JP6577921B2 - Security countermeasure system and security countermeasure method - Google Patents

Description

  The present invention relates to a security countermeasure system and a security countermeasure method. In particular, the present invention relates to a security countermeasure system and a security countermeasure method for automatically changing a security countermeasure setting using an access control apparatus, a packet analysis apparatus, and a security countermeasure management apparatus in a network.

  In recent years, threats of denial-of-service attacks (DDoS attacks) on networks have increased, and have seriously affected the availability of networks and services. Recent DDoS attacks include volume-type attacks using botnets and tools (sending hundreds of Gbps of traffic), application layer attacks that target specific services on servers and increasing the processing load, and multi-vector attacks combining multiple attack methods Is the mainstream.

  In order to prevent damage caused by DDoS attacks, it is effective to take security measures such as blocking or rate limiting the attack packets in the network close to the attack source. Effective security measures include packet filtering (Non-Patent Document 1) and rate control (Patent Document 1) by an access control device on a network in a volume type attack. In addition, application layer attacks include detection and handling by a packet analysis device at the attack target host.

JP 2014-236461 A

Koji Koji et al., "Examination of DDoS attack suppression method combining multiple bandwidth control methods", IEICE Communications Society, 2016

  FIG. 1 is a schematic diagram showing a conventional security countermeasure. Currently, in a large-scale network that accommodates users, security rules are set by the operator on the network side close to the attack source and / or the user side close to the attack destination based on the attack information.

  Packet filtering, rate limiting, and packet analysis countermeasures in the preceding stage of the attack target server, which are typical security countermeasures against DDoS attacks, are implemented in the following procedure.

  For packet filtering, the operator sets signature information (communication, source / destination IP (Internet Protocol) address, source / destination port, protocol number, etc.) from the attack detection information as a handling rule in the access control device. In the access control device, the countermeasure rule and the packet information are matched, and if a match is found, the corresponding packet is blocked.

  For rate limiting, the access control device sets rate limiting rules (packet rate, connection IP address information, etc.). The traffic passing through the access control device is compared with the rate limiting rule, and if it matches the rate limiting rule, the packet passing is limited.

  As for packet analysis countermeasures in the first stage of the attack target server, packets that arrive at the attack target server are analyzed up to the payload, and when an attack is detected, security countermeasures are implemented by the device itself.

  When implementing such security countermeasures on carrier networks and ISP (Internet Service Provider) networks, it is necessary to secure large-capacity throughput. If the countermeasure rules set by the operator are set inappropriately, errors will occur. The problem is that blockage and oversight occur, and it takes time from the discovery of false blockage and oversight to re-rule setting in the operation by the operator.

  Although packet analysis can be used to detect erroneously blocked or missed packets with high accuracy, packet analysis processing takes time, and in this case, a problem is that large-capacity throughput cannot be secured.

  Therefore, the present invention improves security countermeasure performance while ensuring throughput in security countermeasures by analyzing and detecting packets that may be erroneously blocked or missed by a packet analyzer and feeding back to the access controller. For the purpose.

A security countermeasure system according to an aspect of the present invention includes:
A security countermeasure system having a network tap device for transferring a packet and an access control device for setting a security countermeasure rule for the packet transferred by the network tap device,
A packet analysis device that receives a packet transferred from the network tap device and analyzes whether or not security countermeasures should be performed on the packet;
A security countermeasure management apparatus that receives an analysis result from the packet analysis apparatus, designs a security countermeasure rule based on the analysis result, and instructs the access control apparatus of the security countermeasure rule;
I have a,
The packet analyzer is
A packet receiver for receiving packets before and after security countermeasures from the network tap device;
Comparing the received packets before and after security countermeasures, and an erroneous blocking detection unit for detecting erroneous blocking packets;
An analysis result notifying unit for notifying the security countermeasure management device of an analysis result of the detected erroneous blocking packet;
Have
The security countermeasure management device includes:
A receiving unit for receiving an analysis result from the packet analysis device;
A countermeasure design unit that designs a security countermeasure rule based on the analysis result;
A handling instruction unit for instructing the security handling rule to the access control device;
It is characterized by having .
In addition, a security countermeasure system according to an aspect of the present invention includes:
A security countermeasure system having a network tap device for transferring packets and an access control device for implementing security countermeasures for packets transferred by the network tap device,
A packet analysis device that receives a packet transferred from the network tap device and analyzes whether or not security countermeasures should be performed on the packet;
A security countermeasure management apparatus that receives an analysis result from the packet analysis apparatus, designs a security countermeasure rule based on the analysis result, and instructs the access control apparatus of the security countermeasure rule;
Have
The packet analyzer is
A packet receiving unit for receiving a packet before security countermeasure from the network tap device;
An attack detection unit that detects a normal packet that should not be subjected to security countermeasures from the received packet;
An analysis result notifying unit for notifying the security countermeasure management device of an analysis result of the detected normal packet;
Have
The security countermeasure management device includes:
A receiving unit for receiving an analysis result from the packet analysis device;
A countermeasure design unit that designs a security countermeasure rule based on the analysis result;
A handling instruction unit for instructing the security handling rule to the access control device;
It is characterized by having.

In addition, a security countermeasure method according to one aspect of the present invention includes:
A security countermeasure method in a security countermeasure system having a network tap device for transferring a packet and an access control device for setting a security countermeasure rule for the packet transferred by the network tap device,
A packet analysis device receiving a packet transferred from the network tap device, and analyzing whether the packet should be subjected to security measures;
A security countermeasure management device receiving an analysis result from the packet analyzer, designing a security countermeasure rule based on the analysis result, and instructing the security countermeasure rule to the access control device;
I have a,
In the analyzing step,
The packet analyzer receives packets before and after security measures from the network tap device;
The packet analysis device compares the received packets before and after the security countermeasure, detects a false blocking packet,
The packet analysis device notifies the security countermeasure management device of the analysis result of the detected erroneous blocking packet,
In the instructing step,
The security countermeasure management device receives an analysis result from the packet analysis device;
The security countermeasure management device designs a security countermeasure rule based on the analysis result,
The security countermeasure management device instructs the security rule to the access control device .
In addition, a security countermeasure method according to one aspect of the present invention includes:
A security coping method in a security coping system having a network tap device that transfers a packet and an access control device that performs security coping with the packet transferred by the network tap device,
A packet analysis device receiving a packet transferred from the network tap device, and analyzing whether the packet should be subjected to security measures;
A security countermeasure management device receiving an analysis result from the packet analyzer, designing a security countermeasure rule based on the analysis result, and instructing the security countermeasure rule to the access control device;
Have
In the analyzing step,
The packet analyzer receives a packet before security countermeasure from the network tap device,
The packet analyzer detects a normal packet that should not be subjected to security measures from the received packet,
The packet analysis device notifies the security countermeasure management device of the analysis result of the detected normal packet;
In the instructing step,
The security countermeasure management device receives an analysis result from the packet analysis device;
The security countermeasure management device designs a security countermeasure rule based on the analysis result,
The security countermeasure management device instructs the security rule to the access control device.

  According to the present invention, it is an object to improve security countermeasure performance while ensuring throughput in security countermeasures.

Schematic diagram showing conventional security measures Schematic diagram of a security countermeasure system according to an embodiment of the present invention The flowchart which shows the process in the security countermeasure system which concerns on the Example of this invention. Functional configuration diagram of a security countermeasure system according to an embodiment of the present invention FIG. 3 is a sequence diagram of the security countermeasure system according to the first embodiment of the present invention. Sequence diagram in the security countermeasure system according to the second embodiment of the present invention. Sequence diagram in the security countermeasure system according to Embodiment 3 of the present invention The figure which shows the hardware structural example of the access control apparatus which concerns on the Example of this invention, a packet analysis apparatus, or a security countermeasure management apparatus

  Embodiments of the present invention will be described below with reference to the drawings.

  In an embodiment of the present invention, in a security countermeasure system having a network tap device for transferring a packet and an access control device for setting a security countermeasure rule for the packet transferred by the network tap device, the packet analyzer and the security A method for improving security countermeasures against multi-vector DDoS attacks using a countermeasure management apparatus will be described.

  FIG. 2 is a schematic diagram of a security countermeasure system according to an embodiment of the present invention. The security countermeasure system is applied to a large-scale network such as a carrier network or an ISP carrier network, and implements a security countermeasure against a DDoS attack. The security countermeasure system includes a network tap device 100, an access control device 200, a packet analysis device 300, and a security countermeasure management device 400.

  The network tap device 100 is a device such as a router that transfers a packet received from each user terminal to a destination server. In order to implement security measures, the network tap device 100 has a function of copying and transmitting a received packet.

  The access control device 200 is a device such as a firewall that performs security countermeasures on packets transferred by the network tap device 100. The access control device 200 performs security countermeasures such as rate limiting and blocking based on the security countermeasure rules input by an operator or the like.

  The packet analysis device 300 is a device that receives a packet transferred from the network tap device 100 and analyzes whether or not security countermeasures should be performed on the packet. For example, the packet analysis device 300 analyzes signature information (communication, transmission source / destination IP address, transmission source / destination port, protocol number, etc.) and payload, and the packet is an attack packet to be subjected to security countermeasures. Analyze whether there is. The packet analysis device 300 analyzes the packet offline and notifies the security countermeasure management device 400 of the alert information that is the analysis result. The alert information includes a false blocking detection alert indicating that the packet has been erroneously blocked in the access control apparatus 200, an attack detection alert indicating that security countermeasures should be performed on the packet, and a security for the packet. And a normal detection alert indicating that no action should be taken.

  The security countermeasure management device 400 is a device for setting and managing security countermeasures. The security countermeasure management device 400 receives an analysis result from the packet analysis device 300, designs a security countermeasure rule based on the analysis result, and controls the access control device 200. Direct security countermeasure rules. Further, when a security countermeasure rule is input by an operator or the like, the security countermeasure management apparatus 400 instructs the input security countermeasure rule to the access control apparatus 200. As a result, the security countermeasure setting in the access control device 200 is automatically changed.

  FIG. 3 is a flowchart showing processing in the security countermeasure system according to the embodiment of the present invention.

  First, an operator sets a security countermeasure rule for attack detection information. The security countermeasure rule includes signature information (source / destination IP address, source / destination port, protocol number, etc.) and security countermeasure information such as blocking or rate limiting of the packet with respect to the signature information. The security countermeasure rule may be set when an operator inputs to the access control apparatus 200, or may be set by the operator from the security countermeasure management apparatus 400 to the access control apparatus 200 by inputting to the security countermeasure management apparatus 400. Hereinafter, a case where the security countermeasure management apparatus 400 sets the access control apparatus 200 will be described.

  The security countermeasure management apparatus 400 instructs a security countermeasure rule to the access control apparatus 200 (S101).

  The access control apparatus 200 reflects the security countermeasure rule instructed from the security countermeasure management apparatus 400 (S103).

  Every time the network tap device 100 receives a packet, the network tap device 100 transmits the copied packet to the packet analysis device 300 (S105). For the analysis by the packet analysis device 300, the network tap device 100 may transmit the packet after the security countermeasure to the packet analysis device 300 in addition to the packet before the security countermeasure.

  The packet analysis device 300 analyzes the packet (S107) and detects a false block or an attack (S109). If no false block or attack is detected (S111: NO), packet analysis continues. When an erroneous block or attack is detected (S111: YES), the packet analysis device 300 transmits alert information to the security countermeasure management device 400. Even when the packet is a normal packet, the packet analysis device 300 may transmit alert information indicating the normal packet to the security countermeasure management device 400.

  The security countermeasure management device 400 designs a security countermeasure rule from the alert information (S113), and instructs the access control device 200 of the security countermeasure rule (S115). The access control apparatus 200 reflects the security countermeasure rule instructed from the security countermeasure management apparatus 400 (S103).

  FIG. 4 is a functional configuration diagram of the security countermeasure system according to the embodiment of the present invention.

  The network tap device 100 includes a packet transfer unit 101 and a transfer control unit 102. The packet transfer unit 101 transfers the received packet to the transmission destination, copies the received packet, and transfers it to the packet analysis device 300. The transfer control unit 102 controls a packet transfer destination based on an instruction from the access control apparatus 200.

  The access control device 200 includes a blocking determination unit 201, a handling rule management unit 202, a handling rule reception unit 203, a log generation unit 204, and a log management unit 205. The blocking determination unit 201 performs security countermeasures such as rate limiting and blocking based on the security countermeasure rules. The handling rule management unit 202 sets a security handling rule for the blocking determination unit 201. The countermeasure rule receiving unit 203 receives a security countermeasure rule from the security countermeasure management apparatus 400. The log generation unit 204 generates a security countermeasure rule set by the countermeasure rule management unit 202 as a log and stores the log in the log management unit 205. Further, the rate limiting and blocked packets in the blocking determination unit 201 may be stored in the log management unit 205.

  The packet analysis device 300 includes a packet reception unit 301, a packet management unit 302, an erroneous blockage detection unit 303, an attack detection unit 304, and an analysis result notification unit 305. The packet receiving unit 301 receives the packet transferred from the network tap device 100 and stores it in the packet management unit 302. The erroneous block detection unit 303 detects that a packet is erroneously blocked in the access control apparatus 200. The attack detection unit 304 detects attack packets that should be rate limited and erroneously blocked in the access control apparatus 200. The false blocking detection unit 303 and the attack detection unit 304 can analyze the packets stored in the packet management unit 302 offline. The analysis result notification unit 305 notifies the security countermeasure management apparatus 400 of the analysis results obtained by the false blocking detection unit 303 and the attack detection unit 304.

  The security countermeasure management apparatus 400 includes a countermeasure setting unit 401, an event reception unit 402, a countermeasure design unit 403, a countermeasure management unit 404, and a countermeasure instruction unit 405. The countermeasure setting unit 401 sets a security countermeasure rule input by an operator or the like. The event receiving unit 402 receives the analysis result from the packet analysis device 300. The countermeasure design unit 403 designs a security countermeasure rule based on the analysis result. The countermeasure management unit 404 manages security countermeasure rules set in the countermeasure setting unit 401 and the countermeasure design unit 403. The handling instruction unit 405 instructs a security handling rule to the access control apparatus 200.

  Each function will be described in more detail in Examples 1 to 3 below.

<Example 1>
In the first embodiment of the present invention, a procedure will be described in which a packet analysis device 300 detects a packet that is erroneously blocked in the access control device 200, and the security countermeasure management device 400 automatically changes the security countermeasure content of the access control device 200.

  The packet transfer unit 101 of the network tap device 100 copies the packet before security countermeasure and transmits it to the packet analysis device 300 (S201). The packet is subjected to security countermeasures as necessary in the blocking determination unit 201 of the access control apparatus 200 (S203). When the security countermeasure is implemented in the blocking determination unit 201 of the access control apparatus 200, the packet transfer unit 101 of the network tap apparatus 100 copies the packet after the security countermeasure and transmits it to the packet analysis apparatus 300 (S205).

  In the packet analysis device 300, the packet reception unit 301 receives the packets before and after the security countermeasure from the network tap device 100 and stores them in the packet management unit 302. Thereafter, the erroneous blocking detection unit 303 of the packet analysis device 300 compares the packets before and after the security countermeasure offline to detect the erroneous blocking packet (S207). For example, the erroneous blocking detection unit 303 detects whether security countermeasures are being performed on packets that should not be subjected to security countermeasures, from the signature information and payloads of packets before and after the security countermeasures. When an erroneous blocking packet is detected by the erroneous blocking detection unit 303, the analysis result notification unit 305 notifies the security countermeasure management device 400 of an erroneous blocking detection alert (S209).

  When the event reception unit 402 of the security countermeasure management device 400 receives the erroneous blockage detection alert, the countermeasure design unit 403 designs a security countermeasure rule based on the erroneous blockage detection alert, and the designed security countermeasure rule is displayed in the countermeasure management unit 404. Manage (S211). For example, the countermeasure design unit 403 designs a security countermeasure rule for releasing blocking or rate limiting for a packet determined to be erroneously blocked. The handling instruction unit 405 instructs a security handling rule to the access control device 200 (S213).

  In the access control device 200, the countermeasure rule receiving unit 203 receives the security countermeasure rule, and the countermeasure rule managing unit 202 sets the security countermeasure rule (S215). The blocking determination unit 201 blocks or rate-limits the packet based on the set security countermeasure rule (S217).

  This procedure can reduce erroneous interception of user packets.

<Example 2>
In the second embodiment of the present invention, a procedure for detecting a packet missed in the access control apparatus 200 by the packet analysis apparatus 300 and adding a new security countermeasure rule to the access control apparatus 200 by the security countermeasure management apparatus 400 will be described.

  The blocking determination unit 201 of the access control device 200 performs security countermeasures on the packets transferred by the network tap device 100 as necessary (S303).

  The packet transfer unit 101 of the network tap device 100 copies the packet after the security countermeasure and transmits it to the packet analysis device 300 (S305).

  In the packet analysis device 300, the packet receiving unit 301 receives the security-treated packet from the network tap device 100 and stores it in the packet management unit 302. Thereafter, the attack detection unit 304 of the packet analysis device 300 detects an attack packet for which security countermeasures are not performed offline (S307). For example, the attack detection unit 304 detects an attack packet by DPI (Deep Packet Inspection) or the like. When an attack packet is detected by the attack detection unit 304, the analysis result notification unit 305 notifies the security countermeasure management apparatus 400 of an attack detection alert (S309).

  When the event reception unit 402 of the security countermeasure management device 400 receives an attack detection alert, the countermeasure design unit 403 designs a security countermeasure rule based on the attack detection alert, and the designed security countermeasure rule is managed by the countermeasure management unit 404. (S311). For example, the countermeasure design unit 403 designs a security countermeasure rule for implementing blocking or rate limiting for attack packets. The handling instruction unit 405 instructs a security handling rule to the access control apparatus 200 (S313).

  The access control device 200 receives the security handling rule at the handling rule reception unit 203, and sets the security handling rule at the handling rule management unit 202 (S315). The blocking determination unit 201 blocks or limits the attack packet based on the set security countermeasure rule (S317).

  By this procedure, attack packets can be reduced.

<Example 3>
In the third embodiment of the present invention, the security analysis management device 400 accesses a new security countermeasure rule so as to determine a user who transmits a normal packet by performing packet analysis with the packet analysis apparatus 300 and pass the normal user. A procedure for setting the control device 200 will be described.

  The packet transfer unit 101 of the network tap device 100 copies the packet before security countermeasure and transmits it to the packet analysis device 300 (S401). The packet is subjected to security countermeasures as necessary in the blocking determination unit 201 of the access control apparatus 200 (S403).

  In the packet analysis device 300, the packet reception unit 301 receives a packet before security countermeasure from the network tap device 100 and stores it in the packet management unit 302. Thereafter, the attack detection unit 304 of the packet analysis device 300 detects a normal packet that should not be subjected to security countermeasures offline (S407). For example, the attack detection unit 304 determines a normal packet and an attack packet by DPI (Deep Packet Inspection) or the like. If the attack detection unit 304 detects a normal packet, the analysis result notification unit 305 notifies the security countermeasure management device 400 of a normal detection alert (S409).

  When the event reception unit 402 of the security countermeasure management device 400 receives a normal detection alert, the countermeasure design unit 403 designs a security countermeasure rule based on the normal detection alert, and the designed security countermeasure rule is managed by the countermeasure management unit 404. (S411). For example, the countermeasure design unit 403 designs a security countermeasure rule for passing a normal packet without blocking or rate limiting. The handling instruction unit 405 instructs a security handling rule to the access control apparatus 200 (S413).

  In the access control device 200, the countermeasure rule receiving unit 203 receives the security countermeasure rule, and the countermeasure rule managing unit 202 sets the security countermeasure rule (S415). The blocking determination unit 201 allows the normal packet to pass based on the set security countermeasure rule (S417).

  By this procedure, the number of users who transmit normal packets can be increased.

<Effects of Examples of the Present Invention>
In the prior art, erroneous blocking or missed attack packets occur due to a mistake in setting security countermeasure rules. In addition, it takes time to change the countermeasure when an error is set, and operator intervention is also required to change the setting.

  On the other hand, according to the embodiment of the present invention, the packet analysis device analyzes and detects a packet that may be missed or missed, and feeds it back to the access control device. It becomes possible to satisfy the requirements and improve the security performance. Further, the security countermeasure contents in the access control apparatus can be automatically changed by detecting and feeding back the packet analysis apparatus on the network.

  The system according to the embodiment of the present invention can be applied to a large-scale network such as a carrier network or an ISP carrier network, detects and feeds back an application layer type attack on such a large-scale network, and an access control device Security measures can be taken. It is also possible to detect an application layer attack on the network side to which the attacker belongs.

  Furthermore, it is possible to change the setting of security countermeasures step by step, and for example, it is possible to implement flexible countermeasure changes such as gradually increasing the security countermeasure level or changing to a setting that passes a specific user.

<Hardware configuration example>
FIG. 8 illustrates a hardware configuration example of the access control device 200, the packet analysis device 300, or the security countermeasure management device 400 according to the embodiment of the present invention. The access control device 200, the packet analysis device 300, or the security countermeasure management device 400 includes a processor such as a CPU (Central Processing Unit) 151, a memory device 152 such as a RAM (Random Access Memory) and a ROM (Read Only Memory), a hard disk, etc. A computer including the storage device 153 or the like may be used. For example, the functions and processing of the access control device 200, the packet analysis device 300, or the security countermeasure management device 400 are realized by the CPU 151 executing data and programs stored in the storage device 153 or the memory device 152. Information necessary for the access control device 200, the packet analysis device 300, or the security countermeasure management device 400 is input from the input / output interface device 154, and is obtained by the access control device 200, the packet analysis device 300, or the security countermeasure management device 400. The result may be output from the input / output interface device 154.

  The network tap device 100 is a communication device such as a router, but may be configured by hardware similar to that shown in FIG.

<Supplement>
For convenience of explanation, the security countermeasure system according to the embodiment of the present invention is described using a functional block diagram. However, the security countermeasure system according to the embodiment of the present invention may be hardware, software, or a combination thereof. It may be realized. For example, an embodiment of the present invention includes a program that causes a computer to implement the functions of the security countermeasure system according to the embodiment of the present invention, a program that causes a computer to execute each procedure of the method according to the embodiment of the present invention, etc. May be realized. In addition, the functional units may be used in combination as necessary. In addition, the method according to the embodiment of the present invention may be performed in an order different from the order shown in the embodiment.

  As described above, the method for improving the security countermeasure performance while ensuring the throughput in the security countermeasure has been described. However, the present invention is not limited to the above-described embodiments, and various modifications are within the scope of the claims.・ Applicable.

DESCRIPTION OF SYMBOLS 100 Network tap apparatus 101 Packet transfer part 102 Transfer control part 200 Access control apparatus 201 Blocking judgment part 202 Dealing rule management part 203 Dealing rule receiving part 204 Log generation part 205 Log management part 300 Packet analysis apparatus 301 Packet receiving part 302 Packet management part 303 False interception detection unit 304 Attack detection unit 305 Analysis result notification unit 400 Security countermeasure management device 401 Countermeasure setting unit 402 Event reception unit 403 Countermeasure design unit 404 Countermeasure management unit 405 Countermeasure instruction unit 151 CPU
152 Memory device 153 Storage device 154 Input / output interface device

Claims (5)

A security countermeasure system having a network tap device for transferring packets and an access control device for implementing security countermeasures for packets transferred by the network tap device,
A packet analysis device that receives a packet transferred from the network tap device and analyzes whether or not security countermeasures should be performed on the packet;
A security countermeasure management apparatus that receives an analysis result from the packet analysis apparatus, designs a security countermeasure rule based on the analysis result, and instructs the access control apparatus of the security countermeasure rule;
I have a,
The packet analyzer is
A packet receiver for receiving packets before and after security countermeasures from the network tap device;
Comparing the received packets before and after security countermeasures, and an erroneous blocking detection unit for detecting erroneous blocking packets;
An analysis result notifying unit for notifying the security countermeasure management device of an analysis result of the detected erroneous blocking packet;
Have
The security countermeasure management device includes:
A receiving unit for receiving an analysis result from the packet analysis device;
A countermeasure design unit that designs a security countermeasure rule based on the analysis result;
A handling instruction unit for instructing the security handling rule to the access control device;
Having a security handling system.   A security countermeasure system having a network tap device for transferring packets and an access control device for implementing security countermeasures for packets transferred by the network tap device,
  A packet analysis device that receives a packet transferred from the network tap device and analyzes whether or not security countermeasures should be performed on the packet;
  A security countermeasure management apparatus that receives an analysis result from the packet analysis apparatus, designs a security countermeasure rule based on the analysis result, and instructs the access control apparatus of the security countermeasure rule;
  Have
  The packet analyzer is
  A packet receiving unit for receiving a packet before security countermeasure from the network tap device;
  An attack detection unit that detects a normal packet that should not be subjected to security countermeasures from the received packet;
  An analysis result notifying unit for notifying the security countermeasure management device of an analysis result of the detected normal packet;
  Have
  The security countermeasure management device includes:
  A receiving unit for receiving an analysis result from the packet analysis device;
  A countermeasure design unit that designs a security countermeasure rule based on the analysis result;
  A handling instruction unit for instructing the security handling rule to the access control device;
  Having a security handling system. The security countermeasure system according to claim 1 or 2 , wherein when a security countermeasure rule is input, the security countermeasure management apparatus instructs the input control countermeasure rule to the access control apparatus. A security coping method in a security coping system having a network tap device that transfers a packet and an access control device that performs security coping with the packet transferred by the network tap device,
A packet analysis device receiving a packet transferred from the network tap device, and analyzing whether the packet should be subjected to security measures;
A security countermeasure management device receiving an analysis result from the packet analyzer, designing a security countermeasure rule based on the analysis result, and instructing the security countermeasure rule to the access control device;
I have a,
In the analyzing step,
The packet analyzer receives packets before and after security measures from the network tap device;
The packet analysis device compares the received packets before and after the security countermeasure, detects a false blocking packet,
The packet analysis device notifies the security countermeasure management device of the analysis result of the detected erroneous blocking packet,
In the instructing step,
The security countermeasure management device receives an analysis result from the packet analysis device;
The security countermeasure management device designs a security countermeasure rule based on the analysis result,
A security countermeasure method in which the security countermeasure management apparatus instructs the security countermeasure rule to the access control apparatus .   A security coping method in a security coping system having a network tap device that transfers a packet and an access control device that performs security coping with the packet transferred by the network tap device,
  A packet analysis device receiving a packet transferred from the network tap device, and analyzing whether the packet should be subjected to security measures;
  A security countermeasure management device receiving an analysis result from the packet analyzer, designing a security countermeasure rule based on the analysis result, and instructing the security countermeasure rule to the access control device;
  Have
  In the analyzing step,
  The packet analyzer receives a packet before security countermeasure from the network tap device,
  The packet analyzer detects a normal packet that should not be subjected to security measures from the received packet,
  The packet analysis device notifies the security countermeasure management device of the analysis result of the detected normal packet;
  In the instructing step,
  The security countermeasure management device receives an analysis result from the packet analysis device;
  The security countermeasure management device designs a security countermeasure rule based on the analysis result,
  A security countermeasure method in which the security countermeasure management apparatus instructs the security control rule to the access control apparatus.

Images