JP3784799B2 - Attack packet protection system - Google Patents

Description

  The present invention is used in an apparatus for identifying and discarding a specific packet. In particular, the present invention relates to a technique for preventing an attack packet from entering a network. Here, the attack packet refers to a packet sent by a malicious attacker to paralyze the function of a server that provides a service to a user. For example, a SYN packet used for a SYN flooding attack is an attack packet.

  A number of fraudulent acts in which a malicious attacker sends an attack packet to paralyze the function of a server that provides services to users have been reported. A firewall device is known as a means for protecting a server from such an attack packet (see, for example, Non-Patent Document 1).

  The configuration of a conventional firewall system is shown in FIG. The conventional firewall device FW is set before the server S. The firewall device FW has various packet filtering functions, and identifies and discards packets from attackers. Thereby, the server S can avoid an attack.

As an attack packet identification method, for example, in the case of a SYN flooding attack, a large amount of SYN packets are continuously transmitted. Therefore, the attack packet can be identified by monitoring the traffic of the SYN packet. Alternatively, if the sender address of the attacker who sent the attack packet in the past is known, the packet having the sender address can be identified as the attack packet.
Masaaki Futaki, “Firewall“ Safety Meaning and Compensation ””, [online], Internet Week 2002, Tutorial T11, [October 16, 2003 Search], Internet <URL: http: //www.nic .ad.jp / en / materials / iw / 2002 / proceeding / T11.pdf>

  In such a conventional firewall system, the packet sent by the attacker reaches the front stage of the server S through the network. In general, the number of packets sent by an attacker is abnormally large, and the amount of traffic on the communication path to the server S becomes abnormally large, which may lead to congestion. At this time, a packet of a legitimate user trying to access the server S cannot reach the server S due to the influence of the congestion state.

  That is, the conventional firewall system can protect the server itself from an attack, but cannot protect the communication path to the server from the attack.

  The present invention has been performed against such a background, and it is possible to protect not only a server to be attacked but also a communication path leading to the server from an attack, and an attack capable of taking advanced defense measures. The object is to provide a packet protection system.

  The attack packet defense system of the present invention receives a packet arriving at a server by a firewall device in front of the server, detects an attack packet against the server, and sends information indicating that the attack packet has been detected. A filter device provided in a network border receives a packet from outside the network, identifies an attack packet based on the information, and forwards the attack packet to an analysis server. This analysis server acquires the transferred attack packet and analyzes the countermeasure. Using a defense measure based on the analysis result, the filter device discards the attack packet at the entrance of the network.

  As a result, the present invention is characterized by the fact that the communication path to the attack target server can be protected from the attack by dealing with the attack packet at the entrance of the network, and by providing a dedicated server for analysis. It is characterized by being able to implement advanced attack defense measures.

  That is, the first aspect of the present invention is an attack packet defense system, and the feature of the present invention is that means that receives a packet arriving at a server at a preceding stage of the server and detects an attack packet against the server. A firewall device comprising means for sending information indicating that an attack packet has been detected by the means for detecting, an analysis server comprising means for obtaining the attack packet and analyzing the countermeasure, and a network border And a filter device provided with means for receiving a packet from outside the network, identifying an attack packet based on the information, and forwarding the attack packet to the analysis server (Claim 1).

  The means for analyzing comprises: means for identifying the attack packet from among the packets transferred to the analysis server; and means for analyzing a source address of the attack packet identified by the means for identifying, The filter device may include means for generating a filter that discards a packet having the source address based on the analyzed source address of the attack packet.

  Alternatively, the analyzing means analyzes the normal packet that does not correspond to the attack packet from the packets transferred to the analysis server, and analyzes the source address of the normal packet identified by the identifying means The filter device may further comprise means for generating a filter that allows only packets having the source address to pass based on the analyzed source address of the normal packet.

  As a result, attack packets that arrive at the network can be identified by the source address and discarded. In the former case (claim 2), based on the source address of the attack packet, when a normal packet source is newly added, the packet from the normal packet source normally arrives at the destination. However, this cannot be dealt with when a new attack packet source appears.

  In the latter case (Claim 3), since it is based on the source address of the normal packet, when a new source of the attack packet is added, the attack packet from the source of the attack packet is also discarded at the entrance of the network. The However, when a new normal packet transmission source appears, even the normal packet is discarded.

  Since each has advantages and disadvantages, the analysis server applies any attack defense method according to the situation at that time. For example, if a new attack packet transmission source frequently appears, the latter method is applied. On the other hand, if a new normal packet transmission source frequently appears, the former method is applied.

  That is, the analysis server observes the appearance status of a new normal packet source or the appearance status of a new attack packet source, and the source address or normal packet of the attack packet based on the observation result of the observation means. Means for notifying the filter device of any one of the source addresses of the attack packet, the filter device based on either the source address of the attack packet or the source address of the normal packet notified by the means for notifying It is desirable to provide means for generating a filter (claim 4).

  Further, the source of the attack packet may misrepresent the source address. In addition, there are cases where a clever attack method is adopted in which the source address is changed one after another while the attack packet is continuously transmitted. In this case, it becomes difficult to identify the attack packet by the source address of the attack packet.

  In preparation for such a clever attack, the means for forwarding to the analysis server uses a packet that has the address of the analysis server as the destination address and the address of the own filter device as the source address. Means for encapsulating and transferring can be provided (claim 5).

  That is, when a filter device that has already received an attack packet is known, all packets having a destination address to be attacked that arrive at the filter device are set to the address of the analysis server as the destination address. Encapsulation is performed using the address as the source address. The analysis server that has received the encapsulated packet knows that it is a packet from the filter device that has already received the attack packet, so the source address of the content packet extracted by decapsulation is spoofed. Even in this case, the packet can be processed as a packet having a high possibility of being an attack packet.

  According to a second aspect of the present invention, a packet arriving at a server is received at a preceding stage of the server, a means for detecting an attack packet against the server, and information indicating that the attack packet has been detected is transmitted by the detection means. Means for providing a firewall. (Claim 6)

  According to a third aspect of the present invention, there is provided means for acquiring an attack packet and analyzing the countermeasure, and the means for analyzing the attack packet or a normal packet that does not correspond to the attack packet among the packets forwarded to itself. And a means for analyzing a source address of the attack packet or the normal packet identified by the means for identifying (Claim 7).

  Furthermore, means for observing the appearance of a new normal packet source or the appearance of a new attack packet source, and the source address of the attack packet or the source address of the normal packet based on the observation result of the means for observing And a means for notifying the filter device of any of them (claim 8).

  According to a fourth aspect of the present invention, an attack packet is acquired based on information indicating that an attack packet has been detected by receiving a packet from outside the network provided in a network border, and analyzing the countermeasure by acquiring the attack packet. A filter device characterized by comprising means for transferring to an analysis server comprising means for performing (Claim 9).

  Furthermore, it is possible to provide a means for generating a filter that discards a packet having the source address based on the source address of the analyzed attack packet.

  Alternatively, it is possible to provide means for generating a filter that allows only a packet having the source address to pass based on the source address of the analyzed normal packet.

  Further, the means for transferring to the analysis server includes means for encapsulating and transferring a packet to be transferred to the analysis server with a packet having the address of the analysis server as the destination address and the address of the own filter device as the source address. (Claim 12).

  According to a fifth aspect of the present invention, when installed in an information processing apparatus, the information processing apparatus receives a packet arriving at the server at a preceding stage of the server and detects an attack packet against the server, and this detection And a function corresponding to a firewall device having a function of transmitting information indicating that an attack packet has been detected.

  Alternatively, by installing the program of the present invention in the information processing apparatus, the information processing apparatus realizes a function of acquiring an attack packet and analyzing the countermeasure, and the packet transferred to itself as the function of this analysis An analysis server comprising a function for identifying the attack packet or a normal packet that does not correspond to the attack packet, and a function for analyzing a source address of the attack packet or the normal packet identified by the identification function A function corresponding to the above is realized (claim 14).

  Furthermore, the function of observing the appearance of a new normal packet source or the appearance of a new attack packet source, and the source address of the attack packet or the source address of the normal packet based on the observation result of the observed function The function of notifying either of them to the filter device can be realized (claim 15).

  Alternatively, the program of the present invention can be installed in an information processing apparatus to cause the information processing apparatus to attack based on information indicating that an attack packet has been detected by receiving a packet from outside the network provided in the network border. A function corresponding to a filter device having a function of identifying a packet and acquiring an attack packet and transferring it to an analysis server having means for analyzing a countermeasure is realized (claim 16).

  Furthermore, it is possible to realize a function of generating a filter that discards a packet having the source address based on the source address of the analyzed attack packet (claim 17).

  Alternatively, it is possible to realize a function of generating a filter that allows only a packet having the source address to pass based on the analyzed source address of the normal packet.

  Furthermore, as a function to transfer to the analysis server, a function to encapsulate and transfer a packet to be transferred to the analysis server by a packet having the address of the analysis server as the destination address and the address of the own filter device as the source address is realized. (Claim 19).

  A sixth aspect of the present invention is the information processing apparatus-readable recording medium on which the program of the present invention is recorded (claim 20). By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be directly installed in the information processing apparatus via a network from a server holding the program of the present invention.

  This makes it possible to use a general-purpose information processing device to realize an attack packet defense system that can protect not only the attack target server but also the communication path to the server from attacks, as well as advanced defense measures. can do.

  ADVANTAGE OF THE INVENTION According to this invention, not only the server used as an attack target but the communication path to the said server can be protected from an attack. Furthermore, by providing a server specialized in attack analysis, advanced defense measures can be taken.

(First Example)
A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of this embodiment.

  As shown in FIG. 1, the attack packet defense system according to the first embodiment includes a means for receiving a packet arriving at a server S at a preceding stage of the server S and detecting an attack packet against the server S, and a means for detecting the packet. A firewall apparatus FW provided with means for sending information indicating that an attack packet has been detected, an analysis server AS provided with means for acquiring the attack packet and analyzing the countermeasure, and the network provided in the network border An attack packet defense system comprising: a filter device F having means for receiving a packet from the outside, identifying the attack packet based on the information, and transferring the packet to the analysis server AS (Claim 1, 6-12).

  In this embodiment, the filter device F is described as an external device of the border router BR in order to make the explanation easy to understand, but it may be provided as an internal function of the border router BR.

  The means for analyzing comprises means for identifying the attack packet from among the packets transferred to the analysis server AS, and means for analyzing the source address of the attack packet identified by the means for identifying. The apparatus F includes means for generating a filter that discards a packet having the source address based on the analyzed source address of the attack packet (claims 2, 7, and 10).

  Next, the attack packet defense procedure of the first embodiment will be described.

When a plurality of users are accessing the server S, for example, a case is assumed where there is an attack user who attempts to bring down the server by performing a DoS attack. The numbers in FIG. 1 correspond to the numbers in the procedure described below.
(1) The firewall device FW installed in front of the server detects an attack such as an increase in Syn packets.
(2) The firewall device FW notifies attack detection to all the border routers BR in the network. This information is transmitted to the filter device F via the border router BR. The well-known content is the IP address of the server S.
(3) Each filter device F transfers a packet destined for the IP address of the server S to the analysis server AS provided in the network. The analysis server AS analyzes the legitimacy of each access individually.

  FIG. 2 is a diagram showing a comparison between a normal sequence and a Syn attack. In the normal sequence, as shown in FIG. 2A, communication is started in the sequence of Syn, Syn-Ack, Ack. On the other hand, in the Syn attack, as shown in FIG. 2B, after the Syn, Syn-Ack, the user does not respond, and repeatedly sends the Syn packet to the server S again. The server S enters a large number of Ack waiting states (Half-open state). When the server S exceeds the allowable amount, no new Syn is accepted, and the server S is further down.

The analysis server AS recognizes the attack pattern by analyzing the transfer pattern of such a Syn packet. In addition, segment anomalies and other attack patterns are also analyzed.
(4) The attack packet transmission source address is notified to the filter device F via the border router BR to the user who has been found to be malicious.
(5) Since the filter device F that has received this notification generates a filter that does not allow the packet having the address of the attack packet transmission source to pass, the user who has been found malicious cannot access the server S.

(Second embodiment)
A second embodiment will be described with reference to FIGS.

  In the first embodiment, the attack packet is discarded based on the address of the attack packet transmission source. In the second embodiment, the attack packet is discarded based on the address of the normal packet transmission source.

  The analyzing means of the analysis server AS includes means for identifying a normal packet that does not correspond to the attack packet from among the packets transferred to the analysis server AS, and a source address of the normal packet identified by the identification means And the filter device F includes means for generating a filter that passes only a packet having the source address based on the analyzed source address of the normal packet (claims 3, 7, 11). ).

Next, the attack packet defense procedure of the second embodiment will be described. When a plurality of users are accessing the server S, for example, a case is assumed where there is an attack user who attempts to bring down the server by performing a DoS attack. FIG. 3 is an overall configuration diagram of the attack packet defense system of the second embodiment. The numbers in FIG. 3 correspond to the numbers in the procedure described below.
(1) The firewall device FW installed in front of the server detects an attack such as an increase in Syn packets.
(2) The firewall device FW notifies attack detection to all the border routers BR in the network. This information is transmitted to the filter device F via the border router BR. The well-known content is the IP address of the server S.
(3) Each filter device F transfers a packet destined for the IP address of the server S to the analysis server AS provided in the network. The analysis server AS analyzes the legitimacy of each access individually.
(4) When the analysis server AS determines that the access is normal, the filter device F is notified of the normal packet source address so that only the IP packet of the source address is passed.
(5) Upon receiving this notification, the filter device F generates a filter that passes only packets having the address of the normal packet transmission source, and transfers the packet to the server S when receiving the packet having the address of the normal packet transmission source. To do.

  A procedure for determining a normal packet transmission source will be described with reference to FIG. FIG. 4 is a diagram illustrating a procedure for determining a normal packet transmission source. As shown in FIG. 4, the analysis server AS returns a Syn-Ack to the Syn packet from the user. On the other hand, a Reset is sent once to the user who gave Ack, and at the same time, the filter device F is instructed to change the route and transfer the packet from the user to the server S. When the user receives the Reset and sends the Syn packet again, the packet is normally transferred to the server S, and communication is normally started.

(Third embodiment)
In the first embodiment, since it is based on the source address of the attack packet, when a normal packet source is newly added, the packet from the normal packet source normally arrives at the destination. However, this cannot be dealt with when a new attack packet source appears.

  In the second embodiment, since it is based on the transmission source address of the normal packet, when a transmission source of the attack packet is newly added, the attack packet from the transmission source of the attack packet is also discarded at the entrance of the network. However, when a new normal packet transmission source appears, even the normal packet is discarded.

  Since each has advantages and disadvantages, the analysis server AS applies any attack defense method according to the situation at that time. For example, if a new attack packet transmission source frequently appears, the method of the second embodiment is applied. On the other hand, if a new normal packet transmission source appears frequently, the method of the first embodiment is applied.

  That is, the analysis server AS observes the appearance status of a new normal packet transmission source or the appearance status of a new attack packet transmission source, and the source address or normal packet of the attack packet based on the observation result of the observation means. Means for notifying the filtering device F of any one of the transmission source addresses of the attack packet, the filtering device F based on either the transmission source address of the attack packet or the transmission source address of the normal packet notified by the notification unit Means for generating a filter are provided (claims 4 and 8).

  More specifically, the firewall device FW constantly monitors an attack, and notifies the analysis server AS when the attack is detected. Thereby, the analysis server AS can observe the appearance frequency of a new attack packet transmission source. Further, all packets destined for the server S to be attacked are transferred to the analysis server AS, and normal packets are identified from the packets. At this time, the appearance frequency of a new normal packet transmission source can be observed.

  Based on this observation result, the analysis server AS instructs the filter device F to take one of the defense measures described in the first or second embodiment.

(Fourth embodiment)
A fourth embodiment will be described with reference to FIG. FIG. 5 is a diagram for explaining encapsulation for a packet transferred to the analysis server AS. In the fourth embodiment, a packet transfer method to the analysis server AS that can be applied to any of the first to third embodiments will be described.

  The means for transferring the packet to the analysis server AS of the filter device F encapsulates the packet to be transferred to the analysis server AS with a packet having the address of the analysis server AS as the destination address and the address of the own filter device F as the source address. And transferring means (claims 5 and 12).

  That is, the filter device F encapsulates the IP packet destined for the attack target server S, which is ordered to be transferred to the analysis server AS, and sets the analysis server AS as the destination address and the filter device F as the source address. As a result, even if the attacking user misrepresents his / her source address, at least I / O of the filter device F can be grasped, and packets destined for the destination address of the attack target can be regulated.

  For example, the user of the attack packet source may take a clever attack method of changing the source address one after another while continuing to transmit the attack packet. In this case, it becomes difficult to identify the attack packet by the source address of the attack packet.

  In the case of such a sophisticated attack, since the filter device F that has already received the attack packet is known, it has the destination address of the server S to be attacked that arrives at the filter device F. All packets are encapsulated with the address of the analysis server AS as the destination address and the address of the own filter device F as the source address. The analysis server AS that has received the encapsulated packet knows that the packet is from the filter device F that has already received the attack packet. Even if it is, the packet can be processed as a packet having a high possibility of being an attack packet.

(Fifth embodiment)
The present invention can be implemented as a program that, when installed in a general-purpose information processing apparatus, causes the information processing apparatus to realize functions corresponding to the firewall apparatus F, the analysis server AS, and the filter apparatus F of the present invention, respectively ( Claims 13 to 19). The program is recorded on a recording medium and installed in the information processing apparatus (claim 20), or installed in the information processing apparatus via a communication line, so that the information processing apparatus includes the firewall device F and the analysis server AS. A function corresponding to each means of the filter device F can be realized.

  According to the present invention, it is possible to protect the communication path to the attack target server from the attack. Furthermore, by providing a server specialized in attack analysis, advanced defense measures can be taken. Thereby, it is possible to reduce the adverse effect of a malicious user who performs an attack on a user who performs normal access, and to improve the quality of service for the user who performs normal access.

The whole block diagram of the attack packet defense system of a 1st Example. The figure which shows the comparison with a normal sequence and a Syn attack. The whole block diagram of the attack packet defense system of a 2nd Example. The figure which shows the normal packet determination procedure in an analysis server. The figure for demonstrating the encapsulation with respect to the packet transferred to the analysis server of 4th Example. The block diagram of the conventional firewall system.

Explanation of symbols

AS analysis server BR border router F filter device FW firewall device S server

Claims (4)

Means for receiving a packet arriving at a server at a preceding stage of the server and detecting an attack packet against the server;
A firewall device comprising means for sending information indicating that an attack packet has been detected by the means for detecting;
An analysis server comprising means for acquiring the attack packet and analyzing the countermeasure;
A filter device provided with a means for receiving a packet from outside the network provided in a network border, identifying an attack packet based on the information and transferring the attack packet to the analysis server ;
The analysis server
Means for observing the appearance of a new normal packet source or the appearance of a new attack packet source;
Means for notifying the filter device of either the source address of the attack packet or the source address of the normal packet based on the observation result of the means for observing;
With
The attack packet protection system , wherein the filter device includes means for generating a filter based on either the source address of the attack packet notified by the means for notifying or the source address of a normal packet . It has means to acquire attack packets and analyze countermeasures,
This means of analysis is
Means for identifying the attack packet or a normal packet not corresponding to the attack packet from among the packets forwarded to itself;
Means for analyzing a source address of the attack packet or the normal packet identified by the identifying means;
With
Means for observing the appearance of a new normal packet source or the appearance of a new attack packet source;
Means for notifying the filter device of either the source address of the attack packet or the source address of the normal packet based on the observation result of the means for observing;
An analysis server characterized by comprising: By installing on an information processing device,
Realize the function to acquire attack packets and analyze countermeasures,
As a function to analyze this,
A function for identifying the attack packet or a normal packet not corresponding to the attack packet from among the packets forwarded to itself;
A function of analyzing a source address of the attack packet or the normal packet identified by the identifying function;
The function corresponding to the analysis server equipped with
A function for observing the appearance of a new normal packet source or the appearance of a new attack packet source;
A function of notifying the filter device of either the source address of the attack packet or the source address of the normal packet based on the observation result of the function to be observed;
Realize
A program characterized by that . A recording medium readable by the information processing apparatus on which the program according to claim 3 is recorded .

Images