is included in the received detection information. The P2P software type 503 and the certainty factor 502 are compared with the P2P software type 701 and the certainty factor 702 included in the control policy data 609, and the corresponding policy (included in the P2P software type 502 and the control policy data 609 included in the detection information) is compared. It is determined whether there is a policy in which the P2P software types 701 match and the certainty factor 502 included in the detection information is equal to or greater than the certainty factor 702 of the control policy data 609 (step S902).

  If the P2P terminal control program 608 determines that the corresponding policy exists (step S902; Yes), the terminal information 501 and the control information 703 included in the detection information are transferred to the communication path 107 via the IF 605. Then, the control process shown in FIG. 9 is terminated. In the present embodiment, for example, when the P2P terminal control apparatus 103 holding the policy shown in FIG. 7 receives the detection information shown in FIG. 5, “bandwidth control” is selected as the control information. It will be. When the traffic control apparatus 101 receives control information via the communication path 107, the traffic is controlled according to the contents (for example, “bandwidth control”) set in the control information.

  On the other hand, if the P2P terminal control program 608 determines that the corresponding policy does not exist (step S902; No), it does nothing and terminates the control process shown in FIG. Then, when the process of step S902 or S903 ends, all the processes of the control process shown in FIG. 9 end.

  As described above, in the P2P terminal detection system 1000 that detects whether or not a terminal that transmits and receives a packet via the network is a P2P terminal, the P2P terminal detection apparatus 102 uses the IF 301 as a packet that the terminal transmits and receives via the network. When the P2P terminal detection program 307 determines whether the packet received by the IF 301 is an initial packet that is the first packet to be transmitted / received after establishing a connection and determines that the packet is an initial packet, If the initial packet is determined to be random, it is detected that the terminal is a P2P terminal, and the IF 303 detects that the P2P terminal detection program 307 is a P2P terminal. The result is transmitted as detection information, and the P2P terminal control apparatus 103 receives the IF 601. Since the detection information is received from the P2P terminal detection apparatus 103 and the P2P terminal control program 602 controls the detected traffic of the P2P terminal based on the detection information received by the IF 601, without imposing a load on the network. By detecting a P2P terminal, it is possible to control a P2P terminal that originally needs traffic control. That is, it is possible to detect a P2P terminal that performs encrypted communication using only the initial packet, and to control the P2P terminal according to the detection.

  Note that a part of the present embodiment may be changed and implemented as follows. The detection result of the P2P terminal detection program 307 is output to the input / output device 207. As a result, the network administrator can take measures such as issuing a warning message to the user of the P2P terminal.

  When the P2P terminal detection program 307 receives a response to the connection establishment request (with the SYN flag and the ACK flag in the TCP header turned on), the P2P terminal detection program 307 registers the connection information of the packet in the connection management data 308. As a result, meaningless connection information such as a SYN-Flood attack (SYN flooding attack) that attempts a large number of TCP connections that are not established is not retained.

In the connection information registration (step S703), a connection information calculation method in which the connection information of the received packet and the packet in which the transmission / reception IP and the transmission / reception port are reversed may have the same value (for example, transmission IP, Calculated by taking the exclusive OR of the MD5 hash value of the combined value of the sending port and the MD5 hash value of the combined value of the receiving IP and receiving port). This eliminates the need to calculate connection information in which the transmission / reception IP and the transmission / reception port are reversed in the process of step S705. Further, in order to save the memory area of the connection information management data 308, the upper 4 bytes of the exclusive OR obtained earlier may be used as the connection information 401. At this time, the connection information 401 may collide and the connection may be erroneously identified. Therefore, the size of the connection information 401 may be changed according to the memory area.
(Second Embodiment)
In the present embodiment, since the processing related to the detection information transmission (step S808) of the P2P terminal detection program 307 described above is different from the first embodiment, the same components as those in the first embodiment The description will be omitted by attaching the same reference numerals, and the following description will focus on the different points described above.

  FIG. 10 is a diagram illustrating a configuration example of the P2P communication terminal detection device 902 according to the second embodiment. As illustrated in FIG. 10, the P2P communication terminal detection device 902 includes a memory 904 that is different from the memory 304 in the first embodiment. The memory 904 stores the same contents as the memory 304 in the first embodiment, and also stores a P2P type specifying program 1001 for specifying the P2P software type. Further, the P2P type identification program 1001 stores a connection program corresponding to the type of P2P software for connecting to the P2P terminal. In FIG. 10, as an example, the BitTorrent connection program 1002a and the Winny connection program 1002b are stored, but not limited to this, connection programs according to various types of P2P software can be stored.

  In the second embodiment, the CPU 303 executes the P2P type specifying program 1001 stored in the memory 904 to specify the P2P type. As described above, the P2P type identification program 1001 has the P2P connection program 1002 for performing connection according to the P2P software. These programs may be stored in the memory 904 in advance, or may be loaded (installed) from another device via the IF 301 or IF 303 when necessary.

  FIG. 11 is a flowchart showing a processing procedure of a process (hereinafter referred to as a type specifying process) for the P2P type specifying program 1001 of the P2P terminal detecting device 902 to specify the type of the P2P software. The P2P type identification program 1001 is called from the P2P terminal detection program 307 instead of the detection information transmission (step S808) in the first embodiment.

  As shown in FIG. 11, the P2P type identification program 1001 of the P2P terminal detection device 902 determines whether there is a P2P connection program 1002 that has not been attempted for connection, that is, whether or not connection has been attempted for all connection programs. Determination is made (step S1101).

  If the P2P type identification program 1001 determines that connection is not attempted for all connection programs (step S1101; No), the P2P type identification program 1001 determines that the terminal is determined to be a P2P terminal in step S807 in the first embodiment. Then, connection attempt processing for trying connection by the P2P connection program 1002 is performed (step S1102). As an example of the P2P connection program 1002, a processing procedure when the Winny connection program 1002b performs a connection trial process will be described later with reference to FIG.

  On the other hand, if the P2P type specifying program 1001 determines that connection has been attempted for all the connected programs (step S1101; Yes), the type specifying process shown in FIG. 11 is terminated.

  Then, the P2P type specifying program 1001 determines whether or not the connection is correctly performed by the P2P connection program 1002 as a result of the connection attempt in step S1102 (step S1103), and the connection is correctly performed by the P2P connection program 1002. If it is determined (step S1103; Yes), it is determined that the P2P software that is the target of the P2P connection program used for the connection is running on the terminal, and the process proceeds to step S1104.

  On the other hand, if the P2P type identification program 1001 determines that the connection is not correctly performed by the P2P connection program 1002 (step S1103; No), the process returns to step S1101 and repeats the processes of steps S1101 to S1103.

  When the P2P type identification program 1001 determines in step S1103 that the connection has been made correctly by the P2P connection program 1002, the determination result is transmitted as detection information to the communication path 106 via the IF 303 (step S1104). The type specifying process shown in FIG. The detection information includes the determined terminal information 501, the certainty factor 502 indicating the degree of possibility that the terminal is a P2P terminal, and the P2P software type 503 used by the terminal. In this embodiment, since the program for P2P communication is specified, the certainty factor may be transmitted as 1.

  FIG. 12 is a flowchart of a process procedure of the connection trial process shown in FIG. As described above, FIG. 12 describes the Winny connection program 1002b for specifying Winny.

  As illustrated in FIG. 12, the Winny connection program 1002b transmits key information to the terminal determined as the P2P terminal in the process of step S807 in the first embodiment (step S1201). The key information includes a random number 1301, an RC4 encryption key 1302, and data 1303 as illustrated in FIG. The data 1303 is, for example, a byte string obtained by encrypting a byte string “01 00 00 00 61”, which is a version number for recognizing Winny, using the RC4 encryption key 1302.

  The Winny connection program 1002a determines whether a packet is received from the connection destination terminal (step S1202). If the Winny connection program 1002a determines that a packet is received from the connection destination terminal (step S1202; Yes), the process proceeds to step S1203.

  On the other hand, if the Winny connection program 1002a determines that a packet has not been received from the connection destination terminal (step S1202; No), the connection trial process shown in FIG. 12 is terminated. For example, if the Winny connection program 1002a does not receive a packet even after a certain period of time (for example, a time set as a threshold of 3 seconds) has elapsed, the connection trial process shown in FIG. 12 is terminated.

  If it is determined in step S1202 that a packet has been received from the connection destination terminal, the Winny connection program 1002a performs a decoding process on the received packet (step S1203). At this time, if the connection destination is Winny, data having the same structure as the data illustrated in FIG. 13 is sent. Therefore, the data 1303 is decrypted using the RC4 encryption key 1302.

  The Winny connection program compares the result decoded in step S1203 with the above-described byte string “01 00 00 00 61” to determine whether or not they match (step S1204), and determines that they match. If it is determined (step S1204; Yes), it is determined that the connection destination terminal is correctly connected (step S1205). When the processing in step S1202 or S1205 is completed, all the connection trial processing shown in FIG. 12 is completed.

  As described above, according to the second embodiment, the P2P terminal detection device 902 has the memory 904 that stores a plurality of types of P2P software, and the P2P terminal detection device 103 has the storage device 606 that has a plurality of P2P software. The control information and information including the randomness of the initial packet are stored as control policy data 609 in association with the software type, and the P2P detection program 307 connects to the terminal using the P2P software stored in the memory 904. When the connection is normally performed, the P2P software used by the terminal is specified, and the detection information including the control information corresponding to the specified P2P software and the information including the randomness of the initial packet is output. P2P communication terminals can be detected in consideration of the P2P software type, and P2P terminals can be controlled according to the detection. That.

  The present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above embodiments. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

DESCRIPTION OF SYMBOLS 1000 ... P2P terminal detection system, 101 ... Traffic control apparatus, 102 ... P2P terminal detection apparatus, 103 ... P2P terminal control apparatus, 209 ... Traffic control rule, 210 ... Traffic control program, 307 ... P2P terminal detection program, 308 ... Connection management Data, 602... P2P terminal control program, 609... Control policy data, 1001.

Claims (15)

A P2P terminal detection device that detects whether a terminal that transmits and receives packets via a network is a P2P terminal,
Receiving means for receiving packets transmitted and received by the terminal via the network;
Packet determining means for determining whether or not the packet received by the receiving means is an initial packet that is transmitted and received first after connection establishment;
When the packet determination unit determines that the initial packet is the initial packet, the initial packet is determined to be random or not. When the initial packet is determined to be random, the terminal is a P2P terminal. Random determination means to detect;
Control means for controlling traffic of the detected P2P terminal when the random determination means detects that the terminal is the P2P terminal;
A P2P terminal detection device comprising: The packet determination means determines whether the packet received by the reception means is the initial packet by determining whether or not the packet received by the reception means includes an attribute having a connection request. Determine
The P2P terminal detection apparatus according to claim 1. The random determination means determines whether or not the initial packet has randomness every time the receiving means receives the initial packet, and every time the terminal determines that the initial packet has the randomness, the terminal Detect it as a device,
The P2P terminal detection apparatus according to claim 1 or 2, wherein The random determination means, when detecting that the terminal is the P2P terminal, outputs detection information including information identifying the terminal and randomness of the initial packet,
The control unit controls the detected traffic of the P2P terminal based on the detection information output by the random determination unit.
The P2P terminal detection apparatus according to any one of claims 1 to 3, wherein Control information storage means for storing control information indicating how to detect the detected traffic of the P2P terminal in association with information including the randomness of the initial packet;
The control means compares the information including the random number likelihood of the initial packet stored in the control information storage means with the random number likelihood of the initial packet included in the detection information output from the random determination means, The control information storage means stores the random number probability of the initial packet included in the detection information output by the determination means when the randomness probability of the initial packet stored by the control information storage means is more random. Based on the control information, the detected traffic of the P2P terminal is controlled.
The P2P terminal detection apparatus according to claim 4. Further comprising a type storage means for storing a plurality of types of P2P software;
The control information storage means stores the control information and information including the randomness of the initial packet in association with the plurality of P2P software types,
The random determination means performs connection by the P2P software stored in the type storage means to the terminal, and specifies and specifies the P2P software used by the terminal when the connection is normally performed. Outputting detection information including the control information corresponding to the P2P software and information including randomness of the initial packet;
The P2P terminal detection apparatus according to claim 5. The random determination means repeatedly identifies the P2P software used by the terminal by connecting to the terminal using the P2P software stored in the type storage means.
The P2P terminal detection apparatus according to claim 6. A P2P terminal detection method performed by a P2P terminal detection device that detects whether a terminal that transmits and receives a packet via a network is a P2P terminal,
A receiving step of receiving a packet transmitted and received by the terminal via the network;
A packet determination step of determining whether or not the packet received in the reception step is an initial packet that is transmitted and received first after connection establishment;
When it is determined in the packet determination step that the packet is the initial packet, it is determined whether or not the initial packet is random. When the initial packet is determined to be random, the terminal is a P2P terminal. A random determination step for detecting
A control step of controlling traffic of the detected P2P terminal when the terminal is detected as the P2P terminal in the random determination step;
P2P terminal detection method characterized by including. The packet determination step determines whether the packet received in the reception step is the initial packet by determining whether or not the packet received in the reception step includes an attribute having a connection request. Determine whether or not
The P2P terminal detection method according to claim 8. The random determination step determines the presence or absence of randomness of the initial packet every time the initial packet is received in the reception step, and each time the terminal determines that the initial packet has the randomness, P2P Detect it as a device,
The P2P terminal detection method according to claim 8 or 9, characterized in that. When the random determination step detects that the terminal is the P2P terminal, it outputs detection information including information identifying the terminal and randomness of the initial packet;
The control step controls the detected traffic of the P2P terminal based on the detection information output in the random determination step.
The P2P terminal detection method according to any one of claims 8 to 10, wherein: In the control step, the initial packet stored by the control information storage means for storing control information indicating how to control the detected traffic of the P2P terminal in association with information including the randomness of the initial packet is stored. And the initial packet included in the detection information output in the random determination step by comparing the information including the random number likelihood with the random number of the initial packet included in the detection information output in the random determination step. Of the P2P terminal detected based on the control information stored in the control information storage means when the random number is more likely to be a random number than the randomness of the initial packet stored in the control information storage means. Control,
The P2P terminal detection method according to claim 11. The control information storage means stores the control information and information including the randomness of the initial packet in association with the types of the plurality of P2P software,
The random determination step uses the terminal when a connection is made by the P2P software stored in the type storage unit that stores a plurality of types of P2P software for the terminal, and the connection is normally performed. P2P software is specified, and detection information including the control information corresponding to the specified P2P software and information including the randomness of the initial packet is output.
The P2P terminal detection method according to claim 12, wherein: The random determination step repeatedly identifies the P2P software used by the terminal by making a connection to the terminal using the P2P software stored in the type storage unit.
The P2P terminal detection method according to claim 13. A P2P terminal detection system that detects whether a terminal that transmits and receives packets via a network is a P2P terminal,
P2P terminal detection device
First receiving means for receiving packets transmitted and received by the terminal via the network;
Packet determining means for determining whether or not the packet received by the receiving means is an initial packet that is transmitted and received first after connection establishment;
When the packet determination unit determines that the initial packet is the initial packet, the initial packet is determined to be random or not. When the initial packet is determined to be random, the terminal is a P2P terminal. Random determination means to detect;
Transmission means for transmitting, as detection information, a result of the random determination means detecting that the terminal is a P2P terminal;
The P2P terminal control device
Second receiving means for receiving the detection information from the P2P terminal detection device;
Control means for controlling traffic of the detected P2P terminal based on the detection information received by the second receiving means;
A P2P terminal detection system comprising:

Images