JP5317294B2 - BGP illegal message detection method and apparatus - Google Patents

Description

  The present invention relates to a method and an apparatus for detecting an illegal message based on a fluctuation status of an attribute for each prefix notified by a BGP message in a BGP network.

  Anomaly detection has been extensively studied in the field of computer security. Non-Patent Documents 1 and 2 disclose anomaly detection technology in the computer security field. Non-Patent Document 1 is a method in which an abnormal pattern is defined from a traffic pattern at the time of abnormality observed in the past, and is detected as an abnormal state when traffic of the same pattern is observed in a monitoring network. Non-Patent Document 2 is a method of detecting a case where a current feature amount exceeds a certain threshold value as compared with a past statistical feature amount as an abnormal state using a feature amount such as a traffic amount.

  Non-Patent Document 3 is a technique in which the detection methods disclosed in Non-Patent Documents 1 and 2 are applied to abnormality detection of a BGP network. Non-Patent Document 4 is an anomaly detection method specialized in path hijack detection in a BGP network, focusing on changes in the prefix's public information source AS notified by the BGP message. This is a method of detecting a change from the normal state as an abnormal state.

M. Roesch, Snort: Lightweight intrusion detection for networks, USENIX LISA Conference, 1999. H.S.Javitz, and A. Valdes, The NIDES Statistical Component: Description and Justification, SRI International, 1993. K. Zhang, A. Yen, X. Zhao, D. Massey, S. F. Wu, and L. Zhang, On detection of anomalous routing dynamics in BGP, IFIP-TC6 Networking, 2004. J. Karlin, S. Forrest, and J. Rexford, Pretty Good BGP: Improving BGP by Cautiously Adopting Routes, ICNP, 2006.

  In the prior art represented by Non-Patent Document 1, an abnormal pattern is defined from a traffic pattern at the time of abnormality observed in the past, and traffic matching the same pattern is detected as an abnormal state. As a practical example, in Non-Patent Document 3, six abnormal patterns are defined from path fluctuations at the time of abnormality observed in a real BGP network, and path fluctuations matching the same pattern are detected. However, since abnormality detection by this method is limited to path fluctuations that match a predefined pattern, abnormal fluctuations that have not been observed in the past cannot be detected.

  In Non-Patent Document 2, a case where the current feature value exceeds a certain threshold value compared to a past statistical feature value such as traffic amount is detected as an abnormal state. Therefore, the feature value is significantly different from the normal value. Unusable abnormal fluctuations cannot be detected.

  In Non-Patent Document 3, the degree of deviation from the normal time is calculated using the number of BGP messages per unit time for each prefix and the number of appearances of AS in the AS_PATH attribute, and a case where a certain threshold is exceeded is detected as an abnormal state. Is done. However, since the present method is an abnormality detection based on the feature amount, an abnormal variation in which the feature amount is not significantly different from that in the normal state cannot be detected. Further, even if an abnormal state can be detected, an illegal message that causes the abnormal state cannot be identified.

  In Non-Patent Document 4, attention is paid to a change in the prefix public information source AS notified by the BGP message, and the change is detected. Since this method focuses on the fact that there is little change in the public information source AS in the AS_PATH attribute, the number of detections becomes enormous when targeting frequently changing attributes, and it is not possible to easily identify fraudulent messages.

  The object of the present invention is to solve the above-mentioned problems of the prior art and easily identify an abnormal message that causes an abnormality that has not been observed in the past and an abnormality that does not significantly deviate from the feature amount compared to the normal state. An object of the present invention is to provide a method and an apparatus for detecting a BGP illegal message.

  In order to achieve the above object, the present invention provides the following means in a BGP illegal message detection apparatus for detecting an illegal message included in a BGP message advertised from each AS on a BGP network. There are features.

  (1) Message collection means that collects messages that advertise BGP route updates, fluctuation detection means that detects fluctuations in attributes added to messages, and estimation that estimates messages with specific attribute fluctuations as invalid messages Means.

  (2) The estimation means estimates a specific message based on the small number of ASs that use the attribute value after the change.

  (3) It comprises means for collecting a BGP route table and means for detecting an initial value of each attribute for each prefix based on the BGP route table, and the estimating means refers to the BGP route table for each prefix. The initial value of each attribute is grasped, and if the attribute value of a new prefix that has not been observed in the past is the same as the initial value, this is not regarded as a specific attribute variation.

  (4) It comprises means for collecting a BGP routing table and means for counting the number of ASs that use each attribute value for each attribute based on the BGP routing table, and the estimation means is based on many ASs in the BGP routing table. The change to the used attribute value is not judged as a specific attribute change.

  According to the present invention, the following effects are achieved.

  (1) Since a message with a specific change in attribute added to a message that broadcasts BGP route update is presumed to be an illegal message, an illegal message that causes an abnormality that has not been observed in the past or normal It becomes possible to easily detect a fraudulent message that causes an abnormality in which the feature amount is not significantly different from that of the time.

  (2) Since a message with a small number of ASs using the changed attribute value is determined as a specific message, it is easy to detect a specific message.

  (3) By referring to the BGP routing table, the initial value of each attribute is ascertained for each prefix, and even if the message has a new prefix that has not been observed in the past, the changed attribute value is the initial value. Since it is not extracted as an attribute variation, it is possible to prevent all prefix attribute values that have not been observed in the past from being extracted as an attribute variation.

  (4) The attribute value of the attribute variation that was made relatively specific based on the BGP message is checked against the BGP route table, and the specific attribute is used when there are many ASs that use the attribute value after the variation. Since it is not a fluctuation, it is possible to prevent erroneous detection in which a small number of regular messages are regarded as specific illegal messages.

It is a block diagram of a BGP illegal message detection device according to an embodiment of the present invention. It is a block diagram of other embodiment of a BGP illegal message detection apparatus. It is the block diagram which showed the structure of the BGP network to which this invention is applied. It is a functional block diagram of the calculation server which concerns on 1st Embodiment of this invention. It is the flowchart which showed the operation | movement of 1st Embodiment of this invention. It is the figure which expressed typically an example of the extraction result of attribute fluctuation. It is the figure which showed the list | wrist of AS number which uses the attribute value after a fluctuation | variation. It is the figure which showed an example of the grouping based on the attribute value after a fluctuation | variation. It is the figure which showed an example of the extraction result of an entry with a specific attribute fluctuation | variation. It is a functional block diagram of the calculation server which concerns on 2nd Embodiment of this invention. It is a functional block diagram of the calculation server which concerns on 3rd Embodiment of this invention. It is the figure which expressed typically an example of the total result of the frequency of the attribute value of an attribute. It is the figure which expressed typically the estimation method of a fraudulent message. It is the figure which showed the example of extraction of an unauthorized message. It is the figure which showed the example of a display of the detection result of an unauthorized message.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a BGP illegal message detection apparatus according to an embodiment of the present invention, and BGP messages collected by relaying a border router R from a managed BGP router (AS 20 described later). The calculation server 1 that acquires a BGP routing table and detects an illegal message and a suspicious AS as a public information source for each prefix, and a display device 2 that displays the detection result are mainly configured.

  The network and the calculation server 1 may be connected online as shown in FIG. 1, or may be offline as in another embodiment shown in FIG. In this case, the BGP message collected by the managed BGP router and the log data of the BGP routing table are taken into the calculation server 1 via the disk-shaped recording medium 3 and the portable semiconductor memory 4.

  FIG. 3 is a block diagram showing a configuration of a BGP network to which the present invention is applied. The same reference numerals as those described above represent the same or equivalent parts. In the present embodiment, attention is paid to six ASs (AS10 to AS60) constituting the network, and a case where the AS 50 is a fraudulent message publicity source is described as an example.

[Embodiment 1]
FIG. 4 is a functional block diagram of the calculation server 1 according to the first embodiment of the present invention. Here, illustrations of components unnecessary for the description of the present invention are omitted.

  The message extraction unit 101 extracts an ANNOUNCE message that advertises BGP route update from the BGP messages observed and collected by the BGP router AS20. The fluctuation detecting unit 102 extracts the attribute value of each attribute described in the ANNOUNCE message for each prefix, and the attribute value of each attribute described in the ANNOUNCE message observed before and after the attribute value extracting unit 102a. A fluctuation extracting unit 102b that extracts a fluctuation of the attribute value by comparing each prefix is included. The fraudulent message detection unit 103 includes a classification unit 103a that classifies the attribute variation according to the attribute value after variation, and an estimation unit 103b that estimates a message with a specific attribute variation as a fraudulent message based on the classification result. Including.

  FIG. 5 is a flowchart showing the operation of the present embodiment, and mainly shows the operation of the calculation server 1.

  In step S1, the message extraction unit 101 extracts an ANNOUNCE message from a number of BGP messages observed and collected by the BGP router AS20. In step S2, attributes (path attributes) described as additional information in each ANNOUNCE message and their attribute values are extracted by the attribute value extraction unit 102a. The attributes include “ORIGIN” indicating the origin of the route information, “AS_PATH” indicating a list of AS numbers that are passed to reach a certain route, “NEXT_HOP” indicating the address of the router to which the traffic should be forwarded, etc. is there.

  In step S3, the variation extraction unit 102b extracts the attribute variation for each prefix by comparing the attribute values described in the ANNOUNCE message observed before and after and having the same prefix for each attribute. At this time, all the attributes described in the ANNOUNCE message of a new prefix that has not been observed in the past are extracted as fluctuations.

  FIG. 6 is a diagram schematically showing an example of attribute fluctuations extracted for each prefix by the fluctuation extraction unit 102b. In this embodiment, each time an attribute value fluctuation is detected, the observation date, An observation time, a public information source AS, a prefix, a changed attribute (change attribute), and an attribute value after change are associated and entered.

  In FIG. 6, an entry whose “variable attribute” is “ORIGIN” and whose “attribute value” is “IGP” means that the attribute value of the “ORIGIN” attribute corresponding to a certain prefix has changed to “IGP”. . An entry whose "variable attribute" is "NEXT_HOP" and whose "attribute value" is "2.2.2.2" means that the attribute value of the "NEXT_HOP" attribute corresponding to a certain prefix has changed to "2.2.2.2" . An entry whose “variable attribute” is “AS_PATH” and whose “attribute value” is “3” means that the attribute value of the AS_PATH length corresponding to a certain prefix has changed to “3”.

  The public information source AS of each message can be detected as the rightmost AS in the AS_PATH attribute. For example, if AS_PATH is [20 30 60], the public information AS is “60”. Also, AS_PATH is different for each AS, so it is analyzed using AS_PATH length. In the present embodiment, the number of ASs included in AS_PATH is adopted as the AS_PATH length. Therefore, if AS_PATH is [20 30 60], the AS_PATH length is “3”.

  Returning to FIG. 5, in step S4, in order to determine the specificity of each attribute variation, the entries are grouped by the classification unit 103a according to the attribute value after the variation. FIGS. 7 and 8 are diagrams showing an example of the grouping. Here, entries having the same attribute value after attribute change occurring at the same time interval (for example, 1 minute) are classified into the same group, The AS number is detected.

  In this embodiment, the entries corresponding to the two prefixes that publicize that the “variable attribute” “ORIGIN” has changed to the “attribute value” “IGP” are classified into the same group. Also, the entries corresponding to the four prefixes that publicize that the “change attribute” “NEXT_HOP” has changed to “attribute value” “2.2.2.2” are also classified into the same group. Furthermore, the entries corresponding to the two prefixes that publicize that the “change attribute” “AS_PATH” has changed to “attribute value” “3” are also classified into the same group.

  However, even if the “attribute value” after the change is the same, entries with different message observation dates / times are classified into different groups. In the example of FIGS. 7 and 8, among the five entries whose attribute value of “variable attribute” “NEXT_HOP” is changed to “2.2.2.2”, four entries whose observation time is 16:11 are classified into the same group. However, entries in the 16:12 range are not classified into the same group. In addition, since two entries whose attribute value of “variable attribute” “NEXT_HOP” fluctuated to “3.3.3.3” have the same publicity AS (both AS50), the number of ASs that use the same attribute value after fluctuation is 1

  In step S5, based on the grouping results shown in FIGS. 7 and 8, the estimation unit 103b extracts an entry with a specific attribute variation. In this embodiment, as shown in an example in FIG. 9, the attribute value of “variable attribute” “NEXT_HOP” is expressed as a minority grouped into a group whose AS number using the attribute value after variation is “1”. An entry with "4.4.4.4", two entries with "3.3.3.3" attribute value for "variable attribute" "NEXT_HOP", and an attribute value with "2.2.2.2" for "variable attribute" "NEXT_HOP" A total of four entries are extracted, and a message that publicizes them is presumed to be an invalid message.

  In step S6, the public information source ASs (AS40, AS50, and AS60) of the extracted four entries are detected as candidates for the fraudulent message public information source AS. In step S <b> 7, the detection result is output to the display unit 2.

  According to the present embodiment, since a message with a specific change in attribute added to a message that broadcasts BGP route update is estimated to be an invalid message, an illegal cause that causes an abnormality that has not been observed in the past. It becomes possible to easily detect a message or an illegal message that causes an abnormality in which the feature amount is not significantly different from that in a normal state. Further, in this embodiment, when there are a small number of ASs that broadcast the same attribute value after the change, the message is determined to be a specific message, so that a specific message can be easily detected.

[Embodiment 2]
In the first embodiment described above, since all the attributes described in the ANNOUNCE message of the prefix that has not been observed in the past are extracted as variations, there is a case where a regular message is mistaken for an invalid message. . Therefore, in the second embodiment of the present invention, the initial value of each attribute is grasped for each prefix by referring to the BGP routing table, and even if it is an ANNOUNCE message of a new prefix that has not been observed in the past, If the attribute value is the same as the initial value, it is not extracted as a variation.

  FIG. 10 is a functional block diagram of the calculation server 1 according to the second embodiment of the present invention. Since the same reference numerals as those described above represent the same or equivalent parts, the description thereof is omitted.

  The routing table extraction unit 104 extracts the BGP routing table collected by the BGP router AS20. The initial value detection unit 105 detects the initial value of each attribute for each prefix based on the extracted BGP route table. The variation narrowing unit 102c of the variation detecting unit 102 registers the attribute variation extracted by the variation extracting unit 102b as an initial value in the BGP route table as a new prefix that has not been observed in the past. If it is not registered, the attribute variation is maintained. On the other hand, if it is already registered, the attribute variation is narrowed down by canceling the attribute variation.

  According to the present embodiment, it is possible to prevent all attribute values of prefixes that have not been observed in the past from being extracted as attribute variations.

[Embodiment 3]
In the first embodiment described above, it has been described that a relatively specific variation is extracted by comparing the variation state of the attribute described in the observed ANNOUNCE message. However, in the present embodiment, BGP is used. By compiling the route information in advance, the number of ASs that use each attribute value for each attribute is grasped, and for the attribute values used by many ASs in the BGP route table, the number of messages that advertise this as attribute variation is At least it is not determined to be specific.

  FIG. 11 is a functional block diagram of the calculation server 1 according to the third embodiment of the present invention. Since the same reference numerals as those described above represent the same or equivalent parts, the description thereof is omitted.

  The totaling unit 106 totals the number of ASs using each attribute value for each attribute based on the extracted initial value of the BGP routing table. In addition to the function in the first embodiment, the estimation unit 103b further determines that a message including a prefix that changes to an attribute value used by many ASs in the routing table for each attribute is specific. It has a function that does not.

  FIG. 12 is a diagram schematically showing an example of the result of counting the AS number. In this example, the AS number (frequency) using “4.4.4.4” as “attribute value” of “attribute” “NEXT_HOP”. ) Is 44,444, indicating that the number of AS using "2.2.2.2" is 22,222.

  As shown in an example in FIG. 13, the estimation unit 103 b collates entries (here, four) in which attribute fluctuations are specific with the number of ASs using each attribute value for each attribute. Estimate the AS of PR of illegal messages. In the present embodiment, the attribute values “2.2.2.2” and “4.4.4.4” of the “variable attribute” “NEXT_HOP” are clearly used from many BGP routing tables, whereas the attribute value “ Since there is no AS using 3.3.3.3 ", as shown in Fig. 14, only entries whose attribute value after change is" 3.3.3.3 "are extracted as specific, and this specific change A message containing FIG. 15 is a diagram illustrating an example of an unauthorized message output to the display device 2.

  According to the present embodiment, since a message including a prefix that has changed to an attribute value used by many ASs in the BGP routing table is not determined to be specific, an error in which a small number of regular messages are specified as specific malicious messages. Detection can be prevented.

  DESCRIPTION OF SYMBOLS 1 ... Calculation server, 2 ... Display apparatus, 101 ... Message extraction part, 102 ... Fluctuation detection part, 102a ... Attribute value extraction part, 102b ... Fluctuation extraction part, 103 ... Fraud message detection part, 103a ... Classification part, 103b ... Estimation 104: Route table extraction unit 105 ... Initial value detection unit 106 ... Counting unit

Claims (6)

In the BGP fraudulent message detection device that detects fraudulent messages included in BGP messages advertised from each AS on the BGP network,
A message collection means for collecting messages for advertising BGP route updates;
A fluctuation detecting means for detecting a fluctuation of the attribute added to the message for each prefix;
An estimation means for estimating a message having a specific attribute variation as an illegal message ,
The BGP improper message detection apparatus characterized in that the estimation means makes an attribute change with a small AS which advertises a change to the same attribute value for each attribute specific . A means of collecting BGP routing tables;
A means for detecting an initial value of each attribute for each prefix based on the BGP routing table;
The estimation means grasps the initial value of each attribute for each prefix by referring to the BGP route table, and if the attribute value of a new prefix that has not been observed in the past is the same as the initial value, this is used. The BGP illegal message detection apparatus according to claim 1 , wherein the attribute change is not specific. A means of collecting BGP routing tables;
Based on the BGP routing table, comprising means for counting the number of ASs using each attribute value for each attribute,
2. The BGP illegal message detection device according to claim 1 , wherein the estimating means does not make a change to an attribute value used by many ASs in the BGP route table a specific attribute change. The message collection unit, BGP bad message detection device according to any one of claims 1 to 3, characterized in that collecting the messages online from BGP router. The message collection unit, BGP bad message detection device according to any one of claims 1 to 3, characterized in that collecting messages offline BGP router. In the BGP fraudulent message detection method for detecting fraudulent messages contained in BGP messages advertised from each AS on the BGP network,
A procedure for collecting messages to publicize BGP route updates;
A procedure for detecting, for each prefix, a change in an attribute added to the message;
Only contains the procedure for change of the attribute it is estimated that unauthorized messages specific message,
The BGP illegal message detection method characterized in that, in the estimating step, an attribute change with a small AS that advertises a change to the same attribute value for each attribute is made specific .

Images