JP7104201B2 - Packet relay device and packet relay method - Google Patents

Description

The present invention relates to a packet relay device and a packet relay method, and more particularly to a packet relay device and a packet relay method having a flow statistics function.

Cyber attacks such as DDoS (Distributed Denial of Service) attacks and targeted attacks are becoming more sophisticated and diversified every day, and security risks are increasing.

In order to prevent an attack, it is necessary to analyze the behavior of the communication, detect the communication that is carrying out the attack, and take measures such as blocking, band limiting, and detouring the communication. NetFlow (Non-Patent Document 1) and sFlow (Registered Trademark) (Non-Patent Document 2) are conventional techniques for monitoring flow traffic to analyze communication behavior. Of these, NetFlow identifies the flow from the packet header information of the packets that make up the flow, counts the specified traffic statistics for each flow, and outputs it. The technique of monitoring traffic for each of these flows (flow statistics technique) is a function provided in packet relay devices such as routers and switches.

RFC3954 “Cisco Systems NetFlow Services Export Version 9” RFC3176 “InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks” http://itpro.nikkeibp.co.jp/article/COLUMN/20100412/346977/

In the flow statistics technology such as NetFlow and sFlow described above, the flow is identified by the header information of the packet, and the specified traffic statistics information is output for each flow. However, evolving cyber attacks cannot be analyzed only by the prescribed traffic statistics for each flow, and conventional techniques cannot identify the attacks.

The present invention has been made to solve the above problems, and an object of the present invention is to improve the analysis accuracy and efficiency of evolving cyber attacks.

In order to solve the above problems, in the present invention, as an example, a packet relay device having a packet transmission / reception unit, a packet processing unit that performs packet transfer processing, and a control unit, and relaying packets via a network. The flow is identified based on the information contained in the header of the packet transmitted / received via the packet transmission / reception unit, and it is determined whether or not the packets constituting the identified flow match the predetermined attributes. It has a judgment unit that includes information about the judgment result in the packet header of the judged packet and outputs it, and a statistical processing unit that counts flow statistical information based on the information about the judgment result and the flow identification information. The statistical processing unit is for registration. When a packet that has an entry and a statistical count entry and satisfies the flow condition including the judgment result set in the registration entry is received, the registration process set in the statistical processing judgment entry corresponding to the registration entry is performed. When a packet that satisfies the flow condition including the judgment result set in the statistical count entry is newly registered according to the condition of, the flow statistical information is counted in the statistical count entry, and the control unit counts the flow statistical information. , When it is shown that the information about the judgment result of the received packet is the flow to be filtered based on the information about the judgment result of the judged packet and the flow identification information, the flow identification information of the received packet is used. A new registration entry with the conditions determined based on it is registered .

In addition, as an attribute, it is determined whether or not the condition of the attack packet registered in advance is matched.

In addition, conditions for multiple types of attack packets are set in advance, information indicating the type of attack is output as information related to the judgment result, and flow statistical information is counted based on the information indicating the attack type and the flow identification information. It is the one that was made.

Further, as an attribute, the packet discard factor is determined, and as the information regarding the determination result, the information indicating the discard factor is included and output.

According to the present invention, it is possible to improve the analysis accuracy and efficiency of evolving cyber attacks.

It is a figure which shows the structure of the network to which the packet relay device in one Example of this invention is applied. It is a figure which shows the structure of the packet relay device in one Example of this invention. It is a figure which shows the structure of the packet header information in one Example of this invention. It is a figure which shows the structure of the receiving side determination part in one Example of this invention. It is a figure which shows the structure of the Logic attack determination part in one Example of this invention. It is a figure which shows the structure of the filter packet determination part in one Example of this invention. It is a figure which shows the structure of the source spoofing attack determination part and the receiving side packet processing part in one Example of this invention. It is a figure which shows the structure of the flood attack determination part in one Example of this invention. It is a figure which shows the structure of the receiving side statistical processing part in one Example of this invention. It is a figure which shows the structure of the statistical table in one Example of this invention. It is a figure which shows the structural example of the statistical processing judgment table. It is a figure which shows the configuration example of a counter table. It is a figure which shows the structural example of a statistical table. It is a figure which shows the connection relation of the apparatus in the redundant C & C server detection scenario of one Example of this invention. It is a figure which shows the connection relation of the apparatus in the redundant C & C server detection scenario of one Example of this invention. It is a figure which shows the structural example of a statistical table. It is a flowchart of the statistical entry registration process in one Example of this invention. It is a flowchart of the statistical entry deletion processing of the packet reception trigger in one Embodiment of this invention. It is a flowchart of the statistical entry deletion processing of the time-out trigger in one Example of this invention. It is a flowchart of the statistical entry deletion processing of the time-out trigger in one Example of this invention. It is a flowchart of the statistical entry deletion processing of the time-out trigger in one Example of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram showing a network configuration to which a packet relay device according to an embodiment of the present invention is applied.
The packet relay device 100 of this embodiment having a flow statistics function connects the Internet 600 and the LAN 700. Further, the packet relay device 100 of this embodiment is connected to the management terminal 400, and the administrator manages the settings and the like of the packet relay device 100 at the management terminal 400. The packet relay device 100 relays the communication between the Internet 600 and the LAN 700, counts the flow statistical information related to the communication, transmits the counted flow statistical information to the analyzer 500, and analyzes the flow statistical information with the analyzer 500. conduct.

FIG. 2 is a diagram showing a configuration of a packet relay device according to an embodiment of the present invention.
The packet relay device 100 receives the input port 110 for connecting the input line, the packet receiving unit 120 for receiving the packet, the receiving side packet processing unit 130 for performing packet relay processing including the determination of the output port of the received packet, and the received packet. Receiving side judgment unit 140 that performs various judgments, receiving side statistical processing unit 150 that performs receiving side flow statistics processing, packet relay processing means 170 that relays received packets to transmitting side packet processing unit 180, receiving MAC address of transmitted packets Transmission side packet processing unit 180 that performs processing related to packet relay including rewriting of transmission MAC address, transmission side judgment unit 190 that performs various judgments on transmission packets, transmission side statistical processing unit 200 that performs transmission side flow statistics processing, The receiving side packet processing unit 130 and the receiving side determination based on the instructions of the packet transmitting unit 210 for transmitting packets, the output port 220 for connecting the output line, and the management terminal 400 in which the administrator of the packet relay device manages the packet relay device. Unit 140, receiving side statistical processing unit 150, transmitting side packet processing unit 180, transmitting side determination unit 190, sending side statistical processing unit 200, table setting instruction, table read instruction, flow statistical information counted by the packet relay device 100 It is composed of a control CPU 160 that performs transmission to the analyzer 500, communication protocol processing, etc.

The receiving side determination unit 140 determines the attack type of the received packet, determines whether to relay or discard the received packet, and determines the discarding factor when discarding. The transmitting side determination unit 190 determines the attack type of the transmitted packet, determines whether to transfer or discard the transmitted packet, and determines the discarding factor when discarding.

The receiving-side statistical processing unit 150 and the transmitting-side statistical processing unit 200, and the receiving-side determination unit 140 and the transmitting-side determination unit 190 have the same configuration. The control CPU 160 outputs the generated flow statistical information from the output port 221 to which the output line to which the analyzer 500 is connected is connected, and the analyzer 500 analyzes the output flow statistical information.

FIG. 3 is a diagram showing a configuration of packet header information according to an embodiment of the present invention.
In this embodiment, the packet header information 300 handled inside the packet relay device 100 includes L2 information 305, L3 information 306, L4 information 307, L7 information 308, payload 309, which are packet headers of the received packet, and the packet receiver 120. It is composed of input port information 301, output port information 302, packet Byte length 303, and determination result 304 determined and added by the receiving side determination unit 140.

The determination result 304 may be overwritten by the determination result of the transmission side determination unit 190 in the transmission side determination unit 190. The Byte length 303 is specified from the line length indicating the Byte length occupied by the packet in the line including the payload length, the packet length, the frame length, the Preamble, and the Inter Frame Gap. In addition, the Byte length can be defined in any range, such as including or not including the Byte length of Frame Check Sequence. The output port information 302 is determined and added by the receiving side packet processing unit 130. The output port information 302 is an undefined field before the receiving side packet processing unit 130 determines the output port information 302. Typical examples are Ethernet header for L2 information 305, IP header for L3 information 306, TCP header and UDP header for L4 information 307, and http header for L7 information 308, but other protocol headers may be used.

FIG. 4 is a diagram showing a configuration of a receiving side determination unit according to an embodiment of the present invention.
The receiving side determination unit 140 includes a Logic attack determination unit 141, a filter determination unit 142, a source spoofing determination unit 143, a flood attack determination unit 144, and a disposal factor determination unit 145.
The Logic attack determination unit 141 controls the Logic attack table, which is a condition (including a condition related to the Byte length) for determining an attack that utilizes a system vulnerability, in advance when the packet relay device 100 of the present invention is started, and is controlled by the CPU 160 or the administrator. Is registered. Logic attack judgment unit is Logic attack table 14
Received packets that match 10 are judged to be Logic attacks.
In the filter determination unit 142, a filter table in which the conditions of the flow to be filtered (a set of packets determined by the conditions related to the packet header information 300) defined by the administrator of the packet relay device 100 are registered is registered in advance. The filter determination unit 142 determines that the received packet that matches the filter list (also referred to as the filter table) is a filter packet (attack packet registered by the user (administrator)).
The source spoofing determination unit 143 determines that the received packet that the information about the source address of the received packet is spoofed by means such as uRPF (unicast Reverse Path Forwarding) is a source spoofing attack.
In the flood attack determination unit 144, when the flow band exceeds the monitoring band defined by the administrator of the packet relay device 100, or the burst amount of the flow exceeds the allowable burst amount defined by the administrator of the packet relay device 100. If so, it is determined to be a flood attack.
The discard factor determination unit 145 determines whether or not the logic attack determination unit 141, the filter determination unit 142, the source spoofing determination unit 143, and the flood attack determination unit 144 include a disposal factor other than the filter condition determined to be an attack. The discard factor determination unit 145 determines as discard factors such as IP header error, TTL excess, and null discard (as a result of route search, the destination host does not exist). If it does not match the filter conditions to be judged as an attack and each discard factor, it is judged to be normal communication and the packet is passed.

For the received packet determined to match a plurality of attack types or discard factors, the priority determination unit 146 determines one of the plurality of attack types or discard factors in consideration of the priority. For example, if the priority is IP Header Abnormal> Logic Attack> Filter> Source Spoofing> Flood Attack> Null Discard> TTL Exceeded, and the received packet matches Logic Attack, Filter, Source Spoofing, then the priority The determination unit 146 determines that the received packet matches the Logic attack.

FIG. 5 is a diagram showing a configuration of a Logic attack determination unit according to an embodiment of the present invention.
The Logic attack determination unit 141 is configured by a Logic attack table 1410 composed of Logic attack entry 1 1411 to Logic attack entry n 141n in which conditions for determining a Logic attack are set.
When the Logic attack determination unit 141 inputs the packet header information 300, the Logic attack determination unit 141 sequentially compares the information required for the matching determination with the Logic attack entry in the packet header information 300 with the conditions of the Logic attack entry 1 1411 to the Logic attack entry n 141n. do. If there is a Logic attack entry that matches the input packet header information, it is determined that the attack type of the packet having that packet header information is Logic attack.

The conditions of the Logic attack entry include not only the comparison by the condition value but also the logical judgment by the comparison expression and the equal sign expression. For example, when a Land attack is set as a Logic attack, the condition is based on the equal sign of source IP address = destination IP address of L3 information 306. When the Ping of death attack is set as a Logic attack, the comparison formula is that the sum of the fragment offset of L3 information 306 and the Byte length of payload 309 is larger than a certain value. In addition, when setting an Invalid TCP Flags attack as a Logic attack, set an impossible combination of TCP flags as a condition for the Logic attack entry.

If the input packet header information 300 matches the Logic attack entry of the Land attack, the attack type of the packet header information 300 is Logic attack (Land attack). If the input packet header information 300 matches the Logic attack entry of the Ping of death attack, the attack type of the packet header information 300 is Logic attack (Ping of death attack). If the input packet header information 300 matches the Logic attack entry of the TCP Invalid Flags attack, the attack type of the packet header information 300 is Logic attack (TCP Invalid Flags attack).

FIG. 6 is a diagram showing a configuration of a filter packet determination unit according to an embodiment of the present invention.
The filter packet determination unit 142 has a filter table 1420 composed of filter entry 1 1421 to filter entry n 142n in which the determination condition of the filter packet is set. When the packet header information 300 is input, the filter packet determination unit 142 sequentially compares the information required for the match determination with the filter entry in the packet header information 300 with the conditions of the filter entry 1 1421 to the filter entry n 142n. If there is a filter entry that matches the input packet header information 300, it is determined that the packet header information 300 is an attack packet to be filtered. L2 information 305, L3 information 306, L4 information 307, and L7 information 308 of the packet header information 300 are set as the filter entry conditions. The filter entry conditions are instructed by the administrator of the packet relay device 100 from the management terminal 400 and set via the control CPU 160.

FIG. 7 is a diagram showing a configuration of a source spoofing attack determination unit and a receiving side packet processing unit according to an embodiment of the present invention.
The source spoofing attack determination unit 143 has a source route search request unit 1431 and a source spoofing determination unit 1432. The receiving side packet processing unit 130 is configured by a route table 1300 composed of route entries 1 (IP1) 1301 to n (IPn) 130n in which output ports are set for IP addresses 1 to n.

The receiving side packet processing unit 130 usually refers to the route entry corresponding to the destination IP address stored in the L3 information 306 of the packet header information 300, and obtains the information of the output port for this destination IP address. After the processing in the receiving side packet processing unit 130, the packet header information 300 input to the receiving side determination unit 140 is input to the source spoofing attack determination unit 143 for attack determination. The source spoofing attack determination unit 143 first extracts the input port information 301 of the input packet header information 300 and the source IP address of the L3 information 306 in the source route search request unit 1431. The source route search request unit 1431 outputs the extracted source IP address to the receiving side packet processing unit 130. The receiving side packet processing unit 120 refers to the route entry for this source IP address and obtains the information of the output port. The received packet processing unit 120 inputs the obtained output port information to the source spoofing attack determination unit 143. The source spoofing determination unit 1432 of the source spoofing attack determination unit 143 compares the input port information of the packet header information 300 with the output port information obtained by confirming with the received packet processing unit 120. If they do not match, it is determined that the source is spoofed, and the attack type of the packet header information 300 is determined to be a source spoofing attack.

FIG. 8 is a diagram showing a configuration of a flood attack determination unit according to an embodiment of the present invention.
The administrator of the packet relay device 100 sets a monitoring band for each flow defined in advance as a monitoring target. The flood attack determination unit 144 monitors the band for each defined flow, and determines that the attack type of the packet header information 300 of the flow exceeding the monitoring band is a flood attack.

The flood attack determination unit 144 sets the conditions for each flow defined by the administrator of the packet relay device. The flow table 1440 composed of flow entry 1 14401 to flow entry n 1440n, and the monitoring band corresponding to each flow entry. It has a band table 1441 and a band determination unit 1442 composed of band entry 1 14411 to band entry n 1441n including information for determining whether or not the band of each flow exceeds the monitoring band.

When the packet header information 300 is input, the flood attack determination unit 144 sequentially compares the information required for the matching determination with the flow entry in the packet header information 300 and the conditions of the flow entry 1 14401 to the flow entry n 1440n. If the input packet header information matches the flow entry n, the packet header information 300 belongs to the flow entry n and refers to the bandwidth entry n 1440n corresponding to the flow entry n. Information for determining whether the monitoring band and the band of each flow exceed the monitoring band is read from the band entry n 1440n, and whether or not the flow of packet header information 300 exceeds the monitoring band in the band determination unit 1442. Is determined. When the monitoring band is exceeded, the packet with packet header information 300 is determined to be a flood attack.

FIG. 9 is a diagram showing a configuration of a receiving-side statistical processing unit according to an embodiment of the present invention.
The receiving side statistical processing unit 150 has a statistical table 1500, a statistical processing determination table 1501, and a counter table 1502. The statistical table 1500 is a table consisting of n statistical entries 1 15001 to n 1500n for which the conditions of the flow to be counted are set. The statistical processing judgment table 1501 is a table having n statistical processing judgment entries 1 15011 to 1501n for setting statistical entry registration processing and statistical counting processing for each statistical entry. Further, the counter table 1502 is a table composed of n counter entries 1 15021 to counter entries n 1502n having a counter for each statistical entry. The receiving side statistical processing unit 150 is further composed of a timer 1503 and a timeout determination unit 1504.

The statistical processing judgment entry j and the counter entry j correspond to the statistical entry j (j: 1 to n). When the packet header information 300 is input to the receiving side statistical processing unit 150, the information required for the matching determination with the statistical entry in the packet header information is sequentially compared with the conditions of the statistical entry 1 15001 to the statistical entry n 1500n. If there is a matching statistical processing entry j, the corresponding statistical processing judgment entry j is referred to, and processing is performed based on the instruction set in the referenced statistical processing judgment entry j. If a registration instruction is set in the statistical processing judgment entry j, the control CPU 160 is notified of the statistical entry registration process and the packet header information 300. If the judgment result registration instruction is set in the statistical processing judgment entry j, the count target condition including the judgment result is registered as a statistical entry. If a count instruction is set in the statistical processing judgment entry j, the counter of the counter entry j is added.
The details of statistical processing will be described below. The timer 1503 indicates the current time information and is used for determination in the timeout determination unit 1504 or as a part of the information to be written in the counter table 1502.

FIG. 10 is a diagram showing the structure of a statistical table according to an embodiment of the present invention.
The statistics table 1500 consists of statistics entries 1 15001 to statistics entries n 1500n. Statistical entry 15001 is the judgment result 150011, L2 information 150016, L3 information 306 SIP (source IP address) 150012, L3 information 306 DIP (destination IP address) 150013, L4 information 307 SPORT (source port number) 150014. , L4 Information 307 DPORT (destination port number) 150015. It is a feature of the present invention that the statistical entry 15001, which sets the condition of the packet header information to be counted, includes the determination result 15011 added to the packet header information by the receiving side determination unit 140 and the transmitting side determination unit 190. In addition to the determination result, input port information 301, output port information 302, L2 information 305, L3 information 306, L4 information 307, and L7 information 308 may be set as count target conditions. In the example of the statistical table 1500 in FIG. 10, dc (don't care) indicates an arbitrary value.

In the example of the statistical table 1500 of FIG. 10, the statistical entry 15001 and the statistical entry 15002 are statistical entries related to the same flow for L2 information 1, SIP1, DIP1, SPORT1, and DPORT1, but the determination results 150011 are different. The statistical entry 15001 is a statistical entry that counts the flow statistics of packets whose determination result 150011 is source spoofing and which is determined by the source spoofing attack determination unit 143 to be a source spoofing attack packet. The statistical entry 15002 is a statistical entry for counting the flow statistics of packets for which the determination result is normal communication and the normal communication is performed.
As described above, in this embodiment, the L2 information, SIP, DIP, SPORT, and DPORT are the same, and even if the flow is not counted separately in the past, the source spoofing attack and the normal communication flow statistics are distinguished. Can be counted. In the prior art, since the packet header information does not include the determination result and the statistical entry does not include the determination result, it is not possible to distinguish between the source spoofing attack and the normal communication flow statistics.

Further, in the example of the statistical table 1500 of FIG. 10, there are statistical entry 15003 and statistical entry 15004 as statistical entries related to the flow in which the determination result is excessive bandwidth. In addition, statistical entry 15004 and statistical entry 15005 are statistical entries related to the same flow for L2 information 2, SIP3, DIP2, SPORT2, and DPORT2. Statistical entry 15004 is a statistical entry that counts the flow statistics of packets whose determination result is excessive bandwidth and which is determined by the flood attack determination unit 144 to be excessive bandwidth packets. On the other hand, the statistical entry 15005 is a statistical entry that counts the flow statistics of packets for normal communication whose judgment result is normal communication and which is not a flood attack. As described above, in this embodiment, even if the flow is the same, the flow statistics of the flood attack and the normal communication can be counted separately.

Furthermore, statistic entry 15003 is a flow in which only the source IP address is different in SIP2 from the flow of statistic entry 15004 and statistic entry 15005, and in the flow of SIP2, only the statistic entry with no normal communication and the judgment result is overband is counted. ing. In this case, the SIP2 flow determination result is always over-bandwidth, while the SIP3 flow determination result may be over-bandwidth or not over-bandwidth. Comparing the ratio of the count amount with excessive bandwidth (number of packets, number of bytes, etc.) to the count amount without excessive bandwidth for each flow, the flow with a high ratio of the count amount with excessive bandwidth is likely to be a DDoS attack. And the analyzer 500 can analyze.

Further, in the example of the statistical table 1500 of FIG. 10, there are statistical entry 15006, statistical entry 15007, and statistical entry 15008 as statistical entries related to the flow in which the determination result is null discard. Statistics entry 15006, statistics entry 15007, and statistics entry 15008 are the same for L2 information 4, SIP4, DIP4, and SPORT4, and only DPORT is a different flow for DPORT4, DPORT5, and DPORT6. Such a flow can be observed by a scanning activity for searching for a terminal whose port is open as the next infection destination in the malware infection spreading activity. Therefore, if a count of stats entries that are null-discarded and differ only in DPORT, such as stats entry 15006, stats entry 15007, and stats entry 15008, is detected, the SIP of the stats entry may be infected with malware. It can be used as an opportunity for the administrator to take measures such as applying anti-malware tools or strengthening communication monitoring by analyzing with 500.

Further, in the example of the statistical table 1500 of FIG. 10, there is a statistical entry 15009 as a statistical entry related to the flow of L2 information 7, SIP7, DIP7, SPORT7, and DPORT7 whose determination result exceeds TTL. TTL excess is also used by network management tools like traceroute. Therefore, the TTL excess cannot be determined as an attack, but the TTL excess determination result can be explicitly set as the count target condition. The presence or absence of aggression can be analyzed by the analyzer 500 based on the flow statistics of the flow whose judgment result exceeds TTL and the flow statistics of the flow whose judgment result is a discarded packet.

Further, in the example of the statistical table 1500 in FIG. 10, by setting d.c. in the judgment result 150011 as in 1500A, the flow of L2 information 8, SIP8, DIP8, SPORT8, and DPORT8 is a statistical entry regardless of the judgment result. It can be counted at 1500A. If statistical entries are registered for each judgment result, the consumption of statistical entries will increase and the number of flows that can be counted for statistics will decrease. Therefore, the judgment results will not be included in the count target conditions for flows with low analysis priority. By setting, statistical entries can be used efficiently.

Further, in the example of the statistical table 1500 in FIG. 10, there are statistical entries 1500n-2, statistical entries 1500n-1, and statistical entries 1500n as statistical entries for registering statistical entries. The statistical entry for registration is initially set by the administrator of the packet relay device 100 from the management terminal 400. The administrator can also add or change statistical entries for registration from the management terminal 400 during operation. The entry for the statistical count is autonomously registered by the packet relay device 100 as described later.

If the entry for statistical counting is no longer counted after a certain period of time, or in the L4 information 307 of the packet header information 300, if the L4 information is the TCP protocol, the FIN flag indicating the end of communication in TCP is set to 1. When this happens, the control CPU 160 determines that the communication of the relevant flow has ended. The control CPU 160 deletes the statistical entry corresponding to the relevant flow and the statistical processing judgment entry corresponding to the statistical entry, and performs clear processing in which the counter entry corresponding to the statistical entry is set to 0.

Statistics entry 15009 is not registered when the SIP7 flow starts communication. When a packet exceeding SIP7 and TTL is input, the receiving side or transmitting side statistical processing unit determines that the input packet is a flow matching the statistical entry 1500n-2. The receiving side or transmitting side statistical processing unit sets the registration instruction and the determination result registration instruction, which will be described later, for the statistical entry 1500n-2. In the setting example described later, it is possible to register a statistical entry 15009 for a flow having SIP7 and a judgment result exceeding TTL only, and to suppress registration of a statistical entry having SIP7 and a judgment result other than TTL exceeding.

In addition, statistical entry 1500A is not registered when the SIP8 flow starts communication. When a SIP8 packet is input, the receiving or transmitting statistical processing unit determines that the input packet is a flow that matches the statistical entry 1500n-1. The receiving side statistical processing unit or the transmitting side statistical processing unit can register the statistical entry 1500A for any flow as the judgment result for SIP8 by setting the registration instruction described later for the statistical entry 1500n-1. ..

Even if a flow other than SIP7 or SIP8 starts communication, statistics entry 15001 to statistics entry 15008 are not registered at the time of communication start. Entering a packet other than SIP7 or SIP8 matches statistics entry 1500n. By setting the registration instruction and the judgment result registration instruction described later for the statistic entry 1500n, the statistic entry 15001 to the statistic entry 15008 can be registered based on the setting.

FIG. 11 is a diagram showing a configuration example of the statistical processing determination table.
The statistical processing judgment table 1501 is composed of statistical processing judgment entry 1 15011 to statistical processing judgment entry n 1501n. The statistical processing judgment entry is composed of the registration instruction flag 150111, the judgment result registration flag 150112, and the count instruction flag 15011.
When the packet header information of the input packet in the receiving side statistical processing unit 150 matches the condition registered in the statistical entry corresponding to the statistical processing judgment entry, and the registration instruction flag 150111 is 1, the corresponding The statistical entry of is an entry for registration. The receiving-side statistical processing unit 150 instructs the control CPU 160 to register a statistical entry whose flow corresponds to the packet header information 300. The registered address of the statistical entry to be registered is the youngest address among the addresses in which the statistical entry is not registered in the statistical table 1500. If the registration instruction flag 150111 is 0, the statistical entry is not registered.

The determination result registration flag 150112 is valid when the registration instruction flag is 1. Statistical processing If the packet header information 300 matches the statistical entry corresponding to the judgment entry and the judgment result registration flag 150112 is 1, the entry including the judgment result 150011 for the packet header information 300 at the time of entry registration is included. sign up.
The count instruction flag is valid when the registration instruction flag is 0. If the packet header information 300 matches the statistical entry corresponding to the statistical processing judgment entry and the count instruction flag is 1, the relevant statistical entry becomes an entry for statistical counting and corresponds to the statistical processing judgment entry. The counter of the counter entry 15021 of the counter table 1502 is added.
For example, since statistical entry 15001 to statistical entry 1500A are entries for statistical counting, the registration instruction flag is set to 0, the judgment result registration instruction flag is set to 0, and the count instruction flag is set to 1. Since the statistical entry 1500n-2 and the statistical entry 1500n-1 are entries for registration including the judgment result, the registration instruction flag is set to 1, the judgment result registration instruction flag is set to 1, and the count instruction flag is set to 0. Since the statistical entry 1500n is an entry for registration that does not include the judgment result, set the registration instruction flag to 1, the judgment result registration instruction flag to 0, and the count instruction flag to 0.

FIG. 12 is a diagram showing a configuration example of the counter table.
The counter table 1502 is composed of counter entry 1 15021 to counter entry n 1502n. The counter entry consists of a packet counter 150211, a Byte counter 150212, a previous statistics collection time 150213, and a timeout time 150214.

If the packet header information 300 matches the statistical entry and the count instruction flag of the corresponding statistical processing judgment entry is 1, the relevant statistical entry becomes an entry for statistical counting and corresponds to the statistical processing judgment entry. 1 is added to the packet counter 150211 of the counter entry 15021 of the counter table 1502, the Byte length 303 of the packet header information 300 is added to the Byte counter 150212, and the time information indicated by the timer 1503 is written to the previous statistics collection time 150213. .. If the difference between the current time information indicated by timer 1503 and the previous statistics collection time 150213 is larger than the timeout time 150214, it is determined that communication has ended.

Among the processes described above, the flow of processes related to registration and deletion of statistical entries will be described with reference to the flowcharts of FIGS. 17, 18, 19, and 20. Basically, the registration and deletion of statistical entries in the receiving-side statistical processing unit 150 will be described as an example, but the flow of processing for registering and deleting statistical entries in the transmitting-side statistical processing unit 200 is also the same.

FIG. 17 is a flowchart of the statistical entry registration process according to the embodiment of the present invention.
When the packet relay device 100 receives a packet (1701) on the receiving side statistical processing unit 150, the packet relay device 100 searches the statistical table 1500 with the received packet (1702). As a result of the search, it is determined whether or not there is a match entry (1703), and if there is no match entry, the statistical entry for the received packet does not need to be registered (1712), and the processing for registering the statistical entry ends.
If there is a match entry, the statistical judgment processing entry in the statistical processing judgment table 1501 corresponding to the matching entry in the statistical table 1500 is read (1704). It is determined whether or not the registration instruction flag of the read statistical processing judgment entry is 1 (1705), and if the registration instruction flag is not 1, the statistical entry for the received packet does not need to be registered (1712) and the statistical entry is registered. Ends the processing of.
If the registration instruction flag is 1, an entry registration request is sent to the control CPU 160. At this time, the received packet header and the determination result are combined and transmitted (1706).

When the control CPU 160 receives the entry registration request, it searches (1707) a free entry in the statistics table 1500 for registering a statistical entry. At this time, if there are a plurality of free entries in the statistics table 1500, the free entry of the youngest address among the addresses in the statistics table 1500 is searched as a free entry for registration. As a result of the search, it is determined whether or not there is a free entry (1708), and if there is no free entry, it cannot be registered in the statistics table 1500 without a free entry (1713), and the process of registering the statistical entry is terminated.
If there is a free entry, as an entry registration of the statistical processing judgment table 1501, the statistical processing judgment of the registration flag = 0 in the statistical processing judgment entry of the registration processing judgment table 1501 corresponding to the free entry for registration of the statistical table 1500. Register the entry (1709) and finish the process of registering the statistical entry.
Next, as the entry registration of the statistics table 1500, the received packet header and the judgment result are written in the free entry for registration of the statistics table 1500, the statistics entry is registered (1710), and the registration is completed.
(1711).

FIG. 18 is a flowchart of the statistical entry deletion process triggered by packet reception in the embodiment of the present invention.
When the packet relay device 100 receives a packet (1801) by the receiving side statistical processing unit 150, the packet relay device 100 determines whether or not the received packet is a TCP packet and the FIN flag (flag indicating the end of communication) = 1 of the TCP flag (1802). do. If the received packet is a TCP packet and does not meet the condition that the TCP flag FIN flag (flag indicating the end of communication) = 1, it is not necessary to delete (1814) because the communication has not ended, and the process of deleting the statistical entry ends. ..
If the received packet is a TCP packet and the condition of the TCP flag FIN flag (flag indicating the end of communication) = 1 is satisfied, the received packet statistics collection process (1803) is performed.
When the statistics collection process (1803) for received packets is completed, an entry deletion request is sent to the control CPU 160. At this time, the received packet header is transmitted (1804).
Next, set the variable i, which indicates the number of deletions of statistical entries, to 0 (1805).
Next, the control CPU 160 searches for the statistics entry that matches the received packet header (1806) as a search for the deletion entry in the statistics table 1500. As a result of the search, it is determined whether or not a matching entry, that is, a deleted entry to be deleted exists in the statistical table 1500 (1807). If there is no deletion entry, it is determined whether i = 0 or not (1815), and if i = 0, the non-deletion is completed without the deletion entry (1817), and the processing of deleting the statistical entry is completed. do. If i = 0, the deletion is completed (1816) with a deletion entry.
If there is a delete entry in the judgment of the presence or absence of the delete entry in 1807, the control CPU 160 deletes the delete entry in the statistical table 1500 (1808).
Next, the statistical processing judgment entry of the statistical processing judgment table 1501 corresponding to the deletion entry of the statistical table 1500 is read (1809).
Next, the statistical value of the read statistical processing judgment entry is transmitted (1810) to the control CPU 160.
Next, the statistical value received by the control CPU 160 is transmitted (1811) to the analyzer 500.
Next, the control CPU 160 deletes the statistical processing judgment entry of the statistical processing judgment table 1501 corresponding to the deletion entry of the statistical table 1500 (1812) as the entry deletion of the statistical processing judgment table 1501.
Next, 1 is added to i (1813), and 1806 is processed.

19 (a) and 19 (b) are flowcharts of the statistical entry deletion process triggered by the timeout in the embodiment of the present invention.
In the case of a timeout trigger, the packet relay device 100 determines whether or not communication has ended for each statistical processing determination entry at a fixed cycle for each statistical processing determination entry. The timeout time 150214 can be set for each statistical processing determination entry. In this embodiment, since a statistical entry for a specific flow is provided for each judgment result, even if a statistical processing judgment entry for a specific judgment result times out, the statistical processing judgment entry for another judgment result for that flow times out. There is a possibility that communication is continuing. In order to manage as statistics for each flow regardless of the judgment result, it is possible to delete multiple statistical entries with different judgment results for a specific flow at once instead of deleting the entries for each statistical entry prepared for each judgment result. desirable. Therefore, when a certain statistical processing judgment entry determines that a timeout occurs, the timeout of other statistical processing judgment entries that match the flow is determined instead of immediately deleting the statistical processing judgment entry, and the flow matches. When it is determined that all of the statistical processing judgment entries in the above have timed out, the relevant statistical processing judgment entry and all the corresponding statistical entries are deleted.

Next, the details of the statistical entry deletion process triggered by the timeout will be described.
First, the packet relay device 100 sets 0 (1901) in the variable i indicating the entry number of the statistical processing determination entry.
Next, it is determined (1902) whether or not the current time information indicated by the timer 1503 is the time for checking the timeout related to the determination of the end of communication regarding the statistical processing determination entry i (1902). If statistical processing judgment entry 0 is not the time to check the timeout, 1 is added to i (1927) to determine whether i has reached the maximum value n of the statistical processing judgment entry number (1928). do. When i reaches the maximum value n of the statistical processing judgment entry number, it is unnecessary to delete (1929) because all the statistical processing judgment entries are not the check time of the timeout, and the processing of deleting the statistical processing entry is terminated. If i does not reach the maximum value n of the statistical processing judgment entry number, the judgment processing of 1902 is performed again. If the statistical processing judgment entry i is not the time when the timeout should be checked, the addition processing of 1927 is performed again and the judgment processing of 1928 is performed.
When the statistical processing judgment entry i is the time when the timeout should be checked, the statistical processing judgment entry i of the statistical processing judgment table 1501 is read (1903).

Next, it is determined whether the difference between the current time information indicated by the timer 1503 and the previous statistics collection time 150213 is larger than the timeout time of the statistical processing determination entry i (1904). If the difference between the current time information indicated by timer 1503 and the previous statistics collection time 150213 is not greater than the timeout time of statistical processing judgment entry i, it is judged that communication has not ended and entry deletion is unnecessary (1929).
If the difference between the current time information indicated by the timer 1503 and the previous statistics collection time 150213 is larger than the timeout time of the statistical processing judgment entry i, the statistical entry i of the statistical table 1500 is read (1905).

Next, set the variable j regarding the number of statistical entries that matches the packet header information set in the statistical entry i in the statistical table 1500 to 0, and set the address ADR (j) of the statistical entry j to ADR (0) for convenience. Set to = -1 (1906).
Next, the address after ADR (j) +1 in the statistics table 1500 is searched (1907) by the setting value of the packet header information of the statistics entry i. When j = 0 is set in the processing of 1906, ADR (0) =-0, so the search target is all addresses after ADR (0) + 1 = 0, that is, all addresses in the statistical table 1500.
If there is a match entry as a result of the search, set ADR (j) = address of the match entry (1909). When j = 0 is set in the processing of 1906, ADR (0) = is set to the address of the matching entry.
Next, 1 is added to j (1910).

Next, ADR (j-1) is substituted for ADR (j). When j = 0 is set in the processing of 1906, the result of the addition processing of 1910 is set to j = 1, and ADR (0), that is, the address of the matching entry of the search result in the previous 1907 is assigned to ADR (1). .. Then, the processing of 1907 is performed again.
As a result of the determination in 1908, if there is no matching entry, the addresses ADR (j) of all matching entries that match the flow of the statistical entry i are found, and it is determined whether or not j = 0 (1912). If j = 0, there is a contradiction that there is no matching statistic entry i including the statistic entry i even if the statistic table 1500 is searched in the packet header information of the statistic entry i, so it ends abnormally (1930). Judge and end the process of deleting statistical entries.
If j = 0, the variable k for determining the timeout for all matching entries is set to 0 (1913).
Next, it is determined whether the difference between the current time information indicated by the timer 1503 and the previous statistical collection time 150213 of the statistical processing judgment entry k is larger than the timeout time of the statistical processing judgment entry i (1914). It is determined that the entry deletion is unnecessary (1931), and the processing for deleting the statistical entry is terminated.
If the difference between the current time information indicated by timer 1503 and the previous statistics collection time 150213 of the statistical processing judgment entry k is larger than the timeout time of the statistical processing judgment entry i, 1 is added to k (1915).

Next, it is determined whether or not k is equal to j + 1 (1916), and if it is not equal, the timeout determination of all matching entries has not been completed, so the determination process of 1914 is performed again.
If k is equal to j + 1, it means that the timeout determination of all matching entries has been completed and all matching entries have been determined to be timeouts. Therefore, all matching entries are deleted. Set the variable m to 0 (1917).
Next, a request to delete the statistical entry m (address ADR (m)) is sent (1918) to the control CPU 160.
The control CPU 160 then deletes (1919) the statistic entry m in the statistic table 1500.
Next, the statistical processing judgment entry m in the statistical processing judgment table 1501 is read (1920).
Next, the statistical value of the read statistical processing judgment entry m is transmitted (1921) to the control CPU 160.
Next, the statistical value of the statistical entry m received by the control CPU 160 is transmitted (1922) to the analyzer 500.
Next, the control CPU 160 deletes (1923) the statistical processing judgment entry m in the statistical processing judgment table 1501.
Next, 1 is added to m (1924).
Next, it is determined whether or not m = j + 1 (1925).
If m = j + 1, it means that the deletion of all matching entries has not been completed, so 1918 is processed again.
When m = j + 1, since the deletion of all matching entries is completed, it is determined that the deletion is completed (1926), and the processing of deleting the statistical entry is terminated.

FIG. 20 is a flowchart of the statistical entry deletion process triggered by the timeout in the embodiment of the present invention.
The statistical entry deletion process shown in FIG. 20 is a simplified version of the statistical entry deletion process shown in FIG. In the simplified version of the flowchart, the presence or absence of communication termination is time-out determined at a fixed cycle for each statistical processing determination entry. If the result of the judgment results in a timeout, the statistical processing judgment entry is deleted. There is a possibility that the statistical processing judgment entry related to another judgment result for the same flow as the deleted statistical processing entry does not time out and communication continues, but in the deletion processing of FIG. 20, the statistical entry for each flow is managed. By managing the statistical entries for each judgment result, the deletion process of the statistical entries is simplified.

The details of the statistical entry deletion process of the timeout trigger of FIG. 20 will be described with reference to the flowchart.
First, 0 is set in the variable i indicating the entry number of the statistical processing judgment entry (2001).
Next, it is determined whether or not the current time information indicated by the timer 1503 is the time for checking the timeout related to the determination of the end of communication regarding the statistical processing determination entry i (2002). If statistical processing judgment entry 0 is not the time to check the timeout, 1 is added to i (2012) to determine whether i has reached the maximum value n of the statistical processing judgment entry number (2013). do. When i reaches the maximum value n of the statistical processing judgment entry number, it is not necessary to delete the statistical processing judgment entry because it is not the check time of the timeout of all the statistical processing judgment entries (2014), and the processing of deleting the statistical processing judgment is terminated. If i does not reach the maximum value n of the statistical processing judgment entry number, the judgment processing of 2002 is performed again. If the statistical processing judgment entry i is not the time when the timeout should be checked, the addition processing of 2012 is performed again and the judgment processing of 2013 is performed.
When the statistical processing judgment entry i is the time when the timeout should be checked, the statistical processing judgment entry i of the statistical processing judgment table 1501 is read (2003).
Next, it is determined whether the difference between the current time information indicated by the timer 1503 and the previous statistics collection time 150213 is larger than the timeout time of the statistical processing determination entry i (2004). If the difference between the current time information indicated by timer 1503 and the previous statistics collection time 150213 is not greater than the timeout time of statistical processing judgment entry i, it is judged that communication has not ended and entry deletion is unnecessary (2014).

The difference between the current time information indicated by timer 1503 and the previous statistics collection time 150213 is the statistical processing judgment entry.
If it is greater than the timeout period of i, it sends an entry deletion request to the control CPU 160, that is, a request to delete the statistics entry in the statistics table 1500 (2005).
The control CPU 160 then deletes the statistics entry i in the statistics table 1500 (2006).
Next, the statistical processing judgment entry i of the statistical processing judgment table 1501 is read (2007).
Next, the read statistical value of the statistical processing judgment entry i is transmitted to the control CPU 160 (2008).
Next, the statistical value received by the control CPU 160 is transmitted to the analyzer 500 (2009).
Next, the control CPU 160 deletes the statistical processing judgment entry i (2010).
Next, it is determined that the deletion is completed (2011), and the processing for deleting the statistical entry is terminated.

According to the packet relay device 100 of the present invention described above, the following problems in attack analysis of flow statistics can be solved.

In order to reduce the load on the analyzer, consider a case where it is desired to count only the flow in which the judgment result of the packet relay device 100 is an attack. Since it is not possible to determine whether or not an attack is based only on the packet header information 300, the determination result of the packet relay device 100 is an attack in the conventional flow statistical technique that counts based on the packet header information 300. Only the flow could not be registered as a statistic entry. Therefore, since the flow that does not need to be the target of the statistical count is also registered as the statistical entry, there is a problem that the resources of the statistical table, the statistical processing judgment table, and the counter table are consumed, which is inefficient. According to the packet relay device 100 of the present embodiment, only the flow in which the determination result of the packet relay device 100 is an attack can be registered as a statistical entry, so that the above-mentioned problem can be solved.

In addition, when attack communication and normal communication are being performed at the same time and the flow statistics entries of the packet relay device 100 are likely to be exhausted, it is necessary to analyze the attack communication statistics as a priority count target. Since the conventional flow statistics technique that counts based on the packet header information cannot distinguish between the statistics on attack communication and the statistics on normal communication, there is a problem that the statistics cannot be preferentially counted for attack communication. According to the packet relay device 100 of this embodiment, the statistics related to attack communication and the statistics related to normal communication can be registered separately according to the determination result. Therefore, for example, in the statistical table 1500, the address space for statistical entries related to attack communication is normally set. By ensuring that the address space is wider than the address space for statistical entries related to communication by default, attack communication can be counted with priority over normal communication. Alternatively, if the unused address space of the statistics table 1500 falls below a certain level, the control CPU 160 may not accept registration of normal communication, or the registration instruction flag of the statistics entry for normal communication may be rewritten to 0. , Attack communication can be counted with priority over normal communication.

In addition, in the conventional flow statistics technique that counts based on the packet header information 300 against the source spoofing attack that spoofes the source information of the communication and attacks, the statistics on the spoofed attack and the statistics of normal communication are collected. Since it cannot be counted separately, there is a problem that it is not possible to provide flow statistics regarding spoofed attacks. Especially for spoofed packets, the source IP address indicates the target IP address of the attack and the destination IP address indicates the IP address used for the attack, so by providing flow statistics on the spoofed attack, the details of the attack Analysis is possible. According to the packet relay device 100 of the present embodiment, since the flow statistics whose determination result is the source spoofing attack can be provided, detailed analysis of the above-mentioned attack becomes possible.

In addition, a flood attack type DDoS attack that interferes with the service continuation of the target by sending a large number of packets to the target from a large number of attack sources or continuously communicating for a long period of time requires that the bandwidth is excessive. It is necessary to count and analyze the flow statistics in. In the conventional flow statistics technique that counts based on the packet header information 300, the flow statistics are counted regardless of the band, so the band or burst amount for each flow is analyzed from the Byte counter for each statistical entry and the time information for which the statistics were collected. It was necessary to calculate at 500 and then analyze the flow with excessive bandwidth or burst amount. Originally, there was a problem that a calculation load was applied to a flow having a band or a small burst amount that did not need to be calculated by the analyzer 500. According to the packet relay device 100 of this embodiment, the flood attack determination unit 144 of the packet relay device 100 can register only the flow statistics whose determination result is an excessive band or burst amount and count them. It is not necessary to calculate the band or burst amount for each flow with the analyzer 500, and the calculation load of the analyzer 500 can be reduced.

In addition, it is sufficient to count normal communication under the count target condition of 5 tuple, but when you want to count under more count target conditions for attack communication for detailed analysis, the conventional flow statistical technique that counts based on the packet header information. In, the number of count target conditions could not be increased or decreased based on the judgment result such as the presence or absence of an attack. According to the packet relay device 100 of this embodiment, as shown in the configuration diagram of the statistical table 1500 in FIG. 13, the determination result 150010 is SIP150011, DIP150012, PRT (L4 protocol number) 150015, SPORT150013 in the statistical entry 15002 of normal communication. , DPORT150014 5tuple is the count target condition, and the judgment result 150010 is SIP150011, DIP150012, PRT150015, SPORT150013, DPORT150014, L2 information 150016, L3 information other than SIP / DIP / PRT 150017 , L4 information 150018 other than SPORT / DPORT can be used as the counting target condition. As a result, the statistical entries of attack communication are counted under more detailed counting target conditions to enable detailed statistical analysis. Since the number of statistical entries to be registered increases as the count target condition increases, the number of consumption entries of the statistical entry should be minimized by limiting the number of statistical entries for normal communication to the minimum required 5 tuple count target condition. Can be done.

Next, an example of application to detection of a redundant C & C server (command and control server) (Non-Patent Document 3) using the packet relay device 100 of the present invention will be described.

FIG. 14 is a diagram showing a connection relationship of devices in a redundant C & C server detection scenario according to an embodiment of the present invention.
In the example shown in FIG. 14, the configuration in which the malware-infected terminal 200 connects to the C & C server 1 900 via the packet relay device 100 of this embodiment is shown.
It is assumed that the IP address DIP1 of the C & C server 1 is known as information obtained from the outside, and the administrator of the packet relay device 100 registers it as DIP1 in the DIP of the filter entry 1421 of the filter table 1420 of the packet relay device 100 by default. do. Since DIP1 is a destination IP address with known security characteristics of C & C server 1, the SIP of the statistical entry generated with DIP1 as the counting target condition is used as the filter entry in order to automatically block the terminal that communicated with DIP1. You can set up a scenario such as adding in advance. Therefore, when the packet header information 300 matches the filter entry 1421, the determination result is a filter (C & C), and the factor of the filter determination result is coded so that the filter factor of C & C server communication can be determined.

As shown in FIG. 16, in the statistics table 1500, the administrator of the packet relay device 100 sets the statistics entry 150026 for registration by default. Statistical entry 150026 is a count target condition in which arbitrary packet header information 300 whose determination result 150011 is a filter (C & C) matches. As a typical behavior of the infected terminal, the malware-infected terminal 200 notifies the C & C server 1 900 that it has been infected, and sends a callback communication to the C & C server 1 900 to prompt the C & C server 1 900 to issue an instruction. Execute against. Then, since the callback communication is DIP = DIP1, it matches the filter entry 1421, and the determination result in the receiving side / transmitting side determination unit of the packet relay device of this embodiment is the filter (C & C). Therefore, the communication is filtered and matches statistical entry 150026 for registration, so that the control CPU 160 registers statistical entry 150027 for statistical counting. At this time, the IP address of the infected terminal is set to SIP1, and SIP1 is set in SIP150011 of the statistic entry 150027 for statistic counting. The counter of the statistic entry 150027 for the statistic count registered based on the statistic entry 150026 for registration analyzes what kind of communication was attempted from which IP address to the C & C server 1 900 with what protocol. Can be output to and analyzed.

Further, when the control CPU 160 executes the registration process based on the statistical entry 150026 for registration, if the determination result of the packet header information 300 is a filter (C & C), the control CPU 160 is SIP1 of the packet header information 300. Register entry 150028 with SIP in the statistics table 1500. This is a registration entry for registering a statistical entry for monitoring communication originating from SIP1 because it was determined that SIP1 was infected with malware because it tried to perform C & C server communication. In the case of a redundant C & C server as described in Non-Patent Document 3, when communication with the C & C server 1 900 is blocked by a filter, the infected terminal 800 infected with malware is redundant as shown in FIG. Attempt callback communication with an alternative C & C server 2 1000. Then, since the callback communication corresponds to the statistical entry 150028 for registration, the control CPU 160 registers the statistical entry 150029 for the statistical count. The DIP of statistic entry 150029 is the IP address DIP2 of C & C Server 2 1000. Communication with a host with a DIP2 IP address because the destination IP addresses of the infected terminal 800 after being blocked by the filter (C & C) are not necessarily alternative C & C servers that are all redundant, but are subject to suspicion. If the administrator of the packet relay device 100 determines that it is a C & C server as a result, the administrator registers a filter entry with DIP2 as the destination IP address in the filter table 1420, and the relevant filter entry. Set the judgment result of as a filter (C & C).

In addition to those described in the claims, the following are typical examples from the viewpoint of the present invention.
(1) A packet relay device that has a packet transmission / reception unit, a packet processing unit that performs packet transfer processing, and a control unit, and relays packets via a network.
The flow is identified based on the information included in the header of the packet transmitted / received via the packet transmission / reception unit, and it is determined whether or not the packets constituting the identified flow match the predetermined attributes, and the determination is made. A packet relay device comprising: a determination unit that includes information on a determination result in a packet header of a packet and outputs the information, and a statistical processing unit that counts flow statistical information based on the information on the determination result and the flow identification information.
(2) The packet relay device according to (1) above, wherein, as the attribute, it is determined whether or not the condition of the attack packet registered in advance is matched.
(3) The packet relay device according to (2) above, in which conditions for a plurality of types of attack packets are set in advance, and information indicating the type of attack is output as information regarding the determination result. A packet relay device characterized in that flow statistical information is counted based on information indicating an attack type and flow identification information.
(4) The packet relay device according to (2) above, which determines the packet discard factor as the attribute, and outputs the information related to the determination result including the information indicating the discard factor. A featured packet relay device.
(5) The packet relay device according to (1) above, wherein the statistical processing unit has a registration entry, a registration processing determination entry, and a counter entry, and includes a determination result registered in the registration entry. A packet relay device characterized in that when a packet satisfying a flow condition is received, a registration entry is set and flow statistical information is counted according to the registration processing and counting conditions set in the registration processing determination entry.
(6) In the packet relay device according to (1) above, when the statistical processing unit counts the flow statistical information based on the flow identification information, the flow statistics are obtained for a plurality of determination results for the common flow identification information. A packet relay device characterized by counting information.
(7) A method of relaying packets between networks, in which the flow is identified based on the information contained in the headers of the packets to be sent and received, and whether or not the packets constituting the identified flow match the predetermined attributes. The packet relay method is characterized in that the determination is performed, information on the determination result is included in the packet header of the determined packet, and the flow statistical information is counted based on the information on the determination result and the flow identification information.
(8) The packet relay method according to (7) above, wherein, as the attribute, it is determined whether or not the condition of the attack packet registered in advance is matched.
(9) The packet relay method according to (8) above, in which conditions for a plurality of types of attack packets are set in advance, and information indicating the type of attack is output as information regarding the determination result. A packet relay method characterized in that flow statistical information is counted based on information indicating an attack type and flow identification information.
(10) In the packet relay method according to (8) above, the packet discard factor is determined as the attribute, and the information indicating the discard factor is output as the information regarding the determination result. A featured packet relay method.
(11) In the packet relay method according to (7) above, the relay process is controlled based on the result of analyzing a plurality of flow statistical information having different information on the determination result for the flow identified based on the flow identification information. Packet relay method.

100 packet relay device
110 input port
120 packet receiver
130 Receiving packet processing unit
140 Receiving side judgment unit
141 Logic Attack Judgment Unit
142 Filter packet judgment unit
143 Source spoofing attack judgment unit
144 Flood Attack Judgment Department
145 Disposal factor judgment unit
150 Receiving side statistical processing unit
160 control CPU
170 Packet relay processing means
180 Transmitter packet processing unit
190 Sender judgment unit
200 Sender statistical processing unit
210 Packet transmitter
220 output port
400 management terminal
500 analyzer

Claims (10)

It is a packet relay device that has a packet transmission / reception unit, a packet processing unit that performs packet transfer processing, and a control unit, and relays packets via a network.
The flow is identified based on the information included in the header of the packet transmitted / received via the packet transmission / reception unit, and it is determined whether or not the packets constituting the identified flow match the predetermined attributes, and the determination is made. It has a judgment unit that includes information about the judgment result in the packet header of the packet and outputs it, and a statistical processing unit that counts the flow statistical information based on the information about the judgment result and the flow identification information.
The statistical processing unit has a registration entry and a statistical count entry, and when it receives a packet satisfying the flow condition including the determination result set in the registration entry, the statistical processing determination corresponding to the registration entry is received. When a statistic count entry is newly registered according to the conditions for performing the registration process set in the entry and a packet satisfying the flow condition including the determination result set in the statistic count entry is received, the statistic count entry is received. Count the flow stats in the entry and
When the control unit indicates that the information regarding the determination result of the received packet is a flow to be filtered based on the information regarding the determination result of the determined packet and the flow identification information, the reception unit A packet relay device characterized by newly registering a registration entry in which conditions determined based on the flow identification information of the packet are set . The packet relay device according to claim 1, wherein, as the attribute, it is determined whether or not the condition of the attack packet registered in advance is matched. The packet relay device according to claim 2, in which conditions for a plurality of types of attack packets are set in advance, information indicating the type of the attack is output as information regarding the determination result, and the attack type is indicated. A packet relay device characterized by counting flow statistical information based on information and flow identification information. The packet relay device according to claim 2, wherein a packet discarding factor is determined as the attribute, and information indicating the discarding factor is output as information regarding the determination result. Relay device. The packet relay device according to claim 1, when the statistical processing unit counts the flow statistical information based on the flow identification information, the flow statistical information is counted for a plurality of determination results for the common flow identification information. A packet relay device characterized in that. It is a method of relaying packets between networks, and identifies the flow based on the information contained in the header of the packets to be sent and received, and determines whether or not the packets constituting the identified flow match the predetermined attributes. Then, the packet header of the determined packet is output including the information on the determination result, and the packet satisfying the flow condition including the determination result set in the registration entry is received based on the information on the determination result and the flow identification information. Then, according to the conditions for performing the registration process set in the statistical processing judgment entry corresponding to the registration entry, the statistical count entry is newly registered, and the flow including the judgment result set in the statistical count entry is included. When a packet satisfying the condition is received, the flow statistical information is counted in the statistical count entry, and the information regarding the determination result of the received packet is obtained based on the information regarding the determination result of the determined packet and the flow identification information. A packet relay method comprising newly registering a registration entry in which conditions determined based on the flow identification information of the received packet are set when it is indicated that the flow should be filtered. The packet relay method according to claim 6, wherein as the attribute, it is determined whether or not the condition of the attack packet registered in advance is matched. The packet relay method according to claim 7, in which conditions for a plurality of types of attack packets are set in advance, information indicating the type of attack is output as information regarding the determination result, and the attack type is indicated. A packet relay method characterized by counting flow statistics based on information and flow identification information. The packet relay method according to claim 7, wherein a packet discarding factor is determined as the attribute, and information indicating the discarding factor is output as information regarding the determination result. Relay method. The packet relay method according to claim 6, wherein when counting the flow statistical information based on the flow identification information, the flow statistical information is counted for a plurality of determination results for the common flow identification information. Relay method.

Images