JP6106861B1 - Network security device, security system, network security method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a security system for monitoring network communication while considering communication performance. When detecting a malware intrusion, a detection device transmits threat information related to the detected malware to a network security device, and the network security device receives the threat information transmitted from the detection device. Creation processing in a reception processing unit, a creation processing unit that automatically creates definition information based on threat information received by the reception processing unit, a definition information database that stores definition information in association with registration, and a definition information database A definition registration unit that additionally registers definition information created by the management unit, a monitoring unit that monitors network communication using definition information stored in the definition information database, and a registration time stored in the definition information database. And a deletion unit that deletes the definition information from the definition information database. [Selection] Figure 1

Description

  The present invention relates to a network security device, a security system, a network security method, and a program.

  For example, in Patent Document 1, information on unauthorized access detected by any of the detection means is received by a management means connected to a plurality of defense means and a plurality of detection means via a network, and based on the information. The process of determining the defense measures to be taken against the unauthorized access and the contents of the defense measures for each defense measure and instructing each defense measure to implement the determined defense measures is executed. An unauthorized access prevention program is disclosed.

  Patent Document 2 also discloses a firewall device 10 that restricts external access according to a policy held in the policy holding unit 13 and a DMZ segment 18 that detects unauthorized access and reports a log to the policy management device 30. An intrusion detection device 20, a log format conversion unit 31 that is placed in the internal segment 19 and converts the log into its own format log, a policy creation unit 33 that creates a policy that prohibits unauthorized access based on the converted log, An unauthorized access protection system having a policy management device 30 having a policy format conversion unit 34 that converts a created policy into a policy in the firewall device 10 format, sends the policy to the firewall device 10 and applies it to the policy holding unit 13 is disclosed.

JP 2003-288282 A JP2005-071218

  An object of the present invention is to provide a security system that monitors network communication while considering communication performance.

  The network security device according to the present invention includes a definition information database for storing definition information for detecting a cyber attack in association with a registration, a definition registration unit for registering definition information in the definition information database, and a definition information database. A monitoring unit that monitors network communication using the stored definition information, and a deletion unit that deletes definition information from the definition information database based on the registration time stored in the definition information database.

  Preferably, the deletion unit stores the definition information in the definition information database based on the timing at which communication corresponding to any definition information is detected by the monitoring unit and the registration time registered in the definition information database. Delete registered definition information.

  Preferably, the deletion unit, when the number of definition information registered in the definition information database reaches a predetermined number, timing when communication corresponding to the definition information is detected by the monitoring unit, and the definition The definition information registered in the definition information database is deleted based on the registration time registered in the information database.

  Preferably, the deletion unit determines that the definition information registered in the definition information database is the expiration date of the definition information last detected by the monitoring unit, or the definition information that has passed a predetermined period from the time of registration. And delete it.

  Preferably, it further includes a reception processing unit that receives threat information suggesting a cyber attack from the outside, and a creation processing unit that creates definition information based on the threat information received by the reception processing unit, The definition registration unit additionally registers definition information created by the creation processing unit in the definition information database.

  Preferably, the creation processing unit creates, as the definition information, an HTTP path partially substituted with a wild card character based on the received threat information.

  Preferably, the creation processing unit creates a plurality of definition information with different relay servers for the received threat information.

  Preferably, an upper limit setting unit that sets an upper limit number of definition information that can be registered in the definition information database in accordance with a user instruction, and the deletion unit includes definition information that is registered in the definition information database. However, the registered definition information is deleted so that the number is less than or equal to the upper limit number set by the upper limit setting unit.

  The security system according to the present invention is a security system including a detection device for detecting an intrusion of malware and a network security device, and the detection device is related to the detected malware when an intrusion of malware is detected. Threat information to be transmitted to the network security device, the network security device receiving a threat information transmitted from the detection device, and a definition based on the threat information received by the reception processing unit A creation processing unit for creating information; a definition information database for storing definition information in association with registration; a definition registration unit for additionally registering definition information created by the creation processing unit in the definition information database; and the definition Using the definition information stored in the information database, A monitoring unit for monitoring the over click communication, based on the time of registration, which is stored in the definition information database, from the definition information database, and a deletion unit for deleting the definition information.

  The network security method according to the present invention uses a definition registration step for registering definition information for detecting a cyber attack in association with a definition information database at the time of registration, and definition information stored in the definition information database, A monitoring step of monitoring network communication; and a deletion step of deleting definition information from the definition information database based on the registration time stored in the definition information database.

  The program according to the present invention uses a definition registration step for registering definition information for detecting a cyber attack in association with a definition information database at the time of registration, and the definition information stored in the definition information database. And a deletion step of deleting the definition information from the definition information database based on the registration time stored in the definition information database.

  It is possible to provide a security system that monitors network communication while considering communication performance.

2 is a diagram illustrating a hardware configuration of the information processing system 1. FIG. 2 is a diagram illustrating a hardware configuration of a network security device 4. FIG. 2 is a diagram illustrating a functional configuration of a network security device 4. FIG. It is a figure which illustrates the threat information notified from the detection apparatus. (A) illustrates an attack defense policy registered in the attack defense policy DB 600, and (B) illustrates an attack defense rule registered in the attack defense rule DB 610. (A) illustrates HTTP information included in the threat information notified from the detection device 3, and (B) illustrates a filter condition created based on the threat information. (A) illustrates an HTTP path of threat information including query data, and (B) illustrates a filter condition in which the query data is replaced with a wildcard character. It is a figure explaining the relationship between the maximum detection interval and an effective period. It is a flowchart of attack defense rule creation processing (S10). It is a flowchart of an access control process (S20). It is a flowchart of a detection event process (S30). It is a flowchart of an expiration date inspection process (S40).

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 is a diagram illustrating a hardware configuration of the information processing system 1.
As illustrated in FIG. 1, the information processing system 1 includes a detection device 3 and a network security device 4. The information processing system 1 is an example of a security system according to the present invention.
A computer terminal 8 is connected to the internal network protected by the network security device 4.
The detection device 3 monitors communication in the internal network, detects malware that has entered the internal network, and notifies the network security device 4 of threat information regarding the detected malware. Here, the threat information is information suggesting a cyber attack, for example, information related to an illegal operation caused by malware.
The detection device 3 of this example is connected to a mirror port or a network tap of the network switch 7 of the internal network, and inspects network traffic in the internal network.

  The network security device 4 is a computer having a security function. For example, the network security device 4 is a firewall device, an IPS device (Intrusion Prevention System) device, a Web content filtering device, or a UTM appliance that integrates a plurality of different security functions into one piece of hardware. The network security device 4 of this example is connected between the internal network and the external network, and blocks backdoor communication to the C & C server 9. The C & C server 9 is a server that sends a command to a computer group (botnet) infected with malware and turned into a bot, and is the center of control.

  In this example, the computer terminal 8A connected to the internal network is infected with malware and becomes a bot. When the detection device 3 monitors the network traffic of the internal network and detects malware that has infected the computer terminal 8A, the detection device 3 notifies the network security device 4 of the threat information. The network security device 4 automatically creates an attack defense rule based on the threat information notified from the detection device 3 and additionally registers it, and blocks communication according to the registered attack defense rule. In this way, the detection device 3 and the network security device 4 cooperate to block backdoor communication from the botted computer terminal 8A to the C & C server 9.

FIG. 2 is a diagram illustrating a hardware configuration of the network security device 4.
As illustrated in FIG. 2, the network security device 4 includes a CPU 400, a memory 402, an HDD 404, and a network interface 406 (network IF 406), which are connected to each other via a bus 412.
The CPU 400 is, for example, a central processing unit.
The memory 402 is a volatile memory, for example, and functions as a main storage device.
The HDD 404 is, for example, a hard disk drive device, and stores a computer program and other data files as a nonvolatile recording device.
The network IF 406 is an interface for performing wired or wireless communication, and realizes communication with the mobile terminal 3 via the Internet.

FIG. 3 is a diagram illustrating a functional configuration of the network security device 4.
As illustrated in FIG. 3, a security program 5 is installed in the network security device 4 of this example, and an attack defense policy database 600 (attack defense policy DB 600) and an attack defense rule database 610 (attack defense rule DB 610). Is configured. The attack defense rule DB 610 is an example of a definition information database according to the present invention.
The security program 5 includes a reception processing unit 500, a rule creation processing unit 510, an access control unit 520, a detection event processing unit 530, an expiration date inspection processing unit 540, an upper limit setting unit 550, and an expiration date extension unit 560.
Part or all of the security program 5 may be realized by hardware such as ASIC.

  In the security program 5, the reception processing unit 500 receives threat information suggesting a cyber attack from the outside. The reception processing unit 500 of this example receives threat information related to the detected malware from the detection device 3. Furthermore, the reception processing unit 500 of this example compares the received threat information with the filter conditions of the attack defense policy registered in the attack defense policy DB 600, and provides information indicating the attack defense method as a rule creation processing unit. 510 is notified.

  The rule creation processing unit 510 creates an attack defense rule based on the threat information received by the reception processing unit 500, and additionally registers the created attack defense rule in the attack defense rule DB 610. The rule creation processing unit 510 is an example of a creation processing unit and a definition registration unit according to the present invention. The attack defense rule includes definition information (filter conditions described later) for detecting a cyber attack and a response method (operation mode and monitoring level described later) when communication matching the definition information is detected. It is.

Based on the received threat information, the rule creation processing unit 510 creates an HTTP path partially substituted with a wildcard character as a filter condition. In this example, the rule creation processing unit 510 replaces the query data portion of the HTTP path included in the received threat information with a wildcard character, and uses it as a filter condition.
Further, the rule creation processing unit 510 creates a plurality of attack defense rules with different relay servers for the received threat information. The rule creation processing unit 510 of this example creates a filter condition for proxy connection and a filter condition for Web server connection for HTTP information included in one received threat information.
Note that the rule creation processing unit 510 does not register a new attack defense rule when an attack defense rule is registered in the attack defense rule DB 610 under the same filter condition. For example, the same filter condition may be obtained as a result of simplifying the query data portion with a wildcard character, but such duplicate registration is prevented.

  The access control unit 520 monitors network communication using filter conditions (definition information) stored in the attack defense rule DB 610. The access control unit 520 is an example of a monitoring unit according to the present invention. More specifically, the access control unit 520 monitors network communication using the filter condition of the attack defense rule stored in the attack defense rule DB 610, and when communication matching the filter condition is detected, Take action (blocking communication, recording logs) according to this attack defense rule.

  The detection event processing unit 530 registers the detection history detected by the access control unit 520 in the attack defense rule DB 610. The detection event processing unit 530 of this example updates the number of times of detection of communication and the detection date and time determined by the access control unit 520 to match the filter condition in the attack defense rule DB 610.

  The expiration date inspection processing unit 540 detects when communication corresponding to one of the filter conditions (definition information) is detected by the access control unit 520 and when the attack defense rule registered in the attack defense rule DB 610 is registered. Based on this, the attack defense rule registered in the attack defense rule DB 610 is deleted. The expiration date inspection processing unit 540 is an example of a deletion unit according to the present invention. More specifically, the expiration date inspection processing unit 540 is registered in the attack defense rule DB 610 at the timing last detected by the access control unit 520 among the attack defense rules registered in the attack defense rule DB 610. The attack defense rules that have passed a predetermined period from the time of registration are determined to have expired and are deleted.

  The expiration date inspection processing unit 540 registers the timing detected by the access control unit 520 and the attack defense rule DB 610 when the number of attack defense rules registered in the attack defense rule DB 610 reaches the upper limit number. Based on the registered time, the attack defense rules are deleted in order from the last detection timing or the oldest registration time, and the number of attack defense rules registered is set to the upper limit number or less.

  The upper limit setting unit 550 sets the upper limit number of attack defense rules that can be registered in the attack defense rule DB 610 in accordance with a user instruction. For example, the upper limit setting unit 550 sets the upper limit number of attack defense rules that can be registered in the attack defense rule DB 610 according to the transaction performance input by the user. When the upper limit number of attack defense rules is set to a small value, filter conditions to be checked are reduced, so that deterioration in communication performance is suppressed. Even if communication to the C & C server corresponding to the deleted attack defense rule is performed, since it is detected by the detection device 3 and newly registered as an attack defense rule, subsequent communication can be blocked.

  As will be described later with reference to FIG. 8, the term extension unit 560 calculates the maximum detection interval for each infected terminal based on the detection history for each infected terminal (the detection history by the detection device 3). Based on the maximum detection interval, the effective period (effective days) set in the attack defense rule is extended. The time limit extension unit 560 of this example sets the maximum detection interval as the effective period when the calculated maximum detection interval is larger than the effective period set in the attack defense rule.

FIG. 4 is a diagram illustrating threat information notified from the detection device 3.
As illustrated in FIG. 4, in this example, as threat information, a threat type indicating the type of threat, a malware name that is the name of the malware, a threat level, and a threat information URL that is a URL that displays detailed information on the threat information. , Information on computer terminals infected with malware (IP address, port number at detected communication, MAC address), information on C & C server 9 (IP address of connection destination, port number of connection destination, HTTP information), malware information The distribution source (md5sum of downloaded malware and HTTP information) and the connection destination information (connection destination IP address, connection destination port number) of the infected terminal are notified.
Threat types include, for example, threats such as “connection to C & C server”, “malware detection”, “attack using vulnerabilities in web browsers or applications that have not been detected in the past”, and “known threats”. The types of are included.
The malware name is notified of the generalized malware name, but when the malware name is not registered, a fixed name is notified for each threat type.
As the threat level, for example, three levels such as “Minor”, “Major”, and “Critical” are set in order of increasing threat level, and one of these is notified.
Information about the C & C server 9 may be a proxy. Also, the HTTP information of the C & C server 9 includes, for example, an HTTP communication URL and an HTTP header.
The HTTP information of the malware distribution source includes, for example, an HTTP communication URL to the distribution server and an HTTP header.
The connection destination information of the infected terminal may be a proxy.

FIG. 5A illustrates an attack defense policy registered in the attack defense policy DB 600, and FIG. 5B illustrates an attack defense rule registered in the attack defense rule DB 610.
In the attack defense policy DB 600, an attack defense policy set by the user is registered. The attack defense policy registered in the attack defense policy DB 600 includes an “identification number” indicating the priority order of the attack defense policy, a “threat information filter condition”, an “operation mode” designating a response method, and an attack defense policy. “Valid days” indicating the validity period of the rule is included. The “threat information filter condition” includes the threat type of the threat information and the malware name. A part of the malware name is set with a wild card character or a regular expression.
In the “operation mode”, “defense”, “detection”, or “ignore” is set. When “defense” is set, an attack defense rule for blocking communication is created for the detected threat information. When “detection” is set, an attack defense rule for detecting communication is created for the detected threat information. When "Ignore" is set, attack defense rules are not generated.
“Effective days” is set, for example, by adding together the number of work days required for clean installation of an infected terminal and a period for monitoring that there is no infection of other terminals.
When receiving the threat information from the detection device 3, the reception processing unit 500 compares the received threat information with the filter condition of the attack defense policy registered in the attack defense policy DB 600, and the attack protection that matches the filter condition. The rule creation unit 510 is notified of the operation mode and effective days included in the policy together with the threat information.

When the operation mode and the effective number of days are notified together with the threat information from the reception processing unit 500, the rule creation processing unit 510 creates and creates an attack defense rule illustrated in FIG. The attack defense rule is additionally registered in the attack defense rule DB 610.
The attack defense rule registered in the attack defense rule DB 610 includes an “identification number” for uniquely identifying the attack defense rule, a “filter condition” for specifying the C & C server or the malware distribution server, and a coping method. “Operation mode” to be designated, “Audit level” to designate the contents of monitoring, “URL of C & C server”, “URL of threat information” displaying detailed information of threat information, and validity period of the attack defense rule Filter date, the “expiration date” indicating the expiration date of the attack defense rule, the “creation date” indicating the time of registration of the attack defense rule, the “update date” of the attack defense rule, and the filter condition Records the "detection count" that indicates the number of detections of matching communication, the "last detection date" that indicates the date and time when communication that matched the filter conditions was last detected, and the detection interval for each infected terminal That it is included and the "sense the history of each terminal."
The “identification number” is a serial number given by the rule creation processing unit 510, for example.
“Filter condition” is definition information created by the rule creation processing unit 510 based on threat information, the query part is simplified by wildcard characters, and duplicated for proxy connection and web server connection. It has been created.
The “operation mode” and “audit level” are response methods defined according to the attack defense policy.
“URL of C & C server” is a character string obtained by converting the filter condition into the URL format.
“Effective days” is an effective period of the attack defense rule set according to the “effective days” of the attack defense policy, or an effective period extended by the time limit extension unit 560.
The “expiration date” is obtained by adding “valid days” to the later of the attack defense rule registration (“creation date”) or the “last detection date”.
“Detection count” and “last detection date” are values updated by the detection event processing unit 530. The “detection history for each terminal” is a value updated by the time limit extension unit 560.

FIG. 6A illustrates HTTP information included in the threat information notified from the detection device 3, and FIG. 6B illustrates a filter condition created based on the threat information.
The rule creation processing unit 510 creates a filter condition for the attack defense rule illustrated in FIG. 6B based on the HTTP information of the threat information illustrated in FIG. That is, the HTTP information of the threat information includes the C & C server 9 or the malware distribution server. However, as exemplified in FIG. 6A, the attack defense rule is different depending on whether or not there is a proxy. As illustrated in FIG. 6B, the filter condition is a logical sum (OR) of the filter condition for Web server connection and the filter condition for proxy connection.
The Web server connection filter condition is the logical product (AND) of the HTTP path and the HOST header, and the proxy connection filter condition is that the HTTP path is in proxy format.

FIG. 7A illustrates an HTTP path of threat information including query data, and FIG. 7B illustrates a filter condition in which query data is replaced with a wildcard character.
As illustrated in FIG. 7A, the rule creation processing unit 510, when the query data is included in the HTTP path of the threat information, as illustrated in FIG. Replace with a wildcard character as a filter condition. Here, the wild card character is a character indicating an arbitrary character string, and is “*” in this example.
Thereby, in the communication to the C & C server, the query data may be different depending on the terminal, but the simplification by the wild card character increases the probability of matching the filter condition.

FIG. 8 is a diagram for explaining the relationship between the maximum detection interval and the effective period.
As illustrated in FIG. 8, the expiration date inspection processing unit 540 adds, for each attack defense rule, the “valid days” of the attack defense rule to the last detection date (the date of “detection (6)”), Set an expiration date, and invalidate the attack defense rule that has reached the expiration date.
On the other hand, the time limit extension unit 560 calculates a detection interval for each infected terminal (interval from when it was first detected to when it was last detected), and among the calculated detection intervals for each infected terminal, When the detection interval (maximum detection interval) is greater than the effective number of days, the effective number of days is updated to the maximum detection interval and the expiration date is extended. The maximum detection interval can be regarded as the period from the initial intrusion of the attacker to the re-intrusion. If the effective number of days is shorter than the maximum detection interval, it is determined that the malware may not be handled, and the time limit extension unit 560 is effective. Extend the due date.
In addition, when the malware is a long-term latent type and the activity is resumed after the attack defense rule is invalidated, the detection device 3 detects this again and notifies the network security device 4. An attack defense rule corresponding to this malware is registered.

FIG. 9 is a flowchart of the attack defense rule creation process (S10).
As shown in FIG. 9, in step 100 (S100), the reception processing unit 500 of the network security device 4 stands by until a connection request is received from the detection device 3 (S100: No). Migrate to The detection device 3 connects to the network security device 4 by HTTPS and transmits threat information.

In step 102 (S102), the reception processing unit 500 receives threat information from the detection device 3 via the Web-API. The threat information is, for example, in XML format.
In step 104 (S104), the reception processing unit 500 analyzes the XML of the received threat information, and extracts the threat type, malware name, and HTTP information.

In step 106 (S106), the reception processing unit 500 compares the extracted threat type, malware name, and HTTP information with the filter condition of the attack defense policy.
In step 108 (S108), if the threat type, malware name, and HTTP information extracted from the threat information do not match the filter conditions of the attack defense policy, the reception processing unit 500 returns to S106 and proceeds to the next step. The process proceeds to a comparison process with the filter conditions of the attack defense policy, and when it does not match all the filter conditions of the attack defense policy, the threat information is discarded and the process returns to S100.
If the threat type, malware name, and HTTP information extracted from the threat information match the filter conditions of any of the attack defense policies, the reception processing unit 500 proceeds to S110.
Even when the “operation mode” of the attack defense policy is “ignore”, the reception processing unit 500 discards the threat information and returns to the process of S100.

In step 110 (S110), the rule creation processing unit 510 creates an attack defense rule based on the threat information received by the reception processing unit 500 and the attack defense policy that matches the threat information. The created attack defense rule includes a filter condition for proxy connection and a filter condition for web server connection in which a part of the HTTP path is simplified by a wild card character.
In step 112 (S112), the rule creation processing unit 510 checks whether the created attack defense rule has already been registered in the attack defense rule DB 610.
In step 114 (S114), when the created attack defense rule is already registered in the attack defense rule DB 610, the rule creation processing unit 510 returns to the process of S100 without registering the additional attack defense rule. If the attack defense rule that has been registered is not already registered in the attack defense rule DB 610, the process proceeds to S116.

In step 116 (S116), the expiration date inspection processing unit 540 checks whether or not the number of attack defense rules registered in the attack defense rule DB 610 has reached the set upper limit number.
In step 118 (S118), when the number of registered attack defense rules has reached the upper limit number, the expiration date inspection processing unit 540 proceeds to the process of S120, and the registered number of attack defense rules is the upper limit value. If not, the process proceeds to S122.
In step 120 (S120), the expiration date inspection processing unit 540 determines the final detection timing (detection timing is based on the timing detected by the access control unit 520 and the registration time registered in the attack defense rule DB 610. If there is not, the attack defense rules are deleted in order from the oldest (when registering), and the number of registered attack defense rules is set to the upper limit or less.

In step 122 (S122), the rule creation processing unit 510 assigns an identification number of the attack defense rule.
In step 124 (S124), the rule creation processing unit 510 sets “valid days” of the attack defense policy to “valid days” of the created attack defense rules.
In step 126 (S126), the rule creation processing unit 510 additionally registers the created attack defense rule in the attack defense rule DB 610 in association with the “creation date”.

In step 128 (S128), the rule creation processing unit 510 delivers the additionally registered attack defense rule identification number and filter condition to the access control unit 520.
The access control unit 520 performs an access control process (S20) using the distributed filter condition.

FIG. 10 is a flowchart of the access control process (S20). Note that the processing of this flowchart is started by being called from the communication control driver when the network security device 4 receives a packet.
As shown in FIG. 10, in step 200 (S200), the access control unit 520 determines whether or not the communication is communication from the internal network to the external network. In this example, only communication from the internal network to the external network is the inspection target.
In step 202 (S202), the access control unit 520 proceeds to the process of S204 when the communication is communication from the internal network to the external network, and when the communication is not communication from the internal network to the external network. , The process proceeds to S224.

In step 204 (S204), the access control unit 520 checks whether or not the communication matches the filter condition of the attack defense rule registered in the attack defense rule DB 610.
In step 206 (S206), if the communication matches the filter condition of the attack defense rule, the access control unit 520 proceeds to the process of S210. If the communication does not match the filter condition of the attack protection rule, the access control unit 520 Transition to processing.
In step 208 (S208), the access control unit 520 reads the filter condition of the next attack defense rule, and returns to the process of S204.

In step 210 (S210), the access control unit 520 notifies the detection event processing unit 530 of the identification number, the number of detections, and the detection date and time of the attack defense rule having the matched filter condition.
The detection event processing unit 530 accesses the attack defense rule DB 610, adds the notified “number of detections” to the “detection number” associated with the notified identification number, and uses the notified “detection date and time”. Update “Last detection date”.

In step 212 (S212), the access control unit 520 determines the correspondence according to the operation mode corresponding to the matched filter condition.
In step 214 (S214), when the operation mode is “defense”, the access control unit 520 shifts to the process of S216 and performs blocking, and when the operation mode is “detection”, the access control unit 520 performs the process of S222. Move to detect only.

In step 216 (S216), the access control unit 520 transmits a reset packet to the communication transmission source and communication destination to disconnect the TCP connection.
In step 218 (S218), the access control unit 520 outputs a log indicating that the access has been blocked.
In step 220 (S220), the access control unit 520 notifies the communication control driver that the packet processing has been completed, and ends the processing.

In step 222 (S222), the access control unit 520 outputs a log indicating that it has been detected.
In step 224 (S224), the access control unit 520 requests the communication control driver to pass the communication packet to the next processing control, and continues communication.

FIG. 11 is a flowchart of the detection event process (S30).
As illustrated in FIG. 11, in step 300 (S300), the detection event processing unit 530 requests the access control unit 520 to transmit a detection event.
In step 302 (S302), the access control unit 520 waits for a request until transmission of a detection event is requested.
In step 304 (S304), if there is no detection event transmission request (S304: No), the access control unit 520 returns to the processing of S302 and waits for the request. If there is a request (S304: Yes), the access control unit 520 Proceed to processing.
In step 306 (S306), the access control unit 520 reads a detection event (log) from the detection event queue and transmits it to the detection event processing unit 540.

In step 308 (S308), the detection event processing unit 530 waits to receive a detection event after making a detection event transmission request.
In step 310 (S310), when the detection event processing unit 530 starts receiving the detection event from the access control unit 520, the reception waiting state is canceled and the detection event is received.

In step 312 (S312), the detection event processing unit 530 updates the number of detections and the last detection date associated with each attack defense rule based on the received detection event information.
In step 314 (S314), the detection event processing unit 530 updates the expiration date by adding “valid days” to the updated last detection date according to the update of the last detection date.

FIG. 12 is a flowchart of the expiration date inspection process (S40).
As shown in FIG. 12, in step 400 (S400), the expiration date inspection processing unit 540 sorts the attack defense rules registered in the attack defense rule DB 610 in order from the earliest expiration date.
In step 402 (S402), if no attack defense rule is registered in the attack defense rule DB 610 (S402: No), the expiration date inspection processing unit 540 proceeds to the process of S404 and attacks the attack defense rule DB 610. When one or more defense rules are registered (S402: Yes), the process proceeds to S406.
In step 404 (S404), the expiration date inspection processing unit 540 waits for 10 minutes, and then returns to the process of S400.

In step 406 (S406), the expiration date inspection processing unit 540 acquires the current time.
In step 408 (S408), the expiration date inspection processing unit 540 compares the expiration date of the attack defense rule with the current time, and if the expiration date is earlier than the current time, the attack protection rule is valid. Judge that it has expired.
In step 410 (S410), the expiration date inspection processing unit 540 proceeds to the processing of S404 when the expiration date check has been completed for all the registered attack defense rules, and otherwise , The process proceeds to S412.
In step 412 (S412), if the expiration date inspection processing unit 540 determines that the attack defense rule has expired, the process proceeds to S414, and if it is determined that the attack defense rule has not expired, The process proceeds to S404.

In step 414 (S414), the expiration date inspection processing unit 540 notifies the expiration date extension unit 560 of the attack defense rule that has expired.
The term extension unit 560 calculates the detection interval for each infected terminal for the attack defense rule that has expired, and obtains the maximum detection interval.
In step 416 (S416), the time limit extension unit 560 compares the determined maximum detection interval with the number of effective days.
In step 418 (S418), the time limit extension unit 560 proceeds to the process of S420 when the maximum detection interval is larger than the valid days, and proceeds to the process of S424 when the maximum detection interval is equal to or less than the valid days.

In step 420 (S420), the term extension unit 560 updates the “valid days” of this attack defense rule at the maximum detection interval.
In step 422 (S422), the time limit extension unit 560 updates the “expiration date” of the attack defense rule based on the updated “valid days” (that is, the maximum detection interval).

In step 424 (S424), the expiration date inspection processing unit 540 invalidates this attack defense rule (that is, the attack defense rule expired) and deletes it from the attack defense rule DB 610.
In step 426 (S426), the expiration date inspection processing unit 540 reads the next attack defense rule registered in the attack defense rule DB 610, returns to S408, and inspects the expiration date for the read attack defense rule To do.

As described above, according to the information processing system 1 of the present embodiment, a malware countermeasure method based on the threat information notified from the detection device 3 and the attack defense policy set at the time of introduction, while considering communication performance. By automatically blocking communication to the C & C server 9 and the malware distribution server that are automatically determined and notified by threat information, the initial response can be reliably implemented even in organizations that do not have security engineers who analyze threat information. , Can prevent damage from targeted cyber attacks.
More specifically, the attack defense rule of the malware that has been taken countermeasures is automatically determined from the last detection date and time of communication to the C & C server 9 and the malware distribution server and the effective number of days of the attack defense rule, and the attack defense rule for which the countermeasure has been completed is deleted. By fully automating the initial response at the time of malware infection to the removal of filter conditions after malware countermeasures, it has the effect of reducing the burden on the network administrator for targeted cyber attacks.

DESCRIPTION OF SYMBOLS 1 ... Information processing system 3 ... Detection apparatus 4 ... Network security apparatus 5 ... Security program 500 ... Reception process part 510 ... Rule creation process part 520 ... Access control part 530 ... Detection event process part 540 ... Expiration date inspection process part 550 ... Upper limit Setting unit 560 ... Time limit extension unit 600 ... Attack defense policy database 610 ... Attack defense rule database

Claims (11)

A definition information database for storing definition information for detecting network communication of infected terminals infected with malware at the time of registration;
A definition registration unit that registers definition information in the definition information database based on threat information related to detected malware when a malware intrusion is detected ;
A monitoring unit that monitors network communication using definition information stored in the definition information database;
A network security device, comprising: a deletion unit that deletes definition information from the definition information database based on a registration time stored in the definition information database. The deletion unit is registered in the definition information database based on the timing at which communication corresponding to any definition information is detected by the monitoring unit and the registration time registered in the definition information database. The network security device according to claim 1, wherein the definition information is deleted. The deletion unit registers in the definition information database when the monitoring unit detects communication corresponding to the definition information when the number of definition information registered in the definition information database reaches a predetermined number. The network security device according to claim 1, wherein the definition information registered in the definition information database is deleted based on the registered time. The deletion unit deletes the definition information registered in the definition information database at a timing last detected by the monitoring unit or definition information that has passed a predetermined period from the time of registration as expired. The network security device according to claim 2. A reception processing unit that receives threat information indicating a cyber attack from the outside;
A creation processing unit that creates definition information based on the threat information received by the reception processing unit;
The network security device according to claim 1, wherein the definition registration unit additionally registers the definition information created by the creation processing unit in the definition information database. The network security device according to claim 5, wherein the creation processing unit creates, as the definition information, an HTTP path that is partially replaced with a wildcard character based on the received threat information. The network security device according to claim 5, wherein the creation processing unit creates a plurality of definition information with different relay servers for one received threat information. An upper limit setting unit that sets an upper limit number of definition information that can be registered in the definition information database in accordance with a user instruction;
The network security according to claim 3, wherein the deletion unit deletes the registered definition information so that the definition information registered in the definition information database is equal to or less than the upper limit number set by the upper limit setting unit. apparatus. A security system including a detection device for detecting intrusion of malware and a network security device,
When the detection device detects intrusion of malware, the detection device transmits threat information related to the detected malware to the network security device,
The network security device includes:
A reception processing unit that receives threat information transmitted from the detection device;
A creation processing unit for creating definition information for detecting network communication of an infected terminal infected with malware based on the threat information received by the reception processing unit when intrusion of malware is detected ;
A definition information database which stores in association with the time of registering the definition information,
A definition registration unit for additionally registering the definition information created by the creation processing unit in the definition information database;
A monitoring unit that monitors network communication using definition information stored in the definition information database;
A security system comprising: a deletion unit that deletes definition information from the definition information database based on a registration time stored in the definition information database. A creation step for creating definition information for detecting network communication of an infected terminal infected with malware based on threat information related to the detected malware when a malware intrusion is detected;
A definition registration step for registering the created definition information in association with the definition information database at the time of registration;
A monitoring step of monitoring network communication using definition information stored in the definition information database;
A network security method comprising: a deletion step of deleting definition information from the definition information database based on a registration time stored in the definition information database. A creation step for creating definition information for detecting network communication of an infected terminal infected with malware based on threat information related to the detected malware when a malware intrusion is detected;
A definition registration step for registering the created definition information in association with the definition information database at the time of registration;
A monitoring step of monitoring network communication using definition information stored in the definition information database;
A program for causing a computer to execute a deletion step of deleting definition information from the definition information database based on the registration time stored in the definition information database.

Images