JP5582499B2 - Network monitoring method, system, apparatus and program - Google Patents

Description

  The present invention relates to a network monitoring method, system, apparatus, and program, and more particularly, to a network monitoring method, system, apparatus, and program for monitoring a network using an unused address group.

  The damage caused by malware (malicious software) called worms and botnets is spreading and becoming more serious. Network monitoring technology is required to detect malicious communications intended to spread malware attacks and end-host infections.

  As conventional network monitoring methods targeting malware, there are a method of distributing sensor servers on a network and a method of using an unused address set called a dark net (for example, see Non-Patent Document 1). However, the information that can be collected by these methods is limited to information such as the IP address of the attack source and the port number of the attack source or attack destination, and there is a drawback that it is not possible to obtain information related to details such as the attack contents of the malware.

  As an attempt to compensate for the above drawbacks, an approach has been proposed in which detailed information such as malware attacks is collected using a decoy server called a honeypot (see Non-Patent Document 2, for example). .

  Honeypots behave like regular hosts when viewed by an attacker. There are cases where honeypots are configured by infecting an actual vulnerable OS with malware and observing activity, or by using services that emulate vulnerabilities and return pseudo responses. In both cases, honeypots operate under the control of the supervisor, and are therefore capable of collecting malware information safely.

A. Shimoda and S. Goto, "Flow-based Internet Threat Detection with Dark IP (in Japanese)," IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences, vol. J92-B, no. 1, pp. 163173, 2009 . L. Spitzner, "The honeynet project: Trapping the hackers," IEEE Security & Privacy Magazine, vol. 1, no. 2, pp. 1523, 2003.

  However, although a honeypot is effective as a means for obtaining detailed information on malware, there is a problem that only limited information can be collected when a honeypot is operated using a single address. When operating a honeypot on a plurality of addresses, it is common to use an unused set of consecutive addresses (subnets) as in the dark net described above. Consecutive unused address sets are easy to handle in setting the route of attack packets, and increase the risk that an attacker will know the existence of a honeypot. In addition, when a plurality of addresses are used for honeypots, there is still a problem that the collected data is biased because the addresses are concentrated in the subnet.

  Furthermore, operating multiple types of monitoring servers such as honeypots and sensor servers at the same time and seeing the difference in their behavior is useful for obtaining more information about malware or for comparing performance between monitoring servers. Although an effective approach, there has never been a technique to achieve such an objective.

  The present invention has been made in view of the above problems, and dynamically extracts an address group that can be used for monitoring purposes from a network that is actually used, and operates the monitoring server with the acquired address group. An object of the present invention is to provide a network monitoring method, system, apparatus, and program that can be used.

In order to solve the above problems, the present invention (Claim 1) is a network monitoring system for monitoring network traffic,
At least one or more monitoring servers, a traffic analysis device for analyzing traffic on a network line or externally attached network, a traffic transfer device for transferring received packets to any monitoring server, and an internal host,
The traffic analyzer is
Analyzes the traffic from the external host of the external network to the internal host inside the network, and when there is a communication request from the external host to the internal host for a certain period of time, does not return any response, but requests communication to the external host by itself Monitoring address list generating means for extracting the internal hosts that did not transmit and registering the set of addresses assigned to each of the internal host sets and the identifier of the monitoring server in the storage means as a monitoring address list; ,
May be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and only one-way communication from the external host to the internal host is observed over a certain period with reference to the communication recording unit, or An additional means for adding the address of the internal host to the monitoring address list when no communication is observed;
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion means for deleting the address of the internal host from the monitoring address list;
Monitoring address list transfer means for transmitting the monitoring address list to the traffic transfer device at a predetermined cycle;
Have
The traffic forwarding device is:
Referring to the monitoring address list acquired from the traffic analysis device, the packet addressed to the internal server address is set to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. A transfer control means for transmitting to the server and not forwarding to the internal server of the destination address of the packet;
The monitoring server is
The packet transferred from the traffic transfer device is received, the packet is processed instead of the internal host of the original packet destination, and the processing result is directly or addressed to the address of the external host of the packet source, Proxy processing means for transmitting via the traffic transfer device,
Have.

The present invention (Claim 2) is the traffic analyzer according to Claim 1 described above,
There is further provided means for generating an address list for only an internal host included in the monitoring address list or for only an internal host not included in the monitoring address list and storing the address list in a storage unit .

The present invention (Claim 3) provides the monitoring address list generating means of the traffic analysis device according to Claim 1,
The internal host addresses X included in the monitoring address list are classified into a plurality of groups at random or using a hash function H (X) having a characteristic of returning a unique value for the same address X Includes grouping means.

The present invention (Claim 4) is the traffic analyzer according to Claim 1 described above,
Means for generating a non-monitoring address list comprising a set of addresses assigned to each of the internal host sets and a communication type classified by a protocol type;
In the traffic transfer device,
Means for transferring only packets that do not match the address of the internal host described in the non-monitoring address list and the communication type to the monitoring server.
Further, the present invention (Claim 5) is the traffic analyzer according to Claim 4 described above,
There is further provided means for generating an address list for only an internal host included in the non-monitoring address list or for only an internal host not included in the non-monitoring address list and storing the address list in a storage unit.

The present invention (Claim 6) is a network monitoring method for monitoring network traffic,
In a system having at least one or more monitoring servers, a traffic analysis device that analyzes traffic on a network line or externally attached network, a traffic transfer device that transfers received packets to any monitoring server, and an internal host ,
The traffic analyzer is
Analyzes the traffic from the external host of the external network to the internal host inside the network, and when there is a communication request from the external host to the internal host for a certain period of time, does not return any response, but requests communication to the external host by itself A monitoring address list generating step for extracting an internal host that has not transmitted a message and associating a set of addresses assigned to each of the internal host sets with the identifier of the monitoring server and registering them in the storage means as a monitoring address list; may be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and the communication recording means is If only one-way communication from the external host to the internal host is observed over a certain period of time with reference, or if no communication is observed, the address of the internal host is added to the monitoring address list And additional steps to
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion step of deleting the address of the internal host from the monitoring address list;
A monitoring address list transfer step of transmitting the monitoring address list to the traffic transfer device at a predetermined period;
And
The traffic forwarding device is:
Referring to the monitoring address list acquired from the traffic analysis device, the packet addressed to the internal server address is set to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. A transfer control step that transmits to the server and does not forward to the internal server of the destination address of the packet,
The monitoring server is
The packet transferred from the traffic transfer device is received, the packet is processed instead of the internal host of the original traffic destination, and the processing result is directly or directly to the address of the external host that is the source of the packet, A proxy processing step of transmitting via the traffic transfer device is performed.

The present invention (Claim 7 ) is the network monitoring method according to Claim 6 ,
A step of generating an address list for only the internal hosts included in the monitoring address list or for only an internal host not included in the monitoring address list and storing it in the storage means is further performed.

Further, the present invention (invention 8 ) is the monitoring address list generation step of claim 6 described above,
The internal host addresses X included in the monitoring address list are classified into a plurality of groups at random or using a hash function H (X) having a characteristic of returning a unique value for the same address X .

Further, the present invention (Claim 9 ) applies an arbitrary conversion X ′ to the address X when applying the hash function H (X) to the address X in the above Claim 8 . Use H (X) with hash function applied.

Further, the present invention (Claim 10 ) is the traffic analyzer according to Claim 6 ,
Generating a non-monitoring address list comprising a set of addresses assigned to each of the internal host sets and a communication type classified by a protocol type;
In the traffic transfer device,
Only the traffic that does not match the address of the internal host described in the non-monitoring address list and the communication type is transferred to the monitoring server.
Further, the present invention (invention 11) is the traffic analyzer according to claim 10, wherein
A step of generating an address list for only the internal hosts included in the non-monitoring address list or for only an internal host not included in the non-monitoring address list and storing it in the storage means is further performed.

The present invention (Claim 12) is a network monitoring device for monitoring network traffic,
Traffic analysis means for analyzing traffic on the network, traffic forwarding means for forwarding the received packet to any monitoring server,
The traffic analysis means includes:
Analyze the traffic from the external host of the external network to the internal host in the monitored network. If there is a communication request from the external host to the internal host for a certain period of time, no response will be returned to the external host. A means for extracting an internal host that has not transmitted a communication request, and storing a set of addresses assigned to each of the internal host sets and an identifier of a monitoring server connected to the traffic transfer means as a monitoring address list Monitoring address list generation means to be registered in
May be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and only one-way communication from the external host to the internal host is observed over a certain period with reference to the communication recording unit, or An additional means for adding the address of the internal host to the monitoring address list when no communication is observed;
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion means for deleting the address of the internal host from the monitoring address list;
Monitoring address list transfer means for transmitting the monitoring address list to the traffic transfer means at a predetermined cycle;
Have
The traffic transfer means includes:
Referring to the monitoring address list acquired from the traffic analysis means, the packet addressed to the internal server address is sent to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. Transfer control means for transmitting to the server and not transferring to the internal server at the destination address of the packet is provided.

The present invention (Claim 13 ) is a network monitoring program for causing a computer to function as each means constituting the network monitoring device according to Claim 12 .

  As described above, the present invention does not return any response despite a communication request from an external network host (external host), and issues a communication request to the outside itself within a certain period of time. It is possible to collect and analyze malware information by detecting the internal host that did not exist, temporarily assigning the address to a monitoring server such as a honeypot or sensor server, and operating the monitoring server as a trap server. .

It is a system configuration example of the present invention. It is a figure which shows operation | movement of the traffic analyzer in the 1st Embodiment of this invention. It is an additional flowchart to the monitoring address list in the first embodiment of the present invention. It is an example of the traffic transfer in the case of the monitoring object address in the 1st Embodiment of this invention. It is a figure which shows a series of operation | movement in the 1st Embodiment of this invention. It is a figure which shows the operation | movement in the 2nd Embodiment of this invention. It is a flowchart of operation | movement when the internal host in the 2nd Embodiment of this invention is a transmission origin.

  Embodiments of the present invention will be described below with reference to the drawings.

  In the following example, the network is an IP packet network based on TCP / IP, the address is an IPv4 address in the TCP / IP network, and the communication type is a numerical value specified by the destination port number in the packet for the internal host. The scope of the invention is not limited to this.

[First embodiment]
FIG. 1 shows a system configuration example of the present invention.

  The system configuration example shown in FIG. 1 includes an external network 1 and an internal network 100. The internal network 100 includes two monitoring servers 110a and 110b that function as honeypots and sensor servers, a traffic transfer device 120, and a traffic. The analyzer 130 is composed of internal hosts 140a, 140b, and 140c. The system configuration will be described as the same in the following second to fourth embodiments. Further, the numbers of the monitoring servers 110 and the internal hosts 140 are not limited to the example in FIG. 1, and any number can be set.

  Traffic on the network is analyzed by the traffic analysis device 130, and communication for each of the hosts 140a, 140b, 140c in the network is analyzed.

  The traffic transfer device 120 and the monitoring servers 110a and 110b may be mounted on the same physical device as the traffic analysis device 130, but here are separate devices.

  The traffic analysis device 130 is inserted on a network line or externally attached by a method such as a tap or a mirror, and analyzes the traffic on the network for each internal host 140 in the network.

  The traffic analyzer 130 has the following functions.

As shown in FIG. 2, the traffic analysis device 130 sends out any response when there is a communication request from a host of the external network 1 (hereinafter referred to as “external host”) among the observed internal hosts 140. A set of internal hosts that did not return and did not issue a communication request to the external network 1 within a certain time is extracted, and a set of addresses assigned to each internal host in the host set is monitored. The address list 131 is configured in a storage unit (for example, a memory) inside the traffic analysis device 130. In the example of FIG.
(1) In the case of bidirectional communication like the internal host 140a, it is not added to the monitoring address list 131.

  (2) If only one-way communication from the outside to the inside is observed over a certain period of time as in the case of the internal host 140c, or if no communication is observed at all, it is added to the monitoring address list.

  Table 1 shows an example of a communication record for each address managed by the traffic analysis device 130 by an internal storage means (for example, a memory) when performing the above processing. Table 1 managed by the traffic analyzer 130 stores the address of the internal host 140 to be observed, the presence / absence of internal communication within a certain period, and the time of the last internal communication observed.

以下に、トラヒック分析装置１３０の監視用アドレスリスト１３１への追加処理について説明する。図３は、本発明の第１の実施の形態における監視用アドレスリストへの追加のフローチャートである。

In the following, a process for adding the traffic analyzer 130 to the monitoring address list 131 will be described. FIG. 3 is a flowchart of addition to the monitoring address list according to the first embodiment of this invention.

  The traffic analyzer 130 receives a packet addressed to the internal host X of the network (FIG. 3) (step 101), and if the internal host is already registered in the monitoring address list 131. (Step 102, Yes) The process ends without doing anything.

  If not registered (step 102, No), the current time is compared with the latest arrival time of the packet originating from the internal host X, and if the time difference exceeds a certain time (for example, 360 minutes or more) If separated (step 103, Yes), the host is considered inactive and added to the monitoring address list 131 (step 104).

  That is, when a packet addressed to a certain internal host 140 arrives as a trigger, and that internal host 140 has once become a packet transmission source in the past, it knows how long ago it is and has that time. It is considered as an unused IP address that is inactive when a certain threshold is exceeded. Here, 360 minutes is an example, and can be set to a value that can be arbitrarily installed.

  The traffic analysis device 130 transmits the monitoring address list 131 to the traffic transfer device 120 at predetermined intervals. At this time, information is updated by transmitting all addresses or transmitting only the difference from the previous time.

  The traffic transfer device 120 is installed at a location where traffic can be transferred. For example, the traffic transfer device 120 may be mounted on the same physical device as the traffic analysis device 130 or may be mounted as a separate device.

  As shown in FIG. 4, the traffic transfer device 120 transfers a packet destined for the internal host 140 having an address described in the monitoring address list 131 to one or more monitoring servers 110. FIG. 4 shows a plurality of cases. Also, as shown in the figure, nothing is done for packets addressed to other hosts. That is, it is transferred to the subsequent network device according to a normal procedure.

  In the example of FIG. 4, the traffic transfer apparatus 120 transfers the packet with the monitoring destination address “192.168,233.63” to the monitoring server 110 a (FIG. 4 (1)), and the destination address “192.168.” That is not the monitoring target. The 3.19 "packet is passed as it is and transferred to the internal host 140a (FIG. 4 (2)).

  Table 2 shows an example of a correspondence table of the monitoring server 110 corresponding to the monitoring address.

監視用アドレスと監視サーバの対応関係は任意に決定するか、あるいは、後述するように本発明の第３の実施の形態で示す方法によって決定することができる。この対応表は時間的に変更することもできる。

The correspondence relationship between the monitoring address and the monitoring server can be determined arbitrarily, or can be determined by the method described in the third embodiment of the present invention as described later. This correspondence table can be changed over time.

  In Table 2, the monitoring server 110a with the monitoring server ID = a to which the address “192.168.233.63” of the internal host 140c is assigned sends the packet originating from the address “10.4.99.8” of the external server transferred by the traffic transfer device 120. Receive and perform desired processing, for example, if the received packet is a TCP SYN packet, send a TCP SYN / ACK packet to establish a 3-way hand shake. The packet “233.63” is transmitted via the traffic transfer apparatus 120 or directly to the address “10.4.99.8” of the external server that is the transmission source.

  As a result, the establishment of communication is realized from the external host “10.4.99.8” as if there is only one physical entity having the address “192.168.233.63”. This is shown in FIG. In the monitoring address list 131 of the traffic analysis device 130, it is assumed that the address “192.168.233.63” of the internal host 140c is set in advance to be transferred to the monitoring server 110a.

  (1) The external host (address = 10.4.99.8) of the external network 1 that is the transmission source transmits a packet to the address “192.168.233.63” of the internal host 140c.

  (2) The traffic analyzer 130 receives the packet transmitted from the external host, refers to the internal monitoring address list 131, determines that the address “192.168.233.63” corresponds to the monitoring server a, and forwards the traffic. The data is transferred to the monitoring server 110a via the device 120.

  (3) After processing the received packet, the monitoring server 110a transmits the processing result packet to the external host (address = 10.4.99.8) by setting the transmission source address to “192.168.233.63”. Here, the packet transmitted from the monitoring server 100 a does not pass through the traffic transfer device 120 and the traffic analysis device 130.

  In the example of FIG. 5, the monitoring server 110 performs the setting of the source address of the monitoring server 110 based on the destination address of the packet received by the monitoring server 110, but the traffic transfer device is not limited to this example. 120 may be realized.

  With the above mechanism, the monitoring server can receive a packet addressed to an unused IP address by proxy, and can establish communication by intentionally spoofing the unused IP address.

[Second Embodiment]
In this embodiment, the communication for each internal host 140 listed in the monitoring address list 131 of the traffic analysis device 130 extracted in the first embodiment is continuously monitored, and the internal host 140 makes a communication request by itself. An example in which the address of the host is deleted from the monitoring address list 131 at the time of release will be described.

  FIG. 6 is a diagram showing operations in the second embodiment of the present invention.

In FIG. 6, in the state where the address “192.168.233.63” of the internal host 140 is registered in the monitoring address list 131 of the traffic analyzer 130.
(1) The internal host 140 whose address is “192.168.233.63” transmits a packet to an arbitrary external host.

  (2) When the track analyzer 130 detects a packet from the internal host 140, it deletes the address “192.168.233.63” of the internal host 140 from the monitoring address list 131.

  FIG. 7 is a flowchart of the operation when the internal host is the source in the second embodiment of the present invention.

  When the traffic analyzer 130 receives a packet originating from the internal host X in a certain network (step 201), it first updates the time when the packet of the internal host X arrived most recently to the current time. (Step 202). Next, when the address of the host X is already registered in the monitoring address list 131 (step 203, Yes), the address of the internal host X is deleted from the monitoring address list 131 (step 204). If not, exit without doing anything.

  Here, it is necessary to distinguish whether a certain packet is originating from the actual internal host X, or whether the monitoring server 110 is originating. There are two solutions. In the configuration shown in FIG. 5, since the packet transmitted from the monitoring server 110 does not pass through the traffic analysis device 130, the actual internal host 140 is the transmission source when the packet is observed in the traffic analysis device 130. It is specified. As another method, a configuration in which a packet for which the monitoring server 110 spoofs the address of the internal host X passes through the traffic transfer device 120 is also conceivable.

That is, when the packet arrives from the traffic transfer device 120, it can be seen that the monitoring server 110 is the source, and otherwise the internal host 140 is the source.
In any case, in this method, the address is deleted from the monitoring address list 131 when a packet originating from the actual host X in the network is observed.

[Third Embodiment]
In the present embodiment, a hash function H (X) having a feature that returns a random value for the address included in the monitoring address list 131 shown in the first embodiment or a unique value for the same address X. An example of classifying into multiple groups using

  When the traffic analyzer 130 classifies the addresses X at random, for example, when the number of groups to be classified is M, each address X 1 is 1 to M by a random number that returns a value from 1 to M at random. Categorize.

  Further, when applying the hash function H (X) to the address X, the hash function H (X ′) may be used after applying an arbitrary conversion X ′ to the address X.

  When H (X ′)% M + 1 is calculated by calculating the remainder at M and adding 1, the value is always a value from 1 to M, and is unique for the same address X. The number of groups M is a controllable parameter, and can be determined based on the size of the network to be monitored, the number of addresses assigned to each group, and the like.

  In the following example, SHA-1, which is well-known as a hash function, is used and the number of groups is five.

  First, a case where no conversion is applied to X is shown, and then an example of conversion is shown.

Let X be the string "192.168.233.63". The result of applying SHA-1 to this X is in hexadecimal notation.
"b08bfacb35f261690ce5fa14d6d9828a4c59a9d9"
It becomes. This value is in decimal notation
"1007904026468102533226922959238641403105044441561"
It is. If 1 is added to this value divided by 5, it becomes 2. Therefore, “192.168.233.63” can be classified into group 2.

  The following shows a case in which the lower 8 bits are converted to "0" for address X expressed in 32 bits. That is, X 'for X = "192.168.233.63" becomes X' = "192.168.233.0".

The result of applying SHA-1 to X 'is in decimal notation
"668294084579058110983956357411212418693232089851"
It becomes. Since the remainder obtained by dividing this value by 5 is 1, the group becomes 2 by adding 1.

[Fourth Embodiment]
In the present embodiment, a non-monitoring address / communication list is configured in addition to the type of communication (protocol). Table 3 shows an example of “non-monitoring address / communication list”.

トラヒック分析装置１３０は外部ホスト１から内部ホストX宛に向けたパケットを分析し、該パケットの通信プロトコルが表３に示す「非監視用アドレス・通信リスト」にマッチするか否かをチェックする。例えば該通信の内部ホストの宛先アドレスが"192.168.233.33"であり、通信のプロトコル種類がhttp であった場合は、非監視用アドレス・通信リストにマッチするので非監視の対象となり、該通信は通常通り"192.168.233.33"へと転送される。

The traffic analyzer 130 analyzes a packet directed from the external host 1 to the internal host X, and checks whether the communication protocol of the packet matches the “non-monitoring address / communication list” shown in Table 3. For example, if the destination address of the internal host of the communication is "192.168.233.33" and the communication protocol type is http, it matches the non-monitoring address / communication list, so it becomes a non-monitoring target. Forwarded to "192.168.233.33" as usual.

  Similarly, if the destination address of the packet is “192.168.233.33” and the type of communication is smtp, the packet does not match the list, and is subject to monitoring. The packet is monitored via the traffic transfer device 120. 110.

  That is, even if the destination address is the same, it may or may not be monitored depending on the type of communication. This non-monitoring address / communication list can be updated and managed in the same manner as the monitoring address list 131 shown in the first to third embodiments of the present invention.

[Fifth Embodiment]
For the monitoring address list in the first embodiment or the non-monitoring address / communication list shown in the fourth embodiment, an address list is prepared in the storage means in advance, and by referring to the address list, A list for constructing a monitoring address list or a non-monitoring address list is constructed only for the internal hosts 140 included in the address list or only for hosts not listed in the address list.

  Further, the traffic analysis device and the traffic transfer device shown in FIG. 1 are set as one traffic monitoring device, the operation of the device is constructed as a program, and installed and executed on a computer used as a traffic management device, or It is possible to distribute through a network.

  Further, the constructed program can be stored in a portable storage medium such as a hard disk, a flexible disk, or a CD-ROM, and can be installed or distributed in a computer.

  The present invention is not limited to the above-described embodiments, and various modifications and applications can be made within the scope of the claims.

1 External Network 100 Internal Network 110 Monitoring Server 120 Traffic Transfer Device 130 Traffic Analysis Device 131 Monitoring Address List 140 Internal Host

Claims (13)

A network monitoring system for monitoring network traffic,
At least one or more monitoring servers, a traffic analysis device for analyzing traffic on a network line or externally attached network, a traffic transfer device for transferring received packets to any monitoring server, and an internal host,
The traffic analyzer is
Analyzes the traffic from the external host of the external network to the internal host inside the network, and when there is a communication request from the external host to the internal host for a certain period of time, does not return any response, but requests communication to the external host by itself Monitoring address list generating means for extracting the internal hosts that did not transmit and registering the set of addresses assigned to each of the internal host sets and the identifier of the monitoring server in the storage means as a monitoring address list; ,
May be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and only one-way communication from the external host to the internal host is observed over a certain period with reference to the communication recording unit, or An additional means for adding the address of the internal host to the monitoring address list when no communication is observed;
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion means for deleting the address of the internal host from the monitoring address list;
Monitoring address list transfer means for transmitting the monitoring address list to the traffic transfer device at a predetermined cycle;
Have
The traffic forwarding device is:
Referring to the monitoring address list acquired from the traffic analysis device, the packet addressed to the internal server address is set to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. A transfer control means for transmitting to the server and not forwarding to the internal server of the destination address of the packet;
The monitoring server is
The packet transferred from the traffic transfer device is received, the packet is processed instead of the internal host of the original packet destination, and the processing result is directly or addressed to the address of the external host of the packet source, Proxy processing means for transmitting via the traffic transfer device,
A network monitoring system comprising: 2. The apparatus according to claim 1, further comprising means for generating an address list for only an internal host included in the monitoring address list or for only an internal host not included in the monitoring address list and storing the address list in a storage unit. Network monitoring system. The monitoring address list generating means of the traffic analyzer is
The internal host addresses X included in the monitoring address list are classified into a plurality of groups at random or using a hash function H (X) having a characteristic of returning a unique value for the same address X 2. The network monitoring system according to claim 1, further comprising grouping means. The traffic analyzer is
Means for generating a non-monitoring address list comprising a set of addresses assigned to each of the internal host sets and a communication type classified by a protocol type;
The traffic forwarding device is:
2. The network monitoring system according to claim 1, further comprising means for transferring only packets that do not match the address of the internal host described in the non-monitoring address list and the communication type to the monitoring server. 5. A means for generating an address list for only an internal host included in the non-monitoring address list or for an internal host not included in the non-monitoring address list and storing the address list in a storage unit. The network monitoring system described. A network monitoring method for monitoring network traffic,
In a system having at least one or more monitoring servers, a traffic analysis device that analyzes traffic on a network line or externally attached network, a traffic transfer device that transfers received packets to any monitoring server, and an internal host ,
The traffic analyzer is
Analyzes the traffic from the external host of the external network to the internal host inside the network, and when there is a communication request from the external host to the internal host for a certain period of time, does not return any response, but requests communication to the external host by itself A monitoring address list generating step for extracting an internal host that has not transmitted a message and associating a set of addresses assigned to each of the internal host sets with the identifier of the monitoring server and registering them in the storage means as a monitoring address list; may be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and the communication recording means is If only one-way communication from the external host to the internal host is observed over a certain period of time, or if no communication is observed, the address of the internal host is added to the monitoring address list. And additional steps to
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion step of deleting the address of the internal host from the monitoring address list;
A monitoring address list transfer step of transmitting the monitoring address list to the traffic transfer device at a predetermined period;
And
The traffic forwarding device is:
Referring to the monitoring address list acquired from the traffic analysis device, the packet addressed to the internal server address is set to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. A transfer control step that transmits to the server and does not forward to the internal server of the destination address of the packet,
The monitoring server is
The packet transferred from the traffic transfer device is received, the packet is processed instead of the internal host of the original traffic destination, and the processing result is directly or directly to the address of the external host that is the source of the packet, A network monitoring method comprising: performing a proxy processing step of transmitting via the traffic transfer device. 7. The step of generating an address list for only an internal host included in the monitoring address list or for only an internal host not included in the monitoring address list and storing the address list in a storage unit is further performed. Network monitoring method. In the monitoring address list generation step in the traffic analyzer,
The internal host addresses X included in the monitoring address list are classified into a plurality of groups at random or using a hash function H (X) having a characteristic of returning a unique value for the same address X The network monitoring method according to claim 6. When applying the hash function H (X) to the address X,
9. The network monitoring method according to claim 8, wherein H (X) to which a hash function is applied after applying an arbitrary conversion X ′ to the address X is used. In the traffic analyzer,
Generating a non-monitoring address list comprising a set of addresses assigned to each of the internal host sets and a communication type classified by a protocol type;
In the traffic transfer device,
7. The network monitoring method according to claim 6, wherein only packets that do not match the address of the internal host described in the non-monitoring address list and the communication type are transferred to the monitoring server. 11. The step of generating an address list for only an internal host included in the non-monitoring address list or for only an internal host not included in the non-monitoring address list and storing the address list in a storage unit is further performed. The network monitoring method described. A network monitoring device for monitoring network traffic,
Traffic analysis means for analyzing traffic on the network, traffic forwarding means for forwarding the received packet to any monitoring server,
The traffic analysis means includes:
Analyze the traffic from the external host of the external network to the internal host in the monitored network. If there is a communication request from the external host to the internal host for a certain period of time, no response will be returned to the external host. A means for extracting an internal host that has not transmitted a communication request, and storing a set of addresses assigned to each of the internal host sets and an identifier of a monitoring server connected to the traffic transfer means as a monitoring address list Monitoring address list generation means to be registered in
May be held in the communication record means the presence and time of the last observed internal oscillator internal onset communications for a period of time corresponding to the address of the internal host, upon detecting a packet of the internal host destined internal The host address is not registered in the monitoring address list, and only one-way communication from the external host to the internal host is observed over a certain period with reference to the communication recording unit, or An additional means for adding the address of the internal host to the monitoring address list when no communication is observed;
When continuously analyzing the traffic for each internal host and detecting a communication request originating from the internal host, a deletion means for deleting the address of the internal host from the monitoring address list;
Monitoring address list transfer means for transmitting the monitoring address list to the traffic transfer means at a predetermined cycle;
Have
The traffic transfer means includes:
Referring to the monitoring address list acquired from the traffic analysis means, the packet addressed to the internal server address is sent to at least one monitoring server corresponding to the monitoring server identifier associated with the internal server address. A network monitoring apparatus comprising transfer control means for transmitting to a server and not forwarding to an internal server at the destination address of the packet.   The network monitoring program for functioning a computer as each means which comprises the network monitoring apparatus of Claim 12.

Images