JP6629174B2 - Communication monitoring device, communication monitoring method, and communication monitoring program - Google Patents

Description

  The present invention relates to a communication monitoring device, a communication monitoring method, and a communication monitoring program for detecting an attack by mass communication.

  2. Description of the Related Art Conventionally, a DDoS (Distributed Denial of Service) attack in which a large number of communication packets are transmitted from a plurality of terminals to interrupt a service has been an issue. In order to detect and deal with such attacks, a monitoring device is installed on a router or the like on the network, and if the traffic is extremely large, it is determined that the attack is an attack and the communication causing the problem is discarded. The method is taken.

Such a monitoring device determines an attack by monitoring flow information called NetFlow or sFlow, which is header information of an IP packet (for example, see Non-Patent Documents 1 and 2).
The following determination conditions are used for detecting an attack.
(Condition 1) The traffic exceeds a predetermined threshold.
(Condition 2) The traffic exceeds the past level.
(Condition 3) An error is found in the protocol included in the communication.
(Condition 4) As a result of analyzing the payload of the packet, there is an abnormality in the application layer.
(Condition 5) An unused IP address called a dark IP is a transmission source.
(Condition 6) A predetermined IP address considered to be abused by a virus or the like is the transmission source.

Arbor Networks, Arbor SP, Internet <https://www.arbornetworks.com/images/documents/Data%20Sheets/DS_SP_EN.pdf> Genie Networks, Genie ATM, Internet <http://www.genie-networks.com/images/Download_Files/GenieATM_ServiceWhitepaper_v5.6_ENG.pdf>

  From the viewpoint of network operation, detection accuracy is not required in terms of whether or not a large amount of communication has been illegally performed, and detection accuracy in terms of whether it is likely to affect operation or lead to failure is high. Desired. However, conventional attack detection methods detect attacks based on the viewpoint of whether or not the communication was generated illegally, so that attacks that need not be detected from the viewpoint of network operation may be detected or detected. In some cases, an attack to be missed may be missed, and high detection accuracy based on actual damage or actual effect cannot be obtained.

  An object of the present invention is to provide a communication monitoring device, a communication monitoring method, and a communication monitoring program that can accurately detect an attack likely to affect network equipment.

  A communication monitoring device according to the present invention includes: a detection unit configured to detect a candidate host due to a large amount of communication based on a communication amount of each destination address measured based on information of a communication packet; and a target selected from a network to be monitored. A state estimating unit that periodically makes an echo request to the router and identifies a faulty router that cannot obtain a normal response; and, if the faulty router is a router higher than the victim host candidate, the victim host candidate And a determining unit for determining the communication packet corresponding to the cause of the failure as a cause of the failure.

  The communication monitoring device includes a configuration estimating unit that extracts a communication path from a network to be monitored and derives a topology of a router, wherein the state estimating unit selects the target router based on the topology, and performs the determination. The unit may determine, based on the topology, that the failed router is a higher-level router of the candidate victim host.

  The detection unit may measure a communication amount for each destination address based on flow information of the communication packet.

  A communication monitoring method according to the present invention includes a detection step of detecting a victim host candidate due to a large amount of communication based on a traffic volume for each destination address measured based on information of a communication packet; and a target selected from a network to be monitored. A state estimation step of periodically making an echo request to the router and identifying a faulty router that cannot obtain a normal response; and, if the faulty router is a router higher than the victim host candidate, the victim host candidate A determination step of determining the communication packet to be the cause of the failure.

  A communication monitoring program according to the present invention includes a detecting step of detecting a victim host candidate due to a large amount of communication based on a traffic volume of each destination address measured based on information of a communication packet, and a target selected from a network to be monitored. A state estimation step of periodically making an echo request to the router and identifying a faulty router that cannot obtain a normal response; and, if the faulty router is a router higher than the victim host candidate, the victim host candidate And determining the communication packet to be the cause of the failure.

  ADVANTAGE OF THE INVENTION According to this invention, the attack which has a high possibility of affecting network equipment can be detected with high precision.

It is a figure showing the functional composition of the communication monitoring device concerning an embodiment. FIG. 6 is a diagram illustrating a relationship between a victim host candidate and a failed router according to the embodiment. It is a flowchart which shows the network structure estimation process which concerns on this embodiment. It is a flowchart which shows the network state estimation process which concerns on embodiment. 9 is a flowchart illustrating a communication monitoring process according to the embodiment.

Hereinafter, an example of an embodiment of the present invention will be described.
FIG. 1 is a diagram illustrating a functional configuration of a communication monitoring device 1 according to the present embodiment.
The communication monitoring device 1 is mainly arranged in a router (core router) of a higher hierarchy in a network. The communication monitoring device 1 detects a damaged host candidate due to a large amount of communication, and among the communication addressed to the damaged host candidate, determines a communication that is actually damaged or has a large effect and outputs evaluation information.

  The communication monitoring device 1 is an information processing device (computer) such as a server device or a personal computer, and includes, in addition to the control unit 10 and the storage unit 20, an input / output device for various data or a communication device.

  The control unit 10 is a part that controls the entire communication monitoring device 1, and realizes various functions in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

  The storage unit 20 is a storage area for various programs and various data for causing the hardware group to function as the communication monitoring device 1, and may be a ROM, a RAM, a flash memory, a hard disk (HDD), or the like. Specifically, the storage unit 20 stores a communication monitoring program that causes the control unit 10 to execute each function of the present embodiment.

  The control unit 10 includes a detection unit 11, a configuration estimation unit 12, a state estimation unit 13, and a determination unit 14. The storage unit 20 includes a network configuration database (DB) 21 and a network status database (DB) 22.

The detection unit 11 measures the communication amount for each destination IP address based on the communication packet or the flow information of the communication packet, and is likely to have received a large amount of communication based on the measured communication amount for each destination address. The damaged host candidate is detected and notified to the determination unit 14.
The detection unit 11 may register or update the detected damaged host candidate in a predetermined database and make the determination unit 14 refer to it.

The configuration estimating unit 12 performs network diagnosis such as traceroute on the IP address group of the network to be monitored to be protected, and extracts the path (communication path) of the router, thereby obtaining the topology of the router in the entire network. Is derived.
This topology is information including a connection relationship between a plurality of routers in the network and a group of IP addresses under each router. The topology is stored in the network configuration database 21 and is used by the state estimation unit 13 and the determination unit 14.

  Based on the estimated topology, the state estimating unit 13 periodically makes an ICMP (Internet Control Message Protocol) echo request to a main target router selected from the network to be monitored, and returns a normal response. Identify the failed router that cannot be obtained. The examination result by the echo request is stored in the network state database 22, and for example, it is presumed that a fault has occurred in a router whose response time has been lengthened or whose response frequency has decreased. The specified faulty router is notified to the determination unit 14 directly or via the network status database 22.

  The determining unit 14 refers to the lower-level IP addresses of the failed router based on the estimated topology, and determines whether the lower-level IP addresses include the IP address of the candidate victim host. Alternatively, based on the estimated topology, the determination unit 14 refers to the higher routers of the candidate victim host and determines whether or not these higher routers include a faulty router. If the failed router is a higher-level router of the candidate victim host, the determination unit 14 determines that the communication packet for the candidate victim host is the cause of the failure, and outputs flow information.

FIG. 2 is a diagram illustrating a relationship between a damaged host candidate and a failed router according to the present embodiment.
Based on the estimated topology, it is confirmed from the estimated topology that the routers A, B, and C exist as the communication paths in the host H detected as the candidate host for the heavy communication based on the measured traffic.
At this time, if a router on the communication path, for example, the router B is specified as a faulty router, it is determined that there is a high possibility that the mass communication detected at the same time is the cause of the fault.

FIG. 3 is a flowchart illustrating a network configuration estimation process performed by the communication monitoring device 1 according to the present embodiment.
This process is executed periodically or at a predetermined timing such as when there is a change in network equipment.

  In step S1, the control unit 10 (configuration estimating unit 12) performs network diagnosis such as traceroute on an IP address group in the network to be monitored, and acquires a router path.

In step S2, the control unit 10 (configuration estimating unit 12) derives the topology of the entire network from the path of the router obtained in step S1.
In step S3, the control unit 10 (configuration estimating unit 12) stores the topology derived in step S2 in the network configuration database 21.

FIG. 4 is a flowchart illustrating a network state estimation process by the communication monitoring device 1 according to the present embodiment.
This process is periodically executed repeatedly.

  In step S11, the control unit 10 (state estimation unit 13) reads the topology of the network to be monitored from the network configuration database 21.

  In step S12, the control unit 10 (state estimation unit 13) selects a main router from the topology read in step S11 according to a predetermined rule. For example, an upper-layer router or a router having a large number of subordinate IP addresses may be preferentially selected.

  In step S13, the control unit 10 (state estimation unit 13) issues an ICMP echo request to the router selected in step S12.

  In step S14, the control unit 10 (state estimating unit 13) stores the state of the echo response (the presence or absence of the response, the time until the response, etc.) in the network state database 22 as the examination result of step S13.

  In step S15, the control unit 10 (state estimation unit 13) determines whether there is another router to be selected. If the determination is YES, the process proceeds to step S12, and if the determination is NO, the process ends.

FIG. 5 is a flowchart illustrating a communication monitoring process performed by the communication monitoring device 1 according to the present embodiment.
This process is repeatedly executed while monitoring the communication.
Prior to this processing, it is assumed that the topology of the network to be monitored is derived by the configuration estimation unit 12 and stored in the network configuration database 21.

  In step S21, the control unit 10 (the determination unit 14) determines whether or not a damaged host candidate having a high possibility of receiving a large amount of communication is detected based on the communication amount for each destination address measured by the detection unit 11. Is determined. If the determination is YES, the process proceeds to step S22, and if the determination is NO, the process ends.

  In step S22, the control unit 10 (determination unit 14) refers to the network state database 22 or determines whether or not a faulty router has been detected by the state estimation unit 13 based on the notification from the state estimation unit 13. I do. If the determination is YES, the process proceeds to step S23, and if the determination is NO, the process ends.

  In step S23, the control unit 10 (judgment unit 14) reads the topology of the network to be monitored from the network configuration database 21.

  In step S24, the control unit 10 (the determination unit 14) refers to the topology read in step S23, and determines whether or not there is a failed router above the victim host candidate. If the determination is YES, the process proceeds to step S25, and if the determination is NO, the process ends.

  In step S25, the control unit 10 (determination unit 14) determines that the communication packet addressed to the victim host candidate is the cause of the failure, and outputs information of the communication packet, for example, flow information.

According to the present embodiment, the communication monitoring device 1 specifies a faulty router in the network from the status of the response to the echo request, and if there is a candidate for a host damaged by mass communication under the faulty router, The communication packet addressed to is determined as the cause of the failure.
Accordingly, the communication monitoring device 1 can detect that a large amount of communication with a destination under the router is occurring at the same time when a failure occurs in the router, and to a network facility (router) different from the actual destination. Attacks due to high-volume communications that are likely to affect can be detected with high accuracy.

  Since the communication monitoring device 1 derives the topology of the router based on the network diagnosis, even if the configuration of the network to be monitored is unknown, the communication monitoring device 1 estimates the topology and raises an attack that is likely to affect network equipment. Can be detected with accuracy.

  By using the flow information obtained by sampling the communication packets, the communication monitoring device 1 can efficiently process a large number of communication packets observed in a large-scale network and reduce the processing load.

  The embodiments of the present invention have been described above, but the present invention is not limited to the above-described embodiments. Further, the effects described in the present embodiment merely enumerate the most preferable effects resulting from the present invention, and the effects according to the present invention are not limited to those described in the present embodiment.

  The communication monitoring method by the communication monitoring device 1 is realized by software. When realized by software, a program constituting the software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to a user's computer as a Web service via a network without being downloaded.

Reference Signs List 1 communication monitoring device 10 control unit 11 detection unit 12 configuration estimation unit 13 state estimation unit 14 determination unit 20 storage unit 21 network configuration database 22 network status database

Claims (5)

A detecting unit that detects a candidate host that has been damaged by a large amount of communication, based on a communication amount of each destination address measured based on information of the communication packet;
A state estimating unit that periodically sends an echo request to a target router selected from the network to be monitored and identifies a failed router that cannot obtain a normal response;
And a determination unit that determines, when the failed router is a higher-level router of the candidate victim host, the communication packet for the candidate victim host as a cause of the failure. A configuration estimating unit that extracts a communication path from the network to be monitored and derives a topology of the router,
The state estimating unit selects the target router based on the topology,
The communication monitoring device according to claim 1, wherein the determination unit determines that the failed router is a higher-order router of the candidate victim host based on the topology.   The communication monitoring device according to claim 1, wherein the detection unit measures a communication amount for each destination address based on flow information of the communication packet. A detection step of detecting a victim host candidate due to a large amount of communication based on a communication amount of each destination address measured based on information of the communication packet;
A state estimation step of periodically making an echo request to a target router selected from the network to be monitored and identifying a faulty router that cannot obtain a normal response;
And a determining step of, when the faulty router is a higher-order router of the candidate victim host, determining the communication packet for the candidate victim host as a cause of the fault. Based on the traffic of each destination address measured based on the information of the communication packet, a detection step of detecting a victim host candidate due to a large amount of communication,
A state estimation step of periodically making an echo request to a target router selected from the network to be monitored and identifying a failed router that cannot obtain a normal response;
A determining step of determining, when the faulty router is a higher-ranked router of the candidate victim host, the communication packet for the candidate victim host as a cause of the fault;

Images