JP4235907B2 - Worm propagation monitoring system - Google Patents

Description

  The present invention relates to a worm propagation monitoring system that identifies a propagation path of an unauthorized packet transmitted by a worm, and more particularly to a packet sorting device that can identify a propagation path of an unauthorized packet when an unknown worm is infected.

  Prior art documents related to a worm propagation monitoring system for specifying a propagation path of an illegal packet transmitted by a conventional worm include the following.

JP 2000-049852 A JP 2000-26183 A JP 2001-217834 A JP 2002-158699 A JP 2003-298648 A JP 2003-298651 A

  On the Internet in recent years, worms (types of viruses that infect networks and infect themselves) that rapidly infect devices such as server machines such as “MS-SQL Slammer” and “Blaster”. However, it does not infect other files.)

  Such worms cause serious social problems such as global network failures, and it is desired to strengthen monitoring of worm activities over a wide area.

  On the other hand, the data part of malicious packets sent by such worms at the time of infection includes programs that are illegally executed using the vulnerability of the infected system. It has a specific data pattern specific to the worm.

  Therefore, by detecting such a specific data pattern unique to the worm at each observation point of the network, it is possible to specify the propagation path of the packet having the data pattern.

  FIG. 12 is a configuration block diagram showing an example of such a conventional worm propagation monitoring system. In FIG. 12, 1, 2 and 3 are NIDS (Network Intrusion Detection System: hereinafter simply referred to as NIDS), 4 is an IDS monitoring apparatus for managing each of the NIDS 1 to 3, and 100 is a network on the Internet. A backbone network, which is a high-speed and large-capacity backbone line connecting the networks, 101 is a management network to which the IDS monitoring device 4 is connected, and 102, 103 and 104 are general-purpose networks to be monitored.

  The management network 101 is connected to the backbone network 100, and the networks 102, 103, and 104 are also connected to the backbone network 100. The IDS monitoring device 4 is connected to the management network 101.

  NIDS 1 is connected to the gateway of the network 102, and similarly, NIDS 2 and 3 are connected to the gateways of the networks 103 and 104, respectively.

  Here, the operation of the conventional example shown in FIG. 12 will be described with reference to FIG. FIG. 13 is a flowchart for explaining the operation of the worm propagation monitoring system.

  In “S001” in FIG. 13, definition information (signature: for example, a specific data pattern specific to a worm) is set in advance in each of the NIDSs 1 to 3. Then, in “S002” in FIG. 13, each of the NIDSs 1 to 3 monitors the packets passing through the gateways of the networks 102 to 104.

  In FIG. 13, when the NIDS 1 to 3 identify an invalid packet based on the above-described definition information (signature) in “S003”, the IDS monitoring device 4 is illegal among the NIDS 1 to 3 in “S004” in FIG. 13. Information regarding illegal packets is collected from the NIDS that identifies the invalid packet, and the IDS monitoring device 4 identifies the propagation path of the illegal packet in “S005” in FIG.

  Specifically, each of the NIDS 1 to 3 acquires a passing packet, and whether the acquired packet is compared with the definition information (signature) set in advance is an illegal packet corresponding to the definition information (signature). It is judged whether or not and the IDS monitoring device 4 is notified accordingly.

  On the other hand, the IDS monitoring apparatus 4 that has received such a notification collects information such as a transmission destination address and a transmission source address related to an illegal packet identified from the NIDS that is the notification transmission source, and then transmits the NIDS of the notification transmission source. The location of the network through which the illegal packet has been propagated is identified from the location of the network (the location is identified from the IP (Internet Protocol) address or the like of the NIDS).

  As a result, when the NIDS is arranged at the entrance and exit of each network and the definition information (signature) of the illegal packet is set, the passing packet is monitored, and the illegal packet is specified from the definition information (signature) When the IDS monitoring device 4 collects information from the corresponding NIDS, it becomes possible to identify an unauthorized packet propagation path, in other words, a propagation path when a worm infection spreads.

  However, in the conventional example shown in FIG. 12, it is necessary to set definition information (signature) of invalid packets in advance for each NIDS installed at the entrance and exit of each network, but the definition information (signature). Is created based on the packet transmitted by the worm, and it takes several hours until the definition information (signature) of the packet transmitted by the worm, which has been unknown until now, is prepared.

  On the other hand, since the worm of recent times may only take about 10 or more minutes until the infection spreads, when the definition information (signature) of the packet transmitted by the unknown worm is set to NIDS, The problem that the detection of an illegal packet transmitted by the worm would be too late because it is assumed that the worm has already spread or after the infection of the worm has already ended. was there.

For this reason, when the worm infection spreads, the NIDS installed at the entrance / exit of each network cannot identify the malicious packet transmitted by the worm, and the illegal transmission when the worm infection actually spreads. There was a problem that the propagation path of the packet could not be grasped.
Therefore, the problem to be solved by the present invention is to realize a worm propagation monitoring system capable of specifying an unauthorized packet propagation path when an unknown worm is spread.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In a worm propagation monitoring system that identifies the propagation path of illegal packets sent by worms,
It is provided at the connection point between the backbone network and multiple networks, records the data part of the passing packet, the passage time, the source address and the destination address, and corresponds to the matched data part when there is a search request Multiple worm packet recording devices that send transit time, source address, and destination address as information, and worm packets that capture illegal packets transmitted by unknown worms that are spreading from packets that reach unassigned address blocks A worm propagation that requests a search from each worm packet recording device based on a data portion of an illegal packet acquired from the acquisition device and the worm packet acquisition device, and analyzes and displays the information acquired from each worm packet recording device With the monitoring device, the unknown It is possible to identify the propagation path of worm currently infected has expanded to capture over arm.

The invention according to claim 2
In the worm propagation monitoring system according to claim 1 ,
The worm packet recording device,
By converting the data part into a hash value using a hash function and recording the hash value and the information together, an unknown worm that is spreading the infection is captured and the worm whose infection is currently spreading It becomes possible to specify the propagation path.

The invention described in claim 3
In the worm propagation monitoring system according to claim 1 ,
The worm packet recording device,
By converting the data part into a hash value using a hash function, counting the appearance frequency of the same hash value, and sequentially recording the transit time, the source address, and the destination address corresponding to the hash value, It is possible to capture unknown worms that are spreading and identify the propagation path of the worm that is currently spreading. In addition, it is possible to shorten the hash value search time and the storage capacity of the storage means.

The invention according to claim 4
In the worm propagation monitoring system as claimed in claim 3 ,
The worm packet recording device,
By sequentially deleting information with a low appearance frequency of hash values, it becomes possible to capture an unknown worm that is spreading and identify the propagation path of the worm that is currently spreading. In addition, it is possible to shorten the hash value search time and the storage capacity of the storage means.

The invention according to claim 5
In the worm propagation monitoring system according to any one of claims 1 to 4 ,
The worm packet recording device,
The storage means, the data portion, or the hash value obtained by converting the data portion with a hash function and the information are recorded together, and the data portion that matches when there is a search request, or the data portion It is composed of an arithmetic control means that sends the information corresponding to the hash value converted by the hash function, thereby capturing the unknown worm that is spreading and identifying the propagation path of the worm that is currently spreading. It becomes possible to do.

The invention described in claim 6
In the worm propagation monitoring system according to claim 1 ,
The worm packet capture device comprises:
When the acquisition number of packets having the same data portion in the same protocol exceeds a preset threshold, the packet is regarded as a packet transmitted by an unknown worm, and the protocol of the packet is transmitted to the worm propagation monitoring device. By transmitting the data portion, it is possible to capture an unknown worm that is spreading and identify the propagation path of the worm that is currently spreading.

The invention described in claim 7
In the worm propagation monitoring system according to claim 1 ,
The worm propagation monitoring device is
Based on the information obtained from the worm packet recording device, an unknown worm is displayed by displaying the distribution of illegal packets that have passed with the x-axis or y-axis as the source address and the y-axis or x-axis as the destination address. It becomes possible to specify the propagation path of an illegal packet when the infection spreads. In addition, it is possible to identify unknown worms that are spreading and identify the propagation path of worms that are currently spreading.

The invention described in claim 8
In the worm propagation monitoring system according to claim 1 ,
The worm propagation monitoring device is
Based on the information obtained from one of the worm packet recording devices, by displaying the x-axis as time and the number of packets of illegal packets that have passed through the y-axis, It becomes possible to specify the propagation path. In addition, it is possible to identify unknown worms that are spreading and identify the propagation path of worms that are currently spreading.

The invention according to claim 9
In the worm propagation monitoring system according to claim 1 ,
The worm propagation monitoring device is
Based on the information acquired from each worm packet recording device, the transmission source address and the transmission destination address of the detected illegal packet are combined and displayed by a line segment, so that the infection of the unknown worm can be expanded. It becomes possible to specify the propagation path of an illegal packet. In addition, it is possible to identify unknown worms that are spreading and identify the propagation path of worms that are currently spreading.

The present invention has the following effects.
According to the first, second, third, fourth, fifth, sixth, seventh, eighth, and ninth aspects of the present invention, the data portion and the passage time of the packet that each worm packet recording device installed at the entrance / exit of each network passes through. The source address and destination address are recorded, and the worm packet capture device captures an illegal packet transmitted by an unknown worm that is spreading the infection from the packet that reaches the unassigned address block. The worm packet recording device is requested to search based on the data part of the captured illegal packet received from the packet capture device, and the acquired information is analyzed and displayed to capture the unknown worm that is spreading the infection. It is possible to identify the transmission route of the worm that is currently spreading.

According to the invention of claim 3 and claim 4, the appearance frequency of the same hash value is counted, and the transit time, the source address and the destination address corresponding to the hash value are sequentially recorded, or the hash By sequentially deleting information with a low value appearance frequency, it is possible to reduce the hash value search time and the storage capacity of the storage means.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a configuration block diagram showing an embodiment of a worm propagation monitoring system according to the present invention. In FIG. 1, 100, 101, 102, 103 and 104 are given the same reference numerals as in FIG. 12, and 5, 6 and 7 are worm packet records for acquiring all the packets passing through and recording the data portion of the packets. A device 8 is a worm propagation monitoring device such as a computer that requests the worm packet recording devices 5 to 7 to search.

  The management network 101 is connected to the backbone network 100, and the networks 102, 103, and 104 are also connected to the backbone network 100. A worm propagation monitoring device 8 is installed in the management network 101.

  The worm packet recording device 5 is connected to an entrance / exit of the network 102 (a connection point between the backbone network 100 and the network 102), and similarly, an entrance / exit of the networks 103 and 104 (a connection point between the backbone network 100 and the network 103 or the network 104). ) Are connected to the worm packet recording devices 6 and 7, respectively.

  Here, the operation of the embodiment shown in FIG. 1 will be described with reference to FIG. 2, FIG. 3, FIG. 4 and FIG. 2 and 4 are flowcharts for explaining the operation of the worm packet recording device, FIG. 3 is a block diagram showing a specific example of the worm packet recording devices 6 to 8, and FIG. 5 is for explaining the operation of the worm propagation monitoring device 9. FIG.

  In “S101” in FIG. 2, the worm packet recording devices 5 to 7 acquire packets that pass through the network entrance and exit, and have the specific data pattern unique to the worm acquired in “S102” in FIG. 2. The part is extracted, and the extracted data part is converted into a hash value using a hash function.

  Then, in “S103” in FIG. 2, the worm packet recording devices 5 to 7 also record the passage time, the transmission source address, the transmission destination address, and the like of the packet acquired together with the above hash value.

  Here, in FIG. 3, which is a specific example of the worm packet recording devices 5 to 7, 9 is a calculation control means such as a CPU (Central Processing Unit), and 10 is a storage means such as a RAM (Random Access Memory).

  The input from the line that is the observation point is connected to the arithmetic control means 9, and the output of the arithmetic control means 9 is connected to the storage means 10.

  For example, as indicated by “LG01” in FIG. 3, a packet input from a line as an observation point is taken into the arithmetic control means 9, and has a specific data pattern specific to a worm in an IP (Internet Protocol) packet. To extract the data part.

  Then, the arithmetic control means 9 converts the extracted data portion into a hash value using a hash function, and stores this hash value together with information such as the transit time, source address, and destination address of the acquired packet. Record in means 10.

  Then, in “S201” in FIG. 4, the worm packet recording devices 5 to 7 determine whether or not there is a request for searching for an illegal packet from the worm propagation monitoring device 8, and if there is a request for searching for an illegal packet. If not, the process returns to the step “S201” in FIG.

  If it is determined in “S201” in FIG. 4 that there is a request for searching for an invalid packet, the worm packet recording devices 5 to 7 in “S202” in FIG. To do.

  Specifically, the arithmetic control unit 9 constituting the worm packet recording devices 5 to 7 converts the data part of the packet (sent from the worm propagation monitoring device) that has been inquired into a hash value, and also stores the storage unit. A search is performed based on the hash value obtained by converting the data recorded in 10.

  In “S203” in FIG. 4, the worm packet recording devices 5 to 7 determine whether or not an illegal packet has been recorded, and if there is no illegal packet (to be exact, the data portion of the illegal packet). If it is determined, the process returns to the step “S201” in FIG.

  If it is determined in “S203” in FIG. 4 that an invalid packet (to be exact, the data portion of the invalid packet) has been recorded, the worm packet recording devices 5 to 7 in “S204” in FIG. Information such as passage time, transmission source address, transmission destination address, and the like recorded for the illegal packet (more precisely, the data portion of the illegal packet) is transmitted to the worm propagation monitoring device 8.

  Specifically, the arithmetic control unit 9 constituting the worm packet recording devices 5 to 7 passes the transit time stored in the storage unit 10 together with the hash value that matches the hash value generated from the data portion of the packet that has been inquired. The information such as the transmission source address and the transmission destination address is read and transmitted to the worm propagation monitoring device 8.

  On the other hand, in “S301” in FIG. 5, the worm propagation monitoring device 8 determines whether or not information related to the data portion of the packet transmitted by the unknown worm has been input. Specifically, it is determined whether or not information on the data portion of an illegal packet transmitted by the unknown worm obtained from an organization that analyzes the worm after the expansion of the unknown worm infection is input.

  If it is determined in step S301 in FIG. 5 that information on the data portion of the illegal packet has not been input, the process returns to step S301 in FIG. 5 to determine that the data portion of the illegal packet has been input. In this case, in “S302” in FIG. 5, the worm propagation monitoring device 8 requests the worm packet recording devices 5 to 7 arranged at the entrance and exit of each network to search for the illegal packet.

  Specifically, the worm propagation monitoring device 8 transmits the data portion of the input illegal packet to each of the worm packet recording devices 5 to 7 and requests a search for recording.

  Then, in “S303” in FIG. 5, the worm propagation monitoring device 8 determines whether or not information related to an illegal packet has been acquired from each of the worm packet recording devices 5 to 7, and determines that the information has not been acquired. In that case, the process returns to the step “S301” in FIG.

  If it is determined in S303 in FIG. 5 that information regarding an illegal packet has been acquired from each worm packet recording device, the worm propagation monitoring device 8 analyzes the acquired information in S304 in FIG. Display on the display means.

  For example, FIG. 6 is an explanatory diagram showing an example of a display screen when the distribution of illegal packets that have passed is shown with the x-axis as the source address and the y-axis as the destination address. As shown in FIG. 6, the illegal packets transmitted by the worm detected this time are mainly transmitted from the source address indicated by “SA21” in FIG. 6 and concentrated on the destination address indicated by “DS21” in FIG. You can easily grasp that you are.

  For example, FIG. 7 shows a display when the x-axis is the passage time and the number of illegal packets that have passed the y-axis at the entrance / exit of a specific network (specifically, the worm packet recording device 6). It is explanatory drawing which shows an example of a screen.

  “UP31” and “DP31” in FIG. 7 indicate the number of packets passing in the upstream and downstream directions, respectively, and as shown in FIG. 7, the worms transmitted around the passage time indicated by “TM31” in FIG. It is possible to grasp that a correct packet has been propagated.

  Further, for example, FIG. 8 is an explanatory diagram illustrating an example of a display screen when a transmission source address and a transmission destination address of a detected illegal packet are combined with a line segment.

  As shown in FIG. 8, each transmission destination shown in “DA41”, “DA42”, “DA43”, “DA44”, “DA45” and “DA46” in FIG. 8 from the source address shown in “SA41” in FIG. Easily understand that an invalid packet is being sent to the address

  That is, the worm packet recording devices 5 to 7 record the data portions of all the packets that pass through the worm packet recording devices 5-7, and each worm is based on the data portion of an illegal packet transmitted by an unknown worm after the spread of unknown worm infection By searching the packet recording device, it is possible to identify an illegal packet propagation path when the worm infection spreads even if it is an unknown worm.

  As a result, the worm packet recording devices 5 to 7 installed at the entrances and exits of each network record the data portion of the packet passing through, the passage time, the transmission source address and the transmission destination address, and the worm propagation monitoring device 8 is input. By requesting each worm packet recording device to search based on the data portion of the packet, and analyzing and displaying the acquired information, it is possible to identify the propagation path of an illegal packet when an unknown worm spreads Become.

  Incidentally, in the embodiment shown in FIG. 1, after the unknown worm infection spread, the malicious packet of the unknown worm infection spread based on the data portion of the malicious packet transmitted by the unknown worm obtained by analysis. While the propagation path is specified, it is possible to capture the malicious packet sent by the unknown worm while the infection spread of the unknown worm and identify the propagation path of the worm that is currently spreading. .

  FIG. 9 is a configuration block diagram showing another embodiment of the worm worm propagation monitoring system according to the present invention for capturing an unknown worm that is spreading such infection and identifying the propagation path of the worm currently spreading. It is. 9, 5, 6, 7, 8, 100, 101, 102, 103, and 104 are assigned the same reference numerals as in FIG. 1, and 11 captures an illegal packet transmitted by an unknown worm that is spreading infection. A worm packet capturing device 105 is an unassigned address block that uses addresses that are not currently allocated to network devices such as computers.

  The management network 101 is connected to the backbone network 100, and the networks 102, 103, and 104 are also connected to the backbone network 100. A worm propagation monitoring device 8 is installed in the management network 101.

  The worm packet recording device 5 is connected to an entrance / exit of the network 102 (a connection point between the backbone network 100 and the network 102), and similarly, an entrance / exit of the networks 103 and 104 (a connection point between the backbone network 100 and the network 103 or the network 104). ) Are connected to the worm packet recording devices 6 and 7, respectively.

  Further, the unassigned address block 105 is connected to the backbone network 100, and the worm packet capturing device 11 is installed in the unassigned address block 105.

  Here, the operation of another embodiment shown in FIG. 9 will be described with reference to FIGS. FIG. 10 is a flowchart for explaining the operation of the worm packet capturing device 11, and FIG. 11 is a flowchart for explaining the operation of the worm propagation monitoring device 8. However, the operation similar to that of the embodiment shown in FIG. 1 and particularly the operation of the worm packet recording devices 5 to 7 are the same as those of the embodiment shown in FIG.

  In “S401” in FIG. 10, the worm packet capturing device 11 acquires the packet that has reached the unassigned address block 105, and extracts the protocol and data portion of the packet acquired in “S402” in FIG.

  The packets that arrive at the unassigned address block 105 are packets that are unrelated to the original communication, and it is very likely that these packets include an illegal packet transmitted by an unknown worm.

  For this reason, the number of acquired packets with the same protocol in the same protocol is monitored, and if the acquired number exceeds the threshold, the packet is regarded as a packet transmitted by an unknown worm, Catch (identify) unknown worms.

  That is, in “S403” in FIG. 10, the worm packet capture device 11 determines whether or not the number of acquired packets with the same protocol and the same data portion exceeds a preset threshold, and does not exceed the threshold. If it is determined that the process has been completed, the process returns to the step “S401” in FIG.

  If it is determined in “S403” in FIG. 10 that the number of acquired packets with the same protocol and the same data portion has exceeded a preset threshold value, the worm packet capturing device in “S404” in FIG. 11 regards the packet as a packet transmitted by an unknown worm, and transmits the protocol and data portion of the illegal packet to the worm propagation monitoring device 8.

  On the other hand, in “S501” in FIG. 11, the worm propagation monitoring device 8 determines whether or not the protocol and data portion of the packet captured from the worm packet capturing device 11 has been received. If it is determined that the data portion has not been received, the process returns to the step “S501” in FIG.

  If it is determined that the protocol and data part of the captured illegal packet have been received, the worm propagation monitoring device 8 in “S502” in FIG. 11 causes the worm packet recording device 5 arranged at the entrance / exit of each network. To search for the illegal packet.

  Specifically, the worm propagation monitoring device 8 transmits the data portion of the received illegal packet received to each of the worm packet recording devices 5 to 7 to request a record search.

  Then, in “S503” in FIG. 11, the worm propagation monitoring device 8 determines whether or not the information regarding the packet captured from each worm packet recording device is acquired, and if it is determined that the information has not been acquired. Return to the step of “S501” in FIG.

  If it is determined that information regarding an illegal packet captured from each worm packet recording device is acquired in “S503” in FIG. 11, the worm propagation monitoring device 8 acquires the acquired information in “S504” in FIG. Is displayed on the display means.

  For example, from the display screen shown in FIG. 6, an illegal packet transmitted by the detected unknown worm is mainly transmitted from the source address indicated by “SA21” in FIG. 6, and the transmission indicated by “DS21” in FIG. It is possible to easily grasp that the address is concentrated on the destination address.

  Further, for example, from the display screen shown in FIG. 7, it is possible to grasp that an illegal packet transmitted by an unknown worm has propagated around the passage time indicated by “TM31” in FIG. 7 as shown in FIG. it can.

  Further, for example, from the display screen shown in FIG. 8, an unknown worm is sent from the source address shown in “SA41” in FIG. 8 to “DA41”, “DA42”, “DA43”, “DA44”, “ It can be easily understood that an illegal packet is transmitted to each destination address indicated by DA45 "and" DA46 ".

  As a result, the data portion of the packet passed by the worm packet recording devices 5 to 7 installed at the entrance / exit of each network, the passage time, the transmission source address, the transmission destination address, etc. are recorded, and the worm packet capturing device 11 stores the unassigned address. An illegal packet transmitted by an unknown worm whose infection is spreading is captured from the packet reaching the block 105, and each of the worm propagation monitoring device 8 receives each of the data based on the data portion of the captured malicious packet received from the worm packet capture device 11. By searching the worm packet recording devices 5 to 7 and analyzing and displaying the acquired information, the unknown worm that is spreading the infection is captured and the propagation path of the worm that is currently spreading is identified. Is possible.

  In the embodiment shown in FIG. 1 or FIG. 9, three networks are exemplified as the monitoring target networks 101 to 104. However, the number of networks is not limited to this number of course. It is possible to apply.

  In this case, it is necessary to install a worm packet recording device at the entrance / exit of each network according to the number of networks to be monitored.

  Further, in the embodiment shown in FIG. 1 and the like, when the worm packet recording device records the data portion of the illegal packet, the data portion is converted into a hash value and recorded in the storage means 10. The data portion itself may be recorded in the storage means 10 without being converted into a hash value.

  Further, in the embodiment shown in FIG. 1 and the like, when the worm packet recording device records the data portion of the illegal packet, the data portion is converted into a hash value and recorded in the storage means 10. Instead of recording the hash values in time series, the appearance frequency of the same hash value may be counted and the transit time, the transmission source address, the transmission destination address, and the like corresponding to the hash value may be sequentially recorded.

  In this case, since illegal packets transmitted by the worm often become a large number of packets, the search time for hash values can be shortened by searching in order from hash values having a high appearance frequency. Further, even when the same hash value passes in large quantities, only one hash value needs to be recorded, so that the storage capacity of the storage means can be reduced.

  Furthermore, information with low appearance frequency of hash values may be deleted sequentially. Specifically, the top 100 appearance frequencies of the hash value are stored, and the hash value having the appearance frequency of the 101st or lower and the information corresponding to the hash value are discarded.

  In this case, it is only necessary to record information with a high frequency of appearance of hash values, so that the storage capacity of the storage means can be reduced.

  Moreover, although the display screen shown in FIG.6, FIG7 and FIG.8 is illustrated as an example of the display screen which the worm propagation monitoring apparatus 8 displays on a display means, of course, it is not limited to these display screens. .

  Also, the display screen shown in FIG. 6 displays the distribution of illegal packets that have passed, with the x-axis as the source address and the y-axis as the destination address based on the source address and destination address acquired from each worm packet recording device. Of course, the y-axis may be the transmission source address and the x-axis may be the transmission destination address.

1 is a configuration block diagram showing an embodiment of a worm propagation monitoring system according to the present invention. FIG. It is a flowchart explaining operation | movement of a worm packet recording apparatus. It is a block diagram which shows the specific example of a worm packet recording apparatus. It is a flowchart explaining operation | movement of a worm packet recording apparatus. It is a flowchart explaining operation | movement of a worm propagation monitoring apparatus. It is explanatory drawing which shows an example of the display screen when the x-axis is a transmission source address and the y-axis is a transmission destination address and the distribution of illegal packets passed is shown. It is explanatory drawing which shows an example of a display screen at the time of making the x-axis the passage time and the packet number of the illegal packet which passed the y-axis at the entrance and exit of a certain network. It is explanatory drawing which shows an example of the display screen at the time of combining the transmission source address and transmission destination address of the detected illegal packet with a line segment. It is a block diagram which shows the other Example of the worm worm propagation monitoring system which concerns on this invention. It is a flowchart explaining operation | movement of a worm packet capture apparatus. It is a flowchart explaining operation | movement of a worm propagation monitoring apparatus. It is a block diagram which shows an example of the conventional worm propagation monitoring system. It is a flowchart explaining operation | movement of a worm propagation monitoring system.

Explanation of symbols

1,2,3 NIDS (Network Intrusion Detection System)
4 IDS monitoring device 5, 6, 7 Worm packet recording device 8 Worm propagation monitoring device 9 Arithmetic control means 10 Storage means 11 Worm packet capture device 100 Backbone network 101 Management network 102, 103, 104 Network 105 Unassigned address block

Claims (9)

In a worm propagation monitoring system that identifies the propagation path of illegal packets sent by worms,
It is provided at the connection point between the backbone network and multiple networks, records the data part of the passing packet, the passage time, the source address and the destination address, and corresponds to the matched data part when there is a search request A plurality of worm packet recording devices that transmit passage time, source address and destination address as information;
A worm packet capturing device that captures an illegal packet transmitted by an unknown worm that is spreading from a packet that reaches an unassigned address block;
A worm propagation monitoring device for requesting each worm packet recording device to search based on a data portion of an illegal packet acquired from the worm packet capturing device, and analyzing and displaying the information acquired from each worm packet recording device;
A worm propagation monitoring system characterized by comprising: The worm packet recording device,
The data part is converted into a hash value using a hash function, and the hash value and the information are recorded together.
The worm propagation monitoring system according to claim 1. The worm packet recording device,
The data part is converted into a hash value using a hash function, the appearance frequency of the same hash value is counted, and a transit time, a source address, and a destination address corresponding to the hash value are sequentially recorded. Do
The worm propagation monitoring system according to claim 1. The worm packet recording device,
It is characterized by deleting information with low appearance frequency of hash values sequentially
The worm propagation monitoring system according to claim 3. The worm packet recording device,
Storage means;
The data part or a hash value obtained by converting the data part with a hash function and the information are recorded together, and the matched data part or the data part is converted by the hash function when a search request is made. And an arithmetic control means for transmitting the information corresponding to the hash value.
The worm propagation monitoring system according to any one of claims 1 to 4. The worm packet capture device comprises:
When the acquisition number of packets having the same data portion in the same protocol exceeds a preset threshold, the packet is regarded as a packet transmitted by an unknown worm, and the protocol of the packet is transmitted to the worm propagation monitoring device. Characterized by transmitting the data part
The worm propagation monitoring system according to claim 1. The worm propagation monitoring device is
Based on the information acquired from the worm packet recording device, the distribution of illegal packets that have passed is displayed using the x-axis or y-axis as the source address and the y-axis or x-axis as the destination address.
The worm propagation monitoring system according to claim 1. The worm propagation monitoring device is
Based on the information acquired from one of the worm packet recording devices, the x-axis is displayed as time, and the number of illegal packets passing through the y-axis is displayed.
The worm propagation monitoring system according to claim 1. The worm propagation monitoring device is
Based on the information acquired from each of the worm packet recording devices, a source address and a destination address of a detected illegal packet are combined and displayed by a line segment.
The worm propagation monitoring system according to claim 1.

Images