JP2019033320A - Attack handling system and attack handling method - Google Patents

Abstract

To properly handle a reflection attack.SOLUTION: An attack handling device 10 of an accommodation network NW_N1 includes a determination section 12 and a control instruction section 16. An attack verification device 20 of a NW_B_N3 includes an attack verification section 23. The determination section 12 generates attack potential information of a reflection attack by a specific protocol from detection information of the reflection attack to the NW_B_N3 detected by an attack detection device. The attack verification section 23 generates attack potential determination result information indicating that the reflection attack is definite when a communication history from a source address of the reflection attack to the accommodation network NW_N1 is present in a monitoring log of communication in the NW_B_N3, based on the attack potential information received from the attack handling device 10. When the attack potential determination result information received form the attack verification device 20 indicates that the reflection attack is definite, the determination section 12 cut-off controls communication by the specific protocol from the source address of the reflection attack.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an attack countermeasure system and an attack countermeasure method.

  In recent years, a reflection attack that attacks specific servers using a vulnerable server as a reflector, using the characteristics of protocols such as DNS (Domain Name System), NTP (Network Time Protocol), SSDP (Simple Service Discovery Protocol), etc. (See, for example, Non-Patent Document 1).

  In the reflection attack, the source IP (Internet Protocol) address is spoofed in the attack packet and the IP address of the server that is the attack target is set, and the IP address of the reflector (for example, DNS server) is set as the destination IP address Then, an attack is performed by controlling a bot included in the attack source network.

  As countermeasures that can be taken on the victim network side including the attack target against the reflection attack, it is conceivable to implement DNS or NTP access control addressed to the attack target or to introduce FW (Fire Wall). However, it is desirable to deal with the victim network side because the performance of the device is limited. For example, an increase in the number of IoT devices with weak security measures is one factor in the performance limit of the apparatus.

  Therefore, a method (behavior detection technique) for detecting a reflection attack when, for example, the amount of packets such as DNS or NTP for a specific IP address exceeds a threshold in a FW on the accommodation network side has been proposed (for example, Non-patent document 2).

“DDoS attacks become larger due to an increase in reflection attacks”, Sakura Internet Inc., [online], [searched July 24, 2017], Internet <http://knowledge.sakura.ad.jp/cyber- security / 6348 / ＞ “FortiDDoS DDoS attack mitigation appliance”, Fortinet, [online], [searched July 24, 2017], Internet <URL: http://www.fortinet.co.jp/doc/FortiDDoS_DS.pdf >

  However, the above-described conventional technology is based on the assumption that, for example, the amount of communication from a specific IP address or the amount of communication to a specific IP address exceeds a threshold is due to a reflection attack. Therefore, even when a reflection attack is detected, normal communication may be included, and it is difficult for the accommodation network side to accurately detect and determine the reflection attack. Therefore, from the victim network side, since the attack source network cannot be determined, there is a problem that the detected reflection attack cannot be dealt with accurately.

  An example of an embodiment disclosed in the present application has been made in view of the above, and an object thereof is to provide an attack countermeasure system and an attack countermeasure method capable of accurately dealing with a reflection attack.

  In an example of the embodiment of the present application, the attack countermeasure system includes an attack countermeasure device included in the first network and an attack verification device included in the second network. The attack countermeasure device generates a probability information generating unit that indicates the possibility of the reflection attack by a specific protocol from the detection information of the reflection attack to the second network detected by the attack detection device. And an attack information transmission unit that transmits the attack possibility information to the attack verification device, and an attack that indicates whether or not the reflection verification indicated by the attack possibility information needs to be dealt with from the attack verification device The determination result information receiving unit that receives the possibility determination result information, and the identification from the source address of the reflection attack related to the detection information when the reflection attack indicated by the attack possibility determination result information is definite And an instruction unit for instructing the attack detection apparatus to block communication according to the protocol. Further, the attack verification device transmits the transmission information to a monitoring log acquired from a possibility information receiving unit that receives the attack possibility information from the attack countermeasure device and a communication monitoring device that monitors communication in the second network. It is determined whether or not there is a communication history from the original address to the first network, and if it exists, the reflection attack is not fixed, and if it does not exist, the reflection attack is fixed An attack verification unit that generates attack possibility determination result information, and a determination result information transmission unit that transmits the attack possibility determination result information to the attack countermeasure apparatus.

  According to an example of the embodiment of the present application, for example, it is possible to accurately cope with a reflection attack.

FIG. 1 is a diagram illustrating an example of a configuration of a communication system according to the embodiment. FIG. 2 is a block diagram illustrating an example of the configuration of the attack response system according to the embodiment. FIG. 3 is a diagram illustrating an example of detection information in the embodiment. FIG. 4 is a diagram illustrating an example of attack possibility information in the embodiment. FIG. 5 is a diagram illustrating an example of attack possibility determination result information in the embodiment. FIG. 6 is a diagram illustrating a DNS protocol which is an example of a communication condition protocol for confirming a monitoring log for attack verification in the embodiment. FIG. 7 is a sequence diagram illustrating an example of a reflection attack handling process according to the embodiment. FIG. 8 is a diagram illustrating an example of a computer in which an attack countermeasure device and an attack verification device are realized by executing a program.

  Hereinafter, embodiments of an attack countermeasure system and an attack countermeasure method according to the present application will be described. In addition, the following embodiment shows only an example and does not limit this application. In the following embodiments, the description of the same configuration and the same processing as described above will be omitted.

  In addition, FW (Fire Wall), a server, a router, a network camera, etc. which are shown in the following embodiments are only examples of network devices.

[Embodiment]
(Communication system according to the embodiment)
FIG. 1 is a diagram illustrating an example of a configuration of a communication system according to the embodiment. As shown in FIG. 1, the communication system 1 is, for example, an NGN (Next Generation Network). The communication system 1 has accommodation NW (NetWork) _N1, NW_A_N2, and NW_B_N3. The communication system 1 is a network compliant with, for example, BGP (Border Gateway Protocol).

  The accommodation NW_N1 is an example of a network accessible from an external network. The accommodation NW_N1 includes an attack countermeasure device 10, a security device 30A, and routers R1-1, R1-2, and R1-3. The security device 30A is, for example, an integrated security appliance device. The security device 30A is connected to each of the attack countermeasure device 10 and the routers R1-1 to R1-3. The attack countermeasure device 10 is connected to an IRR (Internet Routing Registry) 40. The attack countermeasure device 10 is connected to an attack verification device 20 included in NW_B_N3 described later. Details of the attack countermeasure device 10 will be described later.

  A network camera C1 and servers S1-1 and S1-2 are connected to the router R1-1. Similarly, a network camera C2 and servers S2-1 and S2-2 are connected to the router R1-2, and a network camera C3 and servers S3-1 and S3-2 are connected to the router R1-3. . The servers S1-1 to S3-2 are, for example, open resolvers.

  NW_A_N1 is an example of an attack source network that performs a reflection attack. NW_A_N2 has a server S2. The server S2 is an example of an attack server that attacks the server S3 by spoofing an IP (Internet Protocol) address of the server S3 included in the NW_B_N3 described later, and is, for example, a bot.

  NW_B_N3 is an example of a victim network that receives a reflection attack. NW_B_N2 includes an attack verification device 20, a security device 30B, and a server S3. The security device 30B is, for example, an integrated security appliance device. The server S3 is an example of an attack target server that receives a reflection attack, and the IP address is, for example, the IP address A. The attack verification device 20 is connected to the attack countermeasure device 10 included in the accommodation NW_N1. Details of the attack verification device 20 will be described later.

  For example, the server S2, which is the attack source server, sends an attack packet of DNS (Domain Name System) (inquiry) spoofed using the IP address A of the server S3, which is the attack target server, as the transmission source address. -1 and S1-2. The attack packet reaches the network camera C1 and the servers S1-1 and S1-2 via the security device 30A and the router R1-1 of the accommodation NW_N1.

  Then, for example, the network camera C1 and the servers S1-1 and S1-2 that have received the DNS (inquiry) attack packet send a DNS (response) response packet to the attack packet to the server S3 with the genuine IP address A. Send. The response packet reaches the server S3 via the security device 30A of the accommodation NW_N1 and the security device 30B of NW_B_N3.

  That is, the server S2 that is the attack server spoofs the IP address of the server S3 that is the attack target server, and is predetermined with respect to the network cameras C1 to C3, the servers S1-1 to S3-2, and the like that are accommodated in the accommodation NW_N1. The communication protocol is inquired, and a response to the inquiry is transmitted to the server S3, which is the attack target server whose IP address is spoofed. The network cameras C1 to C3, the servers S1-1 to S3-2, etc. are called reflectors because they return a response to the server S3 having a genuine IP address in response to an inquiry in which the IP address is spoofed. Here, the predetermined communication protocol is a communication protocol for one-way communication in which a response query (communication) is generated in response to an inquiry query (communication) such as NTP, SSDP, and CHARGEN.

(Attack countermeasure system according to the embodiment)
FIG. 2 is a block diagram illustrating an example of the configuration of the attack response system according to the embodiment. The attack response system 100 according to the embodiment includes an attack response device 10 included in the accommodation NW_N1 and an attack verification device 20 included in NW_B_N3. The attack countermeasure device 10 and the attack verification device 20 are connected to be able to communicate with each other. The attack countermeasure device 10 is connected to the IRR 40. The attack countermeasure device 10 is connected to the security device 30A. The attack verification device 20 is connected to the security device 30B.

  The security device 30A monitors the reflection attack and detects the reflection attack. The security device 30A is an example of an attack detection device. The security device 30A outputs detection information including an attack type, a transmission source IP address, and a destination IP address as information regarding the detected reflection attack. Here, the attack type is information indicating the type of reflection attack such as DNSamp, NTP (Network Time Protocol) amp. The transmission source IP address is the IP address of the reflector in the accommodation NW_N1. The destination IP address is the IP address of the server S3 that is the attack target server included in NW_B_N3. Hereinafter, the IP address of the reflector is, for example, “IP address B”.

  The attack handling apparatus 10 includes a log acquisition unit 11, a determination unit 12, a destination resolution unit 13, a threat information transmission unit 14, a threat information reception unit 15, and a control instruction unit 16. The attack verification device 20 includes a threat information reception unit 21, a log acquisition unit 22, an attack verification unit 23, and a threat information transmission unit 24.

  The log acquisition unit 11 acquires the detection information 51 output from the security device 30A by using Syslog or the like. FIG. 3 is a diagram illustrating an example of detection information in the embodiment. The determination unit 12 outputs a destination resolution instruction to the destination resolution unit 13. The destination resolution unit 13 makes an inquiry to the IRR 40 based on the destination IP address included in the detection information 51 output by the security device 30A according to an instruction from the determination unit 12, and acquires an AS (Autonomous System) number. Then, the destination resolution unit 13 notifies the determination unit 12 of the acquired AS number. Accordingly, the determination unit 12 recognizes the NW address of NW_B_N3 corresponding to the destination IP address included in the detection information 51.

  Then, the determination unit 12 generates attack possibility information 52 indicating that the accommodation NW_N1 may transmit an attack packet of the reflection attack to the NW_B_N3. It transmits to the attack verification apparatus 20 of NW_B_N3 via the information transmission part 14. FIG. FIG. 4 is a diagram illustrating an example of attack possibility information in the embodiment.

  Specifically, the determination unit 12 transmits the attack possibility information 52 to the attack verification device 20 through the threat information transmission unit 24 using, for example, a BGP community notification. The BGP community notification is a part of Updata of BGP route information. The attack possibility information 52 includes a transmission source AS number, a destination AS number, a transmission source IP address segment, a destination IP address, an attack type, and a BGP community attribute. The determination unit 12 is an example of a possibility information generation unit that generates the attack possibility information 52.

  Here, the BGP community attribute is an attribute value for manipulating route information in the BGP network, and in this embodiment, “no-export” (route information is not transferred to another AS) is set.

  On the attack verification device 20 side, the threat information receiving unit 21 receives the attack possibility information 52 transmitted from the attack countermeasure device 10. Upon receiving the attack possibility information 52, the threat information receiving unit 21 instructs the log acquisition unit 22 to acquire the monitoring log recorded by the security device 30B using Syslog or the like. In response to an instruction from the threat information receiving unit 21, the log acquisition unit 22 acquires a monitoring log recorded by the security device 30B using Syslog or the like.

  Then, the attack verification unit 23 refers to the attack possibility information 52 received by the threat information reception unit 21 and the monitoring log acquired by the log acquisition unit 22, and determines whether the packet transmission from the accommodation NW_N1 side is a reflection attack. Perform attack verification to determine whether or not. Specifically, the attack verification unit 23 has communicated in the past to the accommodation NW_N1 side using the attack type communication protocol included in the attack possibility information 52 by the server S3 that may be the attack target server. Check the monitoring log for whether or not

  The attack verification unit 23 records, in the monitoring log, a record in which the server S3, which may be an attack target server, communicated in the past to the accommodation NW_N1 side using the same communication protocol as the attack type included in the attack possibility information 52 If it is determined that the attack possibility information 52 does not indicate a reflection attack (reflecting attack indefinite). On the other hand, the attack verification unit 23 records that the server S3, which may be an attack target server, communicated in the past to the accommodation NW_N1 side using the same communication protocol as the attack type included in the attack possibility information 52. If it is not recorded, it is determined that the attack possibility information 52 indicates a reflection attack (reflection attack confirmed). That is, the attack verification unit 23 determines whether or not the reflection attack is confirmed based on the attack possibility information 52.

  Then, the attack verification unit 23 generates attack possibility determination result information 53 indicating whether or not the reflection attack is confirmed, and uses the generated attack possibility determination result information 53 via the threat information transmission unit 24 as an attack countermeasure device. 10 to send. FIG. 5 is a diagram illustrating an example of attack possibility determination result information in the embodiment.

  Specifically, the attack verification unit 23 transmits the attack possibility determination result information 53 to the attack countermeasure device 10 via the threat information transmission unit 24 using, for example, a BGP community notification. The attack possibility determination result information 53 includes a transmission source AS number, a destination AS number, and a determination result. In the attack possibility determination result information 53, the transmission source AS number is the same as the destination AS number in the corresponding attack possibility information 52, and the destination AS number is the transmission source AS number in the corresponding attack possibility information 52. Is the same. The determination result is a result of the attack verification unit 23 determining whether or not the reflection attack is confirmed based on the attack possibility information 52, and is either a reflection attack confirmation or a reflection attack unconfirmed.

  FIG. 6 is a diagram illustrating a DNS protocol which is an example of a communication condition protocol for confirming a monitoring log for attack verification in the embodiment. For example, when the attack type is DNSamp, the source IP address is one of the accommodated NW_N1 IP addresses, the attack type communication protocol is DNS, and the past communication content for which the monitoring log is examined is the DNS query. It is. As described above, when the communication content of the DNS query is recorded in the monitoring log, it is determined that the reflection attack is not confirmed based on the attack possibility information 52, and when the communication content of the DNS query is not recorded, the attack is performed. The reason why the reflection attack can be determined based on the possibility information 52 is because the DNS is UDP (User Datagram Protocol), which is one-way communication, and response communication occurs on the premise of inquiry communication. NTP, SSDP, CHARGEN, etc. are the same as DNS.

  The threat information receiving unit 15 receives the attack possibility determination result information 53 from the attack verification device 20. The determination unit 12 controls the control instruction unit 16 based on the attack possibility determination result information 53 received by the threat information reception unit 15 from the attack verification device 20, and performs an attack possibility determination result on the security device 30A. Depending on the determination result included in the information 53, the communication having the IP address A of the server S3 whose source IP address is NW_B_N3 is blocked or permitted. Blocking is, for example, packet dropping. Note that the IP address A of the server S3 of NW_B_N3 to be blocked is an IP address spoofed by the server S2 included in NW_A_N2.

(Reflection attack countermeasure processing according to the embodiment)
FIG. 7 is a sequence diagram illustrating an example of a reflection attack handling process according to the embodiment. First, in step S11, the security device 30A detects a reflection attack. The detection information 51 is, for example, attack type: DNSamp, transmission source IP address: IP address B, and destination IP address: IP address A. Note that at this stage, whether or not the reflection attack detected by the security device 30A is a reflection attack is uncertain.

  Next, in step S <b> 12, the security device 30 </ b> A is acquired by Syslog or the like of the attack countermeasure device 10, and transmits the detection information 51 to the attack countermeasure device 10. In step S13, the attack handling apparatus 10 receives the detection information 51 from the security apparatus 30A.

  Next, in step S14, the attack handling apparatus 10 transmits the destination IP address included in the detection information 51 received in step S13 to the IRR 40. In step S15, the IRR 40 receives the destination IP address included in the detection information 51. In step S16, a destination AS number is acquired from the destination IP address received in step S15. In step S17, the IRR 40 transmits the destination AS number acquired in step S16 to the attack countermeasure apparatus 10.

  Next, in step S18, the attack handling apparatus 10 receives the destination AS number from the IRR 40. For example, the attack handling apparatus 10 acquires the destination AS number: 1000 from the destination IP address: IP address A of the detection information 51.

  In step S19, the attack handling apparatus 10 includes attack possibility information 52 including the destination AS number acquired in step S18 and the AS number of the accommodation NW_N1 including the own apparatus as the transmission source AS number in the detection information 51 received in step S13. Is transmitted to the attack verification device 20 included in NW_B_N2 using the BGP community notification. Attack possibility information 52 includes, for example, transmission source AS number: 100, destination AS number: 1000, transmission source IP address segment: IP address B, destination IP address: IP address A, attack type DNSamp, BGP community attribute: no- export.

  Next, in step S <b> 20, the attack verification device 20 receives the attack possibility information 52 from the attack countermeasure device 10. In step S21, the attack verification apparatus 20 transmits a monitoring log request for acquiring a monitoring log including a communication history between NW_B_N2 and the outside to the security apparatus 30B. In step S22, the security device 30B receives the monitoring log request from the attack verification device 20. In step S23, the security device 30B transmits a monitoring log to the attack verification device 20 in response to receiving the monitoring log request in step S23. The monitoring log collected by the attack verification device 20 is, for example, a monitoring log corresponding to any one of the IP address of the transmission source IP address: IP address A, the destination IP address: accommodation NW_N1, and the communication protocol: DNS.

  Next, in step S24, the attack verification device 20 receives a monitoring log from the security device 30B. In step S25, the attack verification apparatus 20 performs an attack verification process for determining whether or not a communication history that matches a predetermined communication condition exists in the monitoring log received in step S24. The predetermined communication conditions are, for example, transmission source IP address: IP address A, destination IP address: IP address B or destination AS number: 100, communication protocol: DNS (inquiry).

  Then, the attack verification device 20 determines that the reflection attack is unconfirmed when the communication log that matches the predetermined communication condition is included in the monitoring log, and the communication history that matches the predetermined communication condition is not included in the monitoring log. In this case, it is determined that the reflection attack is confirmed.

  Next, in step S26, the attack verification apparatus 20 transmits the attack possibility determination result information 53 including the determination result by the attack verification process in step S25 to the attack countermeasure apparatus 10 using the BGP community notification. The attack possibility determination result information 53 is, for example, transmission source AS number: 100, destination AS number: 1000, and determination result: reflection attack confirmation.

  Next, in step S <b> 27, the attack handling apparatus 10 receives the attack possibility determination result information 53 from the attack verification apparatus 20. In step S28, the attack response apparatus 10 determines whether or not the determination result is a reflection attack confirmation in the attack possibility determination result information 53 received in step S27. In step S29, when the determination result in step S28 is that the reflection attack is confirmed, the attack countermeasure apparatus 10 has the same attack type as that included in the detection information related to the attack detected in step S11 with respect to the security apparatus 30A. An attack countermeasure instruction that blocks a packet that is a communication protocol and has a destination IP address included in the detection information as a source IP address is transmitted. The attack countermeasure instruction is, for example, transmission source IP address: IP address A, communication protocol: DNS (inquiry), countermeasure: blocking.

  Next, in step S30, the security device 30A receives an attack handling instruction from the attack handling device 10. In step S <b> 31, the security device 30 </ b> A performs control to block the packet in accordance with the attack handling instruction received from the attack handling device 10.

  According to the embodiment, it is possible to easily and accurately identify an optimal countermeasure location for a reflection attack that cannot be grasped on the side of the victim network NW_B_N2 by inter-network cooperation between the accommodation NW_N1 and NW_B_N3. In addition, according to the embodiment, it is possible to automatically identify an optimum countermeasure location for the reflection attack at the protocol level implemented in the network device. In addition, according to the embodiment, it is possible to easily and accurately identify an optimum countermeasure location for a reflection attack by adding an extension to an existing function of a network device having a transfer function.

[Modification of Embodiment]
(Acquisition of AS number)
In the above-described embodiment, the destination resolution unit 13 of the attack countermeasure apparatus 10 acquires the AS number from the IRR 40. However, the present invention is not limited to this, and the destination resolution unit 13 may acquire the AS number based on the Whois protocol, CRISP (Cross Registry Information Service Protocol), or other protocols.

(About transmission and reception of attack possibility information and attack possibility determination result information)
In the above-described embodiment, the attack countermeasure device 10 transmits the attack possibility information 52 to the attack verification device 20 using BGP. Further, the attack verification apparatus 20 transmits the attack possibility determination result information 53 to the attack countermeasure apparatus 10 using BGP. However, transmission / reception of the attack possibility information 52 or the attack possibility determination result information 53 is not limited to using BGP.

(About security devices)
In the above-described embodiment, the security devices 30A and 30B are integrated security appliance devices. However, the present invention is not limited to this, and at least one or both of the security device 30A and the security device 30B may be another device, for example, a router in which FW is mounted.

(About device configuration of attack countermeasure device and attack verification device)
Each component of the attack countermeasure device 10 and the attack verification device 20 shown in FIG. 2 is functionally conceptual, and does not necessarily need to be physically configured as illustrated. That is, the specific forms of distribution and integration of the functions of the attack countermeasure device 10 and the attack verification device 20 are not limited to those shown in the figure, and all or a part thereof can be arbitrarily determined according to various loads and usage conditions. It can be configured to be functionally or physically distributed or integrated.

  Moreover, the attack countermeasure apparatus 10 and the attack verification apparatus 20 may be provided as one attack countermeasure verification apparatus that includes all of the respective components and omits duplication of components having the same name. For example, the attack countermeasure verification apparatus includes a log acquisition unit 11 (log acquisition unit 22), a determination unit 12, a destination resolution unit 13, a threat information transmission unit 14 (threat information transmission unit 24), and a threat information reception unit 15 (threat information reception). Unit 21), a control instruction unit 16, and an attack verification unit 23.

  When the attack countermeasure verification apparatus functions as the attack countermeasure apparatus 10, the log acquisition unit 11 (log acquisition unit 22), the determination unit 12, the destination resolution unit 13, and the threat information transmission unit 14 (threat information transmission unit 24). ), The functions of the threat information receiving unit 15 (threat information receiving unit 21) and the control instruction unit 16 are validated. When the attack countermeasure verification device functions as the attack verification device 20, the log acquisition unit 11 (log acquisition unit 22), the destination resolution unit 13, the threat information transmission unit 14 (threat information transmission unit 24), threat information The function of the receiving unit 15 (threat information receiving unit 21) becomes effective.

  In the attack countermeasure verification apparatus, all or a part of the functions can be configured to be functionally or physically distributed or integrated in arbitrary units according to various loads, usage conditions, or the like.

  In addition, among the processes described in the embodiment, all or a part of the processes described as being automatically performed can be manually performed. Alternatively, all or some of the processes described as being manually performed among the processes described in the embodiments can be automatically performed by a known method. In addition, the above-described and illustrated processing procedures, control procedures, specific names, and information including various data and parameters can be changed as appropriate unless otherwise specified.

(About the program)
FIG. 8 is a diagram illustrating an example of a computer in which an attack countermeasure device and an attack verification device are realized by executing a program. The computer 1000 includes a memory 1010 and a CPU 1020, for example. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. In the computer 1000, these units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to the display 1130, for example.

  The hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, each program that defines each process of the attack countermeasure device 10 and the attack verification device 20 is stored in, for example, the hard disk drive 1031 as a program module 1093 in which a command executed by the computer 1000 is described. For example, a program module 1093 for executing information processing similar to the functional configuration in the attack countermeasure apparatus 10 is stored in the hard disk drive 1031. In addition, a program module 1093 for executing information processing similar to the functional configuration in the attack verification device 20 is stored in the hard disk drive 1031.

  In addition, setting data used in each process in the embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 to the RAM 1012 as necessary, and executes them.

  Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1031, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and the program data 1094 may be read by the CPU 1020 via the network interface 1070.

  The above embodiments are included in the invention disclosed in the claims and equivalents thereof, as long as they are included in the technology disclosed in the present application.

DESCRIPTION OF SYMBOLS 10 Attack countermeasure apparatus 11 Log acquisition part 12 Judgment part 13 Destination resolution part 14 Threat information transmission part 15 Threat information reception part 16 Control instruction | indication part 20 Attack verification apparatus 21 Threat information reception part 22 Log acquisition part 23 Attack verification part 24 Threat information transmission 30A, 30B Security device 51 Detection information 52 Attack possibility information 53 Attack possibility determination result information 100 Attack response system 1000 Computer 1010 Memory 1030 Hard disk drive interface 1090 Hard disk drive 1040 Disk drive interface 1100 Disk drive 1050 Serial port interface 1110 Mouse 1120 Keyboard 1060 Video adapter 1130 Display 1070 Network interface 1080 Bus 1091 OS
1092 Application program 1093 Program module 1094 Program data

Claims (4)

An attack countermeasure system having an attack countermeasure device included in a first network and an attack verification device included in a second network,
The attack countermeasure device includes:
A possibility information generating unit that generates attack possibility information indicating the possibility of the reflection attack by a specific protocol from the detection information of the reflection attack to the second network detected by the attack detection device;
A possibility information transmitter for transmitting the attack possibility information to the attack verification device;
A determination result information receiving unit that receives, from the attack verification device, attack possibility determination result information indicating whether or not a countermeasure is required for the reflection attack indicated by the attack possibility information;
When the reflection attack indicated by the attack possibility determination result information is fixed, the attack detection apparatus is instructed to block communication based on the specific protocol from a source address of the reflection attack related to the detection information. And an instruction unit to
The attack verification device includes:
A possibility information receiving unit for receiving the attack possibility information from the attack countermeasure device;
In the monitoring log acquired from the communication monitoring device that monitors communication in the second network, it is determined whether or not a communication history from the transmission source address to the first network exists, An attack verification unit that generates the attack possibility determination result information that the reflection attack is definite when the reflection attack is not definite and does not exist;
An attack response system comprising: a determination result information transmission unit that transmits the attack possibility determination result information to the attack response device. The attack countermeasure system according to claim 1, wherein at least one or both of the attack possibility information and the attack possibility determination result information is transmitted and received using BGP (Border Gateway Protocol). The attack countermeasure system according to claim 1, wherein at least one or both of the attack detection device and the communication monitoring device is an integrated security appliance device. An attack countermeasure method executed in an attack countermeasure system having an attack countermeasure apparatus included in a first network and an attack verification apparatus included in a second network,
Executed by the attack countermeasure device;
A possibility information generating step of generating attack possibility information indicating the possibility of the reflection attack by a specific protocol from the detection information of the reflection attack to the second network detected by the attack detection device;
A possibility information transmission step of transmitting the attack possibility information to the attack verification device;
A determination result information receiving step for receiving, from the attack verification device, attack possibility determination result information indicating whether or not a countermeasure is required for the reflection attack indicated by the attack possibility information;
When the reflection attack indicated by the attack possibility determination result information is fixed, the attack detection apparatus is instructed to block communication based on the specific protocol from a source address of the reflection attack related to the detection information. Including an instruction process to
Executed by the attack verification device;
A possibility information receiving step of receiving the attack possibility information from the attack countermeasure device;
In the monitoring log acquired from the communication monitoring device that monitors communication in the second network, it is determined whether or not a communication history from the transmission source address to the first network exists, An attack verification step for generating the attack possibility determination result information that the reflection attack is definite when the reflection attack is not definite and does not exist;
And a determination result information transmission step of transmitting the attack possibility determination result information to the attack countermeasure device.

Images