JP2019004419A - Network monitoring device, and system and method therefor - Google Patents

Abstract

To early detect suspicious communication in a network on the basis of an illegal access etc., in a system having apparatuses mutually connected to the network.SOLUTION: A network monitoring device which monitors a packet which flows in the network includes a processing unit and an interface. The interface includes a packet capture unit which captures a packet in the network. The processing unit performs the processing of: extracting, from the captured packet, a packet feature amount related to communication in a plurality of monitor viewpoints, in a learning period and a monitor period; determining, in the learning period, the constancy of each packet feature amount extracted in the plurality of monitor viewpoints; generating a model related to each monitor viewpoint which is determined to be valid; and comparing, for the monitor viewpoint determined to have constancy in the learning period, the packet feature amount extracted in the monitor period with the model generated in the learning period, to determine the existence or non-existence of abnormal communication.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a technique for extracting a feature amount of communication based on analysis of a packet flowing on a network and monitoring the change in a system in which devices are connected to the network.

  Conventionally, as shown in Patent Document 1, a network monitoring technique is known in which a packet related to device authentication is analyzed to monitor whether one or more suspicious behavior conditions related to authentication are satisfied. This prior art is a technique for improving the determination accuracy of whether or not unauthorized access has occurred by monitoring a plurality of suspicious behavior conditions.

JP 2014-86822 A

  In the prior art, (1) the more monitoring viewpoints of the model, the greater the amount of processing for monitoring the presence or absence of communication behavior that deviates from the model, and (2) which monitoring viewpoint is appropriate as a model, that is, modeling There is a problem that it may be unknown at the time of model creation whether there is a difference between the normal communication and the communication at the time of occurrence of an abnormality to be monitored.

  An object of the present invention is to early detect suspicious communication on a network based on unauthorized access or the like in a system in which devices are connected to a network.

  In order to solve the above problems, the present invention is a network monitoring apparatus that monitors a packet flowing through a network as a preferred example, and includes a processing unit and an interface, and the interface captures a packet of the network. A capture unit, wherein the processing unit extracts a packet feature amount from the captured packet in a plurality of monitoring viewpoints in a learning period and a monitoring period, and extracts the packet feature amount in a plurality of monitoring viewpoints in the learning period For the monitoring viewpoint that is determined to be stationary, the model is created for the monitoring viewpoint that is determined to be stationary, and the monitoring viewpoint that is assumed to be stationary in the learning period is extracted in the monitoring period The presence / absence of abnormal communication is determined by comparing the packet feature quantity with the model.

  According to the present invention, in a system in which devices are connected to a network, suspicious communication on the network based on unauthorized access or the like can be detected at an early stage.

The figure which shows the system configuration | structure in connection with one Example. The figure which shows a network monitoring apparatus. The figure which shows the operation | movement sequence at the time of model creation. The figure which shows the operation | movement sequence at the time of communication monitoring. The figure which shows the operation | movement flow of a packet classification | category part. The figure which shows a classification method accumulation | storage part. The figure which shows the packet queue for every packet classification. The figure explaining the packet feature-value extraction part at the time of model creation. The figure explaining the packet feature-value extraction part at the time of communication monitoring. The figure explaining the index of a feature-value item. The figure which shows the feature-value calculation result. The figure explaining a packet feature-value selection learning part. The figure explaining the continuity presence / absence determination of a feature amount. The figure explaining the monitoring viewpoint selection accumulation | storage part. The figure explaining a model storage part. The figure explaining a packet feature-value verification part. The figure explaining abnormality notification. The figure explaining a network monitoring apparatus.

  FIG. 1 is a diagram illustrating a system configuration according to an embodiment. In the present embodiment, there are the network monitoring device 104 and the devices 101-1 and 101-2 having the communication function to be monitored by 104, and communication necessary for system operation between the devices 101-1 and 101-2. Has been made. The network switch 103 mediates communication between devices. Each monitored device 101 and the network monitoring device 104 according to this embodiment are connected to input / output ports 102-1, 102-2, and 102-3, which are interfaces of the network switch 103, through communication cables.

  The network monitoring device 104 mirrors packets transmitted and received at the input / output port 102-1 and the input / output port 102-2 with respect to the input / output port 102-3 of the network switch 103 in order to passively monitor the packets in the system. It is desirable to do.

  FIG. 2 is a diagram illustrating the network monitoring apparatus 104 according to an embodiment. Since the network monitoring device 104 performs model creation and communication monitoring, the entire device has two modes: a model creation mode and a communication monitoring mode.

  Reference numeral 111 denotes a packet capture unit. This is a block that captures a packet on the network output by mirroring via the input / output port 102-3 in FIG. 1 and temporarily stores it in the buffer until the next block processes it. Based on the packet captured in 111, it operates in both the model creation mode and the communication monitoring mode for use in model creation and communication monitoring.

  Reference numeral 112 denotes a packet classification unit. Packets temporarily accumulated in the packet capture unit 111 are classified by a combination of an IP address and a port number (Source IP address, Destination IP address, Source Port number, Destination Port number) and accumulated in the packet queue for each classification. . This classification corresponds to the classification of combinations of devices (hardware) that communicate with and applications (software) that operate on the devices, and it is considered that the characteristics of communication differ for each combination. It is assumed that communication monitoring is performed in this combination unit. In order to align the packet classification method at the time of model creation and communication monitoring, the packet classification method applied at the time of model creation is stored in the classification method storage unit 121, referenced at the time of communication monitoring, and the same classification method as at the time of model creation. Classify the packet.

  Reference numerals 113-1 and 113-2 denote packet feature amount extraction units used for model creation and communication monitoring, respectively. The feature amount extraction is performed based on various monitoring viewpoints such as a packet length and a communication duration time. In order to clearly distinguish the functional blocks (114 and 115) at the connection destination, the packet feature quantity extraction units 113-1 and 113-2 are described as separate functional blocks, but the packet classification unit 112 has accumulated in the queue. It is logically the same from the viewpoint of inputting the result and calculating the feature quantity of packet communication. However, at the time of communication monitoring, feature value calculation is skipped for monitoring viewpoints that do not have continuity. The determination of which packet classification and which monitoring viewpoint the feature quantity is calculated for or the calculation is skipped is made with reference to a table stored in a monitoring viewpoint selection accumulation unit 122 described later.

  Reference numeral 114 denotes a packet feature quantity selection learning unit used when creating a model. The packet feature quantity extracted based on various monitoring viewpoints extracted by the packet feature quantity extraction unit 113-1 is used as an input, and it is determined whether or not each monitoring viewpoint has continuity. In order to perform control to perform feature amount calculation and model comparison at the time of monitoring, and feature amount calculation and model comparison at the time of communication monitoring when there is no continuity, communication monitoring etc. are performed for each monitoring viewpoint. An enabler 1403 indicating whether to perform or not is generated, and the result is stored in the monitoring viewpoint selection storage unit 122. The enabler 1403 accumulated in the monitoring viewpoint selection accumulation unit 122 determines whether to calculate or skip the feature amount in the packet feature amount extraction unit 113-2 at the time of communication monitoring, and skips collation with the model in 115. Used to determine whether or not to

  Further, the packet feature quantity selection learning unit 114 creates a model related to the monitoring viewpoint determined to have continuity, and stores the model in the model storage unit 123.

  Reference numeral 115 denotes a packet feature amount verification unit 115 that determines whether or not a communication abnormality has occurred based on a comparison between a feature amount extraction result obtained by the feature amount extraction unit 113-2 and a model stored in the model storage unit 123. When the occurrence of the communication abnormality is detected, the packet feature amount verification unit 115 outputs to the notification unit 116 that the abnormality has occurred. Here, the comparison with the model is a combination of the packet classification and the monitoring viewpoint in which the enabler 1403 stands in the model storage unit 123.

  Reference numeral 116 denotes a notification unit for notifying the system user of the detection when abnormal communication is detected, and any unit can be used as long as it can notify the system user, such as standard output to a screen or output to a printer.

FIG. 3 is an operation sequence at the time of creating a model according to one embodiment.
Each time a packet arrives at the packet capture unit 111, the packet classification unit 112 is activated. The packet classification unit 112 classifies each packet into one of a combination of an IP address and a port number while referring to the captured packet header, and stores the packet in a packet queue for each classification. The packet classification unit 112 manages the capture time of a packet used for model creation, ends the packet capture after a lapse of a necessary time from the capture start time, and activates the packet feature amount extraction unit 113-1. At this stage, one or more packets are stored in each queue for each packet classification. The classification method storage unit 121 that stores the packet classification method is empty before the start of packet capture, and each time a packet with an unknown combination of IP address and port number is detected, the combination of the IP address and port number is detected. Is accumulated in the form of addition. S1001 is responsible for packet classification and queue accumulation, capture time management, and classification method storage unit 121 update as described above.

  The packet feature quantity extraction unit 113-1 is activated after the packet capture of the period necessary for model creation by the packet classification unit 112, and the feature quantity related to all packets in the packet queue is related to all packet classifications and all monitoring viewpoints. When the calculation is completed, the packet feature amount selection learning unit 114 is activated. S1002 is in charge of the above-described feature amount calculation.

  The packet feature quantity selection learning unit 114 is activated when the feature quantity calculation is completed by the packet feature quantity extraction unit 113-1, and determines whether or not the feature quantities related to all packet classifications and all monitoring viewpoints have continuity. The determination result is stored in the monitoring viewpoint selection storage unit 122 as an enabler 1403, and when the determination result is stationary, a model is created from the feature quantity regarding the packet classification and the monitoring viewpoint, and the model storage unit 123 To accumulate. S1003 is in charge of the above-described continuity determination, accumulation of determination results, creation of a model relating to packet classification having continuity and a monitoring viewpoint, and accumulation of results.

FIG. 4 is an operation sequence during communication monitoring according to an embodiment.
Each time a packet arrives at the packet capture unit 111, the packet classification unit 112 is activated, and the packet classification unit 112 classifies each packet into one of a combination of an IP address and a port number while referring to the header of the captured packet. Accumulate in the packet queue for each classification. The packet classification method refers to the model creation result stored in the classification method storage unit 121. Here, unlike when creating a model, when a packet with an unknown combination of IP address and port number is detected, the packet classifying unit 112 regards that abnormal communication has occurred without waiting for the matching with the model, and notifies the notification unit 116 of it. I do. The packet classification unit 112 manages the capture time of packets used for model creation, and activates the packet feature amount extraction unit 113-2 periodically, for example, every second.

  Real-time performance of packet analysis is ensured by starting periodically at short time intervals. S1011 is in charge of packet classification and storage in a queue, issuance of an abnormal communication detection notification upon detection of an unknown IP address and port number combination, and periodic startup of 113-2.

  The packet feature amount extraction unit 113-2 is periodically activated by the packet classification unit 112, and acquires the packet classification result for each time segmented by the packet classification unit 112 from the packet queue. For the acquired packet at each time interval, the monitoring viewpoint selection / accumulation unit 122 performs feature quantity calculation regarding the combination of the packet classification and monitoring viewpoint in which the enabler 1403 is set, and the packet is calculated when all the corresponding feature quantity calculations are completed. The feature amount verification unit 115 is activated. S1012 is in charge of the feature amount calculation regarding the combination of the packet classification and the monitoring viewpoint in which the feature amount calculation is enabled, and the activation of the packet feature amount verification unit 115 after the completion of the calculation.

  The packet feature amount verification unit 115 compares the calculated feature amount with the model stored in the model storage unit 123 with respect to the combination of the packet classification and the monitoring viewpoint in which the feature amount calculation and the model comparison are enabled. It is determined whether or not the former is out of the model, and if it is determined that the former is out of the model, it is considered that abnormal communication has occurred, and the notification unit 116 is notified. S1013 is in charge of collating the calculated feature quantity with the created model, determining whether the feature quantity is out of the model, and notifying occurrence of abnormal communication when the feature quantity is out.

  The notification unit 116 is activated when an abnormal communication occurrence notification is received from the packet classification unit 112 or the packet feature amount verification unit 115 and notifies the system user of the occurrence of abnormal communication. Examples of means for notifying occurrence of abnormal communication include character output on a screen and output to a printer. In step S1014, notification to the system user such as character output on the screen and output to the printer is performed.

FIG. 5 is a diagram illustrating an operation flow of the packet classification unit 112 according to an embodiment.
When the packet classification unit 112 is activated when the power is turned on in S2001, it is confirmed in S2002 whether the condition for activating the packet feature amount extraction unit 113-1 or 113-2 is satisfied. At the time of model creation, after all packet classification is completed, at the time of communication monitoring, it is confirmed whether a regular activation cycle such as every second has been reached. If the activation condition is satisfied, an activation trigger is issued to the packet feature amount extraction unit 113-1 or 113-2 in S2008. Which one is activated depends on the model creation mode or the communication monitoring mode.

  S2003 checks whether there is a packet input from the packet capture unit 111. If there is no packet input, the process returns to S2002, and if there is a packet input, the process proceeds to S2004.

  In step S2004, a combination of an IP address and a port number necessary for packet classification is extracted from the header of the input packet. In step S2005, the index is searched for which combination is the extracted combination. The packet classification method is stored in the format shown in FIG. 6, and an index is looked up from the combination of the IP address and the port number. This table and a packet queue to be described later are initialized in an empty state at the starting stage of S2001.

  In S2006, it is determined whether or not the index has been tabled in S2005. If the table can be looked up, the process proceeds to S2007, and the input packet is stored in the packet queue corresponding to the index. The packet queue is managed for each index in the form shown in FIG. If the table cannot be retrieved, the process proceeds to S2009 when creating the model, and after adding an index to the table in FIG. 6 and adding a packet queue, the input packet is sent to the packet queue corresponding to the newly created index in S2007. Store. When the communication is monitored, the process proceeds to S2010, and notification of abnormal communication is notified to the notification unit 116. After the processing of S2007 and S2010 is completed, the processing returns to S2002 and the activation condition confirmation processing of the packet feature amount extraction unit is performed.

  FIG. 6 is a diagram illustrating the classification method storage unit 121 according to an embodiment. A packet classification index 601 is assigned to each unique combination of information 602 (Host 1 and Host 2) relating to two devices and information 603 (Port 1, Port 2, Protocol) relating to an application operating on each device. Examples of Host1 and Host2 are IP addresses, Port1 and Port2 are examples of port numbers used in TCP and UDP, and Protocol is TCP and UDP corresponding to the protocol number stored in the IP header. To do. Assume that Host1 and Port1 are the Source side, and Host2 and Port2 are the Destination side.

  FIG. 7 is a diagram illustrating a packet queue for each packet classification according to an embodiment. The packet body is composed of a header and a payload, and the packet classification unit 112 extracts the packet classification from the header, that is, the IP address and port number necessary for creating the table of FIG. The extracted IP address and port number information corresponds to the index number in the table of FIG. 6, and the packet body is stored in the packet queue corresponding to the index. When a new combination of IP address and port number is detected at the time of model creation, an index corresponding to the combination is newly issued, and a packet queue is additionally generated in accordance with the index generation.

FIG. 8 is a diagram illustrating a packet feature amount extraction unit at the time of model creation according to an embodiment.
When the packet feature quantity extraction unit 113-1 or 113-2 is activated when the power is turned on in S 2101, the process waits for an activation trigger issued by the process S 2008 in the packet classification unit 112 in S 2102. The process waits in an infinite loop in S2102 until the trigger comes, and proceeds to S2103 when the trigger comes.

  S2103 is the beginning of the for sentence relating to the packet classification index of the packet queue (that is, packet classification), and S2104 is the beginning of the for sentence relating to the feature quantity item index. The index of the feature quantity item will be described later with reference to FIG. The end of each for statement is S2103-2 and S2104-2.

  In step S <b> 2105, the feature amount calculation is performed on the packet stored in the packet queue with respect to the packet classification index and the feature amount item index. The feature amount calculation will be described later with reference to FIG.

  When the double for sentence is completed, the packet feature amount selection learning unit 114 is activated in S2106. After completion of activation, the process returns to S2102 and waits for an activation trigger from the packet classification unit 112 again.

  FIG. 9 is a diagram illustrating a packet feature amount extraction unit during communication monitoring according to an embodiment. 8 is almost the same as FIG. 8, except that a conditional branch of S2107 is added after S2104 and that S2106 is replaced with S2108.

  In step S2107, the enabler 1403 checks the packet classification index and the feature amount item index. If the enabler 1403 is standing, the feature amount calculation is performed in S2015, and if the enabler 1403 is not standing, the feature amount calculation is skipped.

  In step S2108, the packet feature amount verification unit 115 is activated. After completion of activation, the process returns to S2102 and waits for an activation trigger from the packet classification unit 112 again. A period during which the packet feature quantity extraction unit is activated during communication monitoring is defined as a monitoring period.

FIG. 10 is a diagram for explaining an index of a feature amount item according to an embodiment.
A feature amount item index 1001 is described in the first column, a feature amount item name 1002 is described in the second column, and a feature amount data format 1003 is described in the third column. The index referred to in the “for” sentence in FIG. 9 corresponds to the index in the first column in FIG.

  Here, a feature amount calculation method will be described. Since the third column defines types such as a list type, a range type, and a vector type, each type will be described. Integer and Float indicate whether the feature value is an integer or floating point.

  The list type is such that one feature value is extracted for each packet or packet group, and when a plurality of feature values are extracted, deduplication of the feature values is performed and unique feature values are listed. Refers to the method of modeling. For example, the packet length has a feature quantity of length for each packet. If there are 3 packets in the packet queue, and each length is 60 bytes, 90 bytes, and 60 bytes, the 60 bytes are duplicated, so the model is composed of binary values of 60 bytes and 90 bytes that are deduplicated. A list.

  In the range type, one feature value is extracted for each packet or packet group, and when a plurality of feature values are extracted, the maximum value and the minimum value are extracted, and an arbitrary scaling factor for each value is extracted. (Upper limit value and lower limit value of the feature amount regarded as the normal range are obtained after acting (an arbitrary parameter for adjusting the abnormality detection sensitivity). The upper and lower limits are used as models.

  In the vector type, a plurality of feature amounts are extracted for each packet. When evaluating the similarity between the byte sequences of the payload, a vector whose elements are the first byte, the second byte, and the like of the payload is extracted as a feature amount. A vector is generated for each packet. As a model, two representative vectors are used as models for all packet vectors in the packet queue.

  Specifically, for example, a sequence number or the like, where the byte position incremented for each packet is 0, and the byte position that is the same value for all packets in the packet queue is 1 (that is, the mask for each byte is set). A mask vector to be performed) and a vector obtained by multiplying the mask vector and the vector of each packet for each element, that is, a total of two vectors. Note that the latter vector can be calculated for all vectors in the packet queue. However, because of the mask vector definition, elements whose values differ between packets are zeroed by the mask vector. Are completely the same for all packets.

  Further, with respect to the point that one feature amount is extracted for each packet or each packet group described above, the former example is the length of the packet. The latter example is communication duration. The communication duration is the time between the time stamp of the packet in which the SYN flag of the TCP packet is set and the time stamp of the packet in which the FIN flag (or RST flag) is also set. Exchanged. The plurality of packets are called a packet group.

  As described above, the model type includes a list type, a range type, and a vector type, and the feature amount extraction unit includes each packet and each packet group.

  FIG. 11 is a diagram illustrating a feature amount calculation result according to an embodiment. The first column indicates the packet classification index 1101, the second column indicates the feature amount item index 1102, and the third and subsequent columns indicate the feature amounts 1103-1106.

  As described with reference to FIGS. 8 and 10, the feature amount is calculated for each packet classification index and feature amount item index (see FIG. 10). Since the feature amount calculation is performed on all packets stored in the packet queue, a plurality of feature amounts may appear.

  The first row in FIG. 11 shows the result of extracting the feature quantity of the packet length for the first packet queue. The first three packets in the packet queue all indicate that the packet length is 368 bytes. Actually, the fourth and subsequent packets are similarly tabulated.

  Similarly, the second row shows the result of extracting the feature amount of the communication duration for the first packet queue. The elapsed time from the packet with the SYN flag to the packet with the FIN flag is tabulated, and in the example of the figure, the first packet group is 1.2 seconds, the second packet group is 1.1 seconds, It shows that 3 packet groups are 0.3 seconds. Actually, the fourth and subsequent packet groups are similarly tabulated.

  Similarly, the third row shows the result of extracting the byte sequence of the payload as the feature amount for the first packet queue. Here, as an example, the first 4 bytes of the payload are extracted as a feature vector, but the extracted byte position and length can be configured. For the first 3 packets in the packet queue, the first 4 bytes of the first packet are 0x5A, 0xA5, 0x5A, 0xA5, the second packet is 0x5A, 0xA5, 0x5A, 0xA6, the third packet is 0x5A, Indicates 0xA5, 0x5A, 0xA7. Actually, the fourth and subsequent packets are similarly tabulated.

  Similarly, the fourth row shows the result of extracting the packet length as a feature amount for the second packet queue. Unlike the first stage, this is an example in which each packet has a different length.

FIG. 12 is a diagram illustrating a packet feature amount selection learning unit according to an embodiment.
When the packet feature quantity selection learning unit is activated when the power is turned on in S2201, the process waits for an activation trigger issued by the process S2106 in the packet feature quantity extraction unit 113-1 in S2202. The process waits in an infinite loop in S2202 until the trigger comes, and proceeds to S2103 when the trigger comes.

  The loop related to the packet classification index related to S2103 and S2104 and the loop related to the feature amount item index are the same as those in FIG.

  In S2203, for each packet classification index and feature quantity item index, it is determined whether the feature quantity (see FIG. 11) extracted by the packet feature quantity extraction unit 113-1 has continuity. After creating the model, the enabler 1403 is set to “Enable”, and the enabler 1403 is set to “Disable” when there is no continuity. The enabler 1403 is stored in the monitoring viewpoint selection storage unit 122, and the created model is stored in the model storage unit 123. After the completion of the two for sentences, the process returns to S2202 and waits for an activation trigger from the packet feature amount extraction unit 113-1. A period during which the packet feature selection learning unit is activated is defined as a learning period.

  FIG. 13 shows the determination as to whether or not the feature quantity has continuity, FIG. 14 shows an example of the monitoring viewpoint selection storage unit 122, and FIG. 15 shows an example of the model storage unit 123.

  FIG. 13 is a diagram illustrating determination of the presence / absence of feature amount continuity according to an embodiment. The first column shows the packet classification index 1301, the second column shows the feature amount item index 1302, and the third column shows the continuity evaluation 1303. The feature quantity to be evaluated for continuity conforms to FIG. Here, for the sake of simplicity, an example in which the continuity evaluation is performed on the three feature value values displayed in FIG. 11 without omission is shown, but in reality, the same applies to all feature values. Perform a stationarity assessment.

  The first row of the table shows an example of continuity evaluation regarding the feature amount of the packet length of the first packet queue. According to FIG. 11, the three feature quantities are all 368 bytes, and the list of unique packet lengths as a result of deduplication is composed of only 368 bytes. That is, it indicates that there is only one type of packet length variation. In this example, the case where there are up to two unique packet length variations is considered to be stationary, and the case where it exceeds the variation is considered not stationary. As a result, the packet length of the first packet queue is determined to be stationary. Here, the two types of threshold values are configurable system parameters, and are initially set in step S2201 of FIG.

  On the other hand, the fourth row of the table is an example of the continuity evaluation regarding the feature quantity of the packet length of the second packet queue. According to FIG. 11, a list of unique packet lengths as a result of deduplication is 168, Since it is composed of three values of 1514 and 392 bytes and does not satisfy the above threshold condition for variation of the packet length, it is determined that there is no continuity.

  The second row of the table is an example of continuity evaluation regarding the feature amount of the communication continuation time of the first packet queue. According to FIG. 11, the three feature amounts are 1.1, 1.2, and 0.3 [seconds]. Since the communication continuation time depends on the processing time and transmission speed, the number of unique value variations such as a list type is not suitable for determining continuity. Here, the ratio between the average value of the feature values and the standard deviation is used as an evaluation index, and when the average / standard deviation exceeds 10, the stationarity is determined. In the example of the figure, since the ratio of the average and the standard deviation does not exceed 10, it is determined that there is no continuity. Here, the threshold value of the ratio of average to standard deviation = 10 is a configurable system parameter, and is initially set in step S2201 in FIG.

  The third row of the table is an example of continuity evaluation regarding the feature amount of the payload of the first packet queue. According to FIG. 11, the values for the first 3 bytes are completely identical over the three feature values, and only the value of the fourth byte is different between packets. Here, it is determined that the stationarity is present when the number of bytes completely matching between packets is 3 or more, and that the stationarity is absent when the number of bytes is 2 or less. In this example, since 3 bytes are completely matched, it is determined that there is continuity. Here, the threshold regarding the number of completely matching bytes is a configurable system parameter, and is initially set in step S2201 of FIG.

  The model obtained as a result of the above is the packet length list for the first stage = [368], the second stage and the fourth stage have no model because there is no continuity, and the third stage has a payload representative vector [0x5A, 0xA5 , 0x5A, 0x00] and the mask vector [1,1,1,0] are models.

  FIG. 14 is a diagram illustrating a monitoring viewpoint selection accumulation unit according to an embodiment. The first column shows the packet classification index 1401, the second column shows the feature amount item index 1402, and the third column shows the enabler 1403.

  In FIG. 13, the continuity evaluation is performed for each packet classification index and for each feature amount item index. For the combination of indexes for which the evaluation result is determined to be stable (stable), “Enable” and “stationarity” are performed. When it is determined that there is none (Unstable), “Disable” is recorded.

  FIG. 15 is a diagram illustrating a model storage unit according to an embodiment. The first column shows the packet classification index 1501, the second column shows the feature quantity item index 1502, and the third column shows the model 1503.

  In the description of FIG. 13, the continuity evaluation is performed for each packet classification index and for each feature amount item index, and the model generated for the combination of indexes having continuity has been described. Items that do not have stationarity, that is, the second and fourth levels in the table of FIG. 15 are N / A (Not Applicable) because there is no model. For items that have stationarity, the first level is the packet length. A list of unique values, that is, [368], the third stage is recorded with payload representative vectors [0x5A, 0xA5, 0x5A, 0x00] and mask vectors [1,1,1,0] as models.

FIG. 16 is a diagram illustrating a packet feature amount verification unit according to an embodiment.
When the packet feature amount verification unit is activated when the power is turned on in step S2301, a start trigger issued by the process S2108 in the packet feature amount extraction unit 113-2 is waited in step S2302. The process waits in an infinite loop in S2302 until the trigger comes, and proceeds to S2103 when the trigger comes.

  The loop related to the packet classification index related to S2103 and S2104 and the loop related to the feature amount item index are the same as those in FIG.

  In S2303, the enabler 1403 related to the packet classification index and the feature item index is checked from the table (FIG. 14) of the monitoring viewpoint selection accumulation unit 122. In the case of Disable, the process skips to S2104-2 and performs the next index combination process. In the case of Enable, the process proceeds to S2304.

  In S2304, the feature amount (FIG. 11) extracted by the packet feature amount extraction unit 113-2 is compared with the model (FIG. 15). In the combination of the packet classification index and the feature item index, a plurality of feature amounts are output as shown in FIG. 11, but each of the feature amounts is compared with the model, and at least one feature amount is out of the model. If it is detected as abnormal communication.

  For example, in the case of a list type model, when the feature value does not exist in the model list, it is regarded as abnormal communication. In the case of the range type model, if the feature value is out of the normal value upper and lower limits of the model, it is regarded as abnormal communication. In the case of a vector type model (payload), the representative vector of the payload that is the model (example of 4 elements) is [p1, p2, p3, p4], and the mask vector is [m1, m2, m3, m4], observation Assuming that the feature vector is [o1, o2, o3, o4], if either m1 × o1 = p1, m2 × o2 = p2, m3 × o3 = p3, m4 × o4 = p4 is not satisfied, Regarded as abnormal communication.

  In S2305, a conditional branch is made as to whether or not the abnormal communication is determined in S2304. If it is determined that the communication is abnormal, the process proceeds to S2306. If it is determined that the communication is not abnormal, the process of S2306 is skipped.

  In S2306, similar to S2010 in FIG. 5, the notification unit 116 is notified of abnormal communication detection.

  FIG. 17 is a diagram for explaining abnormality notification according to an embodiment. The first column shows the error index 1701, the second column shows the device information 1702, the third column shows the information 1703 related to the application, and the fourth column shows the abnormality detection content 1704.

  The abnormality notification is issued from S2010 of FIG. 5 or S2306 of FIG. As an example of a specific format, in addition to Host, Port, and Protocol information related to the abnormality notification based on FIG. 6, specific abnormality contents are notified.

  When an abnormality notification is received from S2306 in FIG. 16, since the feature quantity is out of the created model, information on what feature quantity has been detected for which feature quantity item (FIG. 10) is included. As a specific example, as shown in the first row of FIG. 17, the packet length feature amount (here, 456 bytes) detected at the time of communication monitoring is the content for notifying that it is out of the model. As described in the communication monitoring sequence of FIG. 4, when a packet having a combination of an unknown IP address and port number is detected, unlike the model creation, the packet classification unit 112 does not wait for matching with the model and performs abnormal communication. The notification unit 116 is notified of the occurrence. The second row shows an example.

  When an abnormality notification is received from S2010 in FIG. 5, since the communication (combination of IP address and port number) not found in the created model has been detected, the content is a notification that communication outside the model has been detected.

  The above content is a data structure related to an abnormality notification, and a screen display or printer output is performed after a display method is appropriately determined based on this data structure.

FIG. 18 is a diagram illustrating a network monitoring apparatus according to an embodiment.
Reference numeral 201 denotes a bus for performing communication between devices. Reference numeral 202 denotes a memory for storing a program. 202 includes a packet classification unit 112, a packet feature amount extraction unit 113, a packet feature amount selection learning unit 114, and a packet feature amount verification unit 115. Reference numeral 203 denotes an arithmetic processing device such as a CPU that operates a program. A memory 204 used by the program is used as a classification method storage unit 121, a monitoring viewpoint selection storage unit 122, a model storage unit 123, and a work area of each program. Reference numeral 205 denotes a network interface device for capturing a packet. This corresponds to the packet capture unit 111. An output device 206 such as a screen or a printer outputs an abnormality detection result based on FIG.

  According to the embodiment of the present invention, as the monitoring viewpoint of the model increases, the determination accuracy of unauthorized access or the like increases, while the problem that the processing amount for monitoring the presence or absence of communication behavior deviating from the model increases. By selecting only monitoring viewpoints that have continuity at the time of model creation and adopting means for model creation and packet monitoring, it is possible to suppress an increase in processing amount due to improvement in determination accuracy. Also, a process of preparing a plurality of monitoring viewpoint candidates at the time of model creation for a packet group flowing on the network in the system, and determining whether the packet group has continuity for each of the plurality of monitoring viewpoints Thus, the problem of uncertain which monitoring viewpoint is appropriate as a model is solved.

DESCRIPTION OF SYMBOLS 101 ... Device 102 with a communication function ... Input / output port 103 of the network switch 103 ... Network switch 104 ... Network monitoring device 111 ... Packet capture unit 112 ... Packet classification unit 113 ... Packet feature amount extraction unit 114 ... Packet feature amount selection learning unit 115: Packet feature amount verification unit 116 ... Notification unit 121 ... Classification method storage unit 122 ... Monitoring viewpoint selection storage unit 123 ... Model storage unit 201 ... Bus 202 ... Program storage memory 203 ... Arithmetic processing device 204 ... Data of reference from program Storage memory 205 ... Network interface device 206 ... Output device

Claims (7)

A network monitoring device for monitoring packets flowing through a network,
A processing unit and an interface;
The interface is
A packet capture unit for capturing packets of the network;
The processor is
In the learning period and the monitoring period, packet feature values are extracted from the captured packets from a plurality of monitoring viewpoints.
In the learning period, determination of continuity is performed on the packet feature values extracted from a plurality of monitoring viewpoints, and a model is created for the monitoring viewpoint that is determined to have continuity,
A network monitoring apparatus characterized in that, for the monitoring viewpoint that the learning period is stationary, the presence or absence of abnormal communication is determined by comparing the packet feature amount extracted in the monitoring period with the model. 2. The network monitoring device according to claim 1, wherein whether or not the packet feature value extracted during the learning period is stationary is determined by a packet length feature value, a communication duration feature value, or a payload vector feature value. Each is provided with a threshold for determining continuity, and continuity is determined based on the threshold. If there is continuity, the packet length value, the communication duration statistic, or the payload vector is modeled. A network monitoring device characterized by recording as: 3. The network monitoring device according to claim 2, based on a device corresponding to a packet transmission source, a device corresponding to a packet transmission destination, an application used in the packet transmission source, and an application used in the packet transmission destination. A network monitoring apparatus characterized by classifying packets, determining whether each classified packet has continuity, and recording the determination result as an enabler. 4. The network monitoring device according to claim 3, wherein, in the monitoring period, referring to an enabler for the classified packet and skipping the extraction of the packet feature amount for a packet determined to be non-stationary. Monitoring device. 3. The network monitoring device according to claim 1 or 2, wherein the packet is classified using a combination of an IP address and a port, and if the packet to be monitored is not a classified packet, an error is notified and the packet is extracted during the monitoring period. As a result of comparing the packet feature quantity with the model, if the packet feature quantity is out of the model, the network monitoring apparatus notifies the packet feature quantity in the monitoring period as abnormal. A device to be monitored is connected via a network, and is a network monitoring system that monitors a packet flowing through the network, and performs an arithmetic process based on the interface that captures the packet and the captured packet A processing unit,
The processor is
Extracting packet feature values from the captured packet from a plurality of monitoring viewpoints,
With respect to the packet feature values extracted from a plurality of monitoring viewpoints, determination of continuity is made during the learning period, and a model is created for the monitoring viewpoint determined to have continuity,
A network monitoring system characterized in that, from the monitoring viewpoint that the learning period is stationary, the presence or absence of abnormal communication is determined by comparing the packet feature amount extracted in the monitoring period with the model. A network monitoring method using a network monitoring device for monitoring packets flowing through a network,
The network monitoring device captures packets from the network;
In the learning period and the monitoring period, the packet feature amount from the captured packet,
Extract from multiple monitoring perspectives,
In the learning period, the packet feature quantity extracted from a plurality of monitoring viewpoints is determined to be stationary, and a model is created for the monitoring viewpoint that is determined to be stationary,
A network monitoring method characterized by determining whether or not there is abnormal communication by comparing the packet feature amount extracted in a monitoring period and the model with respect to a monitoring viewpoint that the learning period is stationary.

Images