JP5874470B2 - Source address spoofing judgment system - Google Patents

Description

  The present specification relates to a technique for detecting a packet spoofing a source address.

  Detects a replay attack on an attacking host by an attacking source host by spoofing the source address by using a packet passing through a gateway connected to the network equipped with the attacking host, using the stepping host as a stepping stone. For example, there are the following techniques. The attack detection device includes a response counter and a request counter. The response counter counts the number of response packets output from the platform host to the attack destination host. The request counter counts the number of request packets output from the attack destination host. The attack detection device determines that a replay attack has been performed when the number of response packets counted by the response counter is greater than the number of request packets counted by the request counter.

JP 2007-288246 A

  In the above technique, only the comparison between the number of request packets and the number of response packets passing through the gateway is performed in detecting a packet spoofing the IP address of the transmission source (IPSA spoofed packet). Therefore, the IPSA spoof packet may not be detected depending on the positional relationship with the attack source host, the platform host, the attack destination host, and the gateway.

  Therefore, in one aspect of the present embodiment, a technique for detecting an IPSA spoofed packet is provided regardless of the network connection mode.

The transmission source address spoofing determination system according to the present embodiment includes a communication information detection device and a transmission source address spoofing determination device. The communication information detection device includes a detection unit, a communication information determination unit, and a transmission unit. The detection unit sequentially detects communication information transmitted through a communication line connecting the relay devices. The communication information determination unit determines whether the detected communication information is communication information in which a connection is normally established based on a communication protocol used for the communication information. A transmission part transmits the detection information regarding the detected communication information, when the detected communication information is not the communication information which established the connection normally as a result of determination. The transmission source address spoofing determination system includes a collection unit, a verification unit, a route information acquisition unit, and a spoofing determination unit. The collection unit collects detection information transmitted from the communication information detection device. The verification unit aggregates the collected detection information, and verifies whether the communication information included in the collected detection information is communication information that has normally established a connection based on the communication protocol. As a result of the determination, the route information acquisition unit performs the following process when the communication information included in the collected detection information is not communication information that has normally established a connection based on the communication protocol. That is, the path information acquisition unit is one of the information processing apparatuses belonging to the network to which the second information processing apparatus belongs for the communication information transmitted from the first information processing apparatus to the second information processing apparatus among the detected communication information. To request route information. Here, the route information is route information up to the transmission source address of the communication information. The route information acquisition unit acquires route information from one of the information processing apparatuses. When the result of the route information is not normal or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the fraud determination unit determines that the transmission source address of the communication information is Judged to be misrepresentation. The communication line is logically one communication line formed from a set of a plurality of physical lines. The communication information detection device is disposed on each physical line. The transmission unit of the second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line transmits the detection information related to the detected communication information. To the first communication information detecting device. The communication information determination unit of the first communication information detection device includes the communication information indicated by the detection information transmitted from the second communication information detection device and the communication information detected by the detection unit of the first communication information detection device. It is determined whether or not the communication information has successfully established a connection based on the communication protocol used for the communication information. If the result of determination is that the communication information is not communication information that has normally established a connection, the transmission unit of the first communication information detection device transmits detection information related to the communication information.

  According to one aspect of this embodiment, an IPSA spoofed packet can be detected regardless of the network connection mode.

An example of the transmission source address misrecognition determination system in this embodiment is shown. An example of the network structure for the IPSA misrepresentation packet detection in this embodiment is shown. The structure of a packet is shown. It is a figure for demonstrating the TCP connection establishment by 3 way handshake. The overall flow of this embodiment is shown. It is a figure for demonstrating the monitoring of the abnormal connection sequence of TCP for the detection of the IPSA spoofing packet (when the IP address which does not originally exist in IPSA is set) in this embodiment. It is a figure explaining the detection process of the abnormal sequence based on the IPSA misrepresentation packet (when the IP address which does not originally exist in IPSA is set) by the packet detection apparatus (# 3) in the case of FIG. FIG. 6 is a diagram for explaining an abnormal sequence detection process based on an IPSA spoof packet (when an IP address that does not originally exist in the IPSA is set) by the packet detection device (PD # 2, PD # 5) in the case of FIG. 5; is there. It is a figure for demonstrating the monitoring of the abnormal connection sequence of TCP for the detection of the IPSA spoofing packet (when the existing IP address is set) in this embodiment. It is a figure explaining the detection process of the abnormal sequence based on the IPSA spoofing packet (when the existing IP address is set) by the packet detection device (PD # 2, PD # 5). It is a figure explaining the detection process of the abnormal sequence based on an IPSA spoofing packet (when the existing IP address is set) by a packet detection apparatus (PD # 3). It is a figure explaining the detection process of the abnormal sequence based on the IPSA spoofing packet (when the existing IP address is set) by the packet detection apparatus (PD # 1, PD # 6). It is a figure for demonstrating the process which notifies the detection event by the packet detection apparatus in this embodiment to a management server. An example of the processing flow of the packet detection apparatus in this embodiment is shown. It is a figure for demonstrating the process which determines whether the received packet is a packet which should be received when the normal connection sequence by 3-way handshake is materialized in order to determine the abnormal connection sequence in this embodiment. . An example of the detailed flow of the 3-way handshake verification process 1 (S14) when a SYN packet is received in the present embodiment is shown. An example of the detailed flow of the 3-way handshake verification process 2 (S15) when a SYN-ACK packet is received in the present embodiment is shown. An example of a detailed flow of the 3-way handshake verification process 3 (S16) when an ACK packet is received in the present embodiment is shown. An example of a detailed flow of temporary storage buffer management processing (S17) in the present embodiment will be shown. It is a figure for demonstrating the verification process of the abnormal connection sequence in this embodiment. The normal sequence judgment example by the verification process of the abnormal connection sequence under an equal cost multipath condition in this embodiment is shown. It is a figure for demonstrating operation | movement of the packet detection apparatus at the time of the ether channel area arrangement | positioning in this embodiment. An example of the verification table in this embodiment is shown. An example of the verification process flow of the abnormal connection sequence by the management server in this embodiment is shown. It is a figure for demonstrating determination whether the packet determined to be the abnormal connection sequence in this embodiment is an IPSA misrepresentation packet (when the IP address which does not originally exist in IPSA is set). It is a figure for demonstrating determination whether the packet determined to be the abnormal connection sequence in this embodiment is an IPSA spoofing packet (when the existing IP address is set). It is a figure for demonstrating the conditions 2 in determination of S43. An example of the processing flow which determines whether the packet determined to be the abnormal connection sequence in this embodiment is an IPSA misrepresentation packet is shown. 4 shows an example of a network configuration for displaying an IPSA spoofed packet detection screen on a client PC in the present embodiment. An example of the IPSA misrepresentation packet detection screen in this embodiment is shown. An example of the node icon definition screen in this embodiment is shown. An example (the 1) of a link line definition screen in this embodiment is shown. An example (the 2) of a link line definition screen in this embodiment is shown. An example (the 3) of a link line definition screen in this embodiment is shown. An example of the TND definition screen in this embodiment is shown. An example of a screen displayed when an IPSA spoofed packet is detected in this embodiment (when an IP address that does not exist in IPSA is set) is shown. The example of a display of the screen at the time of IPSA spoofed packet detection in the embodiment (when the IP address which exists actually is set to IPSA) is shown. An example of the instruction | indication screen for specifying the IPSA spoofing packet transmission terminal in this embodiment is shown. It is an example of a screen displayed when the terminal which transmitted the IPSA spoofing packet in this embodiment is specified. The example of a screen displayed when the terminal which transmitted the IPSA spoofing packet in this embodiment could not be specified is shown. The base map image generation processing flow in this embodiment is shown. The display processing flow of the detection result of the IPSA misrepresentation terminal detection in this embodiment is shown. It is a block diagram of a hardware environment of a computer to which this embodiment is applied.

  With the depletion of IPv4 (Internet Protocol Version 4) addresses, the transition to IPv6 (Internet Protocol Version 6) is expected to progress in the future. As a security model for IPv4, a method of intensively checking traffic by placing a firewall on the boundary line of a clearly separated network such as the Internet and an intranet is often used. Note that a global address is used on the Internet. Private addresses are used on the intranet.

  In the IPv4 security model, the following method is conceivable as a method for detecting a packet spoofing an IP address of a transmission source (IPSA spoofing packet). The subnet information to which the firewall is connected is registered in advance for each physical port in the firewall arranged on the boundary line between the Internet and the intranet. For example, as subnet information to be registered in the firewall, a global address is set on the port 1 side, a class A private address is set on the port 2 side, and class B and C private addresses are set on the port 3 side. The firewall can detect a packet whose source address of an input packet from each physical port does not match the previously registered subnet information as an IPSA spoofed packet.

  However, for example, it is assumed that the network ahead of each port is subdivided between X.X.X.X / 8 and X.X.X.X / 30. Furthermore, it is assumed that the fragmented address space is distributed over each port of the firewall (a case where address aggregation cannot be performed well). In this case, there is a possibility that the number of subnets to be registered increases and the actual operation cannot be endured.

  In addition, with the transition to IPv6, global addresses will be used in the internal intranet in the future, making it impossible to use the simplest setting by distinguishing between conventional global addresses and private addresses. Furthermore, the IPv6 address description itself is more complicated than the IPv4 address notation such as “2001: db1: xxxx :: / 48” and “2001: db1: xxxx: abcd :: / 64”. As a result, the method of manually registering subnet information in the firewall one by one seems to be increasingly difficult to apply to networks after IPv6 transition.

In addition, as described above, the IPSA spoofed packet may not be detected depending on the positional relationship with the attack source host, the platform host, the attack destination host, and the gateway.
Therefore, in one aspect of the present embodiment, a transmission source address spoofing determination system that easily detects an IPSA spoofed packet, without registering subnet information for detection in advance, regardless of the network connection mode. explain.

  As for the confirmation method when detecting an IPSA spoofed packet, the conventional method often outputs a text-based log to the firewall management screen. However, in this case, in addition to log information, it is necessary to analyze the attack route and which device is being attacked while using information such as the logical configuration diagram and physical configuration diagram of the network separately. It is difficult to get a quick overview of the attack.

  Therefore, in this embodiment, a source address spoofing determination system that can visually display information such as an attack route and which device is being attacked will be described.

  FIG. 1 shows an example of a transmission source address spoofing determination system in the present embodiment. The transmission source address spoofing determination system 200 includes a communication information detection device 1 and a transmission source address spoofing determination device 2. The communication information detection apparatus 1 includes a detection unit 1a, a communication information determination unit 1b, and a transmission unit 1c. An example of the communication information detection device 1 is a packet detection device 12. The management server 14 is mentioned as an example of the transmission source address misrecognition determination device 2.

  The detection unit 1a sequentially detects communication information transmitted through the communication line 7 connecting the relay devices 9. An example of the process performed by the detection unit 1a is the process of S11. An example of the relay device 9 is a router 15. The other relay device 9 is connected to the network 8. Similarly, the communication information detection apparatus 1 is arranged in the network 8.

  The communication information determination unit 1b determines whether the detected communication information is communication information that has normally established a connection based on a communication protocol used for the communication information. An example of the process performed by the communication information determination unit 1b is the process of S17-4.

  If the result of determination is that the detected communication information is not communication information that has successfully established a connection, the transmission unit 1c transmits detection information relating to the detected communication information. An example of the process performed by the transmission unit 1c is the process of S17-5.

The source address spoofing determination device 2 includes a collection unit 2a, a verification unit 2b, a route information acquisition unit 2c, and a spoof determination unit 2d.
The collection unit 2a collects the detection information transmitted from the communication information detection device 1. An example of the process performed by the collection unit 2a is the process of S21.

  The verification unit 2b aggregates the collected detection information and verifies whether the communication information included in the collected detection information is communication information that has normally established a connection based on the communication protocol. An example of the process performed by the verification unit 2b is the process of S24.

  As a result of the determination, the path information acquisition unit 2c performs the following process when the communication information included in the collected detection information is not communication information that has normally established a connection based on the communication protocol. In other words, the path information acquisition unit 2c, for the communication information transmitted from the first information processing device 3 to the second information processing device 4 among the detected communication information, The information processing device 6 is requested to acquire route information. Here, the route information is route information from any one of the information processing apparatuses 6 to the transmission source address of the communication information. The route information acquisition unit 2 c acquires route information from any of the information processing devices 6. Examples of the process performed by the route information acquisition unit 2c include the processes of S53 and S54. An example of the information processing device 6 is a terminal network device 13.

The misrepresentation determination unit 2d determines the source of the communication information when the result of the route information is not normal or when the route indicated by the route information is different from the transmission route from the first information processing device 3 to the second information processing device 4. It is determined that the address is a misrepresentation. As an example of the process performed by the misrepresentation determination unit 2d, the processes of S55 to S58 are given.
With this configuration, it is possible to determine the IPSA misrepresentation of a packet.

  The communication information is information to which a transmission control protocol (TCP) header is added. The communication information determination unit 1b performs the following processing on the detected communication information according to the three-way handshake. That is, the communication information determination unit 1b detects communication information whose TCP flag is SYN and communication information whose TCP flag is ACK within a threshold time after detecting communication information whose TCP flag is SYN included in the TCP header. Are sequentially detected.

  With this configuration, it is possible to determine whether the packet has completed a normal connection sequence according to the 3-way handshake.

  The verification unit 2b collects the collected detection information based on the transmission source address, the transmission destination address, and the TCP flag. The verification unit 2b performs the following processing on the communication information included in the collected detection information according to the three-way handshake. That is, after detecting communication information whose TCP flag is SYN included in the TCP header, the verification unit 2b sequentially transmits communication information whose TCP flag is SYN-ACK and communication information whose TCP flag is ACK within a threshold time. Determine if it was detected.

  By configuring in this way, a normal connection sequence is established between the transmission source and the transmission destination even if the communication information detection device 1 determines that the connection sequence is abnormal due to the network topology. Connection sequences can be excluded from IPSA misrepresentation. That is, it is possible to eliminate the influence of TCP communication paths between terminals distributed in an equal cost multipath network.

  The misrepresentation determination unit 2d determines that the transmission source address of the communication information is misrepresentation when the result of the route information is not normal. Alternatively, the misrepresentation determination unit 2d may enter the address space of the communication information detection device that has detected communication information transmitted from the first information processing device to the second information processing device, in any of the addresses of the relay device included in the route information. If not included, it is determined that the transmission source address of the communication information is misrepresentation.

By configuring in this way, it is possible to determine IPSA misrepresentation.
The communication line 7 is logically one communication line formed from a set of a plurality of physical lines. The communication information detection apparatus 1 is disposed on each physical line. Communication information detection devices other than the first communication information detection device among the communication information detection devices arranged on the physical lines forming the same communication line are referred to as second communication information detection devices. The transmission unit 1c of the second communication information detection device transmits detection information related to the detected communication information to the first communication information detection device. The communication information determination unit 1b of the first communication information detection apparatus determines whether the communication information is communication information that has normally established a connection based on the communication protocol used for the communication information. Here, the communication information is the communication information indicated by the detection information transmitted from the second communication information detection device and the communication information detected by the detection unit 1a of the first communication information detection device. If the result of determination is that the communication information is not communication information that has normally established a connection, the transmission unit 1c of the first communication information detection device transmits detection information related to the communication information.

  By configuring in this way, with respect to the Ether channel period, the communication information is aggregated to the first communication information detecting apparatus represented by the second communication information detecting apparatus. The effect of distributed communication can be avoided.

The transmission source misrepresentation determination device 2 further includes a registration unit 2e, an image generation unit 2f, an addition unit 2g, and a display control unit 2h.
The registration unit 2e registers information related to addresses on the network for the relay device 9, the communication line 7, and the information processing device 6 that acquires route information. An example of the process performed by the registration unit 2e is the process of S61.

  The image generation unit 2f generates a connection relationship between the relay device 9, the communication line 7, and the information processing device 6 that acquires route information based on the registered information. The image generation unit 2f generates a network configuration image (base map) in which symbols corresponding to the relay device 9, the communication line 7, and the information processing device 6 that acquires route information are arranged based on the connection relationship. An example of the process performed by the image generation unit 2f is the process of S62. An example of the network configuration image is an IPSA spoofed packet detection screen 80.

  The display control unit 2h follows a request from the client PC in the client-server form as shown in FIG. That is, the display control unit 2h maps an arbitrary detection result from the latest or past history transmission source IP address spoofed packet detection information onto the base map generated by the image generation unit 2f, and FIG. Alternatively, a detection screen as shown in FIG. 37 is provided. Based on the screen request from the client PC received by the display control unit 2h, the addition unit 2g maps the detection result of the IPSA spoofing packet that matches the request on the base map generated by the image generation unit 2f. Examples of the process performed by the display control unit 2h include the processes of S63 and S65. An example of the process performed by the adding unit 2g includes the process of S62.

  With this configuration, the source address spoofing information can be displayed on the IPSA spoofed packet detection screen 80. Therefore, it is possible to visually display information such as the attack path and which device is being attacked.

  FIG. 2 shows an example of a network configuration for detecting an IPSA spoofing packet in the present embodiment. The network 11 to be monitored includes a packet detection device (PD) 12, a terminal network device (TND) 13, a management server 14, and a router 15. In the network 11 to be monitored, packet detection devices 12 and end network devices 13 are distributed. The routers 15 are connected by physical lines such as communication cables. The router 15 and the router 15, and the router 15 and the terminal network device 13 are connected by a logical network.

  The router 15 is a device that performs data transfer processing of the network layer (layer 3) in an OSI (International Organization for Standardization) reference model.

  One packet detection device 12 is arranged for each network between the routers 15. In addition, when one logical network is configured by a plurality of physical lines by the Ethernet channel, the packet detection device 12 is arranged for each physical line. The packet detection device 12 detects a packet (SYN, SYN-ACK, ACK) passing through a physical line on which the packet detection device 12 itself is arranged. The packet detection device 12 determines whether the detected packet is a normal connection sequence based on the 3-way handshake. If the connection sequence is not normal, the packet detection device 12 notifies the management server 14 of the detection result. The function of the packet detection device 12 may be provided in a firewall.

  The management server 14 collects information detected by the packet detection device 12, and verifies the connection sequence determined to be abnormal by the packet detection device 12 based on the collected detection results. There is a case in which any of a series of packets (SYN, SYN-ACK, ACK) by the three-way handshake is not detected by the packet detection device 12 because it passes through a route different from other packets, and is determined to be an abnormal connection sequence. is there. However, even in such a locally abnormal connection sequence, a normal connection sequence may be established between the transmission source and the transmission destination when the entire network 11 is viewed. Therefore, the management server 14 verifies whether a normal connection sequence is established between the transmission source and the transmission destination. If the management server 14 determines that the connection sequence is abnormal even between the transmission source and the transmission destination, the trace route is sent to the terminal network device 13 for the transmission source address set in the SYN packet in the abnormal connection sequence. Ask to be issued. Based on the result of the request, the management server 14 determines whether or not the transmission source address set in the SYN packet is a spoofed address. The management server 14 also has a support function for transmitting the detection result to the administrator's computer and identifying the source of the IPSA spoofing packet.

  In this embodiment, since the TCP connection sequence determination is performed, the 3-way handshake is used. However, the present invention is not limited to this, and a connection sequence determination method according to the communication protocol can be used.

  One terminal network device 13 is arranged for each segment of the terminal network portion of the network 11. In response to a request from the management server 14, the terminal network device 13 issues a trace route to the transmission source address set in the SYN packet in the abnormal connection sequence. The terminal network device 13 may be a computer in which a program having the function of the terminal network device 13 is installed. Further, the program having the function of the terminal network device 13 may be installed in a computer under attack.

  FIG. 3 shows the structure of a packet. FIG. 3A shows the data structure of the packet. The packet includes an IP header, a TPC (Transmission Control Protocol) header, and a data part.

  FIG. 3B shows the structure of the IP header. The IP header has items of version, header length, service type, packet length, identifier, flag, fragment offset, lifetime, protocol, header checksum, source IP address, destination IP address, option, and padding. The “source IP address” (IPSA) is set to the source IP address. The “destination IP address” (IPDA) is set to the destination IP address. Since other items are not mentioned in this embodiment, they are omitted.

  FIG. 3C shows the structure of the TPC header. The TPC header has items of source port number, destination port number, sequence number, acknowledgment number, header length, reserved bits, TCP flag, window size, checksum, emergency pointer, option, and padding. In the “TCP flag”, flag values such as a SYN flag, a SYN-ACK flag, and an ACK flag are set. Since other items are not mentioned in this embodiment, they are omitted.

  FIG. 4 is a diagram for explaining TCP connection establishment by the 3-way handshake. FIG. 4A shows a connection sequence for establishing a connection by a three-way handshake. FIG. 4B is a diagram illustrating a normal connection sequence detection process performed by the packet detection device. In FIGS. 4A and 4B, it is assumed that the IP address (“10.0.20.1/24”) of the transmission side is set in the IPSA of the packet transmitted from the transmission side to the reception side. .

  When the transmission side transmits a SYN packet in which “SYN” is set in the TCP flag, the SYN packet is transmitted to the reception side via the packet detection device 12. When the receiving side returns a SYN-ACK packet in which “SYN-ACK” is set in the TCP flag, the SYN-ACK packet is returned to the transmitting side via the packet detection device 12. When the transmission side transmits a SYN-ACK packet in which “SYN-ACK” is set in the TCP flag, the ACK packet is transmitted to the reception side via the packet detection device 12.

  After detecting the SYN flag of the received packet, the packet detector 12 detects that all sequence packets (SYN packet, SYN-ACK packet, ACK packet) have been detected within the threshold time, judge. Therefore, when the condition is not satisfied, the packet detection device 12 determines that the sequence based on the received packet is an abnormal connection sequence.

  FIG. 5 shows the overall flow of this embodiment. The packet detection device 12 in the network 11 monitors an abnormal TCP connection sequence (S1). When an abnormal connection sequence is detected, the packet detection device 12 transmits a detection result to the management server 14 (S2). After receiving the detection result of the abnormal TCP connection sequence from the packet detection device 12, the management server 14 merges the detection results. Using the merged detection result, the management server 14 uses the packet detection device 12 to establish a normal TCP connection sequence between the transmission source and the transmission destination even when the normal connection sequence is not established. It is verified whether it is established (S3). The management server 14 determines whether the cause of the TCP connection abnormality is due to IPSA misrepresentation by using the result of the trace route issuance by the terminal network device for the TCP connection sequence determined to be abnormal as a result of the verification ( S4).

  Hereinafter, this embodiment will be described in more detail. In the IPSA spoofed packet, there are cases where an IP address that does not originally exist is set in the IPSA, and cases where an actual IP address is set in the IPSA. First, a TCP sequence of an IPSA spoofed packet in which an IP address that does not originally exist in IPSA is set will be described with reference to FIG.

  FIG. 6 is a diagram for explaining monitoring of an abnormal TCP connection sequence for detection of an IPSA spoofed packet (when an IP address that does not originally exist in the IPSA) is set in the present embodiment. The numerical values given to each device and each port of the router in FIG. 6 indicate an IP address / subnet mask.

  The network in FIG. 6 uses a layer 3 switch (L3SW) as the router 15. In the terminal network, a layer 2 switch (L2SW) 16 is used to configure the network.

  The terminal network (attacker terminal) 17 used by the attacker and the terminal network device 13 are connected to the L2SW (16) in the terminal network on the upper side of FIG. A terminal network device 13 and a server 18 are connected to the L2SW (16) in the terminal network on the left side of FIG. A management server 14, a server 19, and a terminal network device 13 are connected to the L2SW (16) in the terminal network on the right side of FIG. The server 19 is a server targeted by an attacker.

  The attacker terminal 17 transmits an IPSA spoof packet to the target server 19. The packet includes “IPSA”, “IPDA”, “TCP flag”, and “data”. In “IPSA”, “IP address of transmission source (IPSA)” is set. In “IPDA”, “destination IP address (IPDA)” is set. In the “TCP flag”, flags such as “SYN (connection request)” and “ACK (response confirmation)” are set.

  The IP address of the attacker terminal 17 is originally “10.0.20.1/24”. However, in FIG. 6, in the IPSA spoofing packet 21, “10.0.99.99” that does not originally exist is set as the IP address of the attacker terminal. In addition, the IP address of the target server 19 is set in the “IP address of transmission destination (IPDA)” of the IPSA spoofing packet 21.

  The attacker terminal 17 transmits an IPSA spoofing packet 21 (TCP flag value = “SYN”, SYN packet) to the target server 19. Then, the IPSA spoofing packet 21 is transmitted to the target server 19 via the packet detection device 12 (PD # 2, PD # 5, PD # 3). Upon receiving the SYN packet, the target server 19 transmits a response packet (TCP flag value = “SYN-ACK”, SYN-ACK packet).

  The SYN-ACK packet is transmitted to the default gateway L3SW (15) via the packet detection device 12 (PD # 3). Since there is no IPDA set in the SYN-ACK packet, the default gateway L3SW (15) discards the SYN-ACK packet. Therefore, the packet detection device 12 (PD # 2, PD # 5) cannot receive the SYN-ACK packet. If the SYN-ACK packet is not received, the ACK packet corresponding to the SYN-ACK packet is not transmitted from the transmission source, so the packet detection device 12 (PD # 3) receives the ACK packet. Can not do it. Therefore, the packet detection device 12 (PD # 2, PD # 3, PD # 5) detects an incomplete connection sequence.

  Hereinafter, the determination of the connection sequence by the packet detection device 12 (PD # 2, PD # 3, PD # 5) in the case of FIG. 5 will be described with reference to FIGS. 7 and 8, a spoofed IP address (“10.0.99.99”) is set in the IPSA of a packet transmitted from the transmission side (attacker terminal 17) to the reception side (target server 19). And

  FIG. 7 is a diagram illustrating an abnormal sequence detection process based on an IPSA spoofed packet (when an IP address that does not originally exist in the IPSA is set) by the packet detection device (# 3) in the case of FIG. .

  As shown in FIG. 7A, when the transmission side (attacking side) transmits a SYN packet, the SYN packet is received via the packet detection device 12 (PD # 3) (attacked). Side). When the receiving side (attacked side) returns a SYN-ACK packet, the SYN-ACK packet is sent back to the transmitting side (attacking side) via the packet detection device 12 (PD # 3). . However, as described above, since there is no IPDA of the SYN-ACK packet, the default gateway L3SW (15) discards the SYN-ACK packet. Accordingly, since no ACK packet corresponding to the SYN-ACK packet is generated, the packet detection device 12 (PD # 3) cannot receive the ACK packet.

  In the packet detection device 12 (PD # 3), if no ACK packet is detected after a certain period of time has elapsed after detecting a SYN-ACK packet, a timeout occurs as shown in FIG. In this case, the packet detection device 12 (PD # 3) determines that an abnormal connection sequence has been detected. Note that the receiving side (the attacked side) occupies resources until the timeout time and is in a waiting state (TCP half-open state).

  FIG. 8 shows an abnormal sequence detection process based on an IPSA spoofed packet (when an IP address that does not originally exist in the IPSA is set) by the packet detection device (PD # 2, PD # 5) in the case of FIG. It is a figure explaining.

  As shown in FIG. 8A, when the transmission side (attacking side) transmits a SYN packet, the SYN packet is transmitted to the reception side (PD # 2, PD # 5) via the packet detection device 12 (PD # 2, PD # 5). Sent to the attacked side). When the receiving side (the attacked side) returns a SYN-ACK packet, the receiving side (the attacked side) transmits a SYN-ACK packet.

  However, since the SYN-ACK packet is discarded by the default gateway L3SW (15) as described above, it is not transmitted to the packet detection device 12 (PD # 2, PD # 5). Therefore, in the packet detection device 12 (PD # 2, PD # 5), if a SYN-ACK packet is not detected after a predetermined time has elapsed after the detection of the SYN packet, as shown in FIG. Become. In this case, the packet detection device 12 (PD # 2, PD # 5) determines that an abnormal connection sequence has been detected.

Next, a TCP sequence of an IPSA spoof packet in which an actual IP address is set in IPSA will be described with reference to FIG.
FIG. 9 is a diagram for explaining monitoring of a TCP abnormal connection sequence for detection of an IPSA spoofed packet (when an actual IP address is set) in the present embodiment. The configuration of the network 11 is the same as that in FIG.

  The IP address of the attacker terminal 17 is originally “10.0.20.1/24”. However, in FIG. 9, in the IPSA spoof packet 21, the IP address “10.0.10.1” of another existing device (the server 18 in the example of FIG. 9) is set as the IP address of the attacker terminal.

  The attacker terminal 17 transmits an IPSA spoof packet 21 (SYN packet) to the target server 19. Then, the IPSA spoofing packet 21 is transmitted to the target server 19 via the packet detection device 12 (PD # 2, PD # 5, PD # 3). When the target server 19 receives the SYN packet, the target server 19 transmits a SYN-ACK packet with the IPSA set in the IPSA spoofing packet 21 as the transmission destination (that is, the server 18). The L3SW (15a) transmits the SYN-ACK packet to the packet detection device 12 (# 6) side. The SYN-ACK packet is transmitted to the server 18 via the packet detection device 12 (PD # 3, PD # 6, PD # 1).

  Since the server 18 has not transmitted the SYN packet, the server 18 discards the received SYN-ACK packet. Therefore, the packet detection device 12 (PD # 1, PD # 2, PD # 3, PD # 5, PD # 6) detects an incomplete connection sequence.

  In the following, using FIG. 10 to FIG. 12, the sequence of connection establishment by the 3-way handshake and the abnormal state by the packet detection device 12 (PD # 1, PD # 2, PD # 3, PD # 5, PD # 6) The sequence determination will be described.

  FIG. 10 is a diagram illustrating an abnormal sequence detection process based on an IPSA spoofed packet (when an actual IP address is set) by the packet detection device (PD # 2, PD # 5).

  As shown in FIG. 10A, when the transmission side (attacking side) transmits a SYN packet, the SYN packet is transmitted to the reception side (PD # 2, PD # 5) via the packet detection device 12 (PD # 2, PD # 5). Sent to the attacked side). When the receiving side (the attacked side) returns a SYN-ACK packet, the SYN-ACK packet is transmitted to the packet detection device 12 (PD # 6) side by L3SW (15a) as described in FIG. Is not transmitted to the packet detection device 12 (PD # 5) side. Therefore, the packet detector 12 (PD # 2, PD # 5) cannot receive the SYN-ACK packet.

  Therefore, in the packet detection device 12 (PD # 2, PD # 5), since a SYN-ACK packet is not detected even after a lapse of a certain time after the detection of the SYN packet, a timeout occurs as shown in FIG. . In this case, the packet detection device 12 (PD # 2, PD # 5) determines that an abnormal connection sequence has been detected.

  FIG. 11 is a diagram illustrating an abnormal sequence detection process based on an IPSA spoofed packet (when an actual IP address is set) by the packet detection device (PD # 3).

  As shown in FIG. 11A, when the transmission side (attacking side) transmits a SYN packet, the SYN packet is transmitted to the reception side (attacked) via the packet detection device 12 (PD # 3). Side). When the receiving side (attacked side) returns a SYN-ACK packet, the SYN-ACK packet is sent back to the transmitting side (attacking side) via the packet detection device 12 (PD # 3). . However, as described above, the L3SW (15a) transmits a SYN-ACK packet to the server 18. Since the server 18 discards the SYN-ACK packet, the ACK packet corresponding to the SYN-ACK packet is never transmitted. Therefore, the packet detection device 12 (PD # 3) cannot receive the ACK packet.

  In the packet detector 12 (PD # 3), if a SYN-ACK packet is not detected after a certain time has elapsed after the detection of the SYN-ACK packet, a timeout occurs as shown in FIG. In this case, the packet detection device 12 (PD # 3) determines that an abnormal sequence has been detected. Note that the receiving side (the attacked side) occupies resources until the timeout time and is in a waiting state (TCP half-open state).

  FIG. 12 is a diagram illustrating an abnormal sequence detection process based on an IPSA spoofed packet (when an actual IP address is set) by the packet detection device (PD # 1, PD # 6).

  As shown in FIGS. 12A and 12B, the packet detection devices (PD # 1, PD # 6) detect the SYN-ACK packet in a state where no SYN packet is detected. In this case, the packet detection device 12 (PD # 1, PD # 6) determines that an abnormal sequence has been detected.

  FIG. 13 is a diagram for explaining processing for notifying a management server of a detection event by the packet detection device according to the present embodiment. For example, in FIG. 13, when the packet detection device 12 (PD # 2, PD # 3, PD # 5) detects an abnormal connection sequence, an event detected by the management server 14 by an SNMP (Simple Network Management Protocol) trap function. To report.

  FIG. 13 shows processing corresponding to FIG. 6 (when an IP address that does not originally exist in IPSA is set), but FIG. 9 (when another IP address that exists actually is set) is the same. . In other words, in FIG. 9, when the packet detection device 12 (PD # 1, PD # 2, PD # 3, PD # 5, PD # 6) detects an abnormal connection sequence, it sends to the management server 14 by the SNMP trap function. Report the detected event.

  As a recovery measure when an SNMP trap is missed, the management server 14 may perform polling processing for each packet detection device 12 at regular time intervals to collect detection events from each network.

Next, an abnormal connection sequence detection by the packet detection device described with reference to FIGS. 6 to 13 and a notification result notification to the management server will be described with reference to FIGS.
FIG. 14 shows an example of the processing flow of the packet detection apparatus in this embodiment. As will be described with reference to FIGS. 14 to 19, the packet detection device 12 detects an abnormal connection sequence and notifies the management server of the detection result.

  When receiving the packet (S11), the packet detection device 12 determines whether or not the received packet is a TCP packet based on the header of the received packet (S12). If the received packet is not a TCP packet (“No” in S12), the process returns to S11.

  If the received packet is a TCP packet (“Yes” in S12), the packet detection device 12 checks the TCP flag included in the received packet (S13). When the TCP flag is “SYN”, the packet detection device 12 performs the 3-way handshake verification process 1 (S14). Details of the processing of S14 will be described with reference to FIG. When the TCP flag is “SYN-ACK”, the packet detection device 12 performs the 3-way handshake verification process 2 (S15). Details of the processing of S15 will be described with reference to FIG. When the TCP flag is “ACK”, the packet detection apparatus 12 performs the 3-way handshake verification process 3 (S16). Details of the processing of S16 will be described with reference to FIG. If the TCP flag is not “SYN”, “SYN-ACK”, or “ACK”, the process returns to S11.

  In S14 to S16 (FIGS. 16, 17, and 18), the packet detection apparatus 12 should receive a received packet when a normal connection sequence based on a 3-way handshake is established in order to determine an abnormal connection sequence. Determine if it is a packet. This determination process will be described with reference to FIG.

  FIG. 15 is a diagram for explaining processing for determining whether or not a received packet is a packet to be received when a normal connection sequence based on a three-way handshake is established in order to determine an abnormal connection sequence in the present embodiment. FIG. The packet detection device 12 includes a storage device such as a memory and a hard disk drive (HDD).

  The packet detector 12 reserves temporary storage buffers 21 (temporary storage buffers # 1, # 2,... #N) as buffer areas for holding received packets in the storage device. The temporary storage buffer #n is created for each connection sequence of the 3-way handshake. For example, data items of “detection time”, “IPSA”, “IPDA”, and “TCP flag” are held in the temporary storage buffer #n. “Detection time” indicates the date and time when the packet detection device 12 detected the received packet. “IPSA” indicates the IP address (IPSA) of the transmission source of the received packet. “IPDA” indicates the IP address (IPDA) of the transmission destination of the received packet. “TCP flag value” indicates the value of the TCP flag of the received packet.

In addition, the packet detection device 12 has a search area 22 in the storage device. The search area 22 is a work area on a memory that temporarily holds information.
The packet detection device 12 registers a shortage packet for completing the 3-way handshake in the search area 22 using the packet held in the temporary storage buffer 21. That is, the packet detection device 12 generates “IPSA”, “IPDA”, and “TCP flag value” of the next packet to be received in order to establish a normal connection sequence from the packet stored in the temporary storage buffer 21, and searches the search area. 22 is registered.

  For example, in the temporary storage buffer # 1, detection time = “20xx.11.24-23: 38: 24.xxx”, IPSA = “10.0.30.1”, IPDA = “10.0.99.99”, TCP flag = “SYN-ACK” Packets up to are accumulated. In this case, in order to establish a normal connection sequence based on the three-way handshake, the IPSA, IPDA, and TCP flag values of the next received packet are IPSA = “10.0.99.99”, IPDA = “10.0.30.1”, TCP Flag = “ACK”. Therefore, the packet detection apparatus 12 registers IPSA = “10.0.99.99”, IPDA = “10.0.30.1”, TCP flag value = “ACK”, and corresponding buffer = “# 1” in the search area 22.

  Similarly, for the temporary storage buffer # 2, the packet detection device 12 puts IPSA = “10.0.10.1”, IPDA = “10.0.30.1”, TCP flag = “ACK”, corresponding buffer = “# 2” in the search area 22. ".

  When receiving a new packet, the packet detection device 12 searches the search area 22 for an entry that matches the “IPSA”, “IPDA”, and “TCP flag value” of the received packet. In FIG. 15, when the newly received packet is IPSA = “10.0.10.1”, IPDA = “10.0.30.1”, and TCP flag value = “ACK”, “IPSA” of the received packet is displayed in the search area 22. , “IPDA”, and “TCP flag value”. In this case, the temporary storage buffer “# 2” is set in the item “corresponding buffer” of the entry. Therefore, the packet detection device 12 stores the received packet in the temporary storage buffer # 2.

  FIG. 16 shows an example of a detailed flow of the 3-way handshake verification process 1 (S14) when a SYN packet is received in this embodiment. The packet detection device 12 searches the search area 22 for an entry that matches “IPSA”, “IPDA”, and “TCP flag value = SYN” of the received packet (S14-1).

  If there is no matching entry in the search area 22 (“No” in S14-2), the packet detection device 12 newly secures a temporary storage buffer #n in the storage device for the 3-way handshake abnormality determination. (S14-6).

  The packet detection apparatus 12 temporarily stores the received SYN packet in the newly secured temporary storage buffer #n (S14-7). The packet detection device 12 performs temporary storage buffer management processing (S17). S17 will be described with reference to FIG.

  When there is a matching entry in the search area 22 (“Yes” in S14-2), the packet detection apparatus 12 receives the received data in the temporary storage buffer set in the data item “corresponding buffer” included in the entry. The SYN packet is temporarily stored (S14-3). The packet detection device 12 deletes the matched entry from the search area 22 (S14-4).

  If the normal connection sequence is established, the packet detection apparatus 12 registers an entry including “IPSA”, “IPDA”, and “TCP flag value = SYN-ACK” of the next packet to be received in the search area 22 (S14-). 5). Thereafter, the process returns to S11.

  FIG. 17 shows an example of a detailed flow of the 3-way handshake verification process 2 (S15) when a SYN-ACK packet is received in this embodiment. The packet detection apparatus 12 searches the search area 22 for an entry that matches the “IPSA”, “IPDA”, and “TCP flag value = SYN-ACK” of the received packet (S15-1).

  If there is no matching entry in the search area 22 (“No” in S15-2), the packet detection device 12 newly secures a temporary storage buffer #n in the storage device for the 3-way handshake abnormality determination. (S15-6).

  The packet detector 12 temporarily stores the received SYN-ACK packet in the newly secured temporary storage buffer #n (S15-7). The packet detection device 12 performs temporary storage buffer management processing (S17). S17 will be described with reference to FIG.

  When there is a matching entry in the search area 22 (“Yes” in S15-2), the packet detection apparatus 12 receives the received data in the temporary storage buffer set in the data item “corresponding buffer” included in the entry. The SYN-ACK packet is temporarily stored (S15-3). The packet detection device 12 deletes the matched entry from the search area 22 (S15-4).

  If the normal connection sequence is established, the packet detection device 12 registers an entry including “IPSA”, “IPDA”, and “TCP flag value = ACK” of the next packet to be received in the search area 22 (S15-5). . Thereafter, the process returns to S11.

  FIG. 18 shows an example of a detailed flow of the 3-way handshake verification process 3 (S16) when an ACK packet is received in this embodiment. The packet detection device 12 searches the search area 22 for an entry that matches the “IPSA”, “IPDA”, and “TCP flag value = ACK” of the received packet (S16-1).

  If there is no matching entry in the search area 22 (“No” in S16-2), the packet detection device 12 newly secures a temporary storage buffer #n in the storage device for the 3-way handshake abnormality determination. (S16-5).

  The packet detection apparatus 12 temporarily stores the received ACK packet in the newly secured temporary storage buffer #n (S16-6). The packet detection device 12 performs temporary storage buffer management processing (S17). S17 will be described with reference to FIG.

  When there is a matching entry in the search area 22 (“Yes” in S16-2), the packet detection apparatus 12 receives the received data in the temporary storage buffer set in the data item “corresponding buffer” included in the entry. The ACK packet is temporarily stored (S16-3). The packet detection device 12 deletes the matched entry from the search area 22 (S16-4). Thereafter, the process returns to S11.

  FIG. 19 shows an example of a detailed flow of the temporary storage buffer management process (S17) in the present embodiment. The packet detection device 12 starts the threshold timer for measuring the threshold time after writing the packet information in the temporary storage buffer (S17-1).

  The packet detection device 12 determines whether or not new packet information is written in the temporary storage buffer within the threshold time (S17-2). If packet information is newly written in the temporary storage buffer within the threshold time (“Yes” in S17-2), the packet detection device 12 determines whether or not the connection sequence by the 3-way handshake is completed. (S17-3). When a set of connection sequence packets (SYN packet, SYN-ACK packet, ACK packet) is stored in the temporary storage buffer 21 (#n), the packet detection device 12 has completed the connection sequence by the 3-way handshake. Is determined. When it is determined that the connection sequence by the 3-way handshake is completed (“Yes” in S17-3), the packet detection device 12 releases the temporary storage buffer #n area secured on the storage device (S17-7). . Thereafter, the process returns to S11.

  When it is determined that the connection sequence by the 3-way handshake is not completed (“No” in S17-3), the packet detection device 12 restarts the threshold timer (S17-4). Then, the process returns to S17-2.

  In S17-2, when packet information is newly written in the temporary storage buffer within the threshold time ("No" in S17-2), the packet detection device 12 indicates that the abnormal connection sequence is in the management server. 14 (S17-5). In this case, the packet detection device 12 notifies the management server 14 that it is an abnormal connection sequence including information in the temporary storage buffer 21.

  When the management server 14 receives the detection result of the abnormal connection sequence determination from the packet detection device 12, the management server 14 merges the detection results and verifies the detection results. This verification is performed in order to verify a connection sequence in which the TCP 3-way handshake is established if other routes are taken into consideration even when the TCP 3-way handshake is not established locally due to the network topology.

  The packet detector 12 holds the information in the temporary storage buffer #n for retransmission for a certain time (S17-6). At this time, the packet detection device 12 adjusts the holding time based on the threshold timer or the number of storage buffers. The packet detection device 12 releases the temporary storage buffer #n area secured on the storage device (S17-7). Thereafter, the process returns to S11.

  When the management server 14 receives the detection result of the abnormal connection sequence determination from the packet detection device 12, the management server 14 merges the detection results and verifies the detection results. This verification is performed in order to verify the connection sequence in which the TCP 3-way handshake is established if other routes are taken into consideration even if the TCP 3-way handshake is not established locally due to the network topology. .

  As described in S17-5, when receiving the detection result of the abnormal connection sequence determination from the packet detection device 12, the management server 14 merges the detection results and verifies the detection results. As a result, as described with reference to FIG. 21, it is possible to eliminate the influence of TCP communication paths between terminals distributed in a network having an equal cost multipath configuration. As for the Ether channel section, as will be described with reference to FIG. 22, by setting a representative packet detection device 12, it is possible to avoid the influence of TCP communication between terminals being distributed and communicating over the Ether channel section. it can. Hereinafter, verification of detection results collected from the packet detection device 12 will be described.

  FIG. 20 is a diagram for explaining an abnormal connection sequence verification process in the present embodiment. The management server 14 merges the abnormal connection sequence detection results of the packet detection devices 12 based on IPSA, IPDA, detection date and time, and the like.

  In FIG. 20, a detection result 31 is transmitted from the packet detection device 12 (PD # 2, PD # 5). Since the detection result 31 indicates that a SYN packet has been detected, the packet detection device 12 (PD # 2, PD # 5) has been waiting for a SYN-ACK packet corresponding to the SYN packet, but has timed out. Show.

  The detection result 32 is transmitted from the packet detection device 12 (PD # 3). In the detection result 32, since a SYN packet and a SYN-ACK packet are detected, the packet detection device 12 (PD # 3) waits for an ACK packet corresponding to the SYN-ACK packet, but has timed out. Indicates.

  As shown in FIG. 20, the management server 14 merges two or more detection results based on IPSA, IPDA, TCP flag values, etc., and eliminates redundant received packet information. The management server 14 determines whether a connection sequence based on a 3-way handshake is established for each connection sequence included in the merge result. The management server 14 re-determines an incomplete connection sequence in which the connection sequence by the three-way handshake is not established as an abnormal connection sequence.

Further, the verification process of the abnormal connection sequence will be described in detail with reference to FIGS.
FIG. 21 shows a normal sequence determination example by the abnormal connection sequence verification process under the equal cost multipath condition in the present embodiment. An equal cost multipath is set between L3SW # 1 and L3SW # 2, and is connected by, for example, two physical lines. A packet detector 12 (PD # X1, PD # X2) is set for each physical line. L3SW # 1 is connected to the transmission-side terminal 41. L3SW # 2 is connected to the server 42.

  The detection result 43 of the packet detection device 12 (# X1) is timed out since the SYN-ACK packet is not received within the time-out threshold after the SYN packet is detected. From this, the connection sequence of the detection result 43 is determined to be abnormal. In the detection result 43, it is assumed that an ACK packet is detected within the time-out threshold value × 3. Since the connection sequence is determined to be abnormal, the packet detection device 12 (PD # X1) transmits the detection result 43 to the management server 14 as an abnormal connection sequence.

  In the detection result 44 of the packet detector 12 (# X2), since the SYN packet is not detected and the SYN-ACK packet is received, the connection sequence of the detection result 43 is determined to be abnormal. Further, in the detection result 43, after detecting a SYN-ACK packet, the ACK packet has not been received within the timeout threshold value, so the timeout has occurred. Since the connection sequence is determined to be abnormal, the packet detection device 12 (PD # X2) transmits the detection result 44 to the management server 14 as an abnormal connection sequence.

  The management server 14 merges the abnormal connection sequence detection results collected from the packet detection device 12. Specifically, the management server 14 merges the collected abnormal connection sequence detection results based on a combination of IPSA and IPDA, a combination of TCP flag values (SYN, SYN-ACK, ACK), and the like. The management server 14 determines, for each connection sequence included in the merged detection result, whether there is a connection sequence that completes the connection sequence by the three-way handshake. If the connection sequence by the three-way handshake is a connection sequence that is completed, the management server 14 re-determines that sequence as a normal connection sequence.

  FIG. 22 is a diagram for explaining the operation of the packet detection apparatus when the Ether channel section is arranged in the present embodiment. Between L3SW # 1 and L3SW # 2, an Ether channel is configured. Ether channel refers to a technology that uses a plurality of physical lines as one logical link. A plurality of physical lines are connected between L3SW # 1 and L3SW # 2. A packet detector 12 (PD # X1, PD # X2, PD # X3) is set for each physical line. L3SW # 1 is connected to the transmission-side terminal 41. L3SW # 2 is connected to the server 42.

  In FIG. 22, packet detection devices 12 arranged in the same Ether channel section are grouped, and one of the packet detection devices is set as a representative packet detection device (representative PD).

Packet detection devices (subordinate PDs) other than the representative packet detection device (representative PD) transmit the received packet information to the representative PD.
The representative PD performs the abnormal connection sequence detection process by combining the packet information collected by the subordinate PD and the packet information received by itself. The representative PD communicates with the management server 14 such as detection event notification using an SNMP trap function and a response to polling from the management server.

  FIG. 23 shows an example of a verification table in the present embodiment. The verification table 50 is a table used by the management server 14 to verify the abnormal connection sequence from the detection results collected from the packet detection device 12. The server 14 constructs the verification table 50 based on the information sent from the packet detection device 12 (notified in S17-5). FIG. 23A shows the verification table 50a before the merge process. FIG. 23B shows the verification table 50b after the merge process.

  The verification table 50 includes data items of “detection PD” 51, “detection date / time” 52, “IPSA” 53, “IPDA” 54, and “TCP flag” 55. The “detection PD” 51 stores information for identifying the packet detection device 12 from which the detection results are collected. The “PD detection date / time” 52 indicates the date / time detected by the packet detection device 12. “IPSA” 53 stores the IP address of the transmission source. “IPDA” 54 stores a destination IP address. The value of the TCP flag is stored in “TCP flag”.

  FIG. 24 shows an example of an abnormal connection sequence verification processing flow by the management server in the present embodiment. The management server 14 receives the abnormal connection sequence detection result including the contents of the temporary storage buffer from the packet detection device 12 (S21). The management server 14 develops the received abnormal connection sequence detection result in time series in the verification table 50a as shown in FIG. 23A using the detection date and time on the packet detection device 12 side (S22).

The management server 14 merges packet information satisfying all the following conditions as shown in FIG. 23B, and eliminates redundant packet information (S23).
(Condition 1) Packet information detected by different packet detection devices 12 (packet information detected by the same packet detection device is not merged).
(Condition 2) Packet information with matching IPSA, IPDA, and TCP flag values.
(Condition 3) Among packet information to be merged, packet information that falls within a threshold time (for example, 10 ms or less) starting from packet information with the earliest detection date and time.
By the process of S23, the packet information detected redundantly by the plurality of packet detection devices 12 can be combined into one.

  Using the merged verification table 50b, the management server 14 performs re-determination processing to determine whether or not the connection sequence is normal based on the three-way handshake flow rules (S24). That is, the management server 14 detects that all connection sequence packets (SYN, SYN-ACK, ACK) are detected within the threshold time after the combination of IPSA and IPDA is appropriate using the merged verification table 50 and the SYN packet is detected. It is determined whether the connection sequence is completed. Based on the verification table 50b, the management server 14 determines that “IPSA: A, IPDA: B, TCP flag value = SYN”, “IPSA: B, IPDA: A, TCP flag value = SYN-ACK”, “ It is determined whether a packet of “IPSA: A, IPDA: B, TCP flag value = ACK” is detected.

When the combination of IPSA and IPDA is appropriate and the connection sequence is a connection sequence in which all connection sequence packets are detected within the threshold time after the SYN packet is detected, the management server 14 determines that the connection sequence is normal ( S26). On the other hand, the management server 14 determines a connection sequence that is not determined to be normal in S24 as an abnormal connection sequence (S25).
After the processing of S25 or S26, the management server 14 deletes the contents of the verification table 50 (S27).

  Next, an IPSA spoof determination is performed as to whether or not the cause of the TCP connection abnormality is due to IPSA spoofing for the packet determined to be an abnormal connection sequence in the above connection sequence verification process. Note that the IPSA spoof determination process differs depending on whether or not the IP address spoofed by the attacker exists on the network 11 with respect to the connection sequence determined to be an abnormal connection sequence in the verification process. IPSA misrepresentation determination when the misrepresented IP address does not exist on the network 11 will be described with reference to FIG. IPSA misrepresentation determination when a misrepresented IP address exists on the network 11 will be described with reference to FIGS. 26 and 27. FIG.

  FIG. 25 is a diagram for describing determination of whether or not a packet determined to be an abnormal connection sequence in this embodiment is an IPSA spoofed packet (when an IP address that does not originally exist in the IPSA is set). .

  The management server 14 extracts a SYN packet not responding to SYN-ACK from the detection results collected from the packet detection device 12. The management server 14 extracts IPSA and IPDA from the extracted SYN packet (S31). The management server 14 performs the following processing using the extracted IPDA and IPSA.

  The management server 14 requests the terminal network device (TND) 13 arranged in the same segment as the IPDA to issue a trace route addressed to the IPSA. Based on the request, the terminal network device 13 issues a trace route addressed to IPSA, and acquires the trace route issue result. The management server 14 acquires the trace route issue result from the terminal network device 13 (S32).

The management server 14 determines that the SYN packet extracted in S31 is an IPSA spoof packet when the following conditions are satisfied using the trace route issue result and the detection result of the packet detection device 12 (S33).
Condition 1: The trace route issuance result is abnormal.
Condition 2: The number of detections per unit time of the extracted SYN packet exceeds the threshold.

  FIG. 26 is a diagram for describing determination of whether or not a packet determined to be an abnormal connection sequence in this embodiment is an IPSA spoof packet (when an actual IP address is set).

  The management server 14 extracts a SYN packet not responding to SYN-ACK from the detection results collected from the packet detection device 12. The management server 14 extracts IPSA and IPDA from the extracted SYN packet (S41). The management server 14 performs the following processing using the extracted IPDA and IPSA.

  The management server 14 requests the terminal network device (TND) 13 arranged in the same segment as the IPDA server to issue a trace route addressed to the IPSA. Based on the request, the terminal network device 13 issues a trace route addressed to IPSA, and acquires the trace route issue result. The management server 14 acquires the trace route issue result from the terminal network device 13 (S42).

The management server 14 determines that the SYN packet extracted in S41 is an IPSA spoof packet when the following conditions are satisfied using the trace route issue result and the detection result of the packet detection device 12 (S43).
Condition 1: The trace route issuance result is normal.
Condition 2: The trace route result does not match the arrangement route of the packet detection device 12 that detected the SYN packet extracted in S41 (see FIG. 27).

  FIG. 27 is a diagram for explaining condition 2 in the determination of S43. The PD detection route table 61 indicates an address space in which each packet detection device 12 that detects the packet extracted in S41 is arranged.

  The management server 14 uses the detection results collected from the packet detection device 12 under the conditions of IPSA = 10.0.10.1 and IPDA = 10.0.30.1 and Protocol No = 6 (TCP) and Tcp flags = 2 (SYN), for example. Extract packet detection information. The management server 14 stores, in the PD detection route table 61, the packet detection device that has detected the corresponding packet and information on the address space in which the corresponding packet detection device is arranged. Information about the address space of the packet detection device 12 may be stored in advance in the storage device of the management server 14.

The trace route result 62 is a trace route result addressed to the IP address “10.0.10.1” from the terminal network device 13.
The management server 14 compares the trace route result 62 with the PD detection route table 61. Of the trace route result 62, “10.0.50.10” is included in the address space “10.0.50.8/30” of PD # 3. However, “10.0.30.254”, “10.0.40.9”, “10.0.40.2”, and “10.0.10.1” of the trace route result 62 are not included in the address space of any packet detection device 12. In this case, the trace route result 62 is inconsistent with the arrangement route of the packet detection device 12 that detected the SYN packet extracted in S41.

  FIG. 28 shows an example of a processing flow for determining whether or not a packet determined to be an abnormal connection sequence in this embodiment is an IPSA spoofed packet. The management server 14 extracts a SYN packet not responding to SYN-ACK from the detection results collected from the packet detection device 12 (S51). The management server 14 extracts IPSA and IPDA from the extracted SYN packet (S52). The management server 14 uses the extracted IPDA and IPSA for the following processing.

  The management server 14 requests the terminal network device (TND) 13 arranged in the same segment as the IPDA server to issue a trace route addressed to the IPSA (S53). Based on the request, the terminal network device 13 issues a trace route addressed to IPSA, and acquires the trace route issue result. The terminal network device 13 transmits the trace route issue result to the management server 14. The management server 14 acquires the trace route issue result from the terminal network device 13 (S54).

  The management server 14 determines whether or not the acquired trace route issue result is normal (S55). When the acquired trace route issuance result is abnormal (or error), the management server 14 determines whether or not the number of detections per unit time of the SYN packet extracted in S51 exceeds a threshold value (S57). When the number of detections per unit time of the SYN packet exceeds the threshold value, the management server 14 determines that the IPSA of the SYN packet is a misrepresentation (S58).

  If the acquired trace route issuance result is normal in S55 (“Yes” in S55), it is determined whether the transmission route of the SYN packet extracted in S51 matches the trace route issuance result (S56). In S56, as described with reference to FIG. 27, if all IP addresses included in the trace route issuance result are included in the address space in which the packet detection device 12 that has detected the SYN packet extracted in S51 is included, management is performed. The server 14 determines that the routes match.

As a result of the determination in S56, if the transmission route of the SYN packet extracted in S51 does not match the trace route issuance result (“No” in S56), the management server 14 determines that the IPSA of the SYN packet is false. (S58).
In this way, it can be determined whether or not the IPSA of the transmitted packet is spoofed.

Next, visualization of IPSA spoofed packet detection will be described.
FIG. 29 shows an example of a network configuration for displaying an IPSA spoofed packet detection screen on the client PC in this embodiment. A personal computer (client PC) 71 is connected to the management server 14 via a network 72 (for example, the Internet or a LAN (Local Area Network)).

  A screen data request is transmitted from the client PC 71 to the management server 14 (arrow 73). Then, the management server 14 provides screen data as shown in FIGS. 30 to 40 to the WEB browser or the dedicated application software on the client PC 71 side (arrow 74).

  FIG. 30 shows an example of the IPSA spoofed packet detection screen in the present embodiment. The IPSA spoofed packet detection screen 80 includes, for example, elements of “node icon” 81, “TND icon” 82, “link line connecting node icons” 83, “common information area” 84, and “information area” 85. Including.

  In the “node icon” 81, “IP address” and “subnet information” can be registered. Of the “link line connecting the node icons” 83, the link where the packet detection device 12 is arranged is indicated by a thick solid line. Of the “link lines connecting the node icons” 83, the links where the packet detection device 12 is not arranged are indicated by thick broken lines. As described in FIG. 31, the “information area” 85 is automatically created when subnet information is registered on the node icon setting screen. The “information area” 85 is normally not displayed.

  A screen for defining each element included in the IPSA spoofed packet detection screen 80 will be described with reference to FIGS.

  FIG. 31 shows an example of a node icon definition screen in the present embodiment. The node icon definition screen 90 is a screen for setting the definition of each node constituting the network such as L2SW and L3SW. The node icon definition screen 90 includes a device name input field 91, an icon selection field 92, a registered address list 93, an add button 94, a delete button 95, a subnet address list 96, an add button 97, and a delete button 98.

  In the device name input field 91, the device name defined in the node icon is input. In the icon selection column 92, selectable patterns of node icons are displayed.

  In the registered address list 93, “IP address” and “remarks” of the device defined in the node icon are displayed. When the add button 94 is pressed, the “IP address” and “remarks” of the device defined in the node icon can be registered in the registered address list 93. When the delete button 95 is pressed, the line selected in the registered address list 93 can be deleted.

  In the subnet address list 99, “IP address” and “remarks” of the subnet address accommodated by the device defined in the node icon are displayed. When the add button 97 is pressed, “IP address” and “remarks” of the subnet address can be registered in the subnet address list 96. When the delete button 98 is pressed, the line selected in the registered address list 93 can be deleted. When registered in the subnet address list 96, an information area 85 is automatically generated.

  32, 33, and 34 show an example of the link line definition screen in the present embodiment. The link line definition screen 100 is a screen for setting a link line definition for each link line 83. The link line definition screen 100 includes a connection source input field 101, a connection source IP address setting field 102, a connection destination input field 103, and a connection destination IP address setting field 104. Furthermore, the link line definition screen 100 includes a registered subnet list 105, an add button 106, a delete button 107, an Ethernet channel setting list 108, an add button 109, and a delete button 110.

  In the connection source input field 101, the device name of the connection source is input. In the connection source IP address setting field 102, the IP address of the connection source device is set. In the connection destination input field 103, the device name of the connection destination is input. In the connection destination IP address setting field 104, the IP address of the connection destination device is set.

  The registered subnet list 105 displays “subnet address” and “remarks” to which the link line belongs. When the add button 106 is pressed, “subnet address” and “remarks” can be registered in the registered subnet list 105. When the delete button 107 is pressed, the row selected in the registered subnet list 105 can be deleted.

  The Ether channel setting list 108 displays “PD name” (packet detection device) arranged on the link line, “IP address” and “port 1 direction” of the packet detection device. “Port 1 direction” means that the port 1 of the two ports of the packet detection device is connected to either the device set in the connection source input field 101 or the device set in the connection destination input field 103. Indicates whether or not When the add button 109 is pressed, “PD name”, “IP address”, and “port 1 direction” can be registered in the Ether channel setting list 108. When the delete button 110 is pressed, the line selected in the Ethernet channel setting list 108 can be deleted.

  When the packet detection device 12 is not registered in the Ether channel setting list 108, the link line 83 is displayed as a dotted line as shown in FIG. When one packet detection device 12 is registered in the Ether channel setting list 108, the link line is displayed as a solid line as shown in FIG. When a plurality of packet detection devices 12 are registered in the Ether channel setting list 108, the Ether channel mark 111 is automatically displayed as shown in FIG.

  FIG. 35 shows an example of a TND definition screen in the present embodiment. The TND definition screen 120 is a screen for setting the definition of each terminal network device (TND) 82. The TND definition screen 90 includes a device name input field 121, an icon selection field 122, a registered address list 123, an add button 124, and a delete button 125.

  In the device name input field 121, a device name defined as the device name is input. In the icon selection field 122, the icons of selectable icons of the terminal network device 13 are displayed.

  The registered address list 93 displays the registered “IP address” and “remarks”. When the add button 124 is pressed, “IP address” and “remarks” can be registered in the registered address list 123. When the delete button 125 is pressed, the line selected in the registered address list 123 can be deleted.

  The detection results and the like by the packet detection device 12 and the terminal network device 13 are displayed by mapping to the respective icons and link lines based on information predefined in the node icon 81, the link line 83, and the TND icon 82. However, if there is no definition information that can be mapped on the screen, the detection result and the like are displayed in the common information area 84.

  The abnormal connection sequence determination result or the like by the management server 14 is displayed by being mapped to an icon or a link line based on information predefined in the node icon 81, the link line 83, and the TND icon 82. However, if there is no definition information that can be mapped on the screen, the abnormal connection sequence determination result or the like is displayed in the common information area 84.

  FIG. 36 shows a display example of a screen when an IPSA spoofed packet is detected in this embodiment (when an IP address that does not exist is set in IPSA). FIG. 37 shows a display example of a screen when an IPSA spoofed packet is detected in this embodiment (when an actual IP address is set in IPSA). In FIG. 36 and FIG. 37, the management server 14 performs mapping display on the screen according to the following rules.

  The management server 14 displays the IPSA spoofed packet detection route by the packet detection device 12 as an arrow 83a on the link line 83 where the packet detection device 12 is registered. The management server 14 calculates the direction of the arrow 83 a from the information of the port 1 direction defined in the link line 83. That is, the management server 14 determines, based on the information of the port 1 direction defined on the link line 83, from the detection result of the packet detection device 12, from which port of the packet detection device 12 the packet is input or output. To detect. Thereby, the management server 14 can detect the passing direction of the packet that has passed through the route where the packet detection device 12 is arranged. As a result, the management server 14 can display the arrangement route of the packet detection device 12 that has detected the IPSA spoof packet, for example, by highlighting or changing the color. Therefore, the management server 14 can also display the communication direction of the IPSA spoofed packet by the direction of the arrow 83a.

  The management server 14 displays the result of the communication confirmation by the terminal network device 13 as an arrow highlighted on the link line based on the IP address defined in the “link line connecting the node icons” 83. The management server 14 calculates the direction of the highlighted arrow from the IP address defined in the link line. That is, the management server 14 maps a link line in which the IP address defined in the link line matches the IP address included in the trace route result obtained from the terminal network device.

  The management server 14 maps and displays the destination address (IPDA) of the IPSA spoof packet, that is, the IP address of the target server in the information area 85a. The management server 14 calculates the subnet address of the target server from the IP address of the target server. Then, using the subnet address registered on the node icon definition screen, the management server 14 displays the IP address of the target server in the information area where the subnet address that matches the calculated subnet address is registered.

  The management server 14 displays the IPSA spoof packet source address (IPSA) in the information area. The management server 14 calculates the subnet address of the transmission source address from the transmission source address of the IPSA spoofing packet. Using the subnet address registered on the node icon definition screen 90, the management server 14 displays the IP address of the IPSA spoofed packet transmission source in the information area 85 where the subnet address that matches the calculated subnet address is registered. . If there is no information area 85 where the subnet address that matches the calculated subnet address is registered, the management server 14 displays IPSA in the common information area 84. In the case of FIG. 36, since there is no spoofed IP address, there is no matching definition information on the IPSA spoofed packet detection screen 80. Therefore, in this case, the spoofed IPSA is displayed in the common information area 85.

  Further, as shown in FIGS. 36 and 37, when the user clicks on the link line 83 (solid link line), the management server 14 sends the IPSA spoof packet corresponding to the packet detection device 12 registered in the clicked link line. A window 131 for displaying the detection result is displayed. The detection contents displayed in the window 131 include, for example, “detection date / time”, “IPSA”, “IPDA”, “TCP flag value”, and “number of attacks”. As a result, it is possible to grasp the more specific scale of the attack and the impact of the attack.

  Next, a support function for specifying the attack source terminal will be described. In the example of FIG. 37, from the IPSA spoofed packet detection screen 80, the user narrows down the suspected segment suspected of having an IPSA spoofed packet (manual operation). Therefore, the user can narrow down the suspected segment by searching for the starting point of the route (display of the highlighted arrow) where the spoofed packet is detected on the IPSA spoofed packet detection screen 80.

  Thereafter, when the user clicks the icon 82 of the end network device 13 arranged in the suspected segment, an instruction screen for specifying the IPSA spoofed packet transmission terminal is displayed as shown in FIG.

  FIG. 38 shows an example of an instruction screen for specifying an IPSA spoofed packet transmission terminal in the present embodiment. The instruction screen 140 includes a “start” button 141 and a “cancel” button 142. When the “Cancel” button 142 is pressed, the instruction screen 140 is closed and the IPSA spoofed packet detection screen 80 is returned.

  When the “start” button 141 is pressed, processing for specifying an IPSA spoofed packet transmission terminal is started. Specifically, the management server 14 instructs the clicked end network device 13 to communicate with an IP address determined to be spoofed (such as transmission of an ICMP (Internet Control Message Protocol) echo request). .

  The terminal network device 13 executes communication addressed to the IP address determined to be spoofed based on an instruction from the management server 14. As the communication is executed, the terminal network device 13 performs address resolution processing using an ARP (Address Resolution Protocol) packet. After attempting communication to the IP address determined to be spoofed, the terminal network device 13 checks the ARP table in the device itself. When the terminal network device 13 confirms the MAC address corresponding to the spoofed IP address in the ARP table in its own device, it notifies the management server 14 of the confirmed MAC address. With this notification, the management server 14 can identify the terminal that transmitted the IPSA spoofing packet. Further, when the end network device 13 cannot confirm the MAC address corresponding to the spoofed IP address, it notifies the management server 14 that the corresponding device does not exist. In this case, the management server 14 cannot identify the terminal that transmitted the IPSA spoofing packet. Based on the response result from the terminal network device 13, the management server 14 performs screen display as shown in FIG. 39 or FIG.

  FIG. 39 is an example of a screen displayed when a terminal that has transmitted an IPSA spoofing packet in this embodiment is specified. As described above, when the MAC address corresponding to the spoofed IP address is notified from the end network device 13, that is, when the terminal that transmitted the IPSA spoofed packet is specified, the screen 150 is displayed as shown in FIG. Is displayed. When the “OK” button 151 is pressed, the screen 150 is closed and, as shown in FIG. 39 (B) or 39 (C), the IPSA spoofed packet detection screen 80 is identified as the terminal that transmitted the IPSA spoofed packet. Information about the terminal is displayed.

  FIG. 39B shows a display example of a terminal specified as a terminal that has transmitted an IPSA spoofing packet (when an IP address that does not exist is set in IPSA). FIG. 39C shows a display example of a terminal specified as a terminal that has transmitted an IPSA spoofing packet (when an actual IP address is set in IPSA). In this case, the spoofed IPSA and the physical address (MAC address) of the terminal are displayed in the information area of the node icon such as L2SW to which the specified terminal is connected.

  FIG. 40 shows an example of a screen displayed when the terminal that has transmitted the IPSA spoofing packet in this embodiment cannot be specified. If the terminal that transmitted the IPSA spoof packet cannot be identified, a screen 160 is displayed as shown in FIG. When the “OK” button 161 is pressed, the screen 150 is closed and the IPSA spoofed packet detection screen 80 is restored.

Next, using FIG. 41A and FIG. 42, the display processing of the detection result of the IPSA spoofed terminal detection using the IPSA spoofed packet detection screen in this embodiment will be described.
FIG. 41 shows a processing flow for generating a base map image in the present embodiment. The user uses the client PC 71 to set information for the components of the network 11 to be monitored using the definition screens of FIGS. 31 to 35 (S61). Then, the management server 14 functions as the image generation unit 2f and generates an image (base map image) configuring the network based on the information set on the definition screens of FIGS. 31 to 35 (S62).
The management server 14 maps an arbitrary detection result from the latest or past history transmission source IP address spoofed packet detection information onto the generated base map, and the IPSA as shown in FIG. 36 or FIG. A spoofed packet detection screen 80 is generated. The management server 14 provides the generated IPSA spoofed packet detection screen 80 to the client PC 71.

  FIG. 42 shows a display processing flow of the detection result of IPSA misrepresentation terminal detection in this embodiment. As described with reference to FIGS. 36 and 37, on the IPSA spoofed packet detection screen 80, a route in which a spoofed packet is detected is displayed with an arrow. On the IPSA spoofed packet detection screen 80 displayed on the display device, the suspected segment is narrowed down by searching for the start point of the route (display of the highlighted arrow) where the spoofed packet is detected. When the user clicks the terminal network device icon in the narrowed suspicious segment, the instruction screen 140 is displayed. The user uses the instruction screen 140 to instruct the start of processing for specifying an IPSA spoofed packet transmission terminal. Then, the management server 14 functions as the display control unit 2h and receives the instruction information from the client PC 71 (S63).

  Based on the instruction information, the management server 14 performs an IPSA misrepresentation terminal detection process. That is, the management server 14 functions as the adding unit 2g and maps the IP address spoofed address detection result to the base map image based on the IPSA spoofed terminal detection request from the client PC 71 (S64). In this process, the management server 14 sends a communication (ICMP) echo request addressed to the IP address determined to be spoofed to the terminal network device 13 belonging to the network to which the IPSA belongs determined to be spoofed in S58. Send).

  The terminal network device 13 receives the instruction information from the management server. Then, the terminal network device 13 executes communication addressed to the IP address determined to be spoofed based on an instruction from the management server 14. As the communication is executed, the terminal network device 13 performs address resolution processing using an ARP (Address Resolution Protocol) packet. After attempting communication to the IP address determined to be spoofed, the terminal network device 13 checks the ARP table in the device itself. When the terminal network device 13 confirms the MAC address corresponding to the spoofed IP address in the ARP table in its own device, it notifies the management server 14 of the confirmed MAC address. With this notification, the management server 14 can identify the terminal that transmitted the IPSA spoofing packet. Further, when the end network device 13 cannot confirm the MAC address corresponding to the spoofed IP address, it notifies the management server 14 that the corresponding device does not exist. In this case, the management server 14 cannot identify the terminal that transmitted the IPSA spoofing packet.

  The management server 14 functions as the display control unit 2h and transmits the requested screen data of the IPSA spoofed packet detection screen 80 to the client PC 71 (S65). That is, the management server 14 performs screen display as shown in FIG. 39 or 40 based on the response result from the terminal network device 13.

  By specifying the hardware address of the attacking terminal by the above operation, it becomes easier to identify the terminal that is actually attacking. It is also possible to detect IPSA spoofed packets without registering subnet information for detection in advance in a router or firewall. Further, according to the present embodiment, it is possible to use the function of identifying the attack path using the map display and the function for identifying the hardware address (MAC address) of the attacking terminal. This makes it much easier to identify the attacking terminal compared to the method of confirming the detection result of spoofed IPSA with a text-based log image.

  FIG. 43 is a block diagram showing the configuration of the hardware environment of a computer to which this embodiment is applied. The computer 170 functions as the packet detection device 12, the terminal network device 13, or the management server 14 by reading a program for performing the processing of this embodiment.

  The computer 170 includes an output I / F 171, a CPU 172, a ROM 173, a communication I / F 174, an input I / F 175, a RAM 176, a storage device 177, a reading device 178, and a bus 179. The computer 170 can be connected to the output device 181 and the input device 182.

  Here, CPU indicates a central processing unit. ROM indicates a read-only memory. RAM indicates random access memory. I / F indicates an interface. An output I / F 171, a CPU 172, a ROM 173, a communication I / F 174, an input I / F 175, a RAM 176, a storage device 177, and a reading device 178 are connected to the bus 179. The reading device 178 is a device that reads a portable recording medium. The output device 181 is connected to the output I / F 171. The input device 182 is connected to the input I / F 175.

  As the storage device 177, various types of storage devices such as a hard disk drive, a flash memory device, and a magnetic disk device can be used.

  The storage device 177 or the ROM 173 stores, for example, a program that realizes the processing described in this embodiment. When the computer 170 is the packet detection device 12, the RAM 176 can secure, for example, a temporary storage buffer area or can be used as a work area. When the computer 170 is the management server 14, the storage device 177 stores the detection results collected from the packet detection device 12, the PD detection route table 61, information set on the definition screens of FIGS. The

  The CPU 172 reads a program that realizes the processing described in the present embodiment stored in the storage device 177 and executes the program.

  A program for realizing the processing described in the present embodiment may be stored in the storage device 177, for example, via the communication network 180 and the communication I / F 174 from the program provider side. Moreover, the program which implement | achieves the process demonstrated by this embodiment may be stored in the portable storage medium marketed and distribute | circulated. In this case, the portable storage medium may be set in the reading device 178 and the program read by the CPU 172 and executed. As the portable storage medium, various types of storage media such as a CD-ROM, a flexible disk, an optical disk, a magneto-optical disk, an IC (integrated circuit) card, and a USB (Universal Serial Bus) memory device can be used. A program stored in such a storage medium is read by the reading device 178.

  The input device 182 can be a keyboard, a mouse, an electronic camera, a web camera, a microphone, a scanner, a sensor, a tablet, a touch panel, or the like. The output device 181 can be a display, a printer, a speaker, or the like. The network 180 may be a communication network such as the Internet, a local area network (LAN), a wide area network (WAN), a dedicated line, a wired line, and a wireless line.

  In addition, this embodiment is not limited to embodiment described above, A various structure or embodiment can be taken in the range which does not deviate from the summary of this embodiment.

Regarding the above embodiment, the following additional notes are disclosed.
(Appendix 1)
A detection unit that sequentially detects communication information transmitted by a communication line connecting between relay devices;
A communication information determination unit that determines whether the detected communication information is communication information that has normally established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, a transmission unit that transmits detection information related to the detected communication information;
A communication information detection device comprising:
A collection unit for collecting the transmitted detection information from the communication information detection device;
A verification unit that aggregates the collected detection information and verifies whether the communication information included in the aggregated detection information is communication information that has normally established a connection based on the communication protocol;
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, A route information acquisition unit that acquires the route information from any one of the information processing devices;
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. A misrepresentation determination unit that determines that there is,
A source address spoofing determination device comprising:
A sender address spoofing determination system characterized by comprising:
(Appendix 2)
The communication information is information to which a transmission control protocol (TCP) header is added,
The communication information determination unit detects the communication information in which the TCP flag included in the TCP header is SYN in accordance with a 3-way handshake, and the TCP flag is set to SYN-ACK within a threshold time for the detected communication information. The transmission source address spoofing determination system according to claim 1, wherein the communication information and the communication information whose TCP flag is ACK are sequentially detected.
(Appendix 3)
The verification unit aggregates the collected detection information based on a transmission source address, a transmission destination address, and the TCP flag, and the communication information included in the aggregated detection information according to a 3-way handshake After detecting the communication information whose TCP flag is SYN included in, it is determined whether the communication information whose TCP flag is SYN-ACK and the communication information whose TCP flag is ACK are detected in order within a threshold time The sender address spoofing determination system according to appendix 2, characterized in that:
(Appendix 4)
The spoof determination unit transmits, when the result of the route information is not normal, or one of the addresses of the relay device included in the route information from the first information processing device to the second information processing device. The transmission source address spoofing determination system according to appendix 1, wherein when the communication information is not included in the address space of the communication information detection device, the transmission source address of the communication information is determined to be spoofing.
(Appendix 5)
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The communication information detection device is disposed on each of the physical lines,
The transmission unit of the second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line is detected. Transmitting detection information relating to communication information to the first communication information detecting device;
The communication information determination unit of the first communication information detection device is detected by the communication information indicated by the detection information transmitted from the second communication information detection device and the detection unit of the first communication information detection device. Determining whether the communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
The transmission unit of the first communication information detection device transmits detection information related to the communication information when the communication information is not communication information that has normally established a connection as a result of the determination. The sender address spoofing determination system according to attachment 1.
(Appendix 6)
The sender spoof determination device further includes:
A registration unit for registering information about addresses on the network for the relay device, the communication line, and the information processing device that acquires the route information;
Based on the registered information, a connection relationship between the relay device, the communication line, and the information processing device that acquires the route information is generated, and information processing that acquires the relay device, the communication line, and the route information is performed. An image generation unit that generates a network configuration image in which symbols corresponding to devices are arranged based on the connection relationship;
Based on the source address determined to be spoofing, an addition unit that adds source address spoofing information indicating that the source address of the communication information is spoofing to the network configuration image;
A display control unit for displaying a network configuration image to which the source address spoofing information is added;
The transmission source address spoofing determination system according to appendix 1, characterized by comprising:
(Appendix 7)
A detection unit that sequentially detects communication information transmitted by a communication line connecting between relay devices;
A communication information determination unit that determines whether the detected communication information is communication information that has normally established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, a transmission unit that transmits detection information related to the detected communication information;
A communication information detection apparatus comprising:
(Appendix 8)
The communication information is information to which a transmission control protocol (TCP) header is added,
The communication information determination unit detects the communication information in which the TCP flag included in the TCP header is SYN in accordance with a 3-way handshake, and the TCP flag is set to SYN-ACK within a threshold time for the detected communication information. The communication information detection apparatus according to appendix 7, wherein the communication information and the communication information whose TCP flag is ACK are sequentially detected.
(Appendix 9)
When communication information transmitted through a communication line connecting between relay devices is sequentially detected, and the detected communication information is not communication information that has normally established a connection based on a communication protocol used for the communication information. A collection unit for collecting detection information related to the detected communication information;
A verification unit that aggregates the collected detection information and verifies whether the communication information included in the aggregated detection information is communication information that has normally established a connection based on the communication protocol;
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, A route information acquisition unit that acquires the route information from any one of the information processing devices;
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. A misrepresentation determination unit that determines that there is,
A source address spoofing determination device comprising:
(Appendix 10)
The verification unit aggregates the collected detection information based on a transmission source address, a transmission destination address, and the TCP flag, and the communication information included in the aggregated detection information according to a 3-way handshake After detecting the communication information whose TCP flag is SYN included in, it is determined whether the communication information whose TCP flag is SYN-ACK and the communication information whose TCP flag is ACK are detected in order within a threshold time The transmission source address misrecognition determining device according to appendix 9, wherein:
(Appendix 11)
The spoof determination unit transmits, when the result of the route information is not normal, or one of the addresses of the relay device included in the route information from the first information processing device to the second information processing device. The transmission source address spoofing determination device according to appendix 9, characterized in that if the communication information is not included in the address space of the communication information detection device, the transmission source address of the communication information is determined to be spoofing.
(Appendix 12)
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The communication information detection device is disposed on each of the physical lines,
The transmission unit of the second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line is detected. Transmitting detection information relating to communication information to the first communication information detecting device;
The communication information determination unit of the first communication information detection device is detected by the communication information indicated by the detection information transmitted from the second communication information detection device and the detection unit of the first communication information detection device. Determining whether the communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
The transmission unit of the first communication information detection device transmits detection information related to the communication information when the communication information is not communication information that has normally established a connection as a result of the determination. The transmission source address spoofing determination device according to attachment 9.
(Appendix 13)
The sender spoof determination device further includes:
A registration unit for registering information about addresses on the network for the relay device, the communication line, and the information processing device that acquires the route information;
Based on the registered information, a connection relationship between the relay device, the communication line, and the information processing device that acquires the route information is generated, and information processing that acquires the relay device, the communication line, and the route information is performed. An image generation unit that generates a network configuration image in which symbols corresponding to devices are arranged based on the connection relationship;
Based on the source address determined to be spoofing, an addition unit that adds source address spoofing information indicating that the source address of the communication information is spoofing to the network configuration image;
A display control unit for displaying a network configuration image to which the source address spoofing information is added;
The transmission source address misrecognition judging device according to appendix 9, characterized by comprising:
(Appendix 14)
On the computer,
Sequentially detects communication information transmitted by communication lines connecting between relay devices,
Determining whether the detected communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not the communication information that has normally established a connection, the detection information related to the detected communication information is transmitted.
A communication information detection program for executing a process.
(Appendix 15)
On the computer,
When communication information transmitted through a communication line connecting between relay devices is sequentially detected, and the detected communication information is not communication information that has normally established a connection based on a communication protocol used for the communication information. Collecting detection information about the detected communication information;
Aggregating the collected detection information, verifying that the communication information included in the aggregated detection information is communication information that has successfully established a connection based on the communication protocol,
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, Obtaining the route information from one of the information processing devices,
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. Judge that there is,
A source address spoofing determination program characterized by causing a process to be executed.
(Appendix 16)
The communication information detection device
Sequentially detects communication information transmitted by communication lines connecting between relay devices,
Determining whether the detected communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, detection information related to the detected communication information is transmitted,
The source address spoofing judgment device
Collecting the transmitted detection information from the communication information detection device;
Aggregating the collected detection information, verifying that the communication information included in the aggregated detection information is communication information that has successfully established a connection based on the communication protocol,
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, Obtaining the route information from one of the information processing devices,
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. A source address spoofing determination method characterized by determining that there is a source address.

200 transmission source address spoofing determination system 1 communication information detection device 1a detection unit 1b communication information determination unit 1c transmission unit 2 transmission source address spoofing determination device 2a collection unit 2b verification unit 2c path information acquisition unit 2d fraud determination unit 2e registration unit 2f image Generation unit 2g Addition unit 2h Display control unit 3 First information processing device 4 Second information processing device 6 Information processing device 7 Communication line 8 Network 9 Relay device 11 Network 12 Packet detection device (PD)
13 Terminal network equipment (TND)
14 Management server 15 Router (L3SW)
16 L2SW
17 Attacker terminal

Claims (8)

A detection unit that sequentially detects communication information transmitted by a communication line connecting between relay devices;
A communication information determination unit that determines whether the detected communication information is communication information that has normally established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, a transmission unit that transmits detection information related to the detected communication information;
A communication information detection device comprising:
A collection unit for collecting the transmitted detection information from the communication information detection device;
A verification unit that aggregates the collected detection information and verifies whether the communication information included in the aggregated detection information is communication information that has normally established a connection based on the communication protocol;
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, A route information acquisition unit that acquires the route information from any one of the information processing devices;
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. A misrepresentation determination unit that determines that there is,
A source address spoofing determination device comprising:
Equipped with a,
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The communication information detection device is disposed on each of the physical lines,
The transmission unit of the second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line is detected. Transmitting detection information relating to communication information to the first communication information detecting device;
The communication information determination unit of the first communication information detection device is detected by the communication information indicated by the detection information transmitted from the second communication information detection device and the detection unit of the first communication information detection device. Determining whether the communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
The transmission unit of the first communication information detection device transmits detection information related to the communication information when the communication information is not the communication information that has normally established the connection as a result of the determination.
A source address spoofing determination system characterized by the above. The communication information is information to which a transmission control protocol (TCP) header is added,
The communication information determination unit detects the communication information in which the TCP flag included in the TCP header is SYN in accordance with a 3-way handshake, and the TCP flag is set to SYN-ACK within a threshold time for the detected communication information. 2. The transmission source address spoofing determination system according to claim 1, wherein the communication information and the communication information whose TCP flag is ACK are sequentially detected. The verification unit aggregates the collected detection information based on a transmission source address, a transmission destination address, and the TCP flag, and the communication information included in the aggregated detection information according to a 3-way handshake After detecting the communication information whose TCP flag is SYN included in, it is determined whether the communication information whose TCP flag is SYN-ACK and the communication information whose TCP flag is ACK are detected in order within a threshold time The transmission source address spoofing determination system according to claim 2, wherein: The spoof determination unit transmits, when the result of the route information is not normal, or one of the addresses of the relay device included in the route information from the first information processing device to the second information processing device. The transmission source address spoofing determination system according to claim 1 , wherein when the communication information is not included in an address space of the communication information detection device, the transmission source address of the communication information is determined to be spoofing. . The sender spoof determination device further includes:
The relay device, the communication lines, and about the information processing equipment to obtain the route information, a registration unit for registering information about the address on the network,
Based on the registered information, a connection relationship between the relay device, the communication line, and the information processing device that acquires the route information is generated, and information processing that acquires the relay device, the communication line, and the route information is performed. An image generation unit that generates a network configuration image in which symbols corresponding to devices are arranged based on the connection relationship;
Based on the source address determined to be spoofing, an addition unit that adds source address spoofing information indicating that the source address of the communication information is spoofing to the network configuration image;
A display control unit for displaying a network configuration image to which the source address spoofing information is added;
The source address spoofing determination system according to claim 1, comprising: A detection unit that sequentially detects communication information transmitted by a communication line connecting between relay devices;
A communication information determination unit that determines whether the detected communication information is communication information that has normally established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, a transmission unit that transmits detection information related to the detected communication information;
A communication information detection apparatus Ru provided with,
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The communication information detection device is disposed on each of the physical lines,
The transmission unit of the second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line is configured to detect the detected communication. Sending detection information about the information to the first communication information detection device,
The communication information determination unit of the first communication information detection device is detected by the communication information indicated by the detection information transmitted from the second communication information detection device and the detection unit of the first communication information detection device. Determining whether the communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
The transmission unit of the first communication information detection device transmits detection information related to the communication information when the communication information is not the communication information that has normally established the connection as a result of the determination.
A communication information detecting apparatus characterized by the above . On the computer,
Sequentially detects communication information transmitted by communication lines connecting between relay devices,
Determining whether the detected communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not the communication information that has normally established a connection, the detection information related to the detected communication information is transmitted.
A communication information detection program Ru to execute the process,
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The computer is disposed on each of the physical lines,
A second computer other than the first computer among the computers arranged on the physical line forming the same communication line transmits detection information related to the detected communication information to the first computer. And
The first computer is configured so that the communication information indicated by the detection information transmitted from the second computer and the communication information detected by the first computer are correctly based on a communication protocol used for the communication information. Determine whether it is communication information that established the connection,
The first computer, the result of judgment, the case where the communication information is not the communication information normally to establish a connection, communication information detection program and transmits the detected information relating to the communication information. The communication information detection device
Sequentially detects communication information transmitted by communication lines connecting between relay devices,
Determining whether the detected communication information is communication information that has successfully established a connection based on a communication protocol used for the communication information;
As a result of the determination, if the detected communication information is not communication information that has normally established a connection, detection information related to the detected communication information is transmitted,
The source address spoofing judgment device
Collecting the transmitted detection information from the communication information detection device;
Aggregating the collected detection information, verifying that the communication information included in the aggregated detection information is communication information that has successfully established a connection based on the communication protocol,
As a result of the determination, if the communication information included in the aggregated detection information is not communication information that has normally established a connection based on the communication protocol, the first information processing apparatus determines the first communication information from the first information processing apparatus. 2 For communication information transmitted to the information processing device, request any one of the information processing devices belonging to the network to which the second information processing device belongs to obtain route information to the transmission source address of the communication information, Obtaining the route information from one of the information processing devices,
When the result of the route information is not normal, or when the route indicated by the route information is different from the transmission route from the first information processing device to the second information processing device, the transmission source address of the communication information is false. Judge that there is
A source address spoofing determination method,
The communication line is a logically one communication line formed from a set of a plurality of physical lines;
The communication information detection device is disposed on each of the physical lines,
The second communication information detection device other than the first communication information detection device among the communication information detection devices arranged on the physical line forming the same communication line is detection information related to the detected communication information. Is transmitted to the first communication information detecting device,
The first communication information detection device includes the communication information indicated by the detection information transmitted from the second communication information detection device and the communication information detected by the first communication information detection device in the communication information. Determine whether the communication information has successfully established a connection based on the communication protocol used,
The first communication information detection device transmits detection information related to the communication information when the communication information is not the communication information that has normally established the connection as a result of the determination.
A sender address spoofing determination method characterized by the above .