JP4768674B2 - Worm-infected host identification method and worm-infected host identification system - Google Patents

Description

  The present invention relates to a worm-infected host identification method and a worm-infected host identification system, and more particularly to a worm-infected host identification method and a worm-infected host identification system for identifying a worm-infected host using data obtained from flow measurement.

In recent years, the spread of worm infections has become a problem on the Internet. A host infected with the worm sends a port scan packet to a randomly or sequentially generated address in order to find the next vulnerable host to infect.
Among them, a host infected with a worm called the Bandwidth limited type is characterized by the fact that infection is explosively expanded because port scanning is performed using the available network transmission bandwidth and the CPU capacity of the host as much as possible. For example, in the case of Slammer, which is a typical Bandwidth limited worm, it is reported that the infected host performed an average of 4000 port scans per second, and the infection spread to the entire network in only about 10 minutes. .
Up to now, new worms can be countered by developing patches for repairing vulnerabilities in OS and application software and vaccine programs for removing infected programs and distributing them to general users. Has been taken.
However, worms with a high infection rate, such as the Bandwidth limited type, are not sufficient because such infections spread to the majority of the network before patches and vaccines are developed.

For worms with a high infection rate such as the Bandwidth limited type, the appearance of the worm is detected as early as possible, the worm-infected host is automatically identified, and the packet transmission rate of the infected host is regulated, etc. It is important to limit the rate at which infection spreads and allow time for patches and vaccines to be developed.
On the other hand, as a method for identifying a worm-infected host, the inventors previously proposed a method for identifying a host that generates a large amount of flow in a short time as a large flow generation host (Superspreader). (See Non-Patent Document 1 below)
The method described in this Non-Patent Document 1 uses a large number of hosts whose threshold number m ^* is equal to or greater than the number of flows m observed at a measurement point within an arbitrary measurement period Φ having a length of φ seconds. It is defined as a flow generation host and explicitly gives a probability H ^* that a host with m = m ^* is specified.
By using this method, it is possible to specify the mass flow generation host with high accuracy by making the most of the limited memory.

As prior art documents related to the invention of the present application, there are the following.
Kamiyama, Mori, Kawahara, “Identification of Mass Flow Generation Host Using Flow Sampling”, IEICE Technical Report IN2005-184.

The mass flow generation host includes not only a worm-infected host but also a host that is a normal host such as a DNS server but generates a large number of flows. Therefore, if a restriction process such as rate restriction is simply performed on the specified mass flow generation host, even a normal host is restricted. In particular, if restriction processing is performed on a host that plays an important role such as a DNS server, there is a possibility that normal operation of the Internet may be hindered. Therefore, it is necessary to carefully perform restriction processing on a specified host.
On the other hand, a host that generates a large amount of flow with a normal host tends to become a mass flow generation host in a plurality of consecutive measurement periods.
The present invention has been made to solve the above-described problems of the prior art, and the object of the invention is to specify the number of flows generated per unit time specified using only statistical data obtained by flow sampling. The object is to provide a worm-infected host identification method and a worm-infected host identification system that narrow down worm-infected hosts from among a large number of flow generation hosts that exceed a threshold.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
In order to achieve the above-described object, the present invention specifies a mass flow generation host in which the number of flows generated per unit time is equal to or greater than a threshold, using only statistical data obtained by flow sampling. A worm-infected host identification method that uses a white list to narrow down worm-infected hosts from a large number of flow generation hosts, and defines the normal state and the worm appearance state as the network state. All the large-volume flow generation hosts that have been stored in the white list, and the white list is not updated during the worm appearance state, and in the worm appearance state, Compared to the created whitelist, only if it does not exist in the whitelist And identifies as uninfected host.

Further, according to the present invention, the white list is configured using a Bloom filter, and the probability (ξ _wl ) of missing a worm-infected host by mistake when matching the white list is equal to or less than a predetermined allowable value (δ _wl ). The bitmap length of the Bloom filter is designed so that the required memory amount of the white list is minimized.
Further, in the present invention, the white list is updated every ω consecutive measurement periods, and the white list has a two-plane configuration. In the normal state, both white lists are constantly updated and initialization is performed. The timing to be performed is shifted by the measurement period of ω / 2, and after the transition to the worm appearance state, the specified mass flow generation host is collated using the white list having the longer updated period.
Further, in the present invention, in the white list with the longer updated period, the measurement period from when the white list was last updated before the worm appearance state to the transition to the worm appearance state is arbitrary. The white list update cycle ω is set so that it is equal to or longer than the continuous measurement period of the integer parameter σ given to.
The present invention is also a worm-infected host identification system for executing the above-described worm-infected host identification method.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, it is possible to narrow down worm-infected hosts from a large number of flow generation hosts that are specified using only statistical data obtained by flow sampling and whose number of flows generated per unit time is equal to or greater than a threshold value. It becomes.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
[Outline of identification method for mass flow generation host]
First, an outline of a method for specifying a mass flow generation host will be described.
In order to specify a large number of flow generation hosts, it is effective to perform sampling for each flow, not for each packet, and total the number of generated flows for each host.
A flow is defined as a set of packets having a common outgoing / incoming IP address and outgoing / incoming port number. Then, an arbitrary measurement period Φ having a length of φ (s) is defined, and the total number of flows arriving at the link of interest within the measurement period Φ is defined as M.
Then, when the number of flows arriving at the link of interest within the measurement period Φ for each host is m, a host with m ≧ m ^* is defined as a mass flow generation host with respect to an arbitrarily defined threshold m ^* . Consider that the mass flow generation host is specified within the measurement period Φ at the link of interest.

よって、サンプルフロー数がｙ以上のホストを特定するとき、このホストが特定される確率Ｈは、下記（２）式で得られる。
また、下記（２）式に、ｍ＝ｍ^＊を代入することによって得られる、下記（３）式を数値的に解くことによって、ｍ^＊とＨ^＊が与えられたときに、ｙかｒの任意の一方を定めたときに対応するもう一方のパラメタを設定することができる。 Now, focus on the host whose flow number is m in the measurement period Φ.
The probability fd that d flows are sampled from m flows of the host of interest within the measurement period Φ is expressed by the following equation (1) using the flow sample rate r.

Therefore, when a host whose sample flow number is y or more is specified, the probability H that this host is specified is obtained by the following equation (2).
Moreover, when m ^* and H ^* are given by numerically solving the following equation (3) obtained by substituting m = m ^* into the following equation (2), y or r The other parameter can be set when any one is defined.

For each packet arriving at the link of interest, when v is the value of s bits obtained through a hash function prepared in advance using a total of 96 bits of the arrival and departure IP addresses and the arrival and departure port numbers as keys, v <v ^* Only when there is a new flow determination device. However, v ^* is a threshold for flow sampling, and r = v ^* / 2s, where r is the flow sampling probability. Since flows belonging to the same flow have the same key, all flows are sampled with a probability r regardless of the flow size.
When v <v ^* , it is determined whether or not the flow to which the next arrival packet belongs has already been counted.
The most intuitive method is to manage all sampled flows in the flow table and determine whether there is an entry for the flow in the flow table, but it is necessary to check all the entries at the maximum. As a result, the processing time increases.
Therefore, a method of determining using a Bloom filter is effective. Bloom filter is a method for determining whether or not a candidate is a member of a certain set, k different hash functions (each returning a b-bit value for the incoming key) and 2 ^b Binary variables (initially all reset to zero) are prepared.
In this case, the value of a binary variable corresponding to k addresses obtained through k hash functions using the 96-bit key of the packet is examined, and if one or more is zero, the flow to which the packet belongs is a new flow. Is determined. Then, all k corresponding binary variables are set to 1.
When the Bloom filter is used, there is no possibility that a flow that has already been counted is erroneously regarded as a new flow, but there is a possibility that a new flow may be mistakenly missed due to a hash value collision.
For the total flow M that has flowed through the link of interest within the measurement period Φ, the expected value D of the number of flows sampled within the measurement period Φ is D = rM. The optimum value of k is expressed by the following equation (4) using D.

よって、新規フローを見逃す確率の平均値ηは（４）式を考慮して、下記（６）式により導出できる。 When the 2 ^b (bits) bitmap of the Bloom filter is updated for n different flows, the probability that a bit in the bitmap is 1 is {1- (1-k / 2 ^b ) ⁿ }.
At this time, if the probability of missing a new flow by mistake is η _n , the probability η _n is expressed by the following equation (5).

Therefore, the average value η of the probability of missing a new flow can be derived from the following equation (6) in consideration of the equation (4).

From equation (6), when r and M are given, the minimum value of b satisfying the average value η ≦ δ _BF (value arbitrarily given) of the probability of missing a new flow can be obtained. The value of k can be set from the above equation (4).
The host table contains the source IP address and the number of sample flows _cj . When it is determined that the flow is a new flow, it is checked whether or not the source IP address of the corresponding packet has already been entered in the host table (for example, the hash value address is checked using the source IP address as a key). If present, increase the number of sample flows by one.
As a result, when the number of sample flows reaches the specific determination threshold value y, the host is specified as a mass flow generation host and written to a mass flow generation host list (corresponding to the white list of the present invention).
On the other hand, if the source IP address is not entered in the host table, a new entry is generated.
When implementing the host table entry update process, it is important to efficiently resolve the address where each entry is accommodated. Here, a method using a generally widely used hash function is assumed. .
For hash value collisions, a solution using a link structure using a pointer exhibits high performance and is widely used, so a form using a link structure is also assumed here.

The host table includes a pointer storage area (hereinafter referred to as a PSA (pointer stored area)) and a host entry storage area (hereinafter referred to as an ESA (entry stored area)).
The ESA is an area where an entry is actually accommodated, and accommodates a host IP address, the number of sample flows c _j , and a pointer to the next entry. The PSA pointer to the first entry accommodating in ESA corresponding to each of the 2 ^beta pieces of hash values is accommodated.
The PSA value corresponding to the hash value h (j) obtained by using the hash function h having a β-bit hash space prepared in advance is checked, and if it is a null value, an entry is created in the empty position of the ESA. The sample flow number c _j is initialized to 1.
On the other hand, if the PSA value is not a null value, the link of the corresponding entry of the ESA is examined in order to check whether the entry of the corresponding host exists, and if there is, the sample flow number c _j of the entry is determined. Increase by one. If it does not exist, a new entry is created.

[Example]
FIG. 1 is a system configuration diagram showing an example of an embodiment of a worm-infected host identification method using a white list of the present invention.
In FIG. 1, 101 is a parameter design device, 102 is a WL update device, 103 is a WL collation device, 104 is a Superspreader specifying device (hereinafter referred to as a mass flow generation host specifying device), 105 is a white list (hereinafter referred to as WL), Reference numeral 106 denotes a worm-infected host list.
The parameter design apparatus 101 designs the white list size g and the update period ω.
Using the host information specified by the mass flow generation host specifying device 104, WL (105) is updated by the WL update device 102 in the normal state, and WL (105) is checked by the WL check device 103 in the worm appearance state. As a result, if it is determined that the host is a worm-infected host, it is output to the worm-infected host list 106.
Next, a method for identifying a worm-infected host using a white list according to an embodiment of the present invention will be described.

[Framework]
Two network states are defined: (1) normal state and (2) worm appearance state.
There are cases where the user himself / herself is unaware of the infection of the worm, and even if he / she notices it, there are cases where he / she does not take action such as using a patch or vaccine, and various types of worms are constantly observed on the Internet. It can be said that the worm always appears.
However, in this specification, a new worm that has a very high infection rate, such as Slammer, and that is likely to spread throughout the entire network in a short period of time, and a state where the number of infected hosts is rapidly increasing is referred to as a worm appearance state. Define. The ultimate goal is to automatically identify and regulate worm-infected hosts to gain time to develop patches and vaccines for such damaging worms.
In this embodiment, the measurement period length φ, the generated flow number threshold value m ^* that defines the mass flow generation host, and the probability H ^{* of} identifying the host with m = m ^* are given in advance by the method described above. Regardless of the state of the network, the mass flow generating host is always specified in each continuous measurement period Φ.

After the detection of a new type of worm, the network goes back to normal again when a patch or vaccine is created through analysis of the worm and a fundamental solution to the worm is possible.
All the mass flow generation hosts specified in the normal state are accommodated in the WL (105).
On the other hand, during the worm appearance state, WL (105) is not updated, and the identified mass flow generation host is compared with WL (105) created in the previous normal state and does not exist in WL (105). Only when it is considered a worm-infected host, rate regulation is performed.
It is highly likely that a normal host identified as a mass flow generation host during the worm appearance state is identified as a mass flow generation host even in the previous normal state. On the other hand, since the host infected with the worm becomes a mass flow generation host after the infection, it does not exist in the WL (105) except the host already infected when the worm is detected.
Therefore, by using WL (105), it is possible to effectively narrow down worm-infected hosts from the specified mass flow generation host.

[WL configuration method]
In the WL (105), the identification number (ID; for example, IP address) of the specified mass flow generation host is entered in ω consecutive measurement periods (update cycles).
Since there is a possibility that the same host may be specified in a plurality of measurement periods, when a newly specified host is entered in WL (105), it is confirmed whether or not the corresponding host already exists in the list. There is a need to.
Further, during the worm appearance state, it is also necessary to determine whether or not the specified host exists in the WL (105). The most intuitive method is to check all the entries of WL (105) every time a large flow generation host is specified. However, as the large flow generation host increases, the required memory amount and the search processing time become linear. To increase.
A different host may be identified as a mass flow generation host for each successively arriving packet, and the WL (105) update and verification process must be completed within the minimum packet time. For this reason, it is difficult to use such a method in an edge router with restrictions on the amount of mounted memory and processing capability.

Therefore, it is considered that the Bloom filter (hereinafter referred to as BF) used for the new flow determination of the mass flow generation host identification method is also used here. For example, the universal hash function is suitable for hardware implementation, and a hash value can be obtained by parallel processing by hardware implementation. By using BF, updating (WL) 105 and collation processing can be completed in a very short time. it can.
While the worm appears, the identified host is checked against the WL (105), but the BF will not mistakenly miss a host that exists in the WL (105), but it may determine that a non-existent host exists incorrectly There is. This means that the worm-infected host is mistakenly missed.
If the bit map length of BF is 2 ^g (bits), the probability of such an oversight can be reduced by increasing g. However, on the other hand, an increase in g increases the required memory amount of WL (105), so it is necessary to carefully design g in a situation where the amount of mounted memory is limited.
Therefore, in this embodiment, g is designed so that the required memory amount is minimized in a range where the probability ξ _{wl of} erroneously overlooking a worm-infected host at the time of collating WL (105) is less than or equal to a predetermined allowable value δ _wl. Think about it.
When the number of mass flow generation hosts accommodated in the update period of WL (105) is S and the number of BF hash functions is κ, the optimum value of κ is given by the following equation (7). Further, ξ _wl at this time is given by the following equation (8).

Therefore, g can be designed by numerically calculating the minimum integer of g that satisfies ξ _wl ≦ δ _wl . Further, the required memory amount B _wl of WL (105) is B _wl = 2 ^g−3 (byte).
When the memory allocation of the mass flow generation host identification method is performed because the total amount of memory (B _bf , B _psa , B _esa ) necessary for specifying the mass flow generation host and B _wl needs to be equal to or less than the installed memory amount B , B can be replaced with (B-Bwl) to realize appropriate memory allocation including WL (105).
Here, B _bf is the amount of BF Bitmap memory for the new flow determination of the mass flow generation host identification method, and B _psa is the host table pointer storage area used for the new flow determination of the mass flow generation host identification method The amount of memory (PSA), B _esa, is the amount of memory in the host entry storage area (ESA) of the host table used for new flow determination in the mass flow generation host identification method.

[WL update cycle]
Under normal conditions, more bits in the BF Bitmap are set to 1 as the identified mass flow generation host is accommodated in WL (105). Therefore, if the accommodation in the WL (105) is repeated infinitely, the Bitmap is filled with 1, and it is determined that an arbitrary host is accommodated in the WL (105) in the worm appearance state.
Therefore, it is necessary to initialize the bitmap of WL (105) to zero at some timing. Here, the WL (105) update cycle is given by ωφ where ω is an arbitrary integer. That is, WL (105) is initialized for every continuous ω observation periods.
If a worm is detected immediately after the initialization of WL (105) and a worm appears, a worm-infected host will be identified using WL (105) containing only a small number of large flow generation hosts. , Many mass flow generation hosts of normal hosts are erroneously determined as infected hosts.
Therefore, as shown in FIG. 2, two WLs (105) of white list 1 and white list 2 are prepared. As shown in FIG. 2, in a normal state, the specified mass flow generation host is set to two WL ( 105). Then, the timing (Reset in FIG. 2) for initializing each WL (105) is shifted by ωφ / 2.

After the worm is detected and transitioned to the worm appearance state, of the two WLs (105), the one with the longer update period (the elapsed time since the last initialization) (White list 2 in FIG. 2) Used for collation. At this time, if the worm appears from the start of the first measurement period after the detection of the worm, even if a worm is detected at an arbitrary time, the update period of the WL (105) used for verification is determined. (Ωφ / 2 + φ) or more. The required memory amount B _wl of WL (105) is B _wl = 2 ^g−2 (byte).
The problem is how to determine the parameter ω that determines the update cycle of WL (105). The longer the update cycle, the more normal mass flow generation hosts can be accommodated in WL (105), and the appearance of worms. The possibility of erroneously determining a normal host as an infected host in the state can be reduced.
On the other hand, however, the required memory amount of WL (105) increases with the increase in the number S of mass flow generation hosts accommodated during the update period of WL (105). Therefore, as shown in FIG. 2, ω is set so that the update period of WL (105) when transitioning to the worm appearance state becomes equal to or larger than σφ using an arbitrarily given integer parameter σ. That is, the following equation (9) is set.

There remains a problem of what value should be set to σ, but the occurrence pattern of a large volume flow generation host at normal time is expected to have periodicity such as days and weeks, so it has some experience Seems to be configurable. The increase degree of the number S of mass flow generation hosts accommodated in the update period of WL (105) accompanying the increase of the update period decreases with the increase of the update period. Therefore, it is expected that sufficient performance can be obtained even with a relatively small parameter σ.
By the way, the setting parameters g and κ of the WL (105) can be designed again every time the WL (105) is initialized by the method described in [WL configuration method]. At this time, the number (S) of mass flow generation hosts specified during the update period of WL (105) is necessary, but since it is unknown at the start of the update period, it is necessary to use an estimated value.
In this embodiment, it is assumed that the number of mass flow generation hosts accommodated in the WL (105) is simply used when the WL (105) is initialized.

[Numeric evaluation]
The numerical evaluation results are shown below to confirm the effectiveness of this example.
All the hosts that appear in the actual packet trace published on the Web are regarded as normal hosts, the abnormal traffic generated by the worm-infected host is generated by computer simulation, and a new packet trace mixed with the packet trace is created. Generated. The present invention was applied to the mixed packet trace.
Here, the abnormal traffic of the port scan generated by the worm-infected host is modeled using a fluid model. This is a technique often used to model a phenomenon in which an infection spreads, such as the spread of an infectious disease, and gives a good approximation when uniformity without geographical dependence is established in the infection pattern. Not all worms perform port scans on randomly generated addresses, but if they are done randomly, geographical dependency can be ignored, and the expansion of worm-infected hosts is also considered in this model. Modeling is possible.
When uniformity is established, the number (I _t ) of infected hosts at time t can be modeled by the following equation (10) with respect to the average value α of the number of hosts infected by one infected host per unit time.

各感染ホストのポートスキャンレート（η）の値は、Code Redが６程度、Slammerが４０００程度である。
SlammerのようなBandwidth-limited型のワームを想定して評価を行うことが望ましいが、異常トラヒック量が大きく現実的な時間で評価が行えないため、ここでは、基本特性を得る目的から、η＝１０，２０とした２つの場合について評価した。
大量フロー生成ホスト特定法のパラメタを、φ＝１０秒、ｍ^＊＝５０，Ｈ^＊＝０．５に設定した。１４個の測定期間Φ_１,...,Φ_１4が存在するが、Φ_７の中でワーム発生が検出されたと仮定し、Φ_１〜Φ_７を正常状態、Φ_８〜Φ_１４をワーム出現状態とした。
そして、ＷＬ更新期間の下限を与えるパラメタσに対して、前述の（９）式で得られるωを用いて、Φ_１〜Φ_ωの期間に観測された大量フロー生成ホストの異なり数（全測定期間において、同じホストが複数回カウントされる場合を除いた、純粋な大量フロー生成ホスト数）をＳに設定し、ＷＬ（１０５）を設計した。
また、性能の下限を評価するため、更新期間が最短となるタイミングでワームが検出された場合を評価した。すなわち、σを、１≦σ≦４の範囲で設定し、Φ_８−σ〜Φ_７の期間でＷＬ（１０５）を更新した。 In this embodiment, the host infected with the worm further performs the port scan at intervals according to an exponential distribution with an average of (1 / η) seconds.
In addition, each port scan hits an uninfected vulnerable host with a probability (N-I _t ) / 2 ³² , and it is assumed that the number of newly infected hosts increases by one. Where N is the number of hosts in the entire network that are vulnerable to this worm. At this time, α is expressed as the following equation (11).

The port scan rate (η) of each infected host is about 6 for Code Red and about 4000 for Slammer.
It is desirable to perform the evaluation assuming a Bandwidth-limited type worm such as Slammer. However, since the amount of abnormal traffic is large and cannot be evaluated in a realistic time, here, for the purpose of obtaining basic characteristics, η = Two cases, 10 and 20, were evaluated.
The parameters of the mass flow generation host identification method were set to φ = 10 seconds, m ^* = 50, and H ^* = 0.5. 14 measurement period [Phi _1, ..., [Phi ₁₄ but is present, assuming that the worm generated in the [Phi ₇ is detected, [Phi ₁ to [phi] ₇ of the normal state, [Phi ₈ to [phi] ₁₄ worms appearance It was in a state.
Then, for the parameter σ that gives the lower limit of the WL update period, using ω obtained by the above equation (9), the number of different mass flow generation hosts observed during the period Φ _{1 to} Φ _ω (all measurements) In the period, the number of pure mass flow generation hosts (excluding the case where the same host is counted multiple times) is set to S, and WL (105) is designed.
Moreover, in order to evaluate the lower limit of performance, the case where the worm was detected at the timing when the update period becomes the shortest was evaluated. That is, sigma, and set in the range of 1 ≦ σ ≦ 4, and updates the WL (105) for a period of Φ _8-σ ~Φ _7.

Table 1 shows the total number of hosts (N) and before WL matching in each measurement period in the worm appearance state after Φ ₈ when η = 10, σ = 1, and the total memory amount is B = 64 (kbyte). The number of specific hosts (X) and the number of specific hosts (Y) after WL matching are summarized for normal hosts and infected hosts with m ≦ m ^* . In Table 1 and each table described later, “Normal host” means a normal host, and “Infected host” means an infected host with m ≦ m ^* . The results when σ = 4 are also summarized in Table 2.
In the packet trace used for the evaluation, when m ^* = 50, about 1% of normal hosts are identified as large flow generation hosts (X in Table 1). It can be confirmed that (XY) in Table 1 can be removed from the specific target. The effect is greater when σ = 4 than when σ = 1.
Table 3 shows the number of hosts accommodated in WL (105) at the end of each measurement period of the update period (Φ _{4 to} Φ ₇ ) of WL (105) when σ = 4, and m ≧ m * Shown for each worm-infected host.
When σ = 1, the number of accommodated WLs (105) of normal hosts was 145, but as the number of accommodated hosts of WL (105) increased with the passage of time, the worm appearance state transition point of σ = 4 The number of normal hosts accommodated in is larger than when σ = 1. Therefore, as can be confirmed in Tables 1 and 2, σ = 4 has a greater effect of reducing the erroneous specification of normal hosts than σ = 1.

Further, as the update period of WL (105) increases, the rate of increase in the number of normal hosts accommodated in WL (105) decreases, but this can also be confirmed from Table 3. Therefore, it is expected that a sufficient effect can be obtained even if σ is not set to a very large value and the update cycle of WL (105) is set to a relatively short length.
However, the number of missed worm-infected hosts increases by collating WL (105). For example, when σ = 4, 35 worm-infected hosts accommodated in WL (105) are not necessarily specified.
It can be confirmed from Table 2 that most of the worm-infected hosts that are missed by the collation of WL (105) are hosts that have already been infected before the transition to the worm appearance state, and are hosts accommodated in WL (105).
Therefore, immediately after the transition to the worm appearance state, the ratio of such infected hosts to all infected hosts is large, and the influence of overlooking infected hosts due to the use of WL (105) is large. However, as time passes, the ratio of infected hosts to all infected hosts after the transition to the worm appearance state increases, so the impact becomes smaller.
In order to further confirm the effect of WL (105), the reduction rate R _n of the normal host error specific number, the increase rate R _{w of the} number of missed infected hosts, the mounted memory amount B, the WL (105) update period (parameter σ ) Are shown in Table 4 and Table 5, respectively.
However, for each normal host and m ≧ m ^* worm-infected host, the number of specific hosts before WL matching in the measurement period Φ _i is X _{i, n} and X _{i, w} , and the number of specific hosts after WL matching is Y _{i , N} and Y _{i, w} , the reduction degree R _{n of the} number of normal host errors is expressed by the following expression (12), and the increase degree R _{w of the} number of missed infected hosts is expressed by the following expression (13). And Note that η = 20.

From Tables 4 and 5, when the amount of installed memory B is about 32 (kbytes) or more, by using this embodiment, the increase in the number of missed worm-infected hosts is suppressed to about 20 to 30%, while the error of normal hosts is It can be confirmed that detection can be avoided with an accuracy close to 100%. In addition, since the larger the η is, the stronger the infectivity is, the number of newly infected hosts after the transition to the worm appearance state increases in proportion than the number of infected hosts infected in the normal state and accommodated in the WL (105). , more infected hosts missed an increase in the number of degree of R _w can be suppressed.
In addition, it can be confirmed that the reduction degree R _n of the normal host erroneous identification number is improved as the mounting memory amount B is increased. This is because the memory amount B _bf allocated to the BF of the mass flow generation host specifying process and the memory amounts (B _psa , B _esa ) allocated to the host table increase, and the mass flow generation host specifying accuracy is improved. .
Moreover, it can be confirmed that the reduction degree R _{n of the} number of erroneously specified normal hosts improves as the parameter σ increases. However, as σ increases, the number S of mass flow generation hosts specified during the update period of WL (105) increases and the memory allocated to WL (105) increases. It is expected that the memory amount B _bf allocated to the processing BF and the memory amount (B _psa , B _esa ) allocated to the host table will decrease, and the specific accuracy itself of the mass flow generation host will deteriorate.

The memory amount B _wl of WL (105) is given as a power of 2 and changes discontinuously. However, when σ is other than 4, B _wl = 512 (byte), and only when σ = 4, B _wl = It was 1024 (bytes). Therefore, when B = 16 (kbyte), the result of σ = 4 is deteriorated. Thus, it is necessary to pay attention to the fact that the specific accuracy of the mass flow generation host deteriorates when σ is set large, particularly when the mounted memory amount B is small.
Further, with an increase in the amount of memory B, the increase of R _w of infected hosts missed number can also confirmed that the improved (reduced). This is also because the specific accuracy of the mass flow generation host is improved by the increase in the mounting memory amount B.
Meanwhile, since the worm infected host number contained in WL (105) with increasing σ increases, increasing the degree R _w of infected hosts missed number increases. In Table 5, when σ = 4, the memory amount B _bf allocated to the BF of the mass flow generation host specifying process and the memory amount (B _psa , B _esa ) allocated to the host table are reduced and are in a normal state. in order to infect host number specified by flow Hogs decreases, increasing the degree R _w of infected hosts missed number is decreasing.
Therefore, the larger the mounted memory amount B, the better, but the parameter σ needs to be set carefully.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a block diagram which shows the schematic system configuration | structure of an example of the Example of this invention. It is a time series figure which shows operation | movement of the Example of this invention.

Explanation of symbols

101 Parameter design device 102 WL update device 103 WL verification device 104 Superspreader identification device 105 WL
106 Worm-infected host list

Claims (8)

Using only the statistical data obtained by flow sampling, specify the mass flow generation host whose number of flows generated per unit time is equal to or greater than the threshold,
A worm-infected host identification method that uses a white list to narrow down worm-infected hosts from the identified mass flow generation host,
Define two network states: normal and worm appearance.
In the normal state, all the specified mass flow generation hosts are accommodated in the white list, and the white list is not updated during the worm appearance state,
In the worm appearance state, the specified mass flow generation host is compared with the white list created in the previous normal state, and is specified as a worm-infected host only when it does not exist in the white list Infected host identification method. The white list is configured using a Bloom filter, and the white list is within a range in which the probability (ξ _wl ) of missing a worm-infected host by mistake when matching the white list is less than or equal to a predetermined allowable value (δ _wl ). The worm-infected host identification method according to claim 1, wherein the Bitmap length of the Bloom filter is designed so that the required amount of memory is minimized. The white list is updated every ω consecutive measurement periods, and the white list has a two-plane configuration.
In the normal state, both white lists are constantly updated, and the initialization timing is shifted by a measurement period of ω / 2,
3. The worm-infected host according to claim 1, wherein after the transition to the worm appearance state, the identified mass flow generation host is collated using a white list having a longer updated period. Specific law. In the white list with the longer updated period, an integer parameter σ arbitrarily given from the time when the white list was last updated before the worm appearance state to the transition to the worm appearance state is given. 4. The worm-infected host identification method according to claim 3 , wherein the whitelist update period ω is set so as to be equal to or longer than the continuous measurement period. The whitelist,
Using only statistical data obtained by flow sampling, a mass flow generation host identifying device that identifies a mass flow generation host in which the number of flows generated per unit time is equal to or greater than a threshold,
A WL update device that initializes the whitelist;
A worm-infected host identification system having a WL verification device that narrows down worm-infected hosts using the white list from among the mass flow generation hosts identified by the mass flow generation host identification device,
Define two network states, normal state and worm appearance state, and in the normal state, all the specified mass flow generation hosts are accommodated in the white list,
The WL update device does not update the white list during the worm appearance state,
The WL matching device compares the identified mass flow generation host with the white list created in the previous normal state in the worm appearance state, and identifies it as a worm infected host only when it does not exist in the white list. A worm-infected host identification system. The white list is configured using a Bloom filter,
In the WL collation device, the required memory amount of the white list is the minimum within a range in which the probability (ξ _wl ) of missing a worm-infected host erroneously when collating the white list is equal to or less than a predetermined allowable value (δ _wl ). The worm-infected host identification system according to claim 5, wherein the Bitmap length of the Bloom filter is designed so that The white list has a two-side structure,
The WL update device updates the white list every ω consecutive measurement periods and, in the normal state, always updates both white lists and performs initialization only during the measurement period of ω / 2. Shift,
7. The WL collation device performs collation of the identified mass flow generation host using a white list having a longer updated period after transition to a worm appearance state. The worm-infected host identification system described in 1. The WL update device has an arbitrary measurement period from when the whitelist was last updated before the worm appearance state to the transition to the worm appearance state in the whitelist with the longer updated period. The worm-infected host identification system according to claim 7 , wherein the whitelist update cycle ω is set so as to be equal to or longer than the continuous measurement period of the integer parameter σ given to.

Images