JP5015279B2 - Cause identification system, method, apparatus, and program linked with traffic volume change detection - Google Patents

Description

  The present invention is based on the traffic information obtained from the traffic flowing on the network or the accumulated traffic information when the traffic amount change is detected or manually designated by an external device. This is related to a technique for identifying the traffic that has become.

  Network operators such as ISP (Internet Service Provider) normally monitor the network traffic status in time series of traffic volume (bytes per second, packets per second), DDoS (Distributed Denial of Service) attacks, traffic concentration, Abnormalities such as equipment failures are detected by time-series changes.

  However, just discovering a change in traffic volume does not reveal the cause of the change, and it is not possible to grasp the current situation and take countermeasures. In order to take measures against the traffic change, a method for identifying the cause traffic that caused the traffic change is necessary.

  Therefore, in Patent Document 1, the traffic that caused the change in the traffic amount is compared with the traffic before the occurrence of the change in traffic amount and the traffic that is undergoing the change, so that only the traffic that caused the change is used as a flow identifier. Extract. When determining the flow identifier, optimize the trade-off relationship between the three elements of the contribution to the traffic volume change of the traffic corresponding to the flow identifier, the presence before the change, and the number of flow identifiers according to the evaluation formula Thus, the degree of contribution to the traffic amount change is maximized with the minimum number of flow identifiers, and the flow identifier that minimizes the presence before the change is determined.

JP 2009-44501 A

  However, with the conventional system for identifying the cause of abnormal traffic that focuses on the change in traffic volume, the analysis is performed when the flow rate difference before and during the occurrence of the traffic volume change is larger than the total traffic volume observed. To do. Therefore, the analysis is not performed when the change amount of the total traffic amount is small.

  When the change amount of the total traffic amount is small, there is a problem that the cause analysis cannot be performed even if there is a traffic in which the proportion of the total traffic amount is small but a sudden increase in the traffic amount exists.

  In order to solve this problem, it is conceivable to filter by a specific traffic type, extract the difference, and analyze it, but in general there are various types of attacks, and they are applied one by one. The analysis method has a problem that the processing time becomes long when applied to a large-scale network. Even if the attack type can be specified, it is difficult to specify the attack destination AS (Autonomous System) or server, and it is not always possible to specify abnormal traffic even if filtering by the attack type. was there.

  In addition, when the attack that can be detected by the abnormality detection function is only a characteristic attack having a large proportion of the entire network, there is a problem that a combined attack performed in association with the attack cannot be analyzed.

  In the present invention, the above-mentioned problems are solved by providing the following means.

  In the first invention, the traffic volume change cause identification system is linked with an abnormality detection function for detecting abnormal traffic by monitoring traffic flow fluctuations for a plurality of attack types, and extracts only statistical information of a specific traffic type. And a means for extracting the difference between the normal traffic amount and the abnormal traffic amount for each specific traffic and analyzing the cause of the abnormal traffic. Thereby, even when the change amount of the total traffic amount is small, it is possible to extract the difference amount of only specific traffic and analyze the cause.

  According to a second aspect of the present invention, the traffic amount change specifying system acquires, from the abnormality detection function, filter information of an attack type that has detected abnormal traffic when the abnormality detection function detects an abnormality, and the abnormality detection Means for extracting the difference in traffic volume between the normal time and the abnormal time of a specific traffic type using the filter information of the attack type acquired from the function, and analyzing the cause of the abnormal traffic. Accordingly, since analysis is performed using only the filters detected by the anomaly detection means instead of individually executing filters of all attack types, analysis time can be shortened.

  According to a third aspect of the present invention, the traffic amount change specifying system uses means for grouping and holding a plurality of attack types that are considered to be combined as a combined attack, and filter information of the attack type acquired from the abnormality detection function. At the same time as analyzing the cause of abnormal traffic, there is provided means for performing cause analysis of abnormal traffic using filter information of the attack type belonging to the same group as the acquired attack type. As a result, when the attacks that can be detected by the anomaly detection function are only characteristic attacks that account for a large percentage of the entire network, and the combined attacks that are performed in association with the attacks cannot be detected, the change in traffic volume can be specified. In the system, it is possible to analyze other attacks that may occur as a combined attack in addition to the attacks detected by the anomaly detection means.

  According to a fourth aspect of the present invention, the traffic amount change cause identification system acquires, from the abnormality detection function, detection result information of the detected abnormal traffic when the abnormality detection function detects an abnormality, and the abnormality detection And a means for extracting a difference in traffic volume between normal and abnormal traffic that matches the detection result information acquired from the function and analyzing the cause of the abnormal traffic. As a result, all or any of the traffic information (source address, destination address, protocol number, source port number, destination port number, source AS number, destination AS number, routed router interface, etc.) The analysis time can be shortened because only the traffic attack target (IP address, AS number, port, etc.) that matches the anomaly traffic detected by the anomaly detection means is analyzed. It becomes.

  According to a fifth aspect of the present invention, the traffic amount change cause identifying system uses means for grouping and retaining relevant traffic information as information that can be detected as abnormal traffic, and detection result information acquired from the abnormality detection function. And a means for analyzing the cause of abnormal traffic and simultaneously analyzing the cause using the traffic information belonging to the same group as the acquired detection result information. As a result, the attack that can be detected by the anomaly detection function is only a characteristic attack that accounts for a large percentage of the entire network. In the system, it is possible to analyze another attack that can be a target as a combined attack together with an attack on the target detected by the abnormality detection means.

According to a sixth aspect of the present invention, when the traffic amount change cause identification system detects an abnormality in the abnormality detection function, it acquires filter information and detection result information of the attack type that detected the abnormal traffic from the abnormality detection function. A means for grouping and holding a plurality of attack types that are considered to be combined as a combined attack among the plurality of attack types, and grouping related traffic information as information that can be detected as abnormal traffic The cause of the abnormal traffic is analyzed using the holding means and the attack type filter information and detection result information acquired from the anomaly detection function , and at the same time belongs to the same group as the acquired attack type filter information and detection result information. It is also provided with means for performing cause analysis using the traffic information. As a result, if the flow information related to the attack observed on the network is enormous even if it is filtered by a specific attack, and the difference between normal and abnormal cannot be extracted, the specific attack target filter can be used together. The attack type and target can be narrowed down, and as a result, the difference can be extracted and analyzed.

  In addition, the traffic volume change specifying system can be detected when an attack that can be detected by the anomaly detection function is only a characteristic attack having a large proportion of the entire network and a complex attack that is performed accompanying the attack cannot be detected. Thus, it is possible to analyze an attack type that can be implemented as a combined attack together with an attack detected by the abnormality detection means and other attacks related to the target.

  The first effect is that, in an abnormal traffic cause identification system that focuses on the change in traffic volume, even if the total traffic volume change amount is small, the difference amount of only specific traffic is extracted and the cause analysis is performed. It becomes possible.

  The reason for this is that the traffic volume change cause identification system works with the abnormality detection function and uses a group of filters that extract only statistical information of a specific traffic type, and the difference between normal and abnormal traffic volume for each specific traffic. It is for extracting.

  The second effect is that the analysis time can be shortened even when there are many types of attack traffic.

  The reason is that the analysis is performed using only the filters detected by the anomaly detection means instead of individually executing the filters of all attack types.

  The third effect is that the attack that can be detected by the anomaly detection function is only a characteristic attack that accounts for a large proportion of the entire network, and the combined attack that is performed accompanying the attack cannot be detected. It is possible to analyze the attack.

  The reason is that multiple attack types that can be combined as a combined attack are grouped and held, and the cause of abnormal traffic is also analyzed using filter information of attack types belonging to the same group as the acquired attack type. Because.

  The fourth effect is that the analysis time can be shortened when there are a wide variety of addresses, port numbers, AS numbers and transit routers that are the source / destination of the attack.

  The reason for this is not to individually analyze all the combinations of the transmission source / destination of the observed traffic but to analyze only the combination of the transmission source / destination of the attack detected by the anomaly detection means.

  The fifth effect is that an attack that can be detected by the anomaly detection function is only a characteristic attack that accounts for a large proportion of the entire network, and is detected when a complex attack that is performed accompanying the attack cannot be detected. Together with the attack destination (target), it is possible to analyze other attacks that can be targeted as a combined attack.

  The reason is the same as the source / destination of the acquired attack / router, storing the information of the related source / destination, routed router, etc., such as a set of attack targets that are likely to be targeted as a compound attack. In order to analyze the traffic of the source / destination and relay routers belonging to the group.

  The sixth effect can be realized by combining the first to fifth effects.

The reason is that when the traffic amount change cause identification system detects an abnormality in the abnormality detection function, it acquires filter information and detection result information of the detected attack type from the abnormality detection function , and the attack acquired from the abnormality detection function. simultaneously analyzing the cause of the abnormal traffic using the filter information and the detection result information type, for also performs analysis of the reasons for using a traffic information belonging to the same group as the filter information and the detection result information of the acquired attack type It is.

Explanatory drawing which showed the application scene of the traffic amount change cause specific | specification system 300 which is one Embodiment of this invention. Explanatory drawing which showed the list | wrist of the attack filter 500 which the abnormality detection external function part 200 hold | maintains, and the detection result information 510 of the abnormality detection external function part 200. FIG. 4 is an explanatory diagram showing group lists (attack filter group list 311 and traffic information group lists 312 and 313) held by the filter unit 310 of the traffic amount change cause identifying system 300. FIG. FIG. 11 is a flowchart (part 1) of the analysis operation of the traffic amount change cause identification system 300; FIG. 11 is a flowchart (part 2) of the analysis operation of the traffic amount change cause identification system 300; It is explanatory drawing (the 1) which showed the traffic flow rate graph of the flow extracted when the traffic amount change cause specific system 300 analyzes. It is explanatory drawing (the 2) which showed the traffic flow rate graph of the flow extracted when the traffic amount change cause specific system 300 analyzes.

  Hereinafter, a traffic amount change cause identifying system according to an embodiment of the present invention will be described in detail with reference to the drawings.

[Description of configuration]
FIG. 1 is an explanatory diagram showing an application scene of a traffic amount change cause identifying system according to an embodiment of the present invention.

  In the figure, the traffic amount change cause identifying system 300 includes at least a filter unit 310 and an abnormality analysis execution unit 320. The filter unit 310 includes an interface for acquiring the attack filter 500 and the detection result information 510 with the abnormality detection external function unit 200. The flow information accumulation unit 400 is a storage function that holds traffic information observed on the network.

  The abnormality detection external function unit 200 is an external function that can detect an abnormal state such as a DDoS attack using the flow information 520 acquired from the flow information accumulation unit 400. As an implementation method thereof, a certain traffic type For each protocol (protocol, destination IP address, etc.), a method of detecting an attack when a traffic volume exceeding a set threshold value is detected is conceivable, but other implementation methods may be used.

  The flow information storage unit 400 is not limited in the mechanism and holding format for holding traffic information.

  When the abnormality analysis execution unit 320 acquires the flow information 530 from the flow information storage unit 400, the filter condition (attack filter, detection result information) acquired by the filter unit 310 from the abnormality detection external function unit 200 and the filter unit 310 The flow information is selected according to the filter condition to be held, and only the flow information that matches the filter condition is acquired.

  Note that these components do not necessarily have to coexist in the same device, and a configuration in which they are distributed on the network can be taken.

  FIG. 2 is an explanatory diagram showing an example of a list of attack filters 500 and detection result information 510 acquired by the filter unit 310 from the abnormality detection external function unit 200.

  The list of attack filters 500 is filter information for each attack type acquired by the filter unit 310 from the abnormality detection external function unit 200, and the detection result information 510 includes a transmission source IP address, a transmission destination IP address, a protocol number, and a transmission source. The port number, destination port number, router interface, source AS number, destination AS number are held. It should be noted that the list of attack filters 500 is an example, and it is possible to acquire other attack filters. Furthermore, the number of values notified as the detection result information 510 is not limited, and for example, a plurality of transmission source IP addresses can be notified. It is also possible to notify other types of information.

  FIG. 3 is an explanatory diagram showing an attack filter group list 311 and traffic information group lists 312 and 313 held by the filter unit 310.

  The attack filter group list 311 is a list that manages filter information for each attack and attack filters that can be executed simultaneously as a combined attack with the attack, and holds the combined attack filters 1 and 2 for the attack filter. To do. The traffic information group list (destination IP address) 312 is a list of IP address groups that are highly likely to be attacked at the same time, and the prefix length of the stored address is variable. Furthermore, the traffic information group list (transmission destination AS number) 313 is an AS number group list that is highly likely to be attacked at the same time.

  Note that the groups in the attack filter group list 311 illustrated in FIG. 3 are examples, and the number of combined attack filters is not limited to two, and other attack filter groups can be applied. Further, the traffic information group lists 312, 313 are examples, and the number of group members is not limited, and other types of information (source IP address, source port number, destination port number, router information) Etc.) as a group list.

[Description of operation]
FIG. 4A and FIG. 4B are flowcharts illustrating operations when the traffic amount change cause identifying system 300 performs abnormality analysis. Details of (1)-(1) ′, (2)-(2) ′, (3)-(3) ′, and (4)-(4) ′ in FIG. 4-1 are shown in FIG.

  When the abnormality detection external function unit 200 detects an abnormality (S1), the filter unit 310 acquires the detection result information 510 and the attack filter 500 from the abnormality detection external function unit 200 (S2).

  The abnormality analysis execution unit 320 acquires flow information that matches the detection result information 510 acquired in S2 from the flow information accumulation unit 400 (S3-1), or acquired in S2 in the traffic information group lists 312, 313. Flow information that matches the traffic information held in the same group as the detection result information 510 is acquired (S3-2).

  Also, the abnormality analysis execution unit 320 acquires flow information that matches the attack filter 500 gained in S2 from the flow information acquired in S3-1 or S3-2 (S3-3), or an attack filter group list. In 311, flow information that matches the combined attack filter held as the same group as the attack filter 500 acquired in S <b> 2 is acquired (S <b> 3-4).

  The abnormality analysis execution unit 320 executes abnormality analysis using the flow information obtained in S3-1, S3-2, S3-3, and S3-4, and outputs the result.

  FIGS. 5A and 5B illustrate examples of flow information to be analyzed that is acquired by the traffic amount change cause identifying system 300 according to the flowchart of FIG. The horizontal axis of each graph is time, and the vertical axis is traffic flow.

  The traffic amount change cause identifying system 300 sets the period after the time when the anomaly detection external function unit 200 detects an attack as an abnormal period and the period before that as a normal period, and attacks in the abnormal period based on the difference traffic in those areas Maintains the analysis function to analyze traffic. As shown in FIG. 5-1 a), when the difference between the normal section and the abnormal section is small with respect to all the observed traffic flows, the conventional traffic amount change cause identifying system as described above analyzes the attack. I can't.

  Therefore, the attack filter 500 (TCP SYN) applied when the abnormality is detected and the detection result information 510 illustrated in FIG. 2 are acquired from the abnormality detection external function unit 200 in accordance with S2 of FIG.

  In accordance with S3-1, the abnormality analysis execution unit 320 detects the detection result information 510 (transmission destination IP address = 150.10.1.143, transmission destination AS number = 4859) from the flow information held in the flow information accumulation unit 400. By acquiring the flow information that matches, it is possible to acquire only the flow information for a specific IP address or AS number detected as abnormal as shown in FIG.

  Furthermore, according to S3-3, by acquiring only flow information that matches the attack filter 500 (TCP SYN) acquired from the abnormality detection external function unit 200, it is detected as an abnormality as shown in FIG. 5-1 c-1). It is possible to acquire only the flow information of the specified specific attack type.

  This makes it possible to extract the difference between the normal section and the abnormal section by excluding flow information other than the transmission destination IP address, transmission destination AS, and attack type detected as abnormal, and perform abnormality analysis Is possible.

  Further, the abnormality analysis execution unit 320, based on the flow information held in the flow information storage unit 400, detects the detection result information 510 (transmission destination IP address = 150.10.1.143, transmission destination AS number = S3-2). 4859) and traffic information group lists 312 and 313, the flow information matching the traffic information managed as the same group (transmission destination IP address = 15.0.10.1.0 / 24, transmission destination AS number = 4024) is acquired. Thus, as shown in FIG. 5-2 b), it is possible to acquire only the specific IP address and AS number detected as abnormal and the flow information of the IP address and AS number that can be the target of the combined attack at the same time.

  Furthermore, according to S3-4, only flow information that matches the attack filter (ICMP) managed as the same group as the attack filter 500 (TCP SYN) acquired from the abnormality detection external function unit 200 in the attack filter group list 311 is displayed. By acquiring, it is possible to acquire only the flow information of a specific attack type detected as abnormal as shown in FIG. 5-1 c-1) and an attack type that can be used as a combined attack at the same time.

  Thus, even when the abnormality detection external function unit 200 can detect only the attack corresponding to FIG. 5-2 c-1), the attack types that can be targeted or used simultaneously with the attack are also shown in FIG. -1 c-1), FIG. 5-1 c-2), FIG. 5-2 Extracting and analyzing the difference as shown in c-2) enables detection analysis.

  In this way, by combining detection result information and attack filters and using them as conditions for flow acquisition, flow extraction specialized for a specific attack on a specific target (AS, server, port) becomes possible. Analysis that is not affected by the type and amount of flow is possible.

  The traffic amount change cause identification system 300 of this embodiment includes means for executing the steps shown in FIGS. 4A and 4B.

  The traffic amount change cause identification system 300 of this embodiment can be configured by a computer and a program. Moreover, you may comprise a part or all of the program with a hardware.

  Although the embodiment of the present invention has been specifically described above, the traffic amount change cause identifying system according to the embodiment of the present invention basically receives the traffic statistical information from the network device, and each of the plurality of attack types. A traffic volume change cause identification system that identifies the cause of traffic change based on the difference between normal and abnormal traffic volume, in conjunction with the abnormal detection function that detects abnormal traffic by monitoring traffic flow fluctuations And a means for extracting the difference between normal and abnormal traffic for each specific traffic using a filter group that extracts only statistical information of a specific traffic type and analyzing the cause of abnormal traffic. Just do it.

  The traffic amount change cause identifying system according to the embodiment of the present invention includes: means for acquiring filter information of an attack type that detects abnormal traffic from the abnormality detection function when the abnormality detection function detects abnormality; By using the filter information of the attack type acquired from the function, it is possible to provide means for extracting the difference between the normal traffic amount and the abnormal traffic amount of the specific traffic type and analyzing the cause of the abnormal traffic.

In addition, the cause of abnormal traffic can be determined using means for grouping and holding a plurality of attack types considered to be combined as a combined attack with the plurality of attack types, and filter information of the attack type acquired from the abnormality detection function. Simultaneously with the analysis, a means for performing cause analysis of abnormal traffic using filter information of the attack type belonging to the same group as the acquired attack type can be provided.

  In addition, when the abnormality detection function detects an abnormality, a means for acquiring detection result information of the detected abnormal traffic from the abnormality detection function, and normal traffic matching the detection result information acquired from the abnormality detection function It is possible to provide means for extracting the difference between the traffic volume at the time and the abnormal time and analyzing the cause of the abnormal traffic.

  Also, means for grouping and retaining relevant traffic information as information that can be detected as anomalous traffic, and analyzing the cause of the anomaly traffic using the detection result information obtained from the anomaly detection function, and the obtained detection Means for analyzing the cause using the traffic information belonging to the same group as the result information can be provided.

In addition, when the abnormality detection function detects an abnormality, a filter that acquires filter information and detection result information of the attack type that detected the abnormal traffic from the abnormality detection function, and a combination of the plurality of attack types A means for grouping and holding a plurality of attack types considered to be combined as an attack, a means for grouping and holding relevant traffic information as information that can be detected as abnormal traffic, and an attack acquired from the abnormality detection function simultaneously analyzing the cause of the abnormal traffic using the filter information and the detection result information type, the acquired attack type of filter information and the detection result information and means also performs analysis of the reasons for using a traffic information belonging to the same group Can be provided.

  It should be noted that the present invention is not necessarily limited to the above-described mounting form, and various modifications can be made without departing from the scope of the present invention. Of course, it is possible.

200 ... anomaly detection external function unit, 300 ... traffic amount change cause identification system, 310 ... filter unit, 311 ... attack filter group list, 312 ... traffic information group list (destination IP address), 313 ... traffic information group list (transmission) Destination AS number), 320 ... abnormality analysis execution unit, 400 ... flow information storage unit, 500 ... attack filter, 510 ... detection result information, 530 ... flow information

Claims (7)

Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types , A traffic amount change cause identifying system for identifying the cause of traffic change,
Using a group of filters to extract only the statistics for a specific traffic type, and extracts a difference normal state and abnormal traffic amount for each particular traffic, traffic changes caused comprising means for analyzing the cause of the abnormal traffic In a specific system,
Means for acquiring, from the abnormality detection function, filter information of an attack type that has detected abnormal traffic when the abnormality detection function detects an abnormality;
A means for extracting a difference between normal and abnormal traffic volume of a specific traffic type using the attack type filter information acquired from the abnormality detection function and analyzing the cause of the abnormal traffic is provided. Traffic volume change cause identification system. Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types , A traffic amount change cause identifying system for identifying the cause of traffic change,
Using a filter group that extracts only statistical information of a specific traffic type, for each specific traffic, extract the difference between normal and abnormal traffic volume and analyze the cause of abnormal traffic. In a specific system,
Means for grouping and holding a plurality of attack types considered to be combined as a combined attack with the plurality of attack types;
The cause of abnormal traffic is analyzed using the attack type filter information acquired from the abnormality detection function, and the cause of abnormal traffic is also analyzed using the filter information of the attack type belonging to the same group as the acquired attack type. A traffic volume change cause identifying system comprising: means. Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types , A traffic amount change cause identifying system for identifying the cause of traffic change,
Using a filter group that extracts only statistical information of a specific traffic type, for each specific traffic, extract the difference between normal and abnormal traffic volume and analyze the cause of abnormal traffic. In a specific system,
Means for grouping and retaining relevant traffic information as information that can be detected as anomalous traffic;
A means for analyzing the cause of abnormal traffic using the detection result information acquired from the abnormality detection function, and simultaneously analyzing the cause using traffic information belonging to the same group as the acquired detection result information. A traffic volume change cause identification system. Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types , A traffic amount change cause identifying system for identifying the cause of traffic change,
Using a filter group that extracts only statistical information of a specific traffic type, for each specific traffic, extract the difference between normal and abnormal traffic volume and analyze the cause of abnormal traffic. In a specific system,
Means for acquiring filter information and detection result information of the attack type that detected the abnormal traffic from the abnormality detection function when the abnormality detection function detects an abnormality;
Means for grouping and holding a plurality of attack types considered to be combined as a compound attack among the plurality of attack types;
Means for grouping and retaining relevant traffic information as information that can be detected as anomalous traffic;
Analyzing the cause of abnormal traffic using the filter information and detection result information of the attack type acquired from the abnormality detection function, and simultaneously using the traffic information belonging to the same group as the filter information and detection result information of the acquired attack type A traffic volume change cause identification system characterized by comprising means for performing cause analysis. Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types The traffic amount change cause identifying method of the traffic amount change cause identifying system for identifying the cause traffic of the traffic amount change,
The traffic volume change cause identifying system uses a filter group that extracts only statistical information of a specific traffic type, extracts a difference between normal and abnormal traffic volume for each specific traffic, and determines the cause of abnormal traffic. In the method for identifying the cause of change in traffic volume to be analyzed ,
When the abnormality detection function detects an abnormality, the filter information of the attack type that detected the abnormal traffic is acquired from the abnormality detection function,
Using the filter information of the attack type acquired from the anomaly detection function, the difference between the normal and abnormal traffic volume of a specific traffic type is extracted, and the cause of the abnormal traffic is analyzed. Cause identification method. Based on the difference in traffic volume between normal and abnormal conditions in cooperation with anomaly detection function that detects abnormal traffic by receiving traffic statistics from network devices and monitoring traffic flow fluctuations for multiple attack types , A traffic volume change cause identifying device for identifying the cause traffic of the traffic volume change,
Using a group of filters to extract only the statistics for a specific traffic type, and extracts a difference normal state and abnormal traffic amount for each particular traffic, traffic changes caused comprising means for analyzing the cause of the abnormal traffic In a specific device,
Means for acquiring, from the abnormality detection function, filter information of an attack type that has detected abnormal traffic when the abnormality detection function detects an abnormality;
A means for extracting a difference between normal and abnormal traffic volume of a specific traffic type using the attack type filter information acquired from the abnormality detection function and analyzing the cause of the abnormal traffic is provided. Traffic volume change cause identification device. A program for causing a computer to function as the traffic amount change cause identifying system according to any one of claims 1 to 4 .

Images