JP6715751B2 - Communication monitoring device, communication monitoring method, and communication monitoring program - Google Patents

Description

The present invention relates to a communication monitoring device, a communication monitoring method, and a communication monitoring program that detect an attack due to mass communication.

Conventionally, a DDoS (Distributed Denial of Service) attack in which a large number of communication packets are transmitted from a plurality of terminals to interfere with a service has been a problem. In order to detect and deal with such attacks, a monitoring device is installed in a router on the network, and if the communication volume is extremely large, it is judged as an attack and the communication causing the problem is discarded. The method is taken.

Such a monitoring device monitors the flow information called NetFlow or sFlow, which is the header information of the IP packet, to determine the attack (for example, see Non-Patent Documents 1 and 2).
Further, the following judgment conditions are used for detecting an attack.
(Condition 1) The amount of communication exceeds a predetermined threshold.
(Condition 2) The traffic volume exceeds the past level.
(Condition 3) An abnormality is found in the protocol included in the communication.
(Condition 4) As a result of analyzing the payload of the packet, there is an abnormality in the application layer.
(Condition 5) An unused IP address called dark IP is the transmission source.
(Condition 6) The transmission source is a predetermined IP address that is considered to be misused by a virus or the like.

Arbor Networks, Arbor SP, Internet <https://www.arbornetworks.com/images/documents/Data%20Sheets/DS_SP_EN.pdf> Genie Networks, Genie ATM, Internet <http://www.genie-networks.com/images/Download_Files/GenieATM_ServiceWhitepaper_v5.6_ENG.pdf>

However, with the conventional monitoring method, it is difficult to improve the detection accuracy while shortening the time from the occurrence of an attack to the detection.
For example, under the above-mentioned Conditions 2 to 6, some degree of erroneous detection occurs, so it is difficult to detect an attack under a single condition, and it is necessary to combine with Condition 1. When Conditions 2 to 6 are used without being combined with Condition 1, it is not possible to efficiently narrow down the candidates of the victim IP address under attack, so the number of candidates expands explosively and the amount of calculation becomes too large.
Further, in the condition 1, if the time from the occurrence of an attack to the detection is shortened, the possibility of extracting an IP address that is not the attack target increases. On the other hand, when waiting until enough communication packets are accumulated in order to improve the accuracy of attack detection, the response speed until detection becomes slow.

An object of the present invention is to provide a communication monitoring device, a communication monitoring method, and a communication monitoring program capable of detecting an attack due to a large amount of communication quickly and with high accuracy.

The communication monitoring apparatus according to the present invention, when the communication amount per unit time for each destination address in the sliding window of the first time reaches a preset threshold value based on the flow information of the communication packet, the destination address As a victim host candidate, and a first filter unit that extracts the destination address as a damage end host candidate when the communication volume falls below the threshold, and after the destination address is extracted as the damage end host candidate. If the second time elapses without being extracted as a damaged host candidate again by the first filter unit, the destination address is determined to be a damaged end host, and the second filter unit is deleted from the damaged host candidate, A storage unit that stores the flow information addressed to a host candidate.

The first filter unit registers the damaged host candidate in a database, the second filter unit deletes the damaged end host from the database, and the storage unit associates with the damaged host candidate in the database. The flow information may be accumulated.

The first filter unit may calculate the communication amount based on flow information obtained by sampling the communication packet.

The communication monitoring method according to the present invention, based on the flow information of the communication packet, when the communication amount per unit time for each destination address in the sliding window of the first time reaches a preset threshold value, the destination address As a victim host candidate, and a first filtering step of extracting the destination address as a damage end host candidate when the communication volume falls below the threshold, and after the destination address is extracted as the damage end host candidate. If the second time elapses without being extracted as a damaged host candidate again in the first filter step, the destination address is determined to be a damage end host, and the second filter step is deleted from the damaged host candidate. The computer executes an accumulation step of accumulating the flow information addressed to the host candidate.

The communication monitoring program according to the present invention, based on the flow information of the communication packet, when the communication amount per unit time for each destination address in the sliding window of the first time reaches a preset threshold value, the destination address As a victim host candidate, and a first filtering step of extracting the destination address as a damage end host candidate when the communication volume falls below the threshold, and after the destination address is extracted as the damage end host candidate. If the second time elapses without being extracted as a damaged host candidate again in the first filter step, the destination address is determined to be a damage end host, and the second filter step is deleted from the damaged host candidate. A computer executes a storage step of storing the flow information addressed to a host candidate.

According to the present invention, an attack due to a large amount of communication can be detected quickly and with high accuracy.

It is a figure which shows the function structure of the communication monitoring apparatus which concerns on embodiment. It is a figure which illustrates operation|movement of the 1st filter part which concerns on embodiment. It is a figure which illustrates operation|movement of the 2nd filter part which concerns on embodiment. It is a flow chart which shows processing of the 1st filter part concerning an embodiment. It is a flow chart which shows processing of the 2nd filter part concerning an embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
FIG. 1 is a diagram showing a functional configuration of a communication monitoring device 1 according to this embodiment.
The communication monitoring device 1 is arranged in a higher-layer router (core router) in the network. The communication monitoring device 1 acquires flow information of communication packets destined for the victim host candidate from the router and stores the flow information. The accumulated information is weighted for each host and output as damaged host information, which is used to detect and deal with damaged hosts.

The communication monitoring device 1 is an information processing device (computer) such as a server device or a personal computer, and includes an input/output device for various data or a communication device in addition to the control unit 10 and the storage unit 20.

The control unit 10 is a unit that controls the entire communication monitoring apparatus 1, and implements various functions in the present embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

The storage unit 20 is a storage area for storing various programs and various data for causing the hardware group to function as the communication monitoring device 1, and may be a ROM, a RAM, a flash memory, a hard disk (HDD), or the like. Specifically, the storage unit 20 stores a communication monitoring program that causes the control unit 10 to execute each function of this embodiment.

The control unit 10 includes a first filter unit 11, a second filter unit 12, a storage unit 13, and an output unit 14. The storage unit 20 also includes a damaged host database (DB) 21.

The first filter unit 11 calculates the communication amount per unit time for each destination IP address in the sliding window of the first time (for example, 20 seconds) based on the flow information of the communication packet. The communication amount is, for example, bps (bit per second) or pps (packet per second).
The flow information may be a summary of header information of communication packets sampled at a predetermined rate.

When the communication amount calculated for each destination IP address reaches a preset threshold value (for example, 70 Mbps), the first filter unit 11 extracts this destination IP address as a damaged host candidate. After that, when the communication volume falls below the threshold value, the first filter unit 11 extracts this destination IP address as a damage end host candidate.
The first filter unit 11 registers the victim host candidate in the victim host database 21. The first filter unit 11 also notifies the second filter unit 12 of the damaged host candidate and the damaged end host candidate. At this time, the first filter unit 11 does not delete the damage end host candidate from the damage host database 21.

FIG. 2 is a diagram illustrating an operation of the first filter unit 11 according to the present embodiment.
In the case of the method (a) of the present embodiment using the sliding window, at the time t1, the communication amount (shaded portion) for the past 20 seconds has not reached the threshold value, but at the time t1+Δt( At Δt<20 seconds), the communication amount for the past 20 seconds has reached the threshold.
Therefore, in the conventional method (b) in which the communication amount is sequentially calculated in each period of 20 seconds, the communication amount (shaded portion) calculated at the time t1+20 seconds reaches the threshold, as compared with the method of the present embodiment. Due to (a), the damaged host candidate is promptly detected.

As described above, the first filter unit 11 uses a sliding window to be monitored while continuously moving a past fixed time (first time) when extracting a destination IP address having a large communication amount. Filters reduce the time from attack occurrence to detection.
In addition, it is desirable that the threshold value of the communication amount for extracting the damaged host candidate is set in accordance with the location in the monitored network having the lowest resistance to the attack.

The second filter unit 12 efficiently excludes those having a low attack probability from candidates of a damaged host to be monitored by a filter based on the concept of LRU (Least Recently Used). That is, in the second filter unit 12, after the destination IP address is extracted as the damage end host candidate, the second time (for example, 1 hour) elapses without being extracted again as the damage host candidate by the first filter unit 11. In this case, this destination IP address is determined as the damage end host and deleted from the damage host database 21.
Further, the second filter unit 12 notifies the storage unit 13 of the damaged host candidate and the damaged end host.

FIG. 3 is a diagram illustrating an operation of the second filter unit 12 according to this embodiment.
In this example, after the victim host candidate is registered at time t2, the same destination IP address is registered as the damage end host candidate at time t3.

If the same destination IP address is not registered as a victim host candidate for one hour after time t3 (a), this destination IP address is determined to be a victim end host at time t4 and deleted from the victim host candidates. To be done.
On the other hand, after the time t3, when the same destination IP address is registered again as a damaged host candidate at time t5 (b), the registration as the damaged end host candidate at time t3 is canceled. After that, when the same destination IP address is registered as a damage end host candidate at time t6, this destination IP address is determined to be a damage end host and deleted from the damage host candidate at time t7 one hour later.

The storage unit 13 extracts flow information having the victim host candidate as the destination IP address, and stores the flow information in the victim host database 21 in association with the victim host candidate until the destination IP address is notified as the victim end host.

The output unit 14 analyzes the characteristics of the communication packet based on the flow information destined for the victim host candidate stored in the victim host database 21 and performs the attack detection process. Then, the output unit 14 periodically (for example, every second) outputs the damaged host information.
At this time, the output unit 14 may set the condition for determining an attack by weighting the attack resistance according to the communication environment for each destination IP address. In the first filter unit 11, the processing load is reduced by a common threshold value and the damaged host candidates are narrowed down, but in the output unit 14, a more accurate determination process is performed.

FIG. 4 is a flowchart showing the process of the first filter unit 11 according to this embodiment.
This process is repeatedly executed each time the flow information is acquired.

In step S1, the first filter unit 11 calculates the amount of communication for each destination IP address within the sliding window.

In step S2, the first filter unit 11 determines whether or not there is a destination IP address that has reached the threshold value (from less than the threshold value to more than the threshold value) in the communication traffic for each destination IP address calculated in step S1. judge. If this determination is YES, the process proceeds to step S3, and if the determination is NO, the process proceeds to step S5.

In step S3, the first filter unit 11 registers the destination IP address whose communication amount has reached the threshold value in the damaged host database 21 as a damaged host candidate.

In step S4, the first filter unit 11 notifies the second filter unit 12 of the damaged host candidates.

In step S5, the first filter unit 11 determines whether or not there is a destination IP address that is below the threshold value (from the threshold value or more to the threshold value or less) in the communication traffic for each destination IP address calculated in step S1. judge. If the determination is YES, the process proceeds to step S6, and if the determination is NO, the process ends.

In step S6, the first filter unit 11 notifies the second filter unit 12 of the destination IP address for which the communication amount has fallen below the threshold value as a damage end host candidate.

FIG. 5 is a flowchart showing the process of the second filter unit 12 according to this embodiment.
This process is repeatedly executed on a regular basis.

In step S11, the second filter unit 12 determines whether the first filter unit 11 has notified the damaged host candidate. If this determination is YES, the process proceeds to step S12, and if the determination is NO, the process proceeds to step S14.

In step S12, the second filter unit 12 resets a second time measurement (step S17) described later.

In step S13, the second filter unit 12 notifies the storage unit 13 of the damaged host candidates.

In step S14, the second filter unit 12 determines whether or not the second time has elapsed after receiving the notification of the damage end host candidate. If this determination is YES, the process proceeds to step S15, and if the determination is NO, the process proceeds to step S16.

In step S15, the second filter unit 12 determines the damage end host candidate whose second time has elapsed in step S14 as a damage end host and notifies the storage unit 13 of the damage end host.

In step S16, the second filter unit 12 determines whether the damage end host candidate is notified from the first filter unit 11. If the determination is YES, the process proceeds to step S17, and if the determination is NO, the process ends.

In step S17, the second filter unit 12 starts counting the second time after being notified as a damage end host candidate for each destination IP address.

According to the present embodiment, the communication monitoring device 1 narrows down the damaged host candidates by the first filter unit 11 using the sliding window, and further detects the damaged end host related to the false detection by the second filter unit 12 using the LRU. Efficient exclusion enables rapid and highly accurate detection of attacks due to mass communication.
In the first filter unit 11, the same destination IP address may be frequently extracted alternately as a damaged host candidate and a damage end host candidate. However, the storage unit is stored until the second filter unit 12 determines that the damage end host. 13 accumulates the flow information, and the detection process is continued.

The communication monitoring device 1 registers the damage host candidate in the damage host database 21, deletes the damage end host from here, and accumulates related flow information.
Therefore, the communication monitoring device 1 can appropriately output the damaged host information from the damaged host database 21 at an arbitrary timing and according to the analysis method and the determination condition according to the environment.

By using the flow information obtained by sampling the communication packets, the communication monitoring device 1 can efficiently process a large number of observed communication packets in the core router of a large-scale network and reduce the processing load.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. In addition, the effects described in the present embodiment are merely enumeration of the most suitable effects produced by the present invention, and the effects according to the present invention are not limited to those described in the present embodiment.

The communication monitoring method by the communication monitoring device 1 is realized by software. When implemented by software, a program forming the software is installed in an information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via the network without being downloaded.

1 Communication Monitoring Device 10 Control Section 11 First Filter Section 12 Second Filter Section 13 Storage Section 14 Output Section 20 Storage Section 21 Damaged Host Database

Claims (5)

Based on the header information of the communication packet, in the sliding window of the first time, when the total communication amount for each destination address has reached a preset threshold, it extracts the destination address as the victim host candidates, the communication A first filter unit for extracting the destination address as a damage end host candidate with the damage host candidate remaining when the total amount falls below the threshold value;
After the destination address is extracted as the damage end host candidate, if the second time elapses without being extracted as the damage host candidate again by the first filter unit, the destination address is determined to be the damage end host, A second filter part to be deleted from the victim host candidates,
A communication monitoring device, comprising: a storage unit that stores the header information addressed to the victim host candidate. The first filter unit registers the victim host candidate in a database,
The second filter unit deletes the damage end host from the database,
The communication monitoring device according to claim 1, wherein the storage unit stores the header information in association with a damaged host candidate in the database. The communication monitoring device according to claim 1, wherein the first filter unit calculates the communication amount based on header information obtained by sampling the communication packet. Based on the header information of the communication packet, in the sliding window of the first time, when the total communication amount for each destination address has reached a preset threshold, it extracts the destination address as the victim host candidates, the communication A first filter step of extracting the destination address as a damage end host candidate while leaving the destination address as a damage host candidate when the total amount falls below the threshold value;
After the destination address is extracted as the damage end host candidate, if the second time passes again without being extracted as the damage host candidate in the first filtering step, the destination address is determined to be the damage end host, and A second filtering step to remove from the victim host candidates,
A communication monitoring method, wherein a computer executes a storage step of storing the header information addressed to the victim host candidate. Based on the header information of the communication packet, in the sliding window of the first time, when the total communication amount for each destination address has reached a preset threshold, it extracts the destination address as the victim host candidates, the communication A first filtering step of extracting the destination address as a candidate for ending the damage , while leaving the destination address as a candidate for the damaged host when the total amount falls below the threshold value;
After the destination address is extracted as the damage end host candidate, if the second time passes again without being extracted as the damage host candidate in the first filtering step, the destination address is determined to be the damage end host, and A second filtering step to remove from the victim host candidates,
A communication monitoring program for causing a computer to execute a storage step of storing the header information destined for the victim host candidate.

Images