JP4985503B2 - Communication monitoring device, communication monitoring program, and communication monitoring method - Google Patents

Description

  The present invention relates to a communication monitoring apparatus, a communication monitoring program, and a communication monitoring method, and in particular, a communication monitoring apparatus, a communication monitoring program, and a communication that can reliably detect unauthorized communication using a protocol that allows communication. It relates to the monitoring method.

  Conventionally, in communication between a server and a client via a network such as the Internet, it has been important to prevent unauthorized communication such as access to the server by an unauthorized client having no legitimate access right. Specifically, for example, a countermeasure is generally provided such that a firewall is provided at the boundary between a LAN (Local Area Network) in an organization such as a company and an external network such as the Internet, and communication between the outside and the LAN is restricted.

  By the way, a protocol called HTTP (Hyper Text Transfer Protocol) may be used for data transmission / reception between a server and a client via the Internet. HTTP is mainly used when a client acquires web page data from a web server. If the data transmitted as HTTP is not set individually, it is not blocked by the firewall described above, and can be freely transmitted and received between the server and the client. Therefore, when a malicious user transmits control data for establishing an unauthorized transmission path as HTTP, a transmission path for unauthorized communication is easily established between the server and the client, and unauthorized communication is performed. There is a risk of being caught. Thus, establishment of a transmission path for unauthorized communication using a protocol that is not blocked (for example, HTTP) is generally referred to as tunneling.

  In order to prevent such tunneling, for example, techniques disclosed in Patent Document 1 and Patent Document 2 can be used. In other words, when tunneling, the control data for establishing an unauthorized transmission path includes a specific pattern. Therefore, this data pattern is stored in advance as a signature, and is actually transmitted and received with the stored signature. It is possible to determine whether or not the packet is used for tunneling by collating it with the packet to be transmitted. In other words, when a signature is included in a transmitted / received packet, it can be determined that tunneling is performed.

JP 2003-218949 A Japanese Patent Laid-Open No. 2004-140618

  However, in general, a specific method of unauthorized communication such as tunneling is not clear, and there is a problem that it is not possible to reliably detect all unauthorized communications by collating a previously stored signature with a packet. Specifically, since it is impossible for a malicious user to store in advance all data patterns of control data transmitted as HTTP for tunneling, a signature characteristic to unauthorized communication is stored in the packet. However, depending on the method of unauthorized communication, the stored characteristic signature is not always included in the packet.

  If the tunneling technique changes, the control data transmitted and received by the protocol also changes. However, it is not realistic to store in advance signatures corresponding to all control data that can change. Therefore, it is only a part of unauthorized communication that can be detected by matching a packet with a signature.

  The present invention has been made in view of the above points, and provides a communication monitoring device, a communication monitoring program, and a communication monitoring method capable of reliably detecting unauthorized communication using a protocol that allows communication. With the goal.

  In order to solve the above-mentioned problem, the communication monitoring apparatus extracts packets transmitted / received in a session established between a pair of transmission / reception apparatuses from a plurality of packets transmitted / received by a protocol capable of transmitting control information for communication. Session extraction means, access destination extraction means for extracting an access destination specified by control information from a packet in the session extracted by the session extraction means, and characters representing the access destination extracted by the access destination extraction means A conversion unit that performs conversion according to the protocol for the column; an access unit that accesses a conversion access destination obtained by conversion by the conversion unit to obtain page information; and that is acquired from the conversion access destination by the access unit On the basis of the obtained page information by the session extraction means. Extracted Te session adopts a configuration having a determination means for determining whether an unauthorized communication.

  The communication monitoring program is a communication monitoring program executed by a computer, and is established between a pair of transmission / reception devices from a plurality of packets transmitted and received by a protocol capable of transmitting control information for communication to the computer. A session extraction step for extracting packets transmitted and received in the session; an access destination extraction step for extracting an access destination specified by control information from the packets in the session extracted in the session extraction step; and the access destination A conversion step for converting the character string representing the access destination extracted in the extraction step according to the protocol, and accessing the conversion access destination obtained by conversion in the conversion step to obtain page information Access step and said access step Based on the obtained page information from the conversion accessed Te, the session extracted in the session extracting step is to be executed and determining whether or not an unauthorized communication.

  Further, the communication monitoring method includes a session extraction step of extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting communication control information; From the packet in the session extracted in the session extraction step, an access destination extraction step for extracting the access destination specified by the control information, and a character string representing the access destination extracted in the access destination extraction step A conversion step for performing conversion according to the protocol, an access step for obtaining page information by accessing a conversion access destination obtained by conversion in the conversion step, and acquired from the conversion access destination in the access step Based on the page information, in the session extraction step Issued session is to have a determining step of determining whether or not an unauthorized communication.

  According to these, page information is acquired from a plurality of access destinations including the access destination specified by the control information exchanged within the session, and whether or not the session is unauthorized communication based on the acquired page information. Determine whether. For this reason, even when an illegal signature obtained in the past is not included in the control information, it is possible to determine whether the access destination specified by the control information and the peripheral access destination are illegal. Thus, it is possible to reliably detect unauthorized communication using a protocol that is allowed.

  According to the communication monitoring apparatus, the communication monitoring program, and the communication monitoring method disclosed in this specification, it is possible to reliably detect unauthorized communication using a protocol that allows communication.

  The gist of the present invention is that when a session in which packets containing the same data pattern are repeatedly transmitted and received is detected, the page information is actually acquired from the access destination specified by the packet in this session, and the acquired page If the information includes an illegal word indicating tunneling, the session is determined to be unauthorized communication. Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing a schematic configuration of a communication system according to an embodiment of the present invention. The communication system shown in the figure includes a server 10, a client 20, a relay device 30, and a communication monitoring device 100.

  The server 10 is connected to the network N, and transmits and receives packets to and from the plurality of clients 20 via the network N. The plurality of clients 20 are connected to the network N via the relay device 30 and transmit / receive packets to / from the server 10. The relay device 30 includes, for example, a router, a switch, or a firewall, and relays packets transmitted and received between the server 10 and the client 20.

  Here, the server 10 and the client 20 mutually generate an application layer message to request or respond to data. However, since this message is not constant in size, this message is sent to the TCP / IP (Transmission Control). It is transmitted and received as a packet of a predetermined size in the (Protocol / Internet Protocol) layer. That is, the server 10 and the client 20 generate a message composed of control data including communication protocol control information and information data to be controlled by the control information, and the generated message is set to a predetermined size corresponding to one packet. Divide and send.

  Further, the packet configuration according to the present embodiment is as shown in FIG. 2, for example. That is, for example, an HTTP message for requesting transmission of web page data is composed of control data and information data, and a TCP / IP header for storing a packet transmission source address, a destination address, and the like is added to the HTTP message. Yes. The control data includes control information for controlling communication with the packet destination, an access destination designated for the packet destination, and a port number related to the access destination. Among these, the access destination and the port number are stored behind the control information such as “CONNECT” as shown in the lower part of FIG. That is, in the example shown in FIG. 2, the access destination and the port number are “192.168..XXX.XXX: PP”, “192.168..XXX.XXX” indicates the IP address of the access destination, and “PP "Indicates the port number related to the access destination. As an access destination, a domain name may be stored instead of the IP address. In addition to “CONNECT”, there are various types of control information such as “GET” and “POST”.

  Returning to FIG. 1, the communication monitoring apparatus 100 acquires a packet transmitted / received between the server 10 and the client 20, and whether an invalid message is transmitted / received for each session established between the server 10 and the client 20. Monitor whether or not. At this time, the communication monitoring apparatus 100 extracts the access destination from the control data of the message transmitted / received at the beginning of the session, actually accesses the periphery of the extracted access destination, and the session executes tunneling based on the access result It is determined whether or not the communication is unauthorized. Note that communication monitoring by the communication monitoring apparatus 100 will be described in detail later. The message transmitted / received at the beginning of the session is a message based on a legitimate protocol such as an HTTP message even if the session is unauthorized communication. Therefore, the communication monitoring apparatus 100 can extract the access destination from the message (for example, HTTP message) transmitted / received at the beginning of the session.

  FIG. 3 is a block diagram showing a main configuration of communication monitoring apparatus 100 according to the present embodiment. The communication monitoring apparatus 100 shown in FIG. 1 includes a packet reception unit 101, a packet storage unit 102, a session extraction unit 103, an illegal signature storage unit 104, a session determination unit 105, an access destination extraction unit 106, a conversion unit 107, and a web access unit 108. The unauthorized word storage unit 109, the tunneling determination unit 110, the monitoring result output unit 111, and the unauthorized signature generation unit 112.

  The packet receiving unit 101 receives all packets transmitted and received between the server 10 and the client 20. The packet accumulating unit 102 accumulates the packet received by the packet receiving unit 101. Note that the packet storage unit 102 may transmit a packet of a session that is not determined to be unauthorized communication in the process described later to the server 10 or the client 20 specified by the destination address. The packet storage unit 102 may store a copy of the packet received by the packet reception unit 101 and transmit the original packet to the server 10 or the client 20.

  The session extraction unit 103 extracts a packet group corresponding to one session from the packets stored by the packet storage unit 102. Specifically, the session extraction unit 103 searches and extracts, from the packets stored by the packet storage unit 102, a SYN packet that is transmitted and received when the session is established and a FIN packet that is transmitted and received when the session is disconnected. All packets transmitted and received between the same server 10 and client 20 are extracted between these SYN packets and FIN packets. In addition, the session extraction unit 103 may extract a session by searching for an RST packet transmitted / received when the session is forcibly terminated or detecting a session timeout.

  The illegal signature storage unit 104 stores data patterns frequently included in packets transmitted and received during illegal communication such as tunneling as illegal signatures. Specifically, the illegal signature storage unit 104 stores a plurality of illegal signatures each having a data pattern of several bytes, as shown in FIG. 4, for example. Although omitted in FIG. 4, the illegal signature storage unit 104 stores a position where each illegal signature is arranged in the message part of the packet together with the data pattern. That is, the illegal signature storage unit 104 stores, for example, how many bytes from the head of the message part each data pattern shown in FIG. 4 is arranged.

  The session determination unit 105 collates the packet in the session extracted by the session extraction unit 103 with the unauthorized signature stored by the unauthorized signature storage unit 104, and determines whether the session is unauthorized communication. If the message part of the packet includes a data pattern that matches the illegal signature, the session determination unit 105 notifies the monitoring result output unit 111 that the currently extracted session is an illegal communication.

  In addition, if the message part of the packet does not include a data pattern that matches the illegal signature, the session determination unit 105 further determines whether or not the same data pattern repeatedly appears in the message part in the session. If the same data pattern repeatedly appears, the session determination unit 105 determines that the currently extracted session is an illegal session candidate. This is because in unauthorized communication such as tunneling, the same data pattern is often included in the control data in the message part in order to establish an unauthorized transmission path. This means that a fraudulent session candidate that is not detected by matching with the signature is detected. Similarly, when there are a predetermined number or more of packets having the same control data size in the message part, the session determination unit 105 may determine that the currently extracted session is an illegal session candidate.

  When the session extraction unit 105 determines that the currently extracted session is an illegal session candidate, the access destination extraction unit 106 checks the control data of the packet extracted by the session extraction unit 103 and is designated. Extract the access destination. Specifically, the access destination extraction unit 106 controls, for example, “CONNECT” shown in FIG. 2 in the control data of the packet that triggers the session determination unit 105 to determine that the session is an invalid session candidate. The access destination and port number are extracted from the back of the information.

  The conversion unit 107 converts the access destination and the port number extracted by the access destination extraction unit 106 with a plurality of patterns, and generates a plurality of access destinations including the periphery of the original access destination. Specifically, the conversion unit 107 adds a character string specific to a protocol such as “https: //” or “http: // www.” To the character string of the access destination or port number, and uses the control data. An access destination around the indicated access destination is generated. Note that the conversion unit 107 may convert the entire character string of the access destination and the port number extracted by the access destination extraction unit 106, or may convert a part of the character string. Further, when the access destination is an IP address, the conversion unit 107 searches a DNS (Domain Name System) server (not shown) to obtain a domain name corresponding to the IP address, and partially converts characters constituting the domain name. A character string specific to the protocol may be added after performing conversion such as conversion.

  The web access unit 108 actually performs web access to the plurality of access destinations generated by the conversion unit 107. Then, the web access unit 108 acquires page information such as a web page from each access destination, and outputs the page information to the tunneling determination unit 110. Here, since it is considered that there is no access destination that cannot be connected when the web access unit 108 accesses, if all the access destinations generated by the conversion unit 107 are not connectable, Currently extracted sessions are not harmful and are not considered to be unauthorized communications. Further, even when an error page or the like is acquired from the access destination, the web access unit 108 assumes that the connection to the access destination is possible and outputs the page information of the error page to the tunneling determination unit 110.

  The illegal word storage unit 109 stores in advance an illegal word characteristic as a character string included in the page information of the access destination when tunneling is performed. Specifically, the illegal word storage unit 109 stores a character string such as “VPN”, “Share”, or “Storage” as an illegal word. These illegal words are strings that tend to be used when specifying actions other than referring to a web page. If the accessed web page is valid, the illegal word is usually included in the page information. It is never included.

  The tunneling determination unit 110 determines whether or not an illegal word stored by the illegal word storage unit 109 is included in the page information acquired by the web access unit 108, and when the illegal word is included in the page information. It is determined that the currently extracted session is to perform tunneling. Then, the tunneling determination unit 110 notifies the monitoring result output unit 111 and the unauthorized signature generation unit 112 that the session is tunneling. Further, the tunneling determination unit 110 determines that the session is not an unauthorized session when an invalid word is not included in the page information.

  The monitoring result output unit 111 is notified from the session determination unit 105 that the currently extracted session is an unauthorized communication, or notified from the tunneling determination unit 110 that the session is to be tunneled. In that case, the fact is output as a monitoring result.

  The illegal signature generation unit 112 generates an illegal signature from a data pattern that repeatedly appears in a session that is determined to execute tunneling. That is, the unauthorized signature generation unit 112 generates an unauthorized signature using a data pattern that is a basis for the session determination unit 105 to determine a session as an unauthorized session candidate. Then, the unauthorized signature generation unit 112 stores the generated unauthorized signature in the unauthorized signature storage unit 104. Therefore, when the tunneling determination unit 110 determines that the session is to perform tunneling, a new unauthorized signature generated by the unauthorized signature generation unit 112 is learned by the unauthorized signature storage unit 104.

  Next, the operation of the communication monitoring apparatus 100 configured as described above will be described with reference to the flowchart shown in FIG.

  Packets transmitted and received between the server 10 and the client 20 are always received by the packet receiving unit 101 of the communication monitoring apparatus 100 and accumulated by the packet accumulating unit 102. Then, the session extraction unit 103 extracts a packet group corresponding to one session from the accumulated packets (step S101). That is, the packet group transmitted / received between the transmission / reception of the SYN packet and the transmission / reception of the FIN packet is detected by the session extraction unit 103 by detecting the SYN packet transmitted / received when the session is established and the FIN packet transmitted / received when the session is disconnected. Are extracted as packets of one session. As described above, when a session is extracted, the session extraction unit 103 may search for an RST packet or detect a session timeout.

  Then, the session determination unit 105 collates the message part of the packet in the session with the illegal signature stored by the illegal signature storage unit 104 (step S102), and if the message part has a matching part with the illegal signature (step S102). S102 Yes) Since the currently extracted session is considered to be unauthorized communication, a monitoring result to that effect is notified (step S112).

  On the other hand, if there is no matching part with the illegal signature in the message part (No in step S102), the session determination unit 105 continues to determine whether or not there is a problem packet including a message part suggesting illegal communication such as tunneling in the session. Determination is made (step S103).

  Here, the data size of the message differs depending on the contents of control and information. That is, the sizes of control data and information data included in each message are usually all different. However, when the message includes control data for performing tunneling, the size of the control data of a plurality of messages transmitted and received within the same session is the same, or the same data pattern is included in the control data.

  Specifically, for example, as shown in FIG. 6, when the sizes of the control data # 1, the control data # 3, and the control data # 5 are the same, a session in which these messages are transmitted and received is tunneling or the like. There is a possibility of unauthorized communication. Therefore, when there is a possibility that the currently extracted session is an unauthorized communication, the session determination unit 105 includes a data pattern that repeatedly appears in the session or includes control data of the same size. It is determined whether a packet has been transmitted / received within the session.

  If there is no problem packet in the session as a result of this determination (No in step S103), the currently extracted session is determined to be a regular session that does not execute unauthorized communication such as tunneling (step S113), and the process is performed. finish. On the other hand, if there is a problem packet in the session (Yes in step S103), the currently extracted session is determined to be an unauthorized session candidate that may execute unauthorized communication such as tunneling (step S104). ) Is notified to the access destination extraction unit 106.

  Then, the access destination extraction unit 106 extracts the access destination specified by the control data from the HTTP message part included in the session extracted by the session extraction unit 103 (step S105). Specifically, the access destination extraction unit 106 detects control information such as “CONNECT” stored in the control data, and extracts a character string indicating an access destination arranged behind this character string. The extracted character string indicates the IP address or domain name of the access destination.

  The access destination character string extracted by the access destination extraction unit 106 is output to the conversion unit 107, and the conversion unit 107 performs conversion according to a predetermined rule (step S106). That is, for example, as shown in FIG. 7, the conversion unit 107 adds character strings used in the HTTP protocol to all or part of the access destination character string, and generates character strings indicating a plurality of access destinations. .

  FIG. 7 shows an example of access destination conversion when an IP address and a port number are extracted as the access destination in the upper row, and an access destination conversion when the domain name and the port number are extracted as the access destination in the lower row. An example is shown. When the IP address and port number are extracted as the access destination, for example, as shown in the upper part of FIG. 7, “https: //” is added to the character string representing the IP address and port number, or only the IP address is changed. “Http: //” is added to the character string to be represented. When the domain name and port number are extracted as the access destination, in addition to the above example, as shown in the lower part of FIG. 7, for example, the domain name with the host name (for example, “host.domain”) and the host A character string such as “http: // www.” Or “http: // web.” Is added to an unnamed domain name (for example, “domain”).

  In this embodiment, in addition to the example shown in FIG. 7, various conversions may be performed on the character string to be accessed. For example, the conversion unit 107 may search for a domain name corresponding to the IP address from a DNS server (not shown), and may perform conversion for replacing or changing the characters of the domain name.

  All access destinations obtained by such conversion are notified from the conversion unit 107 to the web access unit 108, and the web access unit 108 performs web access to all access destinations (step S107). Here, since all of a plurality of access destinations obtained by conversion by the conversion unit 107 are accessed, not only access destinations specified by the control data but also access destinations such as peripheral servers can be accessed by the web. Tried. Then, the web access unit 108 determines whether or not connection to each access destination is possible (step S108). If connection to all access destinations is impossible (No in step S108), Since it cannot be determined that the extracted session performs illegal communication such as tunneling, the process ends.

  On the other hand, if there is one access destination that can be connected (step S108 Yes), page information such as a web page is acquired from the connectable access destination (step S109). Here, when an error page or the like is acquired from the access destination, the web access unit 108 determines that the connection is possible, and the acquired error page becomes page information. All the page information acquired from the connectable access destination is output from the web access unit 108 to the tunneling determination unit 110.

  Then, all the page information and the illegal word stored by the illegal word storage unit 109 are collated by the tunneling determination unit 110, and it is determined whether or not an illegal word is included in the page information (step S110). . Since this illegal word is a word that suggests that the session is an illegal communication such as tunneling, if the illegal word is not included in the page information (No in step S110), the illegal word is currently extracted by the tunneling determination unit 110. Is determined not to perform tunneling. In this case, a packet having a matching portion with an illegal signature is not transmitted / received in the session, and a packet for prompting access to page information including an illegal word is not transmitted / received. Is determined not to execute unauthorized communication such as tunneling, and the process ends.

  If an illegal word is included in the page information (Yes in step S110), the tunneling determination unit 110 determines that the currently extracted session is to perform tunneling. In this case, the unauthorized signature generation unit 112 generates an unauthorized signature from the data pattern that repeatedly appears in the session (step S111), and stores it in the unauthorized signature storage unit 104. At the same time, since the session executes tunneling, a monitoring result to that effect is notified (step S112).

  As described above, according to the present embodiment, the access destination specified by the control data included in the packet is extracted even when the packet in the session does not have a matching portion with the illegal signature, and the extracted access destination Whether or not the session is to execute unauthorized communication depending on whether or not an illegal word is included in the page information obtained from the access destination, actually accessing multiple access destinations including servers around judge. For this reason, even if the control data does not contain an illegal signature that has already been confirmed to appear when executing unauthorized communication, it is possible to reliably detect unauthorized communication using a protocol that allows communication. be able to.

  In the above embodiment, the communication monitoring apparatus 100 determines whether or not the session is to perform tunneling. However, the above-described processing is described as a computer-readable program. The present invention can also be implemented by causing a computer to execute this program.

  Regarding the above embodiment, the following additional notes are disclosed.

(Supplementary note 1) Session extraction means for extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting communication control information;
An access destination extracting means for extracting an access destination designated by the control information from the packet in the session extracted by the session extracting means;
Conversion means for performing conversion according to the protocol on the character string representing the access destination extracted by the access destination extraction means;
Access means for obtaining page information by accessing a conversion access destination obtained by conversion by the conversion means;
A communication unit comprising: a determination unit configured to determine whether or not the session extracted by the session extraction unit is an unauthorized communication based on page information acquired from the conversion access destination by the access unit; apparatus.

(Appendix 2) The conversion means includes
The communication monitoring apparatus according to appendix 1, wherein a character string corresponding to the protocol is added to a part or all of a character string representing an access destination.

(Supplementary Note 3) The determination means includes
Including illegal word storage means for preliminarily storing illegal words characteristic as character strings included in page information exchanged in illegal communication,
Determining that the session extracted by the session extraction unit is an unauthorized communication when the illegal word stored by the illegal word storage unit is included in the page information acquired from the conversion access destination. The communication monitoring apparatus according to appendix 1.

(Supplementary Note 4) Generation means for generating an unauthorized signature for detecting unauthorized communication from a data pattern that repeatedly appears in a session when the determination means determines that the communication is unauthorized,
An unauthorized signature storage means for storing the unauthorized signature generated by the generating means;
The access destination extracting means includes
The access destination is extracted from the packet in the session when the packet in the session extracted by the session extraction unit does not include a matching portion with the illegal signature stored in the illegal signature storage unit. The communication monitoring device according to attachment 1.

(Supplementary Note 5) A communication monitoring program executed by a computer,
A session extraction step for extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting control information for communication;
An access destination extraction step for extracting an access destination designated by the control information from the packet in the session extracted in the session extraction step;
A conversion step of performing conversion according to the protocol on the character string representing the access destination extracted in the access destination extraction step;
An access step of obtaining page information by accessing a conversion access destination obtained by conversion in the conversion step;
A determination step of determining whether or not the session extracted in the session extraction step is an unauthorized communication based on the page information acquired from the conversion access destination in the access step. Communication monitoring program.

(Appendix 6) The conversion step includes
6. The communication monitoring program according to appendix 5, wherein a character string corresponding to the protocol is added to a part or all of a character string representing an access destination.

(Appendix 7) The determination step includes:
The session extracted in the session extraction step is invalid when an illegal word characteristic as a character string included in the page information exchanged in illegal communication is included in the page information acquired from the conversion access destination. The communication monitoring program according to appendix 5, characterized in that it is determined that the communication is inconsistent.

(Supplementary Note 8) The access destination extraction step includes:
A portion in which a packet in the session extracted in the session extraction step matches an unauthorized signature for detecting unauthorized communication generated from a data pattern that repeatedly appears in a session that has been determined to be unauthorized communication in the past. 6. The communication monitoring program according to appendix 5, wherein an access destination is extracted from a packet in a session when it is not included.

(Additional remark 9) The session extraction step which extracts the packet transmitted / received within the session established between a pair of transmission / reception apparatuses from the some packet transmitted / received by the protocol which can transmit the control information for communication,
An access destination extraction step for extracting an access destination designated by the control information from the packet in the session extracted in the session extraction step;
A conversion step of performing conversion according to the protocol on the character string representing the access destination extracted in the access destination extraction step;
An access step of obtaining page information by accessing a conversion access destination obtained by conversion in the conversion step;
A determination step of determining whether or not the session extracted in the session extraction step is unauthorized communication based on the page information acquired from the conversion access destination in the access step. Communication monitoring method.

(Supplementary Note 10) The conversion step includes:
The communication monitoring method according to appendix 9, wherein a character string corresponding to the protocol is added to a part or all of a character string representing an access destination.

(Supplementary Note 11) The determination step includes:
The session extracted in the session extraction step is invalid when an illegal word characteristic as a character string included in the page information exchanged in illegal communication is included in the page information acquired from the conversion access destination. 10. The communication monitoring method according to appendix 9, wherein it is determined that the communication is correct.

(Supplementary Note 12) The access destination extraction step includes:
A portion in which a packet in the session extracted in the session extraction step matches an unauthorized signature for detecting unauthorized communication generated from a data pattern that repeatedly appears in a session that has been determined to be unauthorized communication in the past. 10. The communication monitoring method according to appendix 9, wherein an access destination is extracted from a packet in a session when it is not included.

1 is a block diagram showing a schematic configuration of a communication system according to an embodiment. It is a figure which shows the specific example of the packet structure which concerns on one embodiment. It is a block diagram which shows the principal part structure of the communication monitoring apparatus which concerns on one embodiment. It is a figure which shows the specific example of the unauthorized signature which concerns on one embodiment. It is a flowchart which shows operation | movement of the communication monitoring apparatus which concerns on one embodiment. It is a figure which shows the specific example of the message which concerns on one Embodiment. It is a figure which shows the specific example of the access destination conversion which concerns on one embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Packet receiving part 102 Packet storage part 103 Session extraction part 104 Fraud signature storage part 105 Session determination part 106 Access destination extraction part 107 Conversion part 108 Web access part 109 Invalid word storage part 110 Tunneling determination part 111 Monitoring result output part 112 Unauthorized signature Generator

Claims (6)

Session extraction means for extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting control information for communication;
An access destination extracting means for extracting an access destination designated by the control information from the packet in the session extracted by the session extracting means;
Conversion means for performing conversion according to the protocol on the character string representing the access destination extracted by the access destination extraction means;
Access means for obtaining page information by accessing a conversion access destination obtained by conversion by the conversion means;
A communication unit comprising: a determination unit configured to determine whether or not the session extracted by the session extraction unit is an unauthorized communication based on page information acquired from the conversion access destination by the access unit; apparatus. The converting means includes
The communication monitoring apparatus according to claim 1, wherein a character string corresponding to the protocol is added to a part or all of a character string representing an access destination. The determination means includes
Including illegal word storage means for preliminarily storing illegal words characteristic as character strings included in page information exchanged in illegal communication,
Determining that the session extracted by the session extraction unit is an unauthorized communication when the illegal word stored by the illegal word storage unit is included in the page information acquired from the conversion access destination. The communication monitoring apparatus according to claim 1. Generating means for generating an unauthorized signature for detecting unauthorized communication from a data pattern that repeatedly appears in a session when the determining means determines that the communication is unauthorized;
An unauthorized signature storage means for storing the unauthorized signature generated by the generating means;
The access destination extracting means includes
The access destination is extracted from the packet in the session when the packet in the session extracted by the session extraction unit does not include a matching portion with the illegal signature stored in the illegal signature storage unit. The communication monitoring apparatus according to claim 1. A communication monitoring program executed by a computer, wherein the computer
A session extraction step for extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting control information for communication;
An access destination extraction step for extracting an access destination designated by the control information from the packet in the session extracted in the session extraction step;
A conversion step of performing conversion according to the protocol on the character string representing the access destination extracted in the access destination extraction step;
An access step of obtaining page information by accessing a conversion access destination obtained by conversion in the conversion step;
A determination step of determining whether or not the session extracted in the session extraction step is an unauthorized communication based on the page information acquired from the conversion access destination in the access step. Communication monitoring program. A session extraction step for extracting packets transmitted / received in a session established between a pair of transmission / reception devices from a plurality of packets transmitted / received by a protocol capable of transmitting control information for communication;
An access destination extraction step for extracting an access destination designated by the control information from the packet in the session extracted in the session extraction step;
A conversion step of performing conversion according to the protocol on the character string representing the access destination extracted in the access destination extraction step;
An access step of obtaining page information by accessing a conversion access destination obtained by conversion in the conversion step;
A determination step of determining whether or not the session extracted in the session extraction step is unauthorized communication based on the page information acquired from the conversion access destination in the access step. Communication monitoring method.

Images