JP4241677B2 - Communication management device, unauthorized communication terminal device identification system and method, and program - Google Patents

Description

  The present invention relates to a communication management device, an unauthorized communication terminal device identification system and method, and a program, and in particular, connects an unauthorized communication detection device to a communication relay device of a network to be managed, collects and records unauthorized communication notifications therefrom, Communication management device and unauthorized communication terminal for drawing and displaying for summarizing records, displaying the result of aggregation on the network configuration diagram, and displaying the terminal device that performed unauthorized communication exceeding the threshold number so that it can be easily identified The present invention relates to an apparatus identification system and method, and a program.

  In the prior art, terminal devices with a large number of unauthorized communications are identified while performing trend analysis on the unauthorized communications records collected from the unauthorized communications detecting device by searching, narrowing down conditions, displaying graphs, and the like.

  Here, for example, Patent Document 1 discloses an unauthorized access verification apparatus and method as an invention relating to an unauthorized communication detection performed in a management target network.

  This device detects unauthorized access to a protection target server connected to an internal network, receives and stores an IDS that outputs an unauthorized access notification, and unauthorized access notification, and responds to access to the protection target server 13. And a packet collection device for receiving and storing the response packet output.

  The packet collection device has means for checking whether or not the response packet corresponding to the unauthorized access notification has a preset pattern and determining whether or not there is damage due to the unauthorized access.

  However, there is no disclosure of displaying unauthorized access (unauthorized communication addressed to the protection target server) in consideration of the number of times and displaying it in an easy-to-understand form on the network configuration diagram.

JP 2004-206564 A (first page)

  In the prior art, experience and knowledge are required to perform a task of identifying a terminal device having a large number of unauthorized communications from an unauthorized communication record collected from an unauthorized communication detection device.

  An object of the present invention is to provide an identification system and method for an unauthorized communication terminal device, a communication management device, and a program that can easily identify a terminal device having a large number of unauthorized communications.

  A first communication management device according to the present invention is a communication management device that manages a network including a communication terminal and a communication relay device, and manages connection configuration information of the communication relay device and a communication terminal device connected thereto. Means for collecting and recording unauthorized communication notifications from the unauthorized communication detecting device connected to the communication relay device and detecting communication matching the conditions, and drawing and displaying the unauthorized communication occurrence status based on the recording Unauthorized communication record drawing means, wherein the unauthorized communication record drawing means includes a level definition including one or more threshold values for classifying the number of unauthorized communications into a plurality of levels, and display states corresponding to levels different from each other. Means for setting and holding; means for referring to the connection configuration information; calculating the number of unauthorized communications per communication path from the record; judging the level against the threshold; and A drawing unit that creates a configuration diagram of the managed network based on the subsequent configuration information, adds the number of unauthorized communications to each communication path, and sets a display state of the communication path to a state corresponding to the determined level; .

  A second communication management device according to the present invention is a communication management device that manages a network including a communication terminal and a communication relay device, and includes terminal connection configuration information of the communication relay device and a communication terminal device connected thereto. Means for managing, means for managing connection configuration information between the communication relay devices, means for managing route information of the communication relay devices, and fraud that detects communications that are connected to the communication relay devices and meet the conditions Means for collecting and recording unauthorized communication notifications from the communication detection device, and unauthorized communication record rendering means for rendering and displaying an unauthorized communication occurrence status based on the record, wherein the unauthorized communication record rendering means includes the number of unauthorized communications. Means for setting and holding a level definition including one or more threshold values for classifying into a plurality of levels and different display states corresponding to levels, the terminal connection configuration information, and the route A communication target unit that calculates the number of unauthorized communications per communication path from the record, determines the level based on the threshold value, and the managed network based on the terminal connection configuration information and the inter-relay device connection configuration information The image forming apparatus includes drawing means for creating a configuration diagram, adding the number of unauthorized communications to each communication path, and setting a display state of the communication path to a state corresponding to the determined level.

  A third communication management apparatus according to the present invention is the first or second communication management apparatus, wherein the display state corresponding to each level is a color of a line representing a communication path.

  A fourth communication management apparatus according to the present invention is the first or second communication management apparatus, wherein the display state corresponding to each level is a thickness of a line representing a communication path.

  A fifth communication management device according to the present invention is the first or second communication management device, wherein the means for collecting and recording the unauthorized communication notification also records the occurrence time of the unauthorized communication, and the level definition The means for setting and holding the information sets the level definition of multiple types in association with the length of the unauthorized communication period to be counted, and the type of display state to be varied according to the level is different for each definition. The unauthorized communication record / drawing means has a means for acquiring information specifying the period of unauthorized communication to be aggregated from the aggregation request source, and calculates the number of unauthorized communications per communication path. A means for determining a level totalizes unauthorized communication notifications in which the occurrence time of the record is specified, calculates the number of unauthorized communications for each communication path, and defines a level definition corresponding to the length of the period. Level using threshold Determined, the drawing means is set according to the display state of the display state of the communication path by adding a fraudulent communication number corresponding levels defined in the block diagram of a managed network.

  A sixth communication management device according to the present invention is the fifth communication management device, wherein the plurality of level definitions are associated with a first definition associated with an aggregation for a short period of unauthorized communication records; The second definition associated with the aggregation of unauthorized communication records over a long period of time, the display state corresponding to each level of either of the two definitions as the color of the line representing the communication path, and the other definition The display state corresponding to each level is the thickness of the line representing the communication path.

  An identification system for an unauthorized communication terminal device according to the present invention includes any one of the first to sixth communication management devices, a communication terminal device connected to a network managed by the communication management device, and the network. A communication relay device, and an unauthorized communication detection device connected to the communication relay device and detecting a communication meeting a condition, and the communication management device is connected to the network or a network connected to the network. The

  A first unauthorized communication terminal device identification method according to the present invention is an unauthorized communication terminal device identification method in a network including a communication terminal and a communication relay device, wherein the communication relay device is connected to the communication terminal device connected thereto. A step of managing configuration information; a step of collecting and recording an unauthorized communication notification from an unauthorized communication detecting device connected to the communication relay device and detecting a communication meeting a condition; and an unauthorized communication occurrence status based on the recording A fraudulent communication record drawing step for drawing and displaying, wherein the fraudulent communication record drawing step includes one or more thresholds for classifying the number of fraudulent communication into a plurality of levels, and display states corresponding to levels different from each other. A step of setting and holding a level definition including: referring to the connection configuration information, calculating the number of times of unauthorized communication in communication path units from the record, Determining the level in light of the connection configuration information, creating a configuration diagram of the network to be managed based on the connection configuration information, adding the number of unauthorized communications to each communication path, and determining the display state of the communication path Including a step of setting a state corresponding to.

  A second unauthorized communication terminal device identification method of the present invention is an unauthorized communication terminal device identification method in a network including a communication terminal and a communication relay device, the communication relay device and a terminal of a communication terminal device connected thereto. A step of managing connection configuration information, a step of managing connection configuration information between the communication relay devices, a step of managing path information of the communication relay devices, and a communication that is connected to the communication relay device and meets the conditions Collecting and recording an unauthorized communication notification from an unauthorized communication detecting device for detecting the unauthorized communication, and an unauthorized communication record rendering step for rendering and displaying an unauthorized communication occurrence state based on the record, wherein the unauthorized communication record rendering step includes: Set a level definition that includes one or more thresholds to divide the number of unauthorized communications into multiple levels and different level-compatible display states Holding the terminal, referring to the terminal connection configuration information and the route information, calculating the number of times of unauthorized communication for each communication path from the record, determining the level against the threshold value, and the terminal connection configuration Create a managed network configuration diagram based on the information and the inter-relay device connection configuration information, add the number of unauthorized communications to each communication path, and set the display state of the communication path to a state corresponding to the determined level Includes steps.

  A third unauthorized communication terminal device identification method according to the present invention is the first or second unauthorized communication terminal device identification method, wherein the display state corresponding to each level is represented by a color of a line representing a communication path, and To do.

  A fourth unauthorized communication terminal device identification method of the present invention is the first or second unauthorized communication terminal device identification method, wherein the display state corresponding to each level is represented by a line thickness representing a communication path. To do.

  The first program of the present invention includes a step of managing connection configuration information of a communication relay device and a communication terminal device connected thereto, and unauthorized communication detection for detecting communication that is connected to the communication relay device and meets a condition Set and maintain a level definition that includes the step of collecting and recording unauthorized communication notifications from the device, one or more thresholds for classifying the number of unauthorized communications into multiple levels, and different level-corresponding display states A step of referring to the connection configuration information, calculating the number of unauthorized communications per communication path from the record, determining the level based on the threshold value, and configuring the configuration of the managed network based on the connection configuration information A step of creating a diagram, adding the number of unauthorized communications to each communication path, and setting the display state of the communication path to a state corresponding to the determined level. Cause the computer to execute.

  The second program of the present invention includes a step of managing terminal connection configuration information of a communication relay device and a communication terminal device connected thereto, a step of managing connection configuration information between the communication relay devices, and the communication relay A step of managing path information of the device, a step of collecting and recording an unauthorized communication notification from an unauthorized communication detection device connected to the communication relay device and detecting a communication meeting a condition, and the number of unauthorized communications to a plurality of levels. Setting and maintaining a level definition including one or more threshold values for classification and different level-corresponding display states, referring to the terminal connection configuration information and the route information, and from the record to the communication path Calculating the number of unauthorized communications per unit, judging the level against the threshold, and based on the terminal connection configuration information and the inter-relay device connection configuration information Create a physical object network diagram adds the unauthorized communication number to each communication path which, to perform the step of setting the display state of the communication path state corresponding to a level above judgment to the computer.

  A third program of the present invention is the first or second program, wherein the display state corresponding to each level is a color of a line representing a communication path.

  A fourth program of the present invention is the first or second program, wherein the display state corresponding to each level is a thickness of a line representing a communication path.

  The fifth program of the present invention includes a step of managing connection configuration information of a communication relay device and a communication terminal device connected thereto, and unauthorized communication detection for detecting communication that is connected to the communication relay device and meets a condition. Level definition that includes collecting and recording unauthorized communication notifications including the time of occurrence from the device, one or more threshold values for classifying the number of unauthorized communications into a plurality of levels, and different level-corresponding display states In correspondence with the length of the unauthorized communication period to be counted, and a plurality of types and the display state type is set and held differently for each definition; Obtaining information specifying the period of unauthorized communication to be aggregated from the source, intermediately counting unauthorized communication notifications in which the occurrence time of the record is specified, and Referring to the connection configuration information, calculating the number of unauthorized communications per communication path from the intermediate tabulation, judging the level against a threshold value of a level definition corresponding to the specified period, and the connection Create a configuration diagram of the managed network based on the configuration information, add the number of unauthorized communications to each communication path, and set the display state of the communication path according to the determined level and the display state of the corresponding level definition Causes the computer to execute the steps to be performed.

  A sixth program according to the present invention is the fifth program, wherein the plurality of level definitions are associated with a first definition associated with an aggregation for a short period of unauthorized communication records, and an unauthorized communication record The second definition associated with the long-term aggregation, the display state corresponding to each level of either of the two definitions as the color of the line representing the communication path, and the other definition corresponding to each level Is the thickness of the line representing the communication path.

  The effect of the present invention is that a communication relay device in which unauthorized communication exceeding the threshold is performed by a preset threshold value and a terminal device with a large number of unauthorized communications are visually recognized by changing the display state of a line between the terminal devices. The communication relay device connected to the terminal device can be dealt with in a short time in order to make it impossible to communicate with the terminal device.

  In addition, the above effects can prevent the spread of virus infection damage.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  First, the configuration of the first embodiment of the present invention will be described in detail with reference to FIG.

  In FIG. 1, a communication management device 100, a communication relay device 400, a communication relay device 500, a communication relay device 600, a terminal device 710, and a terminal device 720 are connected by a TCP / IP (Transmission Control Protocol / Internet Protocol) network 200. Yes.

  The communication relay device is a router, a switch device, a gateway device, or the like.

The unauthorized communication detection device 300 monitors unauthorized communication flowing through the communication relay device 400.
The unauthorized communication detection device 310 monitors unauthorized communication flowing through the communication relay device 500.
The unauthorized communication detection device 320 monitors unauthorized communication flowing through the communication relay device 600.

  Unauthorized communication is communication that does not conform to the communication protocol, or communication with abnormal communication data or sequence.

  For example, when the same communication source continuously changes the destination while changing the destination for a long time, or when the length of the TCP header and the data length (data count from the data head to the end mark) to be transmitted thereafter do not match. Communication concentrated in a short time.

  The unauthorized communication detection device is a device such as IDS (Intrusion-Detection-System) or IDPS (Intrusion-Detection-And-Protection-System).

  The terminal device 710 has an IP address 711, and the terminal device 720 has an IP address 721.

  The communication management device 100 is a device that operates under program control. The communication relay device connection configuration management unit 110, the terminal device connection configuration management unit 120, the communication relay device path configuration management unit 130, the unauthorized communication record collection unit 140, and the unauthorized communication. The recording / drawing means 150 is included.

  These means are controlled by a program.

  In addition, a display device is connected to the communication management device 100.

  The communication relay device connection configuration management means 110 manages the connection configuration of the TCP / IP network 200, the communication relay device 400, the communication relay device 500, and the communication relay device 600.

  The terminal device connection configuration management means 120 manages the connection configuration of the communication relay device 500 and the terminal device 510, the terminal device 520, and the terminal device 530, and also the communication relay device 600, the terminal device 610, the terminal device 620, and the terminal device 630. Manage the connection configuration.

  The terminal device 510 has an IP address 511, the terminal device 520 has an IP address 521, and the terminal device 530 has an IP address 531, and is connected to the communication relay device 500.

  The terminal device 610 has an IP address 611, the terminal device 620 has an IP address 621, and the terminal device 630 has an IP address 631, and is connected to the communication relay device 600.

  The communication relay device path configuration management unit 130 manages the path configurations of the communication relay device 400, the communication relay device 500, and the communication relay device 600.

  The unauthorized communication record collection unit 140 collects unauthorized communication records from the unauthorized communication detection device 300, the unauthorized communication detection device 310, and the unauthorized communication detection device 320.

  The unauthorized communication record drawing unit 150 includes network connection configuration information managed by the communication relay device connection configuration management unit 110 and the terminal device connection configuration management unit 120, and a route managed by the communication relay device path configuration management unit 130. Based on the configuration information and the unauthorized communication record collected by the unauthorized communication record collecting means 140, the aggregate information of the unauthorized communication record is drawn.

  When the unauthorized communication record / drawing means 150 obtains one or more threshold values for dividing the number of unauthorized communications into a plurality of levels, it automatically sets different display states for each level, and sets the threshold value and display state for each level. It also has a means for holding.

  The operation of the first embodiment of the present invention will be described in detail with reference to FIGS.

  Referring to FIG. 1, a destination of unauthorized communication notification is set in communication management device 100 in advance by communication or the like for unauthorized communication detection devices 300, 310, and 320.

  When each of the unauthorized communication detection devices 300, 310, and 320 detects unauthorized communication, the unauthorized communication detection device 300, 310, and 320 sends an unauthorized communication notification to the communication management device 100 using a protocol such as SNMP (Simple-Network-Management-Protocol).

  The unauthorized communication record collection unit 140 sequentially stores the received unauthorized communication notifications in a record storage unit (not shown).

  An example of this recording is shown in FIG. As shown in the figure, the date and time of occurrence of fraud, the source IP address, the destination IP address, and the number of occurrences (usually once) are recorded.

  Next, the operation of the unauthorized communication record drawing unit 150 will be described.

  When it is detected that the “level setting of number of unauthorized communications” icon on the screen is designated, an input screen for prompting the input of the number of levels is displayed (step A1).

  When 3 is input as the number of levels, an input screen for prompting input of the first threshold value and the second threshold value is displayed (step A2).

  Here, when 15 times and 100 times are input as the first threshold value and the second threshold value, the line colors: black, yellow, and red are automatically set as display states, and these values correspond to the item names. Attach and hold (step A3).

  Next, with reference to the flowchart of FIG. 3, the counting and drawing operations of the unauthorized communication record drawing unit 150 will be described.

  When an aggregation start request (for example, a request that is automatically generated every one hour or an operation of the “aggregation” icon by the operator) is detected (step B1), a date designation condition is set. If activated by the automatic request, the current time is set one hour before the current time (step B2).

  One entry of record data is read from the record storage unit (step B3).

  If the date and time of occurrence of the recorded data meets the set date and time designation conditions (step B4), the number of unauthorized communications is counted for each source IP address-destination IP address.

  That is, if the source IP address-destination IP address is not registered in the intermediate summary table, it is added and the number of unauthorized communications is written in the unauthorized communication count column, and the same source IP address-destination IP address is registered. If so, the number of illegal communication of data is added to the number of illegal communications (step B5).

  Steps B3 to B6 are repeated until the read or processed data becomes the last data in the recording storage unit.

  Assuming that 6 / 1-09: 0 to 6 / 1-10: 00 is set in step B2, the data 811 816,... 820 of FIG. Data is created.

  Data 812,... 822 in FIG. 2 are totaled, and data of number 901 in the intermediate total table in FIG. 4 is created. Similarly, data up to number 906 is created.

  Next, the source IP address-destination IP address information in the intermediate summary table shown in FIG. 4 is converted into communication path information with reference to the relay device connection configuration information, the terminal device connection configuration information, and the route configuration information. The total number of unauthorized communications is counted again, and an unauthorized communications count table (see FIG. 5) is created (step B7).

  Here, the communication path is a path in units of hops of the network below the communication relay device 400 in FIG. 1 and also considering the direction of communication, and a path from the communication relay device 400 to the external terminal and from the external terminal to the communication relay device 400. is there.

  The unauthorized communication count value of each communication path is compared with the first threshold value, and if it exceeds, it is further compared with the second threshold value to determine the level (step B8).

  The communication path display color (black / yellow / red) is set according to the level (see FIG. 6, step B9).

  According to the connection configuration information, a network connection configuration diagram (connection configuration diagram in an initial value state in which the number of unauthorized communications attached to each communication path is 0 and the arrow color is black) is drawn (step B10), and unauthorized communications are performed. If there is data in the frequency table, the line color of the arrow is changed according to the data of each communication path, and the number of occurrences is rewritten and displayed (see FIG. 7, step B11).

  In FIG. 7, an arrow from the communication relay device 500 to the communication relay device 400 and an arrow from the terminal device 520 to the communication relay device 500 are displayed in red, and the communication relay device 500 is connected to the terminal device 520. It can be easily determined that it is necessary to take measures to disable communication.

  It becomes possible to easily identify that the terminal device connected by the line drawn in red has performed illegal communication 100 times or more, and the communication relay device connected to the terminal device is connected to the terminal device. It is possible to cope with the inability to communicate and prevent the spread of virus infection damage.

  In addition, the 10 unauthorized communications from the terminal device 510 via the communication relay device 500 does not exceed the first threshold of 15 times, and is not caused by a virus infection of the terminal device 510 but caused by a simple communication error. By keeping the line color black (initial value), no extra warning is displayed.

  Next, a second embodiment of the present invention will be described. The overall structure of the second embodiment of the present invention is as shown in FIG.

  The operation of the second embodiment of the present invention will be described with respect to differences from the first embodiment. In step A3 of the operation of the unauthorized communication record / drawing means 150, 15 times and 100 times are input as the first threshold value and the second threshold value, and the display state includes line thickness: thin line, normal line, A thick line is automatically set, and these values are stored in association with item names.

  In step B9 of the total drawing operation, the thickness of the arrow of the communication path (thin line / normal line / thick line) is set according to the level (see FIG. 8).

  In step B11, if there is data in the unauthorized communication count table, the thickness of the arrow line is changed according to the data of each communication path, and the number of occurrences is rewritten and displayed (see FIG. 9).

  In FIG. 9, an arrow from the communication relay device 500 to the communication relay device 400 and an arrow from the terminal device 520 to the communication relay device 500 are displayed by thick lines, and the communication relay device 500 is directed to the terminal device 520. Therefore, it can be easily determined that it is necessary to take measures to disable the communication.

  It becomes easy to identify that a terminal device connected by a line drawn with a thick line has performed unauthorized communication 100 times or more, and the terminal device is connected to the communication relay device to which the terminal device is connected. This makes it possible to prevent the virus from being infected and to prevent the spread of virus infection damage.

  Next, a third embodiment of the present invention will be described. The overall configuration of the third embodiment of the present invention is as shown in FIG. 1 as in the previous embodiment.

  However, one or more threshold values corresponding to the level of the number of unauthorized communications and the means for defining and holding the display state of the unauthorized communication record drawing means 150 are different from those in the first and second embodiments.

  The above means is a means capable of setting and holding a plurality of types of definitions for the level, and the definition includes the length of the recording period to be counted (for example, counting illegal communication records generated during one hour as a target) Or 1 hour or 10 hours, such as whether or not unauthorized communication records generated during 10 hours are counted.

  The operation of the third embodiment of the present invention will be described in detail with reference to the drawings.

  The operation of the unauthorized communication record drawing unit 150 will be described.

  When it is detected that the “level setting of number of unauthorized communications” icon on the screen is designated, an input screen for prompting the input of the number of levels is displayed (step C1).

  When 3 is input as the number of levels, an input screen for prompting input of the first threshold value, the second threshold value, and the associated total period length is displayed (step C2).

  Here, 15 times and 100 times are input as the first threshold value and the second threshold value, and when “1 hour” is input as the total period length, the display state of each level is as follows: line color: black, yellow , Red are automatically set, and these values are held in association with the item names of the first definition (step C3).

  A message “Do you want to set the next definition?”, “YES” button, and “NO” button are displayed (step C4).

  When “YES” is instructed, steps C1 and C2 are repeated.

  For the input screen display, when 150 times and 1000 times are input as the first threshold and the second threshold, and “10 hours” is input as the total period length, the display state of each level is displayed as a thick line. S: A thin line, a normal line, and a thick line are automatically set, and these values are held in association with the item name of the second definition (step C5).

In response to the message “Do you want to set the next definition?”, “NO” is returned.
Next, with reference to the flowchart of FIG. 10, the totaling and drawing operations of the unauthorized communication record drawing unit 150 of the third embodiment will be described.

  When an aggregation start request (for example, a request that automatically occurs every 1 hour, a request that automatically occurs every 10 hours, or an operation of the “aggregation” icon by the operator) is detected (step D1), a date specification condition is set. .

  If it is activated by the automatic request, the current time is set from one hour before the current time, or the current time is set from ten hours before the current time (step D2).

  Here, it is assumed that a request automatically generated at a 10-hour cycle is detected, and a time from 10 hours before to the time at that time is set.

  One entry of record data is read from the record storage unit (step D3).

  If the date and time of occurrence of the recorded data meets the set date and time designation condition (step D4), the number of unauthorized communications is counted for each source IP address-destination IP address (step D5).

  Steps D3 to D6 are repeated until the read or processed data becomes the last data in the recording storage unit.

  If 6 / 1-00: 0 to 6 / 1-10: 00 are set in step D2, the data 802, 811, 816,... 820 of FIG. 950 data are created.

  Thereafter, data up to the number 956 of the intermediate summary table is similarly created.

  Next, similarly to step B7, an unauthorized communication count table (see FIG. 12) is created from the intermediate tabulation table shown in FIG. 11 (step D7).

  Since the period length to be counted is determined to be 10H (step D8), the second level definition information holding the period length 10H closest to 10H is referred to, and the unauthorized communication count value of each communication path is set to the second value. The level is determined by comparing with the first threshold value (150) and the second threshold value (1000) of the level definition information (step D13).

  Depending on the level, the line thickness (normal line / thick line) of the communication path is set (see FIG. 12, step D14).

  A network connection configuration diagram (initial value state) is drawn according to the connection configuration information (step D15).

  If there is table data, the thickness of the arrow is changed in accordance with the data of each communication path, and the number of occurrences is rewritten and displayed (step D16).

  If a request that automatically occurs in one hour period is detected in step D1, 6 / 1-09: 0 to 6 / 1-10: 00 are set in step D2, and this time zone is set in steps D3 to D7. The unauthorized communication records that occurred are aggregated.

  Since the period length to be counted is determined to be 1H (step D8), the first level definition information holding the period length 1H closest to 1H is referred to, and the unauthorized communication count value of each communication path is set to the first value. The level is determined by comparing with the first threshold (15) and the second threshold (100) of the level definition information (step D9).

  The line color (yellow / red) of the communication path is set according to the level (step D10), the network connection configuration diagram (initial value state) is drawn according to the connection configuration information (step D11), and the data of each communication path is The line color of the arrow is changed, and the number of occurrences is rewritten and displayed (step D12).

  Thus, there is an effect that the threshold can be set according to the length of the period to be counted.

  Further, since the communication path exceeding the threshold is displayed in red in the aggregation result display for each 1H, and the communication path exceeding the threshold is displayed in a thick line in the aggregation result display for each 10H, it is easy to grasp the content of the problem.

  INDUSTRIAL APPLICABILITY The present invention can be applied to an application such as early identification of a device in which a virus infection event has occurred in a network to which unauthorized communication detection devices are connected.

The block diagram which shows the system configuration | structure of the identification system of the unauthorized communication terminal device of this invention. The figure which shows the example of the unauthorized communication record in the communication management apparatus 100 of FIG. 6 is a flowchart showing an operation for counting and drawing illegal communication records according to the first embodiment of this invention. The figure which shows the example of the content of the intermediate | middle total table in the total process of the unauthorized communication record of 1st Example of this invention. The figure which shows the example of the content of the unauthorized communication count table | surface in the totaling process of the unauthorized communication record of 1st Example of this invention. The figure which shows the example by which the line color (black / yellow / red) was set to the communication path of the unauthorized communication frequency table by totaling and drawing process of unauthorized communication record of 1st Example of this invention. The figure which shows the example of a drawing display of the unauthorized communication generation condition of 1st Example of this invention. The figure which shows the example by which the thickness of the line (thin line / normal line / thick line) was set to the communication path of the unauthorized communication frequency table by the tally and drawing process of the unauthorized communication record of the second embodiment of the present invention. The figure which shows the example of a drawing display of the unauthorized communication generation condition of 2nd Example of this invention. 12 is a flowchart showing an operation of counting and drawing illegal communication records according to the third embodiment of the present invention. The figure which shows the example of the content of the intermediate | middle summary table in the summary process of the unauthorized communication record of 3rd Example of this invention. The figure which shows the example by which the line thickness (thin line / normal line / thick line) was set to the communication path of the unauthorized communication frequency table by the tally and drawing process of the unauthorized communication record of the third embodiment of the present invention. The figure which shows the example of a drawing display of the unauthorized communication generation condition of 3rd Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Communication management apparatus 110 Communication relay apparatus connection configuration management means 120 Terminal apparatus connection configuration management means 130 Communication relay apparatus path configuration management means 140 Unauthorized communication record collection means 150 Unauthorized communication record drawing means 200 TCP / IP network 300, 310, 320 Unauthorized Communication detection device 400, 500, 600 Communication relay device 510, 520, 530, 610, 620, 630, 710, 720 Terminal device

Claims (17)

A communication management device for managing a network including a communication terminal and a communication relay device,
Means for managing connection configuration information of the communication relay device and the communication terminal device connected thereto;
Means for collecting and recording an unauthorized communication notification from an unauthorized communication detection device connected to the communication relay device and detecting communication matching a condition;
Unauthorized communication record drawing means for drawing and displaying an unauthorized communication occurrence state based on the record, the unauthorized communication record drawing means,
Means for setting and holding a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Means for referring to the connection configuration information, calculating the number of unauthorized communications per communication path from the record, and determining the level of the number of unauthorized communications against the threshold;
A drawing unit that creates a configuration diagram of a managed network based on the connection configuration information, adds the number of unauthorized communications to each communication path, and sets a display state of the communication path to a state corresponding to the determined level. A communication management apparatus comprising: A communication management device for managing a network including a communication terminal and a communication relay device,
Means for managing terminal connection configuration information of a communication relay device and a communication terminal device connected thereto;
Means for managing connection configuration information between the communication relay devices;
Means for managing route information of the communication relay device;
Means for collecting and recording an unauthorized communication notification from an unauthorized communication detection device connected to the communication relay device and detecting communication matching a condition;
Unauthorized communication record drawing means for drawing and displaying an unauthorized communication occurrence state based on the record, the unauthorized communication record drawing means,
Means for setting and holding a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Means for referring to the terminal connection configuration information and the path information, calculating the number of times of unauthorized communication in communication path units from the record, and determining the level of the number of unauthorized communications in light of the threshold;
A managed network configuration diagram is created based on the terminal connection configuration information and the inter-relay device connection configuration information, the number of unauthorized communications is added to each communication path, and the display state of the communication path corresponds to the determined level A communication management apparatus comprising drawing means for setting a state. The communication management apparatus according to claim 1, wherein the display state corresponding to each level is a color of a line representing a communication path. The communication management apparatus according to claim 1, wherein the display state corresponding to each level is a thickness of a line representing a communication path. The means for collecting and recording the unauthorized communication notification also records the occurrence time of unauthorized communication,
The means for setting and holding the level definition sets a plurality of level definitions in association with the length of the unauthorized communication period to be counted, and the type of display state to be varied according to the level is defined for each definition. Set different types and keep them,
The unauthorized communication record drawing means has means for acquiring information specifying an unauthorized communication period to be aggregated from an aggregation request source, and means for calculating the number of unauthorized communications for each communication path and determining the level are: Aggregate unauthorized communication notifications for which the time of occurrence in the record is the specified period, calculate the number of unauthorized communications for each communication path, and determine the level using the threshold value of the level definition corresponding to the length of the period ,
3. The communication management according to claim 1, wherein the drawing means sets a display state of a communication path to which the number of unauthorized communications in the configuration diagram of the management target network is added according to the display state of the corresponding level definition. apparatus. The plurality of levels are defined as a first definition associated with aggregation for a short period of unauthorized communication records and a second definition associated with aggregation for a long period of unauthorized communication records. The display state corresponding to each level in one of the definitions is defined as the color of the line representing the communication path, and the display state corresponding to each level in the other definition is defined as the thickness of the line representing the communication path. The communication management apparatus according to claim 5. The communication management device according to any one of claims 1 to 6,
A communication terminal device connected to a network managed by the communication management device;
A communication relay device connected to the network;
An unauthorized communication detection device that is connected to the communication relay device and detects communication that matches a condition;
An identification system for an unauthorized communication terminal device, wherein the communication management device is connected to the network or a network connected to the network. An identification method of an unauthorized communication terminal device in a network including a communication terminal and a communication relay device,
Managing connection configuration information of the communication relay device and the communication terminal device connected to the communication relay device;
Collecting and recording an unauthorized communication notification from an unauthorized communication detection device that is connected to the communication relay device and detects communication that matches a condition;
An unauthorized communication record drawing step for drawing and displaying an unauthorized communication occurrence state based on the record,
In the unauthorized communication record drawing step,
Setting and maintaining a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Referring to the connection configuration information, calculating the number of times of unauthorized communication in communication path units from the record, determining the level of this against the threshold;
Creating a configuration diagram of a network to be managed based on the connection configuration information, adding the number of unauthorized communications to each communication path, and setting a display state of the communication path to a state corresponding to the determined level An identification method of an unauthorized communication terminal device characterized by the above. An identification method of an unauthorized communication terminal device in a network including a communication terminal and a communication relay device,
Managing the terminal connection configuration information of the communication relay device and the communication terminal device connected thereto;
Managing connection configuration information between the communication relay devices;
Managing route information of the communication relay device;
Collecting and recording an unauthorized communication notification from an unauthorized communication detection device that is connected to the communication relay device and detects communication that matches a condition;
An unauthorized communication record drawing step for drawing and displaying an unauthorized communication occurrence state based on the record,
In the unauthorized communication record drawing step,
Setting and maintaining a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Referring to the terminal connection configuration information and the path information, calculating the number of unauthorized communications in communication path units from the record, and determining the level in light of the threshold value;
A managed network configuration diagram is created based on the terminal connection configuration information and the inter-relay device connection configuration information, the number of unauthorized communications is added to each communication path, and the display state of the communication path corresponds to the determined level A method for identifying an unauthorized communication terminal device, comprising a step of setting a state. 10. The method for identifying an unauthorized communication terminal device according to claim 8, wherein the display state corresponding to each level is a line color representing a communication path. 10. The method for identifying an unauthorized communication terminal device according to claim 8, wherein the display state corresponding to each level is a thickness of a line representing a communication path. Managing connection configuration information of the communication relay device and the communication terminal device connected to the communication relay device;
Collecting and recording an unauthorized communication notification from an unauthorized communication detection device that is connected to the communication relay device and detects communication that matches a condition;
Setting and maintaining a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Referring to the connection configuration information, calculating the number of times of unauthorized communication in communication path units from the record, determining the level of this against the threshold;
Creating a configuration diagram of a managed network based on the connection configuration information, adding the number of unauthorized communications to each communication path, and setting a display state of the communication path to a state corresponding to the determined level; A program to make it run. Managing the terminal connection configuration information of the communication relay device and the communication terminal device connected thereto;
Managing connection configuration information between the communication relay devices;
Managing route information of the communication relay device;
Collecting and recording an unauthorized communication notification from an unauthorized communication detection device that is connected to the communication relay device and detects communication that matches a condition;
Setting and maintaining a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different display states corresponding to the levels;
Referring to the terminal connection configuration information and the path information, calculating the number of unauthorized communications in communication path units from the record, and determining the level in light of the threshold value;
A managed network configuration diagram is created based on the terminal connection configuration information and the inter-relay device connection configuration information, the number of unauthorized communications is added to each communication path, and the display state of the communication path corresponds to the determined level A program for causing a computer to execute a step for setting a state. The program according to claim 12 or 13, wherein the display state corresponding to each level is a color of a line representing a communication path. The program according to claim 12 or 13, wherein the display state corresponding to each level is a thickness of a line representing a communication path. Managing connection configuration information of the communication relay device and the communication terminal device connected to the communication relay device;
Collecting and recording an unauthorized communication notification including an occurrence time from an unauthorized communication detecting device connected to the communication relay device and detecting a communication meeting a condition;
Associating a level definition including one or more thresholds for classifying the number of unauthorized communications into a plurality of levels and different level-compatible display states with the length of the unauthorized communications period to be aggregated, Setting and holding a plurality of ways and the type of the display state is different for each definition; and
Receiving the aggregation request for the record, obtaining information specifying a period of unauthorized communication to be aggregated from the request source; and
Intermediately counting illegal communication notifications in which the occurrence time of the record is a specified period;
Referring to the connection configuration information, calculating the number of unauthorized communications per communication path from the intermediate tabulation, determining the level in light of a threshold of a level definition corresponding to the specified period;
Create a configuration diagram of the managed network based on the connection configuration information, add the number of unauthorized communications to each communication path, and display the display state of the communication path with the determined level and the display state of the corresponding level definition A program for causing a computer to execute the steps set according to the above. The plurality of levels are defined as a first definition associated with aggregation for a short period of unauthorized communication records and a second definition associated with aggregation for a long period of unauthorized communication records. The display state corresponding to each level in one of the definitions is defined as the color of the line representing the communication path, and the display state corresponding to each level in the other definition is defined as the thickness of the line representing the communication path. The program according to claim 16.

Images