JP4699893B2 - Packet analysis system, packet analysis program, packet analysis method, and packet acquisition device - Google Patents

Description

  The present invention relates to information management for analyzing information flowing through a network, for example.

Conventionally, information management has been performed to prevent information accidents such as leakage of personal information and information leakage due to unauthorized access. For example, conventionally, there are systems that prevent the occurrence of information accidents by using Firewall, IDS (Intrusion Detection System), content filters, and the like.
Conventionally, when an information accident occurs, a terminal log is acquired in order to investigate the contents of the information accident.
Japanese Patent Laid-Open No. 2004-140618

Even when a conventional system for preventing an information accident is introduced, it is difficult to completely prevent an information accident. In the ex-post response when a conventional information accident occurs, the information that can be investigated from the log information of the terminal is limited, and there is a problem that it is difficult to obtain sufficient information. Furthermore, in order to investigate the log information of the terminal, there is a problem that a corresponding technique is necessary, and a lot of cost is necessary for the investigation.
An object of the present invention is, for example, to leave sufficient information for investigation when an information accident occurs, and to be able to search and browse by a simple operation. It is also intended to facilitate the enhancement of the installed system facilities.

A packet analysis system according to an embodiment of the present invention acquires a packet flowing through a network and analyzes the packet.
A packet acquisition device connected to a predetermined connection point of the network and connected to the storage device via a connection line; and an analysis device connected to the storage device via a connection line;
The packet acquisition device transmits a packet flowing through the connection point via a communication device, and transmits the packet acquired by the packet acquisition unit to the storage device via the communication device, and stores the packet in the storage device. A transmission unit,
The analysis device includes a packet reading unit that reads a packet stored by the storage device via a communication device, and a packet analysis unit that analyzes the packet read by the packet reading unit by the processing device. To do.

  The packet acquisition device is connected to a predetermined connection point of the first network, and the transmission unit transmits the packet acquired by the packet acquisition unit to the storage device via the second network, and reads the packet. The unit reads the packet stored by the storage device via the third network.

  The packet analysis system further includes a management terminal that gives instructions to the acquisition device, the storage device, and the analysis device, and the management terminal, the packet acquisition device, the storage device, and the analysis device are connected by a fourth network. It is characterized by.

  The packet analysis system includes a plurality of packet acquisition devices, and each packet acquisition device of the plurality of packet acquisition devices is connected to a different connection point.

  The packet acquisition device further includes a hash key assignment unit that assigns a hash key to the packet acquired by the packet acquisition unit and stores the hash key in a storage device, and the transmission unit includes the hash key assignment unit. Is transmitted to the storage device and stored in the storage device.

  In addition, the packet acquisition device further includes a time grant unit that assigns a packet acquisition time to the packet acquired by the packet acquisition unit and stores the packet in a storage device, and the transmission unit includes the time grant unit. A packet with time is transmitted to a storage device and stored in the storage device.

  The packet acquisition device further includes an identifier adding unit that assigns an identifier for identifying the packet acquisition device to the packet acquired by the packet acquisition unit and stores the identifier in the storage device. The unit transmits the packet with the identifier to the storage device and stores the packet in the storage device.

  The identifier assigning unit assigns a MAC (Media Access Control) address as an identifier.

  The packet acquisition device further includes an encryption unit that encrypts the packet acquired by the packet acquisition unit and stores the encrypted packet in a storage device, and the transmission unit stores the packet encrypted by the encryption unit. And stored in a storage device.

  The packet reading unit reads the encrypted packet stored by the storage device, and the analysis device further decrypts the encrypted packet read by the packet reading unit and stores it in the storage device. And the packet analysis unit analyzes the packet decoded by the decoding unit.

  The analysis device further includes a log acquisition unit that acquires an operation log and stores the operation log in a storage device when an instruction to access the packet analyzed by the packet analysis unit is given from the management terminal. It is characterized by that.

  In addition, the packet acquisition device further performs a filing process in which the packet acquired by the packet acquisition unit is converted into one file at a predetermined time unit, generates first file data, and stores the first file data in the storage device. One file conversion unit is provided, and the transmission unit transmits the first file data generated by the first file conversion unit as a file, and stores the first file data in the storage device.

  Further, the packet acquisition device further includes a temporary storage unit that temporarily stores the packet acquired by the packet acquisition unit in a buffer memory, and a filing process in which the packet is made into one file based on the capacity of the buffer memory. 2nd file data which generates 2nd file data and memorizes it in a storage device, The 1st file conversion part is the 2nd file data which the 2nd file conversion part generated by file conversion processing The first file data is generated by performing a filing process to make one file in a predetermined time unit.

  In addition, the packet acquisition device further includes a compression unit that compresses the second file data generated by the second file conversion unit and generates the compressed file and stores the compressed file in a storage device. The one-file conversion unit is characterized in that the first file data is generated by performing a file conversion process in which the compressed file generated by the compression unit is converted into one file in a predetermined time unit.

  Further, the packet acquisition device further includes a hash key assigning unit that assigns a hash key to the second file data generated by the second file generation unit as a file, and stores the hash key in a storage device. The filing unit performs the filing process by converting the second file data to which the hash key assigning unit has added the hash key into one file at a predetermined time unit, and generates the first file data. .

  The first filing unit includes identification information that uniquely indicates the packet acquisition device in the file name of the generated first file data.

Further, the packet analysis system according to the exemplary embodiment of the present invention acquires a packet flowing through a network and analyzes the packet.
A packet acquisition unit that acquires a packet flowing through a network via a communication device, a packet storage unit that stores the packet acquired by the packet acquisition unit in a storage device, and a packet that is stored in the packet storage unit is analyzed by a processing device A packet analyzer, and the packet acquisition unit, the packet storage unit, and the packet analyzer are provided by a plurality of devices connected by a network.

A packet analysis method according to an embodiment of the present invention is a packet analysis method of a packet analysis system that acquires a packet flowing through a network and analyzes the packet.
Packet acquisition processing executed by a packet acquisition device connected to a predetermined connection point of the network and connected to the storage device via a connection line, and analysis processing executed by an analysis device connected to the storage device via the connection line And
The packet acquisition step includes a packet acquisition step in which a packet acquisition unit acquires a packet flowing through the connection point via a communication device, and a transmission unit transmits the packet acquired in the packet acquisition step to the storage device via the communication device. And storing in the storage device,
The analysis step includes a packet reading step in which the packet reading unit reads the packet stored by the storage device via the communication device, and a packet analysis in which the packet analysis unit analyzes the packet read in the packet reading step by the processing device. And a step.

A packet analysis program according to an embodiment of the present invention is a packet analysis program for a packet analysis system that acquires a packet flowing through a network and analyzes the packet.
A packet acquisition program of a packet acquisition device connected to a predetermined connection point of the network and connected to the storage device via a connection line; and an analysis program of an analysis device connected to the storage device via a connection line;
The packet acquisition program includes a packet acquisition step in which a packet acquisition unit acquires a packet flowing through the connection point via a communication device, and a transmission unit transmits the packet acquired in the packet acquisition step to the storage device via the communication device. And causing the computer to execute a transmission step to be stored in the storage device,
The analysis program includes a packet reading step in which the packet reading unit reads the packet stored by the storage device via the communication device, and a packet analysis in which the packet analysis unit analyzes the packet read in the packet reading step by the processing device. And causing the computer to execute the steps.

  The packet acquisition program further causes the computer to execute a hash key assigning step in which the hash key assigning unit assigns a hash key to the packet acquired in the packet acquiring step and stores the hash key in the storage device. The packet having the hash key assigned in the hash key assigning step is transmitted to the storage device and stored in the storage device.

  The packet acquisition program further causes the computer to execute an identifier assigning step in which the identifier assigning unit assigns an identifier for identifying the packet obtaining device to the packet obtained in the packet obtaining step and stores the identifier in the storage device. In the transmission step, the packet having the identifier added in the identifier adding step is transmitted to the storage device and stored in the storage device.

  In the identifier assigning step, a MAC address is assigned as an identifier.

  In addition, the packet acquisition program further performs a filing process in which the packet acquired in the packet acquisition step is converted into one file in a predetermined time unit, and the first file data is generated by the first file generation unit. The first file generation step stored in the storage device is executed by the computer. In the transmission step, the first file data generated by the file processing in the first file generation step is transmitted to the storage device and stored in the storage device. It is characterized by making it.

  The packet acquisition program further includes a temporary storage step in which the packet acquired in the packet acquisition step is temporarily stored in the buffer memory by the temporary storage unit, and the packet is stored in one file based on the memory capacity of the buffer. And the second filing step in which the second filing unit generates the second file data and stores it in the storage device. The second filing step causes the computer to execute the second filing step. The second file data generated by filing in the filing step is converted into one file in a predetermined time unit, and the first file data is generated.

  The packet acquisition program further includes a compression step of compressing the second file data generated by the file processing in the second file conversion step, and generating a compressed file by the compression unit and storing it in the storage device. In the first file conversion step, the first file data is generated by performing a file conversion process in which the compressed file generated by compression in the compression step is converted into one file in a predetermined time unit. Features.

  Further, the packet acquisition program further includes a hash key assigning step in which a hash key assigning unit assigns a hash key to the second file data generated by filing in the second file forming step and stores the hash key in a storage device. In the first file conversion step, the second file data to which the hash key is assigned in the hash key assignment step is converted into one file at a predetermined time unit, and the first file data is obtained. Is generated.

  A packet analysis system according to an embodiment of the present invention includes a packet acquisition unit that acquires a packet flowing through a predetermined connection point of a network, and a transmission that transmits the packet acquired by the packet acquisition unit to the storage device and stores the packet in the storage device A packet reading unit that reads a packet stored by the storage device, and a packet analysis unit that analyzes the packet read by the packet reading unit. Therefore, according to the packet analysis system according to the embodiment of the present invention, it is possible to store all information flowing through a predetermined connection point of the network, and to analyze the information.

  First, an example of the hardware configuration of the packet analysis system 1000 according to the embodiment will be described with reference to FIGS.

FIG. 1 is a diagram illustrating an example of an appearance of a packet analysis system 1000 according to the embodiment.
In FIG. 1, a packet analysis system 1000 includes a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B) 902, a mouse 903, a compact disk device (CDD) 905, a NAS (Network Attached Storage) 908, and a system unit 909. , Server A916 and server B917, which are connected by a cable.
Further, the packet analysis system 1000 is connected to the Internet 940 via a local area network (LAN) 942 and a gateway 941. Further, the server C 918 and the server D 919 are connected via a LAN 942 and an L (Layer) 2 switch 943.
Here, the CRT display device 901 is an example of a display device. The NAS 908 is an example of the storage device 200. Further, the server A 916 is an example of the packet acquisition device 100. The server B 917 is an example of the analysis apparatus 300. Further, the management terminal 400 may include a CRT display device 901, a K / B 902, a mouse 903, a CDD 905, and a system unit 909, for example. The management terminal 400 is not limited to this, and may be the system unit 909. The server C918 and the server D919 are servers such as a file server and a WEB server.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the packet acquisition device 100, the storage device 200, the analysis device 300, and the management terminal 400 in the embodiment.
In FIG. 2, a packet acquisition device 100, a storage device 200, an analysis device 300, and a management terminal 400 are computers, and include a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 is connected to a ROM 913, a RAM 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, an FDD (Flexible Disk) 904, a CDD 905, and a magnetic disk device 920 via a bus 912.
The RAM 914 is an example of a volatile memory. The ROM 913 and the magnetic disk device 920 are examples of a nonvolatile memory. These are examples of the storage device 982.
The communication board 915 is connected to the LAN 942 or the like. The communication board 915 is an example of the communication device 986.
The K / B 902, the mouse 903, and the like are examples of the input device 984.
The CPU 911 is an example of a processing device 980.

  The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores a program for executing a function described as “˜unit” in the description of the embodiment described below. The program is read and executed by the CPU 911.
In the file group 924, what is described as “encryption key” and “hash key” in the description of the embodiment described below is stored as “˜file”.
Also, the arrows in the flowcharts described in the following description of the embodiments mainly indicate data input / output, and the data for the data input / output is the magnetic disk device 920, FD, optical disk, CD, MD. (Mini disc), DVD (Digital Versatile Disk) and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “unit” in the description of the embodiment described below may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  In addition, a program that implements the embodiment described below may be stored using a recording device using another recording medium such as the magnetic disk device 920, FD, optical disk, CD, MD, DVD, or the like.

Embodiment 1 FIG.
Next, the first embodiment will be described. In the first embodiment, a packet analysis system 1000 that acquires, accumulates, and analyzes packets flowing through a predetermined connection point of a network will be described.

  The packet analysis system 1000 is used for, for example, investigating the range of influence of an information accident and the cause of the occurrence of an information accident through a network.

  Information accidents mediated by networks include, for example, personal information leaks, viruses, spam, attacks such as Dos (Denial of Services), attacks on third parties based on company systems, and attacks on bulletin board sites. Posting slander or unfavorable content, sending confidential information by e-mail, WEB mail, etc., private use of networks such as Internet auctions and dating sites, unjust charges from sites that were inadvertently accessed, falsely assuming the company name There are other attacks.

  Prior measures are taken to prevent such information accidents by systems such as Firewall, IDS, and content filters. However, even when the above system is introduced, it is difficult to completely prevent information accidents. Therefore, in the event of an information accident, post-action measures are taken to minimize the damage. Here, the damage is, for example, a loss of trust. As a post-measure, for example, it is conceivable to introduce software that acquires a log of the terminal.

An example of a response when an information accident occurs will be described with reference to FIG. FIG. 3 is a diagram illustrating an example of a response when an information accident occurs. Here, for example, it is assumed that software for acquiring a log of the terminal is introduced as a post countermeasure.
When an information accident occurs (1), it is necessary to investigate whether it is a fact, when, who, where, what, and how it is done, and to explain to customers, users, etc. Do not become (2). The quality of this explanation affects whether or not the loss of trust can be prevented. Therefore, for example, SE (System Engineer) is introduced in order to analyze the log acquired by the software for acquiring the log of the terminal and the investigation is performed over time (3). However, since logs are scattered and necessary information is not sufficiently accumulated in the logs (4), sufficient investigation may not be performed (5). Therefore, there are cases where a satisfactory explanation cannot be made (6). As a result, the trust of companies, organizations, etc. may be lost (7).

Here, the fact that necessary information is not sufficiently accumulated in the log will be described with reference to FIG. 4 as an example of a communication log of a normal mail server. FIG. 4 is a diagram illustrating an example of a communication log of a normal mail server.
As shown in FIG. 4, in a communication log of a normal mail server, communication date / time information, a From phrase, a To phrase, a Subject phrase, and the like are stored. Here, for example, when leakage of personal information occurs, it is necessary to investigate the specific content of the leaked personal information. However, personal information is usually written in the mail text or attached file. Therefore, it cannot be investigated with a communication log of a normal mail server as shown in FIG.

  Therefore, in the packet analysis system 1000 according to the first embodiment, as shown in FIG. 5, the entire communicated data including the mail text and the attached file is stored. FIG. 5 is an example of data stored in the packet analysis system 1000. In the packet analysis system 1000 according to the first embodiment, all the communicated data is stored and can be reproduced. Therefore, according to the packet analysis system 1000 according to the first embodiment, it is possible to investigate even when personal information is leaked from the mail text, the attached file, or other parts.

Next, an outline of the packet analysis system 1000 according to the first embodiment will be described based on FIGS. 6 and 7.
FIG. 6 is a diagram showing an outline of the operation of the packet analysis system 1000. The packet analysis system 1000 is connected to a predetermined connection point of the network. The packet analysis system 1000 acquires and accumulates packets flowing through the connection points. Then, the packet analysis system 1000 decodes the accumulated packets when necessary, reproduces the data, and performs search and display.
FIG. 7 is a diagram showing an outline of packet acquisition of the packet analysis system 1000. The packet analysis system 1000 is connected to a predetermined connection point of the network as described above. At the connection point, the packet analysis system 1000 is connected by, for example, an L2 switch 943. The packet analysis system 1000 uses a port mirror function such as a switch hub or a repeater hub to create a copy of the packet flowing on the network, and wire the copied packet to flow. The packet analysis system 1000 does not relay the packet or send the packet to the existing network, so that the existing system is not affected.

Next, connection points of the packet analysis system 1000 according to the first embodiment will be described with reference to FIGS.
FIG. 8 shows an example in which the packet analysis system 1000 is installed at a connection point with the Internet 940. By installing the packet analysis system 1000 at the connection point with the Internet 940, it is possible to monitor information leaks, outgoing information such as internal attacks from outside the company, private use of the network, attacks from outside the company, etc. . Also, most of the traffic here is SMTP (Simple Mail Transfer Protocol) and HTTP (HyperText Transfer Protocol).
FIG. 9 shows an example in which the packet analysis system 1000 is installed at a connection point to the shared server. By installing the packet analysis system 1000 at the connection point to the shared server, it is possible to monitor the taking out of information for accessing confidential information and unauthorized access to the server. The traffic here includes various information such as Windows (registered trademark) file sharing information, HTTP, SMTP, POP (Post Office Protocol), IMAP (Internet Message Access Protocol), and SQL (Structured Query Language). Protocol flows.

Next, a protocol analyzed by the packet analysis system 1000 according to the first embodiment will be described with reference to FIG. FIG. 10 is a diagram illustrating an example of a protocol analyzed by the packet analysis system 1000.
The packet analysis system 1000 corresponds to HTTP, SMTP, FTP (File Transfer Protocol) corresponding to the application layer, presentation layer, and session layer, POP, TCP (Transmission Control Protocol) corresponding to the transport layer, and the network layer. Analyzes IP (Internet Protocol), ETHERNET (registered trademark) corresponding to the data link layer, and the like. However, the present invention is not limited to this, and the packet analysis system 1000 also analyzes other protocols.

Next, the data flow of the packet analysis system 1000 will be described with reference to FIG. FIG. 11 is a diagram illustrating an example of a data flow of the packet analysis system 1000 according to the first embodiment.
Here, the packet analysis system 1000 includes a packet acquisition device 100, a storage device 200, and an analysis device 300. Here, it is assumed that the packet acquisition device 100, the storage device 200, and the analysis device 300 are separate cases.
The packet acquisition apparatus 100 is connected to the network at the connection point described with reference to FIGS. Here, the network to which the packet acquisition device 100 is connected is an example of the first network 10. The packet acquisition device 100 acquires a packet flowing through the connection point and temporarily stores it in the storage device 982. Then, the packet acquisition apparatus 100 collectively encrypts the packets in units of a fixed amount or a fixed time, and transmits them to the storage apparatus 200 as an archive.
The storage device 200 is connected to the packet acquisition device 100 through a dedicated line (an example of the second network 20). That is, the storage device 200 is connected by a connection line different from the network from which the packet acquisition device 100 acquires packets. The storage device 200 stores the encrypted packet received from the packet acquisition device 100 in the storage device 982 provided in the NAS 908 or the like. In addition, the storage device 200 is connected to a backup device or the like, and can back up archive data stored in the storage device 982.
The analysis device 300 is connected to the storage device 200 via a dedicated line (an example of the third network 30). That is, the analysis apparatus 300 is connected by a connection line that is different from the network from which the packet acquisition apparatus 100 acquires packets and the connection line to which the packet acquisition apparatus 100 and the storage apparatus 200 are connected. The analysis device 300 reads the archive data stored in the storage device 982 by the storage device 200. Next, the analysis device 300 decompresses the archive data and generates a packet. Next, the analysis device 300 reproduces the communication data by analyzing and decoding the packet. The analysis device 300 stores the reproduced communication data in the storage device 982 and sets it as a search target when conducting an investigation.
The packet analysis system 1000 may further include a management terminal 400.
The management terminal 400 is connected to the packet acquisition device 100, the storage device 200, and the analysis device 300. The management terminal 400 is different from a network in which the packet acquisition device 100 acquires packets, a connection line that connects the packet acquisition device 100 and the storage device 200, and a connection line that connects the storage device 200 and the analysis device 300. They are connected by a connection line (an example of the fourth network 40). The management terminal 400 manages the packet acquisition device 100, the storage device 200, and the analysis device 300. In addition, the management terminal 400 searches the reproduced communication data stored in the storage device 982 by the analysis device 300 and browses the data using a WEB browser or the like. For example, the packet analysis system 1000 may be able to browse the reproduced communication data stored in the storage device 982 by the analysis device 300 only at the management terminal 400.

  Next, functions of the packet analysis system 1000 according to the first exemplary embodiment will be described with reference to FIG. FIG. 12 is a functional block diagram illustrating functions of the packet analysis system 1000 according to the first embodiment.

  The packet analysis system 1000 includes a packet acquisition device 100, a storage device 200, an analysis device 300, and a management terminal 400. The packet acquisition device 100 is connected to a connection point of the first network 10. The packet acquisition device 100 and the storage device 200 are connected by a connection line (an example of the second network 20). Furthermore, the storage device 200 and the analysis device 300 are connected by a connection line (an example of the third network 30). Furthermore, the management terminal 400 is connected to the packet acquisition device 100, the storage device 200, and the analysis device 300 by a connection line (an example of the fourth network 40).

The packet acquisition device 100 includes a communication unit 110, an information addition unit 120, a filing unit 130, a storage unit 140, a processing device 980, a storage device 982, and a communication device 986.
The communication unit 110 includes a packet acquisition unit 112 and a transmission unit 114. The packet acquisition unit 112 acquires a packet flowing through the connection point via the communication device 986. The packet acquisition unit 112 may acquire all the packets flowing through the connection point, or may acquire only the predetermined protocol. The transmission unit 114 transmits the packet acquired by the packet acquisition unit 112 to the storage device 200 via the communication device 986 and stores the packet in the storage device 200. The transmission unit 114 may transmit the data after the following functions included in the packet acquisition device 100 have been processed to the storage device 200 and store the data in the storage device 200.
The information giving unit 120 includes a hash key giving unit 122 and a time giving unit 124. The hash key assigning unit 122 assigns a hash key to the packet acquired by the packet acquiring unit 112 and stores it in the storage device 982. For example, the hash key assigning unit 122 may assign a hash key to the second file data after the second file forming unit 134 (to be described later) converts the file. The hash key assigning unit 122 assigns a hash key to the input data, and the input data may be anything. The time giving unit 124 gives the packet acquisition time to the packet acquired by the packet acquisition unit 112 and stores it in the storage device 982. The time giving unit 124 gives time to the input data, and the input data may be anything.
The filing unit 130 includes a first filing unit 132, a second filing unit 134, an encryption unit 136, and a compression unit 138. The first filing unit 132 performs filing processing of the packet acquired by the packet acquisition unit 112 as one file in a predetermined time unit, generates first file data, and stores the first file data in the storage device 982. Here, the first filing unit 132 performs, for example, a filing process in which second file data generated by filing processing by the second filing unit 134 (to be described later) is converted into one file at a predetermined time unit. First file data is generated. Here, the predetermined time is, for example, one minute. The first filing unit 132 performs filing processing of input data as a single file in a predetermined time unit, and generates first file data. The input data may be anything. . Furthermore, the first filing unit 132 may perform a compression process in accordance with filing. The second filing unit 134 performs filing processing with the packet as one file based on the capacity of the buffer memory in which the temporary storage unit 142, which will be described later, stores the packet, and generates second file data to store the data 982. For example, when the capacity of the buffer memory becomes full, the second filing unit 134 performs filing processing with the stored packet as one file, and generates second file data. Further, the second filing unit 134 performs a filing process in which the input data is converted into one file based on the capacity of the buffer memory, and generates the second file data. The input data may be anything. Absent. The encryption unit 136 encrypts the packet acquired by the packet acquisition unit 112 and stores it in the storage device 982. The encryption unit 136 may encrypt the first file data or the second file data that has been filed by the first file forming unit 132 or the second file forming unit 134 and store the encrypted data in the storage device 982. The encryption unit 136 encrypts input data, and the input data may be anything. The compressing unit 138 compresses the second file data generated by the file processing by the second filing unit 134, generates a compressed file, and stores the compressed file in the storage device 982. The compression unit 138 compresses input data, and the input data may be anything.
The storage unit 140 includes a temporary storage unit 142. The temporary storage unit 142 temporarily stores the packet acquired by the packet acquisition unit 112 in the buffer memory. The buffer memory is an example of the storage device 982. In the above description, each function included in the packet acquisition device 100 stores the product in the storage device 982, but the present invention is not limited to this, and the temporary storage unit 142 generates data generated by each function included in the packet acquisition device 100. An object may be stored in the storage device 982.

The storage device 200 includes a receiving unit 210, a packet storage unit 220, a processing device 980, a storage device 982, and a communication device 986.
The reception unit 210 receives the data transmitted from the transmission unit 114 via the communication device 986.
The packet storage unit 220 stores the data received by the reception unit 210 in the storage device 982.

The analysis device 300 includes a packet reading unit 310, a decoding unit 320, a packet analysis unit 330, a processing device 980, a storage device 982, an input device 984, and a communication device 986.
The packet reading unit 310 reads the packet stored in the packet storage unit 220 via the communication device 986. That is, the packet reading unit 310 reads the data after processing by each function of the packet acquisition device 100 from the storage device 200 and stores it in the storage device 982.
When the data read by the packet reading unit 310 is encrypted, the decryption unit 320 decrypts the packet that is the encrypted data and stores the decrypted packet in the storage device 982.
The packet analysis unit 330 analyzes the packet read by the packet reading unit 310 by the processing device 980. When the data read by the packet reading unit 310 is encrypted, the packet analysis unit 330 analyzes the data decrypted by the decryption unit 320. Here, analyzing means, for example, reproducing data stored as a packet as communication data. In other words, analyzing means a series of processes for reproducing data cut in packet units into original communication data. Accordingly, data whose contents are not known in a state where it is cut in units of packets becomes data whose contents can be determined by analysis. The packet analysis unit 330 stores the analyzed data in the storage device 982.

  The management terminal 400 manages the packet acquisition device 100, the storage device 200, and the analysis device 300. In addition, the management terminal 400 searches the reproduced communication data stored in the storage device 982 by the analysis device 300 and displays the data on a display device using a WEB browser or the like.

  Next, the operation of the packet analysis system 1000 according to the first exemplary embodiment will be described based on FIG. FIG. 13 is a flowchart of the operation of the packet analysis system 1000 according to the first embodiment.

  First, in the packet acquisition process executed by the packet acquisition device 100, first, in the packet acquisition step (S101), the packet acquisition unit 112 acquires a packet flowing through the connection point to which the packet acquisition device 100 is connected. Temporary storage unit 142 stores the acquired packet in storage device 982 (temporary storage step). Next, in the time giving step (S102), the time giving unit 124 gives the packet acquisition time to the packet. Next, in the second filing step (S103), the second filing unit 134 performs a filing process for collecting packets into one file based on the capacity of the buffer memory, and generates second file data. Next, in the hash key assigning step (S104), the hash key assigning unit 122 assigns a hash key to the second file data. Next, in the compression step (S105), the compression unit 138 compresses the second file data to which the hash key is assigned, and generates a compressed file. Next, in the encryption step (S106), the encryption unit 136 encrypts the compressed file. Next, in the first filing step (S107), the first filing unit 132 performs a filing process for further combining the encrypted data into one file in a predetermined time unit, and the first file data is converted into the first file data. Generate. The first filing unit 132 may perform compression processing together with filing. In the transmission step (S108), the transmission unit 114 transmits the first file data to the storage device 200.

  Next, in the storage process executed by the storage device 200, first, in the reception step (S109), the reception unit 210 receives the first file data transmitted by the transmission unit 114. In the packet storage step (S110), the packet storage unit 220 stores the received first file data in the storage device 982 provided in the NAS 908 or the like.

  Next, in the analysis process executed by the analysis device 300, first, in the packet reading step (S111), the packet reading unit 310 reads the first file data stored in the storage device 982 by the packet storage unit 220. Next, in the decrypting step (S112), the decrypting unit 320 extracts a file from the read first file data and decrypts the encrypted data. Next, the decrypted file is decompressed. In the analysis step (S113), the packet analysis unit 330 analyzes the decoded packet.

In the packet acquisition process, the processes from (S102) to (S107) are not limited to the above order, and may be executed in any order. For example, (S102) to (S107) may be in the order of (S102), (S103), (S107), (S104), (S106), and (S105).
However, according to the above order, the hash key assigning unit 122 assigns a hash key to the second file data. Therefore, a hash key can be assigned to a small unit of data. Therefore, data alteration can be confirmed in small units. Further, the hash key assigning unit 122 assigns a hash key to the data before the processing is performed on the packet acquired by the packet acquiring unit 112. Therefore, there is no possibility of falsification due to internal processing of the packet acquisition device 100. That is, the hash key assigning unit 122 may assign a hash key to the packet acquired by the packet acquiring unit 112.
Further, the compression unit 138 compresses the data before being encrypted. As a result, the compression rate is higher than the compression after encryption, and the compression effect can be expected.

  According to the packet analysis system 1000 according to the first embodiment, it is possible to acquire, store, and analyze all data flowing through a predetermined connection point or based on a predetermined condition. Therefore, according to the packet analysis system 1000 according to the first embodiment, it is possible to obtain data necessary and sufficient for investigation when an information accident occurs. For example, the packet analysis system 1000 according to the first embodiment can reproduce not only normal mail but also HTML mail.

  Further, according to the packet analysis system 1000 according to the first exemplary embodiment, the presence / absence of falsification can be verified later by assigning a hash key to the data acquired by the hash key assigning unit 122. Furthermore, according to the packet analysis system 1000 according to the first exemplary embodiment, it is possible to indicate that data existed at the time by giving the time when the time giving unit 124 acquired the packet to the packet. Therefore, according to the packet analysis system 1000 according to the first embodiment, since the originality and the time are guaranteed, the stored data can be managed by a method that is as reliable as possible as evidence in the courtroom. That is, the packet analysis system 1000 according to the first embodiment can be used as computer forensics, and is a so-called forensic server or forensic system.

  Further, according to the packet analysis system 1000 according to the first exemplary embodiment, the packet acquisition device 100, the storage device 200, and the analysis device 300 are separated from each other. Therefore, the existing NAS 908 or the like can be used for the storage device 200 without special preparation. Therefore, according to the packet analysis system 1000 according to the first exemplary embodiment, cost can be saved as compared with a case where all functions are provided in one housing. In addition, the storage capacity can be easily expanded. In addition, it becomes easy to store a large amount of data, and data can be stored for a long period of time. Therefore, according to the packet analysis system 1000 according to the first exemplary embodiment, it is possible to conduct a retrospective investigation such as months or years after the accident is detected in the post-measures for the information accident.

Further, according to the packet analysis system 1000 according to the first embodiment, the encryption unit 136 encrypts data, and the transmission unit 114 transmits the encrypted data. Therefore, according to the packet analysis system 1000 according to the first exemplary embodiment, the content of data is kept secret even when the communication between the packet acquisition device 100 and the storage device 200 is intercepted. Furthermore, in Embodiment 1, since the connection line between the packet acquisition device 100 and the storage device 200 is a dedicated line, it is possible to prevent the communication between the packet acquisition device 100 and the storage device 200 from being intercepted. .
Here, although the packet analysis system 1000 according to the first embodiment is used for countermeasures against information accidents, etc., it is a system that records information including confidential information, so the packet analysis system 1000 according to the first embodiment. It can be a source of information leakage. However, the storage device 200 stores the encrypted data. Therefore, even when data in the storage device 200 is taken out, the contents cannot be browsed illegally. Therefore, the packet analysis system 1000 according to the first embodiment can be prevented from becoming a source of information leakage.
Furthermore, an encryption key used for encryption may be stored in a USB (Universal Serial Bus) key. In this case, data retention (deletion) can be easily and reliably performed by deleting the USB key.
Further, the encryption process can be performed by a common key encryption method and a public key encryption method. As described above, when the encryption and decryption keys are stored in the USB key and processing is performed, the processing performance is superior to the case where the public key encryption method is used.

Embodiment 2. FIG.
Next, a second embodiment will be described. In the first embodiment, the packet analysis system 1000 is configured such that the packet acquisition device 100, the storage device 200, and the analysis device 300 are separated from each other. In the second embodiment, another method of dividing the packet analysis system 1000 will be described.

An example of how to divide the casing of the packet analysis system 1000 according to the second exemplary embodiment will be described with reference to FIGS. 14, 15, and 16.
FIG. 14 shows an example in which the packet acquisition device 100 is a first housing, and the storage device 200 and the analysis device 300 are second housings. FIG. 15 shows an example in which the packet acquisition device 100 and the storage device 200 are the first housing and the analysis device 300 is the second housing. FIG. 16 shows an example in which the analysis device 300 is divided into a reproduction device 350 and a search device 360, and the case includes four packets acquisition device 100, storage device 200, reproduction device 350, and search device 360. .
It is not necessarily limited to the above-described method of dividing the case, and other methods of dividing the case may be used.

  According to the packet analysis system 1000 according to the second exemplary embodiment, since the casing is divided, facilities can be easily enhanced. In other words, according to the packet analysis system 1000 according to the second embodiment, for example, when there is a possibility of increasing the storage capacity, only the storage device 200 is enhanced by using the storage device 200 as a separate housing. Is possible. Further, when it is desired to acquire packets from a plurality of locations, it is possible to make only a plurality of packet acquisition devices 100 by using the packet acquisition device 100 as a separate housing.

  Further, according to the packet analysis system 1000 according to the second embodiment, as shown in FIG. 16, when the analysis device 300 is divided into a reproduction device 350 and a search device 360, the search processing is enhanced. Can have a plurality of search devices 360 alone.

  Therefore, according to the packet analysis system 1000 according to the second embodiment, it is possible to increase facilities and the like at a reduced cost.

Embodiment 3 FIG.
Next, Embodiment 3 will be described. In Embodiment 3, a packet analysis system 1000 including a plurality of packet acquisition devices 100 will be described.

The outline of the packet analysis system 1000 according to the third embodiment will be described with reference to FIG. FIG. 17 is a diagram illustrating an outline of a packet analysis system 1000 including a plurality of packet acquisition devices 100 according to the third embodiment.
17, the packet analysis system 1000 includes a packet acquisition device A100A connected to the segment 1 and a packet acquisition device B100B connected to the segment 2. In addition, the packet analysis system 1000 includes a storage device 200 and an analysis device 300.

By connecting the packet acquisition device A100A and the packet acquisition device B100B to different segments, packets flowing through each segment can be acquired. For example, as shown in FIGS. 8 and 9, a packet passing through both connection points is acquired by connecting the packet acquisition device 100 to each of a connection point to the Internet 940 and a connection point to the shared server. be able to. That is, when there are a plurality of packet acquisition devices 100, data passing through each connection point can be acquired by connecting each packet acquisition device 100 to a different connection point.
Further, the packet analysis system 1000 according to the third exemplary embodiment stores the packet acquired by each packet acquisition device 100 by adding an identifier indicating the packet acquisition device 100 that acquired the packet to the storage device 200. It is possible to determine which connection point the information passes through.

  Next, functions of the packet analysis system 1000 according to the third exemplary embodiment will be described with reference to FIG. FIG. 18 is a functional block diagram illustrating functions of the packet analysis system 1000 according to the third embodiment. Here, only parts different from the functions of the packet analysis system 1000 according to the first embodiment will be described.

  The information adding unit 120 of the packet acquisition apparatus 100 according to the third embodiment further includes an identifier adding unit 126. The identifier assigning unit 126 assigns an identifier for identifying the packet obtaining device 100 to the packet obtained by the packet obtaining unit 112 and stores it in the storage device 982. In other words, the identifier assigning unit 126 assigns the identifier of the packet acquisition device 100 including the packet acquisition unit 112 to the packet acquired by the packet acquisition unit 112, which packet acquisition device 100 has the information stored in the storage device 200. It is possible to determine whether or not it is acquired. Therefore, in this case, it is possible to determine which connection point the information stored in the storage device 200 passes through. The identifier assigning unit 126 assigns, for example, a MAC address as an identifier.

  Next, the operation of the packet analysis system 1000 according to the third exemplary embodiment will be described based on FIG. FIG. 19 is a flowchart of the operation of the packet analysis system 1000 according to the third embodiment. Here, only the parts different from the operation of the packet analysis system 1000 according to the third embodiment will be described.

(S201) to (S203) are the same as (S101) to (S103) in the first embodiment, respectively.
In the identifier assigning step (S204), the identifier assigning unit 126 assigns an identifier for identifying the packet obtaining device 100 to the packet obtained by the packet obtaining unit 112. Here, the identifier assigning unit 126 assigns an identifier to the second file data.
(S205) to (S214) are the same as (S104) to (S113) in the first embodiment, respectively.

  Here, the identifier assigning step (S204) is not limited to being executed in the above order, but may be in another order such as being executed after (S208).

  According to the packet analysis system 1000 according to the third exemplary embodiment, packets flowing through a plurality of connection points can be acquired and stored in one storage device 200. Therefore, when it is desired to store information flowing through a new connection point, it can be dealt with by adding only the packet acquisition device 100. Also, dividing the packet acquisition device 100 for each segment reduces the load on the packet acquisition device 100.

  Further, according to the packet analysis system 1000 according to the third exemplary embodiment, the identifier of the packet acquisition device 100 is assigned to the acquired packet. Therefore, when performing the survey, the target data is narrowed down by the connection point to be investigated. be able to.

Embodiment 4 FIG.
Next, a fourth embodiment will be described. In the fourth embodiment, a description will be given of a packet analysis system 1000 that acquires a log of operations such as the management terminal 400 searching for a packet.

  Based on FIG. 20, functions of the packet analysis system 1000 according to the fourth exemplary embodiment will be described. FIG. 20 is a functional block diagram illustrating functions of the packet analysis system 1000 according to the fourth embodiment. Here, only parts different from the functions of the packet analysis system 1000 according to the first embodiment will be described.

  The analysis apparatus 300 further includes a log acquisition unit 340. The log acquisition unit 340 acquires an operation log and stores the operation log in the storage device 982 when an instruction to access the packet analyzed by the packet analysis unit 330 is given from the management terminal 400. The log acquisition unit 340 may also acquire a log for operations other than browsing data for accessing the packet analyzed by the packet analysis unit 330.

  The packet analysis system 1000 stores information for countermeasures against information accidents. However, since the packet analysis system 1000 stores a large amount of information, there is a possibility that an information accident may occur using the data of the packet analysis system 1000. Therefore, according to the packet analysis system 1000 according to the fourth exemplary embodiment, the access to the data of the packet analysis system 1000 is also investigated by acquiring the log of the access to the data of the packet analysis system 1000. be able to.

  Furthermore, the packet analysis system 1000 may include an authority grant unit that grants authority to a user who uses the packet analysis system 1000. The packet analysis system 1000 includes, for example, a system administrator authority for setting a system and assigning authority, a data browsing authority for browsing a packet analyzed by the packet analysis unit 330, and a log for investigating a log acquired by the log acquisition unit 340. It has authority such as audit authority, and the authority granting part assigns it to each user. In this case, for example, it is possible to further enhance security by giving only one authority to one user.

  When the storage device 982 of the storage device 200 is full, the packet analysis system 1000 according to the above embodiment may perform a disk rotation that deletes old data and stores new data. .

  Furthermore, although the packet analysis system 1000 according to the above embodiment manages data via a network, settings such as stopping services other than necessary services may be performed. The operation from the management terminal 400 may be encrypted communication using HTTPS (Hypertext Transfer Protocol Security).

  Further, by providing stealth to the packet acquisition port of the packet acquisition device 100, the presence may be concealed without reacting to a server scan or a host scan.

  Further, the analysis device 300 of the packet analysis system 1000 according to the above embodiment uses the mail (SMTP and POP) data stored in the storage device 200 as, for example, a period, a client IP address, a client MAC address, and a server IP. Search may be made by address, server MAC address, server port, FROM clause, TO clause, RECEIVED clause, MAIL FROM clause, RCPTTO clause, CC clause, SUBJECT clause, attached file name, mail size, and the like. Further, the analysis device 300 of the packet analysis system 1000 according to the above-described embodiment may be configured to perform full-text search using free keywords for the SMTP header, the text, and the attached file. As for the attached file, the contents of the attached file may be searched.

  Furthermore, the analysis apparatus 300 of the packet analysis system 1000 according to the above-described embodiment may be configured to reproduce data not only for WEB data communicated by HTTP but also for WEB data communicated by ZIP compression. Further, when data is uploaded by POST, GET, etc., these may be reproduced. That is, in this case, file uploading can also be reproduced, so that the above-described transmission of data to a WEB mail or online storage can also be reproduced.

  Further, the analysis device 300 of the packet analysis system 1000 according to the above embodiment uses, for example, the client's IP address, the client's MAC address, the server's IP address, the WEB (HTTP) data stored in the storage device 200, The search may be made based on the server MAC address, server port, URL (Uniform Resource Locator), size, and the like. Further, the analysis device 300 of the packet analysis system 1000 according to the above-described embodiment may be configured to perform a full-text search using free keywords for the HTTP header, the body text, and the attached file. As for the attached file, the contents of the attached file may be searched.

  Further, the analysis apparatus 300 of the packet analysis system 1000 according to the above embodiment can reproduce the FTP communication by TCP / IP. That is, the analysis apparatus 300 of the packet analysis system 1000 according to the above embodiment can also reproduce the transferred file. In addition, the analysis device 300 of the packet analysis system 1000 according to the above embodiment uses, for example, the period, the client IP address, the client MAC address, the server IP address, and the server MAC as the FTP data stored in the storage device 200. It may be possible to search by address, server port, size, and the like. Moreover, the analysis apparatus 300 of the packet analysis system 1000 according to the above embodiment may be configured to be able to perform a full text search using free keywords for FTP communication. Furthermore, the analysis device 300 of the packet analysis system 1000 according to the above embodiment may determine the character code when searching.

  Furthermore, the analysis apparatus 300 of the packet analysis system 1000 according to the above embodiment may perform decoding into a TCP stream. Moreover, you may enable it to confirm the content of flat communication, such as TELNET. Furthermore, in communication using a plurality of sessions such as FTP, management may be performed for each individual session. Further, encrypted communication such as HTTPS may allow browsing of communication date / time, client / server IP address, port, MAC address, and the like. Further, in the case of encrypted communication such as HTTPS, since the body is encrypted, it may or may not be possible to determine the content even if data is recorded and displayed. Furthermore, a high-speed search can be realized by using an optimized database. The search may use a high-speed, large-volume search process used in the Internet search such as the n-gram method.

It is the figure which showed an example of the external appearance of the packet analysis system 1000 concerning embodiment. It is a figure which shows an example of the hardware constitutions of the packet acquisition apparatus 100 in the embodiment, the storage apparatus 200, the analysis apparatus 300, and the management terminal 400. It is a figure which shows an example of a response | compatibility when an information accident occurs. It is a figure which shows an example of the communication log of a normal mail server. It is an example of the data which the packet analysis system 1000 memorize | stores. 2 is a diagram showing an outline of operation of a packet analysis system 1000. FIG. It is a figure which shows the outline | summary of the packet acquisition of the packet analysis system 1000. FIG. This is an example in which the packet analysis system 1000 is installed at a connection point with the Internet 940. This is an example in which the packet analysis system 1000 is installed at a connection point to a shared server. 2 is a diagram illustrating an example of a protocol analyzed by a packet analysis system 1000. FIG. It is a figure which shows an example of the data flow of the packet analysis system 1000 concerning Embodiment 1. FIG. FIG. 2 is a functional block diagram showing functions of a packet analysis system 1000 according to the first exemplary embodiment. 3 is a flowchart showing an operation of the packet analysis system 1000 according to the first exemplary embodiment. In this example, the packet acquisition device 100 is a first housing, and the storage device 200 and the analysis device 300 are second housings. In this example, the packet acquisition device 100 and the storage device 200 are the first housing, and the analysis device 300 is the second housing. In this example, the packet acquisition device 100, the storage device 200, and the analysis device 300 are divided into a reproduction device 350 and a search device 360. It is a figure which shows the outline | summary of the packet analysis system 1000 provided with the some packet acquisition apparatus 100 which is the packet analysis system 1000 concerning Embodiment 3. FIG. FIG. 10 is a functional block diagram illustrating functions of a packet analysis system 1000 according to a third embodiment. 10 is a flowchart showing an operation of the packet analysis system 1000 according to the third exemplary embodiment. FIG. 10 is a functional block diagram illustrating functions of a packet analysis system 1000 according to a fourth embodiment.

Explanation of symbols

  10 first network, 20 second network, 30 third network, 40 fourth network, 100 packet acquisition device, 110 communication unit, 112 packet acquisition unit, 114 transmission unit, 120 information adding unit, 122 hash key adding unit, 124 Time giving unit, 126 identifier giving unit, 130 filing unit, 132 first filing unit, 134 second filing unit, 136 encryption unit, 138 compression unit, 140 storage unit, 142 temporary storage unit, 200 storage device, 210 reception unit, 220 packet storage unit, 300 analysis device, 310 packet reading unit, 320 decoding unit, 330 packet analysis unit, 340 log acquisition unit, 400 management terminal, 901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 908 N S, 909 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 916 server A, 917 server B, 918 server C, 919 server D, 920 magnetic disk unit, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 FAX machine, 940 Internet, 941 gateway, 942 LAN, 980 processing device, 982 storage device, 984 input device, 986 communication device.

Claims (16)

In a packet analysis system that acquires packets flowing through the network and analyzes the packets,
Comprising Rutotomoni connected to a predetermined connection points of the network, a storage device and a packet acquisition device connected via a connection line, the analyzer and which is connected via a storage device and the connection line,
The packet acquisition device
A packet acquisition unit that get the packets flowing through the connection point,
A time giving unit for giving the packet acquisition time to the packet acquired by the packet acquisition unit;
A second filing unit for generating a second file data by performing a filing process in which the time giving unit assigns the packet to which the time is given to one file in a predetermined size unit;
A hash key assigning unit for assigning a hash key to the second file data generated by the second file generating unit by filing;
A compression unit that compresses the second file data to which the hash key assigning unit assigns the hash key;
An encryption unit for encrypting the second file data compressed by the compression unit;
A first filing unit that performs filing processing of the second file data encrypted by the encryption unit as one file at a predetermined time unit, and generates first file data;
The first filing unit sends the first file data generated by processing a file of the storage device, and a transmission unit to be stored in the storage device,
The analysis device
A packet reading unit for reading the first file data stored by the storage device;
Packet analysis system characterized Rukoto a packet analysis unit for the packet reading unit analyzes the first file data I read. The packet acquisition device is connected to a predetermined connection point of the first network,
The transmission unit transmits the packet acquired by the packet acquisition unit to the storage device via the second network,
The packet analysis system according to claim 1, wherein the packet reading unit reads a packet stored by the storage device via a third network. The packet analysis system further includes:
It has a management terminal that gives instructions to the acquisition device, storage device, and analysis device,
3. The packet analysis system according to claim 2, wherein the management terminal, the packet acquisition device, the storage device, and the analysis device are connected by a fourth network. The analysis device further includes:
4. A log acquisition unit that acquires an operation log and stores it in a storage device when an instruction to access a packet analyzed by the packet analysis unit is given from the management terminal. Packet analysis system. The packet analysis system includes a plurality of packet acquisition devices,
The packet analysis system according to claim 1, wherein each of the plurality of packet acquisition devices is connected to a different connection point. The packet acquisition device further includes:
A packet the packet acquisition unit has acquired, with the identifier assignment part you grant identifiers identifying the packet acquisition device,
The second filing unit performs a filing process in which the time assigning unit assigns the time and the identifier assigning unit assigns the identifier to one file in a predetermined size unit. The packet analysis system according to claim 5 , wherein the packet analysis system is generated . The packet analysis system according to claim 6 , wherein the identifier assigning unit assigns a MAC (Media Access Control) address as an identifier. The packet acquisition device further includes:
A temporary storage unit that temporarily stores the packet acquired by the packet acquisition unit in a buffer memory;
2. The packet analysis system according to claim 1, wherein the second filing unit performs a filing process using a packet as one file in units of the capacity of the buffer memory to generate second file data. The packet analysis system according to claim 1, wherein the first file conversion unit includes identification information that uniquely indicates a packet acquisition device in a file name of the generated first file data. In the packet analysis program of the packet analysis system that acquires packets flowing through the network and analyzes the packets,
It is connected to the predetermined connection points in the network Rutotomoni, a packet acquisition program of the packet acquisition device connected via the storage device and the connection line, and an analysis program for analyzing device connected via the connecting line and the storage device Prepared,
The packet acquisition program
A packet acquisition step get the packets flowing through the connection point,
A time granting step for giving the packet acquisition time to the packet acquired in the packet acquisition step;
A second file forming step for generating a second file data by performing a filing process in which the packet to which time is given in the time giving step is made into one file in a predetermined size unit;
A hash key assigning step for assigning a hash key to the second file data generated by filing in the second file creation step;
A compression step of compressing the second file data to which the hash key is assigned in the hash key assignment step;
An encryption step for encrypting the second file data compressed in the compression step;
A first file conversion step for generating a first file data by performing a file conversion process in which the second file data encrypted in the encryption step is converted into a single file in a predetermined time unit;
Sends the first file data generated by processing filed in the first file of the step to the storage device, to execute a transmission step of storing in the storage device to the computer,
The analysis program is
A packet reading step for reading the first file data stored by the storage device;
A packet analysis program for causing a computer to execute a packet analysis step of analyzing the first file data read in the packet reading step. The packet acquisition program further includes:
Causing the computer to execute an identifier giving step for giving an identifier for identifying the packet acquisition device to the packet acquired in the packet acquisition step;
In the second filing step, a filing process is performed in which the time is given in the time giving step, the packet to which the identifier is given in the identifier giving step is made into one file in a predetermined size unit, and the second file data is The packet analysis program according to claim 10 , wherein the packet analysis program is generated . 12. The packet analysis program according to claim 11 , wherein, in the identifier assigning step, a MAC (Media Access Control) address is assigned as an identifier. The packet acquisition program further includes:
A temporary storage step of temporarily storing the packet acquired in the packet acquisition step in a buffer memory;
11. The packet analysis program according to claim 10, wherein, in the second file creation step, file processing is performed with a packet as one file for each capacity unit of the buffer memory to generate second file data. In the first file creation step, identification information uniquely indicating the packet acquisition device is included in the file name of the generated first file data.
The packet analysis program according to claim 13. In the packet analysis method of the packet analysis system that acquires packets flowing through the network and analyzes the packets,
Is connected to the predetermined connection points in the network Rutotomoni, a storage device and a packet acquisition processing packet acquisition unit executes connected via a connection line, the analysis device connected via the storage device and the connection line to be executed With analysis processing,
The packet acquisition process
A packet acquisition step of acquiring a packet flowing through the connection point;
A time granting step for giving the packet acquisition time to the packet acquired in the packet acquisition step;
A second file forming step for generating a second file data by performing a filing process in which the packet to which time is given in the time giving step is made into one file in a predetermined size unit;
A hash key assigning step for assigning a hash key to the second file data generated by filing in the second file creation step;
A compression step of compressing the second file data to which the hash key is assigned in the hash key assignment step;
An encryption step for encrypting the second file data compressed in the compression step;
A first file conversion step for generating a first file data by performing a file conversion process in which the second file data encrypted in the encryption step is converted into a single file in a predetermined time unit;
Sends the first file data generated by processing filed in the first file of the step to the storage device, and a transmission step of storing in the storage device,
The analysis process
A packet reading step for reading the first file data stored by the storage device;
Packet analysis method comprising Rukoto a packet analysis step of analyzing the first file data I read in the packet reading step. A packet acquisition device that is connected to a predetermined connection point of the network, is connected to the storage device via a connection line, and acquires a packet flowing through the predetermined connection point of the network,
A packet acquisition unit for acquiring a packet flowing through the connection point;
A time giving unit for giving the packet acquisition time to the packet acquired by the packet acquisition unit;
A second filing unit for generating a second file data by performing a filing process in which the time giving unit assigns the packet to which the time is given to one file in a predetermined size unit;
A hash key assigning unit for assigning a hash key to the second file data generated by the second file generating unit by filing;
A compression unit that compresses the second file data to which the hash key assigning unit assigns the hash key;
An encryption unit for encrypting the second file data compressed by the compression unit;
A first filing unit that performs filing processing of the second file data encrypted by the encryption unit as one file at a predetermined time unit, and generates first file data;
A transmission unit configured to transmit the first file data generated by the first filing unit to the storage device and store the first file data in the storage device;
A packet acquisition apparatus comprising:

Images