JP6645998B2 - Response instruction device, response instruction method, response instruction program - Google Patents

Description

  The present invention relates to a response instruction device, a response instruction method, and a response instruction program for preventing a threat from spreading in a network.

  As a conventional technique, a technique disclosed in Patent Literature 1 is known. The technique of Patent Literature 1 can prevent consumption of bandwidth resources inside a router or the like and bandwidth resources of an access network when an attacking IP packet is rejected by a filter unit provided in a router device or the like connecting a network. It is an object of the present invention to provide a simple DDoS protection method and a router device. Then, the detecting means detects the attacking IP packet, the filter information generating means generates the filter information, the distribution means or the return distribution means notifies the filter information to all the filters, and all the filter units detect the attacking IP packet. We are trying to shut it off temporarily.

JP 2005-39721 A

  However, the prior art is a method in which, when an attack is detected, the detected traffic is sequentially subjected to a procedure necessary for blocking the attacking IP packet (hereinafter, referred to as "handling"). In this case, depending on the state of the attack, there is a problem that the response may not be able to keep up with the increase of the attack. Further, it is not assumed that the network connection configuration changes dynamically. Therefore, when an apparatus such as V2V (Vehicle-to-Vehicle: vehicle-to-vehicle communication) moves, it cannot cope appropriately.

  Therefore, an object of the present invention is to enable a proactive response to an attack even when a network connection configuration dynamically changes.

  According to the present invention, a mobile device is capable of moving a source and a destination of a packet. Further, the handling instruction device of the present invention monitors a network packet, specifies a source and a destination, and outputs one or more analysis units that output a threat level indicating a degree of security threat, and a security engine including one or more analysis units. A network control device for controlling the network and a mobile device location information providing device for providing location information of the mobile device are connected. The coping instruction device of the present invention includes a threat information recording unit, a coping information recording unit, a mobile device searching unit, an infection determining unit, a coping determining unit, a proximity clustering unit, a mobile device estimating unit, an enlarged proximity clustering unit, a coping transmission unit. Is provided. The threat information recording unit records threat information that is information for specifying a threat level, a transmission source, a transmission destination, and a time according to an output from the analysis unit. The handling information recording unit records a plurality of pieces of handling information that is information for specifying a handling method. The mobile device searching unit transmits, using the position information of the mobile device provided from the mobile device position information providing device, countermeasure information for disconnecting the transmission source mobile device identified by the threat information from the network from the time of the threat information. During this period, the mobile device that has approached the source mobile device specified by the threat information within a predetermined range is specified. The infection determination unit determines the possibility of infection for each mobile device identified by the mobile device search unit. The handling determining unit selects handling information based on the determination by the infection determining unit. The proximity clustering unit associates the mobile device identified by the threat information and the mobile device identified by the mobile device searching unit with a proximity group, if necessary for a response method identified by the response information selected by the response determination unit. I do. The mobile device estimating unit uses the position information of the mobile device provided from the mobile device position information providing device, when necessary for the coping method specified by the coping information selected by the coping determination unit, and uses the mobile device belonging to the proximity group. The mobile device that is predicted to approach the predetermined range within the predetermined time is specified. The extended proximity clustering unit sets the mobile device identified by the mobile device estimation unit and the mobile devices belonging to the proximity group as an extended proximity group. The response transmission unit transmits the response information selected by the response determination unit to the network control device. The handling determining unit selects the handling information for the proximity group or the handling information for the extended proximity group as the number of mobile devices that may have been infected increases.

  According to the coping instruction device of the present invention, even when coping with the mobile device alone cannot cope with the increase in the attacks, the coping instruction device includes the proximity group which is a group of the mobile devices approached in the past and the mobile device approaching in the future. Create an extended proximity group, which is a group, and take action. Therefore, even when the network connection configuration changes dynamically, it is possible to take proactive measures against attacks.

FIG. 2 is a diagram illustrating a configuration example of a network. The figure which shows the example of a structure containing the handling instruction | indication apparatus of this invention. FIG. 4 is a diagram showing an example of a processing flow according to the present invention. The figure which shows the image of the movement of a vehicle when a moving device is mounted in a vehicle.

  Hereinafter, embodiments of the present invention will be described in detail. Note that components having the same functions are given the same reference numerals, and redundant description is omitted.

  In the following description, K and M are integers of 2 or more, k, k1 and k2 are integers of 1 or more and K or less, m, m1 and m2 are integers of 1 or more and M or less, N is an integer of 1 or more, and n is 1 It is an integer not less than N and not more than N. FIG. 1 shows a configuration example of a network. , K are connected via a network 950. The network device 930-k includes, for example, a base station, a wireless router, a gateway, and the like. However, the network device 930-k need not be limited to any device that can monitor and control the state of the network. The mobile devices 920-1,..., M are connected to one of the network devices 930-k depending on the location. The moving device 920-m is a vehicle, a portable terminal, or the like having a communication function. In the example of FIG. 1, at a certain point, the mobile device 920-1 is connected to the network device 930-2, the mobile devices 920-2 and 920-3 are connected to the network device 930-k1, and the mobile device 920-M is This indicates that the device is connected to the network device 930-k2.

  When the mobile device 920-2 is infected with a virus and starts attacking other devices, in the related art, the mobile device 920-2 is connected to the security engine installed inside the network device 930-k1 or the network device 930-k1. The security engine detects a threat, and takes measures such as disconnecting the mobile device 920-2 from the network 950 (making the mobile device 920-2 incapable of communication). However, if the spread of the threat is very fast, it is not possible to stop the spread of the threat (spread of infection) simply by detecting the threat and then separating it.

  In the present invention, measures such as disconnecting from the network 950 are performed on mobile devices that are not yet threatened. At that time, clustering (creation of a group) is performed in consideration of the proximity between the mobile devices 920-1,..., M (whether the mobile device 920-1,... I do.

  2 shows an example of a configuration including the coping instruction device of the present invention, FIG. 3 shows an example of a processing flow, and FIG. 4 shows an image of the movement of the vehicle when the moving device is mounted on the vehicle. A switch 931 is provided in the network device 930-k, and a mirroring packet is input to the security engine 200. One security engine 200 may be provided for all network devices 930-1,..., M, may be provided for each network device 930-k, or may be provided for several network devices 930-k. m1,..., m2. The security engine 200 includes analysis units 210-1,..., N. The analysis unit 210-n monitors a packet of the network 950 and functions according to an analysis algorithm for analyzing a threat, specifies a transmission source and a transmission destination, and outputs a threat level indicating a degree of a threat to security ( (S210), the threat information, which is information for specifying the threat level, the transmission source, the transmission destination, and the time, is transmitted to the handling instruction device 100 (S220). There are several types of analysis algorithms, and there are analysis algorithms suitable for the types of attacks. Therefore, N analysis units 210-1,...

  In the present invention, as described above, the mobile devices 920-1,. The coping instruction device 100 is connected to the security engine 200, a network control device 300 that controls the network 950, and a mobile device location information providing device 400 that provides location information of the mobile devices 920-1,. The network control device 300 is connected to the network devices 930-1,..., K, etc., and disconnects the mobile device 920-m from the network 950 or changes the IP address to deal with a threat.

  The response instruction device 100 includes a threat information recording unit 191, a response information recording unit 193, a mobile device search unit 130, an infection determination unit 150, a response determination unit 110, a proximity clustering unit 160, a mobile device estimation unit 140, an enlarged proximity clustering. Unit 170 and a coping transmission unit 120. The threat information recording unit 191 records threat information that is information for specifying a threat level, a transmission source, a transmission destination, and a time according to the output from the analysis units 210-1,. When the threat disappears, the threat information is updated such as deleting the threat information (S191).

  The handling information recording unit 193 records a plurality of pieces of handling information that is information for specifying a handling method. As a countermeasure, for example, there is a method of determining the range of the target mobile device and separating the mobile device 920-m from the network 950, a method of changing the IP address, and the like. However, it is not necessary to limit to these.

  When threat information is present in the threat information recording unit 191, the mobile device searching unit 130 uses the position information of the mobile devices 920-1,. In the period between the time indicated in the threat information and the transmission of the handling information for disconnecting the mobile device 920-m1 of the transmission source specified by the threat information from the network, the transmission source specified by the threat information is transmitted. The mobile device 920-m2 approaching the mobile device 920-m1 within a predetermined range is specified (S130, S410). The “predetermined range” means a range that is close enough to be vulnerable to an attack. For example, a range connected to the same network device 930-k may be set as the predetermined range, or a range within a linear distance of several meters may be set as the predetermined range. Good. The position information provided by the mobile device position information providing device 400 differs depending on how the predetermined range is determined. For example, when the connection to the same base station is set as a predetermined range, the position information indicates when and to which base station the connection was made. If the predetermined range is determined by the linear distance, latitude, longitude and the like may be used as the position information.

  The infection determination unit 150 determines the possibility of infection for each mobile device 920-m2 specified by the mobile device search unit 130 (S150). That is, the possibility of infection is determined for each mobile device 920-m2 approaching within a predetermined range of the source mobile device 920-m1 specified by the threat information. For example, the possibility that the mobile device 920-m2 has been infected may be determined from the threat level of the threat information whose source is the mobile device 920-m1 and the destination specified by the threat information. Also, if threat information with the mobile device 920-m2 as the transmission source is found at a later time than the threat information with the mobile device 920-m1 as the transmission source, it is determined that there is a possibility that the mobile device 920-m2 has been infected. Good.

  The response determining unit 110 selects response information based on the determination of the infection determining unit (S110). One or more pieces of countermeasure information may be selected. The handling determining unit 110 selects the handling information for the proximity group or the handling information for the extended proximity group, which will be described later, as the number of mobile devices that may be infected increases. When the possibility of infection is low, such as when the threat level of the threat information is low, the countermeasure determination unit 110 performs a countermeasure such as disconnecting only the mobile device 920-m1 of the transmission source specified by the threat information from the network. Just do it. On the other hand, if there are many mobile devices that may have been infected, it is necessary to take proactive measures. The “proximity group” described below is a group of the mobile device 920-m1 that is the source of the threat and the mobile device 920-m2 that has approached the mobile device 920-m1 within a predetermined range from the past to the present. The “expanded proximity group” is a group in which mobile devices 920-m predicted to approach the mobile devices 920-m1 and m2 of the proximity group in the future are added to the proximity group. For example, the mobile device 920-m which is predicted to approach the mobile devices 920-m1 and m2 of the neighboring group before transmitting the handling information for disconnecting the mobile device from the network from the current time to the network devices 930-1,. An extended proximity group including the extended proximity group may be created, and handling information for disconnecting the mobile device of the extended proximity group from the network may be transmitted. By taking such a measure, it is possible to take proactive measures against an attack even when the network connection configuration changes dynamically. When it is not necessary to proceed to this point, the mobile device 920-m1 sends the handling information for disconnecting the mobile devices 920-m1 and m2 in the proximity group from the network, and sends the mobile devices belonging to the proximity group to the other mobile devices 920-m in the extended proximity group Information specifying 920-m1, m2 may be transmitted as a blacklist.

  The proximity clustering unit 160 identifies the source mobile device 920-m1 and the mobile device search unit 130 specified by the threat information when the coping information selected by the coping determination unit 110 requires the coping method specified. The mobile device 920-m2 is set as a proximity group (S160).

  The mobile device estimating unit 140 may provide the mobile device 920-1,..., M location information provided from the mobile device location information providing device 400 when the handling information selected by the handling determining unit 110 is necessary for the specified coping method. Is used, the mobile device 920-m1 or m2 belonging to the proximity group is identified as a mobile device that is predicted to approach within a predetermined range within a predetermined time (S140, S420). The extended proximity clustering unit 170 sets the mobile device identified by the mobile device estimation unit and the mobile devices belonging to the proximity group as the extended proximity group (S170). The "predetermined time" may be determined, for example, as an average value or a maximum value until the handling information for disconnecting the mobile device from the network from the present time to the network devices 930-1, ..., K. The “predetermined range” is the same as the description of the mobile device search unit 130. In this prediction, it is necessary to consider the speed of the mobile device 920-m1, m2. The speed may be obtained from the difference between the past position and the current position, or may also receive speed information from the mobile device position information providing device 400.

  The mobile device 920-1 in FIG. 4 is a threat source, and the mobile device 920-2 is a mobile device approaching the mobile device 920-1 within a predetermined range. In this case, the mobile devices 920-1 and 920-2 belong to the proximity group. Based on the speed of the mobile device 920-1 and the speed of the mobile device 920-4, when the mobile device 920-4 approaches within a predetermined range before disconnecting the mobile device 920-1 from the network, the mobile device 920-4 is in the enlarged proximity. Belong to a group. Also, based on the speed of the mobile device 920-2 and the speed of the mobile device 920-5, when the mobile device 920-5 approaches within a predetermined range before disconnecting the mobile device 920-2 from the network, the mobile device 920-5 is also used. They will belong to the extended proximity group. Note that ranges 610, 620, 630, and 640 indicated by dotted lines in FIG. 4 show examples of the predetermined range when the mobile device is connected to the same base station within a predetermined range.

  The response transmission unit 120 transmits the response information selected by the response determination unit 110 to the network control devices 300-1, ..., K (S120). The network control device 300 is connected to the network devices 930-1,..., K. The network control device 300 receives one or more pieces of handling information. When a plurality of pieces of handling information are received, the network control device 300 selects any one of the handling information for each of the network devices 930-k (S310), and controls the network according to the selected handling information (S320). . It is conceivable that the executable coping method differs for each network device 930-k, depending on the location and function. Therefore, for example, the network control device 300 may select, from among a plurality of pieces of handling information, handling information that can be executed by the network device 930-k that sends the handling information. In this way, the response instruction device 100 can select the response information without considering the location and function of each network device 930-k.

  The coping instruction device 100, the security engine 200, the network control device 300, and the mobile device location information providing device 400 repeat the processing of steps S210 to S320.

  According to the coping instruction device 100, even when coping with the mobile device 920-m1 alone cannot cope with the increase in attacks, the coping includes the proximity group, which is a group of mobile devices that have approached in the past, and the mobile device that is approaching from now. Create an extended proximity group, which is a group that has been set up, and take action. Therefore, even when the network connection configuration changes dynamically, it is possible to take proactive measures against attacks.

[Program, recording medium]
The various processes described above may be executed not only in chronological order as described, but also in parallel or individually according to the processing capability of the device that executes the process or as necessary. In addition, it goes without saying that changes can be made as appropriate without departing from the spirit of the present invention.

  When the above-described configuration is implemented by a computer, the processing contents of the functions that each device should have are described by a program. By executing this program on a computer, the above-described processing functions are realized on the computer.

  A program describing this processing content can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, a semiconductor memory, and the like.

  The distribution of the program is performed by, for example, selling, transferring, lending, or the like, a portable recording medium such as a DVD or a CD-ROM on which the program is recorded. Further, the program may be stored in a storage device of a server computer, and the program may be distributed by transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. Then, when executing the processing, the computer reads the program stored in its own recording medium and executes the processing according to the read program. As another execution form of the program, the computer may directly read the program from the portable recording medium and execute processing according to the program, and further, the program may be transferred from the server computer to the computer. Each time, the processing according to the received program may be sequentially executed. A configuration in which the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes a processing function only by executing an instruction and acquiring a result without transferring a program from the server computer to the computer. It may be. It should be noted that the program in the present embodiment includes information used for processing by the computer and which is similar to the program (data that is not a direct command to the computer but has characteristics that define the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of the processing may be realized by hardware.

REFERENCE SIGNS LIST 100 response instruction device 110 response determination unit 120 response transmission unit 130 mobile device search unit 140 mobile device estimation unit 150 infection determination unit 160 proximity clustering unit 170 enlarged proximity clustering unit 191 threat information recording unit 193 response information recording unit 200 security engine 210 analyzer 300 network controller 400 mobile device location information providing device 920 mobile device 930 network device 931 switch 950 network

Claims (7)

A security engine including one or more analyzers that monitor network packets, specify a source and a destination, and output a threat level indicating the degree of security threat, and a network control device that controls the network. A coping instruction device connected to a mobile device position information providing device that provides position information of the mobile device,
A mobile device in which a source and a destination of the packet are movable,
According to an output from the analysis unit, a threat information recording unit that records threat information that is information specifying a threat level, a transmission source, a transmission destination, and time;
A response information recording unit that records a plurality of response information that is information for identifying a response method;
Using the position information of the mobile device provided from the mobile device position information providing device, from the time of the threat information to transmitting the coping information for disconnecting the source mobile device specified by the threat information from the network. A mobile device search unit that specifies a mobile device that has approached within a predetermined range to the source mobile device specified by the threat information,
For each mobile device identified by the mobile device search unit, an infection determination unit that determines the possibility of infection,
A response determining unit that selects response information based on the determination of the infection determining unit;
When a response method specified by the response information selected by the response determining unit is necessary, a proximity cluster that sets the source mobile device identified by the threat information and the mobile device identified by the mobile device search unit as a proximity group And
When the handling information selected by the handling determining unit is necessary for the handling method specified, any one of the mobile devices belonging to the proximity group is used by using the location information of the mobile device provided from the mobile device location information providing device. A mobile device estimating unit that specifies a mobile device that is predicted to approach the predetermined range within a predetermined time,
An extended proximity clustering unit that sets the mobile device identified by the mobile device estimation unit and the mobile devices belonging to the proximity group to an extended proximity group;
A response transmission unit that transmits the response information selected by the response determination unit to the network control device,
The handling determining unit selects handling information targeting the proximity group or handling information targeting the expanded proximity group as the number of mobile devices that may have been infected determined by the infection determining unit increases. apparatus. The handling instruction device according to claim 1, wherein
The handling determination unit selects one or more pieces of the handling information,
The response instruction unit, wherein the response transmission unit transmits one or more response information to the network control device. The handling instruction device according to claim 1 or 2,
The handling information recorded by the handling information recording unit includes handling information transmitted to the mobile device identified by the mobile device estimating unit as a blacklist of information identifying mobile devices belonging to the proximity group. A coping instruction device, characterized in that it is used. A security engine including one or more analyzers that monitor network packets, specify a source and a destination, and output a threat level indicating the degree of security threat, and a network control device that controls the network. A coping instruction method using a coping instruction device connected to a mobile device position information providing device that provides position information of the mobile device,
A mobile device in which a source and a destination of the packet are movable,
The response instruction device includes a threat information recording unit, a response information recording unit, a mobile device search unit, an infection determination unit, a response determination unit, a proximity clustering unit, a mobile device estimation unit, an enlarged proximity clustering unit, and a response transmission unit.
The threat information recording unit, according to the output from the analysis unit, a threat level, a transmission source, a transmission destination, to record the threat information that is information specifying the time,
The handling information recording unit records a plurality of pieces of handling information that is information for identifying a handling method,
The mobile device searching unit uses the mobile device location information provided by the mobile device location information providing device to disconnect the source mobile device identified by the threat information from the network from the time of the threat information. Until transmitting information, a mobile device searching step of specifying a mobile device that has approached within a predetermined range to the source mobile device specified by the threat information,
An infection determining step in which the infection determining unit determines, for each mobile device identified by the mobile device searching unit, a possibility of infection;
A response determining step of selecting response information based on the determination of the infection determining step,
When the proximity clustering unit requires a coping method specified by the coping information selected by the coping determination step, the source mobile device specified by the threat information and the mobile device specified by the mobile device searching step A proximity clustering step in which
The mobile device estimating unit uses the location information of the mobile device provided from the mobile device location information providing device when the coping method specified by the coping information selected by the coping determination step is necessary. A mobile device estimation step of identifying a mobile device that is predicted to approach within the predetermined range within a predetermined time,
An extended proximity clustering step, wherein the extended proximity clustering unit sets the mobile device identified by the mobile device estimation step and mobile devices belonging to the proximity group as an extended proximity group;
A response transmission step of transmitting the response information selected by the response determination step to the network control device.
The handling determining step selects handling information targeting the proximity group or handling information targeting the expanded proximity group as the number of mobile devices that may have been infected determined in the infection determining step increases. Method. The coping instruction method according to claim 4, wherein
The handling determining step selects one or more pieces of the handling information,
The handling instruction method, wherein the handling sending step sends one or more pieces of the handling information to the network control device. The coping instruction method according to claim 4 or 5, wherein
The handling information recorded by the handling information recording unit includes handling information to be transmitted to the mobile device identified by the mobile device estimation step as a blacklist of information identifying mobile devices belonging to the proximity group. A coping instruction method characterized in that it is performed.   A response instruction program for causing a computer to function as the response instruction device according to any one of claims 1 to 3.

Images