JP7166969B2 - Router attack detection device, router attack detection program, and router attack detection method - Google Patents

Description

The present invention relates to a router attack detection device, a router attack detection program, and a router attack detection method.

If a vulnerability is disclosed in a router connected to the Internet, it will be attacked from the outside until the vulnerability countermeasure is implemented on that router, and events such as denial of service (DoS), hang-up, and arbitrary code execution will occur. there is a risk of it happening.
Against such risks, security devices such as IDS/IPS that exist between routers and the Internet can partially defend against attacks. Attack detection methods in IDS/IPS include an anomaly type and a signature type (for example, Patent Document 1).

The anomaly type analyzes traffic and detects statistically abnormal packets as attacks, so it is possible to detect attacks with unknown patterns. There is a possibility of "false positives" that the communication is judged as an attack.

The signature type can detect attacks with high accuracy by matching pre-registered patterns with packets. However, new attacks cannot be detected unless a pattern is created by the administrator, and it may take time to create such an attack, and the administrator may not be able to create the pattern due to lack of information.

Therefore, there are cases where attacks cannot be prevented by anomaly-type and signature-type countermeasures from the vulnerability announcement to the implementation of countermeasures on routers.

JP 2018-121262 A

SUMMARY OF THE INVENTION It is an object of the present invention to provide a router attack detection device that prevents attacks on a router from the announcement of the router's vulnerability until the router implements vulnerability countermeasures.

The router attack detection device of this invention is
A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. an attack event determination unit that
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router an attack packet determination unit that determines a candidate packet to be the attack packet based on the timing;
a signature creation unit that creates a signature specifying whether the packet input to the router is the attack packet, using packet information of the candidate packet determined to be the attack packet.

The attack packet determining unit, as the candidate packet,
Packets stored in the packet storage device for a certain period of time determined from the determination time when it is determined that the attack event exists in the first operation log are retrieved.

The attack packet determination unit,
By comparing the packet information of the whitelist in which the packet information of the safe secure packet is described with the packet information of the candidate packet, the candidate packet that is the secure packet is determined, and the candidate packet is determined as the secure packet. excluding the candidate packet from input to the alternate router.

The attack packet determination unit,
Using attack packet prediction information that describes information for predicting the possibility of being an attack packet, the probability that the candidate packet is the attack packet is determined, and the candidate packet is sent to the alternative router in descending order of probability that it is the attack packet. , input said candidate packet.

The signature creation unit
As the signature, a common item signature having items common to the attack packet and the determined plurality of candidate packets is created.

The router attack detection program of this invention comprises:
to the computer,
A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. an attack event determination process to
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router an attack packet determination process for determining a candidate packet to be the attack packet based on the timing;
and signature creation processing for creating a signature specifying whether the packet input to the router is the attack packet using packet information of the candidate packet determined to be the attack packet.

The router attack detection method of the present invention comprises:
the computer
A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. death,
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router determining a candidate packet to be the attack packet based on the timing;
Using the packet information of the candidate packet determined to be the attack packet, a signature for identifying whether the packet input to the router is the attack packet is generated.

ADVANTAGE OF THE INVENTION According to this invention, the router attack detection apparatus which prevents an attack to a router from vulnerability countermeasures being implemented by a router after vulnerability countermeasures are implemented by a router can be provided.

FIG. 2 is a diagram of the first embodiment, and is a functional block diagram of the router attack detection device 100; FIG. 2 is a diagram of the first embodiment, showing the hardware configuration of the router attack detection device 100; 4 is a diagram of the first embodiment and is a flow chart for explaining the operation of the router attack detection device 100. FIG. 4 is a diagram of the first embodiment, showing stored packet information 11a stored in a temporary packet storage DB 11; FIG. 4 is a diagram of the first embodiment, showing saved log information 12a temporarily saved in a log saving DB 12; FIG. Fig. 4 is a diagram of the first embodiment, showing a whitelist 13a stored in a whitelist DB 13; Fig. 10 is a diagram of the first embodiment, showing vulnerability information 140A stored in a vulnerability information DB 14; Fig. 10 is a diagram of the first embodiment, showing an actual event occurrence notification 21a; FIG. 4 is a diagram of the first embodiment, showing signature information 15a stored in a signature DB 15; FIG. 10 is a flowchart showing an operation of extracting an attack packet 701 by an attack packet extraction unit 22 in the diagram of the first embodiment; FIG. FIG. 11 is a flowchart of the continuation of the operation of extracting the attack packet 701 by the attack packet extraction unit 22 in the diagram of the first embodiment; FIG.

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. In each figure, the same reference numerals are given to the same or corresponding parts. In the description of the embodiments, the description of the same or corresponding parts will be omitted or simplified as appropriate.

Embodiment 1.
*** Configuration description ***
A router attack detection device 100 according to the first embodiment will be described with reference to FIGS. 1 to 11. FIG.
FIG. 1 shows functional blocks of a router attack detection device 100. As shown in FIG. Also, FIG. 1 shows an outline of a system in which the router attack detection device 100 is used. Router attack detection device 100 is connected to Internet 600 . A packet is input to the router 300 from the Internet 600 . Router attack detection device 100 is connected between Internet 600 and router 300 . A switch 210 is connected between the router 300 and the router attack detection device 100 . A switch 220 is connected between the internal IP network 500 and the router 300 .

Attacker 400 transmits attack packet 701 to router 300 via Internet 600 in order to attack router 300 . An attack packet 701 is a processed packet that exploits router vulnerability.

FIG. 1 assumes the following.
(1) Attacker 400
(1.1) The attacker 400 grasps the target of attack (IP address) and inherent vulnerabilities by some means.
(1.2) The attacker 400 repeats attacks exploiting the same vulnerability in order to damage the attack target, and has the purpose of making the target service unusable by normal users.
(1.3) Attacker 400 uses known vulnerabilities not addressed in router 300 in attacks. There is a limit to the number of attack source devices (IP addresses) that can be manipulated by the attacker 400, and therefore there is a limit to variations in attack source IP addresses.
(2) Target of attack (service provider to be attacked)
(2.1) It is assumed that the IP address of the connection source cannot be narrowed down.
(2.2) Even if there is a known vulnerability, it is assumed that the environment is such that it is not possible to immediately upgrade the software version.
(3) Target attacks that have effects in a short period of time, such as a few minutes.

The router attack detection device 100 includes a packet storage DB 11, a log storage DB 12, a whitelist DB 13, a vulnerability information DB 14, a signature DB 15, an event occurrence determination unit 21, an attack packet extraction unit 22, a virtual router 23, and a signature creation unit 24. there is Virtual router 23 is an alternate router. Although it is assumed that the virtual router 23 is implemented by software, actual hardware may be used. Note that DB indicates a database. These functions are described later. The event occurrence determination unit 21 is an attack event determination unit. The attack packet extraction unit 22 is an attack packet determination unit. The packet storage DB 11 is a packet storage device.

FIG. 2 shows the hardware configuration of the router attack detection device 100. As shown in FIG. The router attack detection device 100 is a computer. The router attack detection device 100 includes a processor 110 as well as other hardware such as a main storage device 120, an auxiliary storage device 130, an input IF 140, an output IF 150 and a communication IF 160. Note that IF indicates an interface. Processor 110 is connected to and controls other hardware via signal lines 170 .

The router attack detection device 100 includes an event occurrence determination unit 21, an attack packet extraction unit 22, a virtual router 23, and a signature creation unit 24 as functional elements. The virtual router 23 is a virtual router realized by software. The functions of the event occurrence determination unit 21 , the attack packet extraction unit 22 , the virtual router 23 and the signature creation unit 24 are implemented by the router attack detection program 101 .

Processor 110 is a device that executes router attack detection program 101 . The router attack detection program 101 is a program that implements the functions of the event occurrence determination unit 21 , attack packet extraction unit 22 , virtual router 23 and signature creation unit 24 . The processor 110 is an IC (Integrated Circuit) that performs arithmetic processing. Specific examples of the processor 110 are a CPU (Central Processing Unit), a DSP (Digital Signal Processor), and a GPU (Graphics Processing Unit).

The main memory device 120 is a storage device. Specific examples of the main memory device 120 are SRAM (Static Random Access Memory) and DRAM (Dynamic Random Access Memory). The main memory device 120 holds the computation results of the processor 110 .

The auxiliary storage device 130 is a storage device that stores data in a non-volatile manner. A specific example of the auxiliary storage device 130 is an HDD (Hard Disk Drive). The auxiliary storage device 130 is a portable recording medium such as an SD (registered trademark) (Secure Digital) memory card, a NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, and a DVD (Digital Versatile Disk). There may be.
Auxiliary storage device 130 stores router attack detection program 101, packet storage DB 11, log storage DB 12, whitelist DB 13, vulnerability information DB 14, and signature DB 15. FIG. Data such as the router attack detection program 101, the packet storage DB 11, the log storage DB 12, the whitelist DB 13, the vulnerability information DB 14, and the signature DB 15 are stored in another device such as a cloud server, and can be used for router attack detection. The device 100 may obtain from other devices.

The input IF 140 is a port to which various devices are connected and data is input from the various devices. The output IF 150 is a port to which various devices are connected and data is output from the processor 110 to the various devices. Communication IF 160 is a communication port for the processor to communicate with other devices.

The processor 110 loads the router attack detection program 101 from the auxiliary storage device 130 to the main storage device 120, reads the router attack detection program 101 from the main storage device 120, and executes it. The main storage device 120 stores not only the router attack detection program 101 but also an OS (Operating System). The processor 110 executes the router attack detection program 101 while executing the OS. The router attack detection device 100 may include multiple processors that substitute for the processor 110 . These multiple processors share the execution of the router attack detection program 101 . Each processor, like the processor 110, is a device that executes the router attack detection program 101. FIG. Data, information, signal values and variable values used, processed or output by the router attack detection program 101 are stored in the main memory 120, the auxiliary memory 130, or the registers or cache memory within the processor 110. FIG.

The router attack detection program 101 divides the “parts” and “virtual routers” of the event occurrence determination unit 21, the attack packet extraction unit 22, the virtual router 23, and the signature creation unit 24 into “processing,” “procedure,” or “process.” It is a program that causes a computer to execute each processing, each procedure, or each step that has been read.

Also, the router attack detection program 101 is a method performed by the router attack detection device 100, which is a computer, executing the router attack detection program 101. FIG. The router attack detection program 101 may be stored in a computer-readable recording medium and provided, or may be provided as a program product.

***Description of operation***
FIG. 3 is a flowchart for explaining the operation of the router attack detection device 100. As shown in FIG. The operation of the router attack detection device 100 will be described with reference to FIG. The operation of the router attack detection device 100 corresponds to the router attack detection method. The operation of the router attack detection device 100 corresponds to the processing of the router attack detection program 101 .

<Step S11>
In step S11, multiple packets including the attack packet 701 are sent to the router 300 via the Internet 600, as described with reference to FIG. The packet storage DB 11 temporarily stores packets transmitted from the Internet 600 to the router 300 as stored packet information 11a.
FIG. 4 shows stored packet information 11a stored in the packet temporary storage DB 11. As shown in FIG. Examples 1 and 2 are shown in the saved packet information 11a. The stored packet information 11a has the following items: 1. packet number;2. packet reception time;3. Layer 3, 4 protocols;4. source IP address;5. source port;6. destination IP address;7. 8. destination port; payload data;9. Contains packet length.
"1. Packet number" is assigned an integer in ascending order of reception. "2. Packet reception time" includes the date. The protocol names of "3. Layer 3, 4 protocol" are ICMP, IP, TCP, UDP, ESP, IKEv1, IKEv2, . . . is a name such as "5. Source port" is the TCP/UDP port number. "7. Destination port" is the TCP/UDP port number. "8. Payload data" is the data content to be transmitted by the protocol. "9. Packet length" is the IP packet length.

<Step S12>
In step S12, the log DB 12 temporarily stores operation logs and operation logs created by the router 300 and the switches 210 and 220, which are connection devices, upon reception of packets.
FIG. 5 shows saved log information 12a temporarily saved by the log save DB 12. As shown in FIG. In FIG. 5, examples 1 and 2 are shown as the saved log information 12a. The saved log information 12a is system logs and operation data received from the router 300 and the switches 210 and 220, which are connected devices. The received data is added with time information and stored as the storage log information 12a. The types of logs are assumed to be 1 to 4 below. Log type 1=system log, log type 2=SNMPTrap (router), log type 3=SNMPTrap (peripheral device), log type 4=others. As shown in FIG. 5, the saved log information 12a has items of 1. Received time including date of data;2. 3. log type; Contains log data.

<Step S13>
In step S13, the whitelist DB 13 pre-stores the whitelist 13a describing the safe connection source address information.
FIG. 6 shows the whitelist 13a stored in the whitelist DB 13. As shown in FIG. As shown in FIG. 6, the whitelist 13a includes IP addresses as items. FIG. 6 shows examples 1 and 2 as the information of the whitelist 13a. Example 1 is an IP address assuming an in-house network, and Example 2 is an IP address assuming a VPN router global IP address.

<Step S14>
In step S14, the vulnerability information DB 14 stores the published vulnerability information 140A.
FIG. 7 shows vulnerability information 140A stored in the vulnerability information DB 14. As shown in FIG. The vulnerability information 140A includes attack packet requirements 14a, occurrence events 14b, and occurrence logs 14c. FIG. 7 shows two pieces of vulnerability information 140A: vulnerability information 140A1 and vulnerability information 140A2. Vulnerability information 140A is information about published vulnerabilities. When the router attack detection device 100 receives a packet, the vulnerability information 140A cannot determine whether or not the packet is the attack packet 701, but can determine the degree of certainty indicating the possibility that the packet is the attack packet 701. Information. Accuracy is the matching rate described later.
(a) The attack packet requirement 14a is part of the specification of the attack packet 701 . The attack packet requirement 14a cannot specify the attack packet 701. FIG. The attack packet requirement 14a includes the following items: 1. Vulnerability identification number;2. Layer 3, 4 protocols;3. source IP address;4. source port;5. destination IP address;6. 7. destination port; payload data;8. including packet length.
(b) Occurrence events are events that occur in the router 300 when attacked.
The attack packet requirement 14a includes the following items: 1. Vulnerability identification number;2. It contains the type of the occurrence event 14b.
The following are assumed as the types of events that occur.
Event type 1 = startup, event type 2 = restart, event type 3 = CPU high load, event type 4 = communication stop, event type 5 = hangup, event type 6 = crash, event type 7=Arbitrary Code Execution, Occurrence Type 8=Other.
(c) The occurrence log 14c is a log generated and output by the router 300 and the switches 210 and 220 when the attack packet 701 attacks. The occurrence log 14c has items of 1. Vulnerability identification number;2. Contains the contents of the incident log.

<Step S15>
In step S15, the event occurrence determination unit 21 compares the first action log generated by the router 300 with the input of the packet and the occurrence log 14c in which the attack event to the router 300 is described, thereby determining the first action Determine if there is an attack event in the log. Specifically, it is as follows. The event occurrence determination unit 21 compares the saved log (first operation log) of the log DB 12 with the occurrence log 14c of the vulnerability information DB 14, and the content of the saved log (attack event) matches the attack event of the occurrence log 14c. determine whether Note that variable parts such as numerical values are excluded from the determination.

<Step S16>
In step S16, the event occurrence determination unit 21 determines that an event due to a vulnerability attack has occurred when the content of the saved log matches the vulnerability information (occurrence log). The event occurrence determination unit 21 transmits an actual event occurrence notification 21 a to the attack packet extraction unit 22 when determining that an event due to a vulnerability attack has occurred.
FIG. 8 shows the real event occurrence notification 21a. The actual event occurrence notification 21a has items of the actual event occurrence time and the occurrence event 14b. Examples 1 and 2 are shown in FIG.

<Step S17>
In step S17, if it is determined that an attack event exists in the first operation log generated by the router 300, candidate packets that are attack packet candidates are extracted from the packet storage DB 11 that stores packets input to the router 300. FIG.
Then, the attack packet extraction unit 22 inputs the candidate packet to the virtual router 23, which is an alternative router that substitutes for the router 300, and acquires the second operation log generated by the virtual router 23 in accordance with the input of the candidate packet.
The attack packet extraction unit 22 determines whether or not an attack event exists in the second operation log by comparing the occurrence log 14c and the second operation log. If an attack event exists in the second operation log, the attack packet extraction unit 22 extracts the attack packet and the determine the candidate packets that are The process of determining the candidate packet to be the attack packet based on the attack event occurrence timing and the input timing of the candidate packet to the virtual router 23 corresponds to step S39 in FIG. 11 described later.
The attack packet extracting unit 22 determines that the attack event described in the occurrence log 14c in the first operation log created by the router 300 exists as a candidate packet for the attack packet 701 for a certain period of time determined from the determination time. , the packet stored in the packet storage DB 11 is taken out. Specifically, it is as follows.

The attack packet extraction unit 22 considers that the attack packet is included in the packet immediately before (about 5 minutes) the actual event occurrence time indicated by the actual event occurrence notification 21a, which is the determination time, and extracts the packet in that time period from the packet storage DB 11. take out.

<Step S18>
In step S18, the attack packet extraction unit 22 determines the probability that the candidate packet is an attack packet using the vulnerability information 140A, which is the attack packet prediction information containing information for predicting the possibility of being an attack packet. Then, candidate packets are input to the virtual router 23, which is an alternative router, in descending order of probability that they are attack packets.
The attack packet extracting unit 22 compares the packet information of the whitelist 13a in which the packet information of the safe packets is described with the packet information of the candidate packets to determine candidate packets that are safe packets. are excluded from the input to the virtual router 23. Specifically, when the attack packet is input to the virtual router 23, the attack packet extraction unit 22 determines that the extracted candidate packet is not an attack packet based on the whitelist 13a information and the vulnerability information 140A (attack packet requirement 14a). Exclude things. After this exclusion, the attack packet extraction unit 22 calculates the match rate for each packet.

<Step S19>
In step S19, the attack packet extraction unit 22 inputs the packets to the virtual router 23 in descending order of matching rate.
In step S20, when an operation log (second operation log) identical to the actually generated log 14c occurs in the virtual router 23, the attack packet extracting unit 22 extracts the candidate packet that has flowed into the virtual router 23 as an attack packet. I judge.

<Step S21>
In step S21, the signature creation unit 24 creates a signature that specifies whether a packet input to the router 300 is an attack packet using packet information of the candidate packet determined to be the attack packet. Specifically, it is as follows.
The signature creation unit 24 automatically creates a signature for blocking packets determined to be attacks, and updates the signature DB 15 of the conventional IPS equivalent unit. As a result, the same attack packet will not reach the router 300 thereafter.
FIG. 9 shows signature information 15a stored in the signature DB 15. As shown in FIG. FIG. 9 shows signature 1 and signature 2 as signature information 15a. The signature 15a includes, as items, "attack packet identification requirements" for identifying the attack packet 701 and measures to be taken when the attack packet is identified. In FIG. 9, the following seven items are described as "attack packet specification requirements". 1. Layer 3, 4 protocols;2. source IP address;3. source port;4. 5. destination IP address; 6. destination port; payload data;7. is the packet length.

10 and 11 are flowcharts for explaining the operation of extracting the attack packet 701 by the attack packet extraction unit 22. FIG. FIG. 11 describes the operation following FIG. The extraction operation of the attack packet 701 by the attack packet extraction unit 22 will be described with reference to FIGS. 10 and 11. FIG.

<Step S31>
First, the router attack detection device 100 is activated. In step S31, the attack packet extractor 22 waits for the actual event occurrence notification 21a from the event occurrence determiner 21. FIG.

<Step S32, Step S33>
When the actual event occurrence notification 21a is received from the event occurrence determination unit 21 in step S32, the attack packet extraction unit 22 extracts a plurality of packets in a certain period from the packet storage DB 11 in step S33. As described in step S17, the attack packet extraction unit 22 extracts from the packet storage DB 11 the packets received by the router attack detection device 100 within five minutes immediately before the actual event occurrence time described in the actual event occurrence notification 21a. Take out.

<Step S34>
In step S34, the attack packet extraction unit 22 checks the packets acquired from the packet storage DB 11 against the whitelist 13a, and excludes the packets that match the whitelist 13a among the acquired packets.

<Step S35>
In step S35, the attack packet extraction unit 22 calculates the matching rate of packets. The attack packet extraction unit 22 collates the packet information of the remaining packets with the vulnerability information 140A of the vulnerability information DB 14 . The attack packet extraction unit 22 collates the packet information of each packet with the attack packet requirements 14a of the vulnerability information 140A. The attack packet extraction unit 22 extracts "2. Layer 3, 4 protocol", "3. Source IP address", "4. Source port", "5. Destination IP address", "6 Destination port”, “7. Payload data”, and “8. Packet length”. The packet information of each packet has items of the attack packet requirements 14a. In this example, the packet information has data items (fields) from "2. Layer 3, 4 protocol" to "8. Packet length", and these data items are described. For each packet, the attack packet extraction unit 22 calculates the match rate between the packet information of that packet and the attack packet requirement 14a. An example is as follows.
Concordance is probability.
The packet information possessed by the packet A has a match rate of 70% with the attack packet requirements 14a of the vulnerability information 140A1 shown in FIG. The packet information of the packet B has a match rate of 40% with the attack packet requirements 14a of the vulnerability information 140A2 shown in FIG.

<Step S36>
In step S36 of FIG. 11, the attack packet extraction unit 22 rearranges the packets in descending order of matching rate. The attack packet extraction unit 22 sorts the packets into packet A, packet C, packet D, packet B, packet R, and so on.

<Step S37, Step S38>
In step S37, the attack packet extraction unit 22 injects the packets into the virtual router 23 in descending order of the matching rate. In step S<b>38 , the attack packet extraction unit 22 acquires from the virtual router 23 an operation log (second operation log) generated by the virtual router 23 .

<Step S39>
In step S39, the attack packet extraction unit 22 adds the following to the operation log acquired from the virtual router 23:
Check whether an event described in the occurrence log 14c has occurred. If not, the process returns to step S37. If so, the process proceeds to step S40.

<Step S40>
In step S40, if the same event as the event described in the occurrence log 14c has occurred in the operation log of the virtual router 23, the attack packet extraction unit 22 extracts the injected packet that generated the operation log as an attack packet. Decide on a packet. The attack packet extraction unit 22 sequentially injects all packets into the virtual router 23 (NO in step S39, NO in step S42 described later).

<Step S41>
In step S<b>41 , the attack packet extraction unit 22 notifies the signature creation unit 24 of the packet information of the packet determined as the attack packet 701 .

In step S42, the attack packet extraction unit 22 determines whether the packet input to the virtual router 23 is the last packet among those rearranged in step S36. If it is the last packet, the attack packet extraction unit 22 advances the process to step S31, and if it is not the last packet, the attack packet extraction unit 22 advances the process to step S37.

The signature creation operation by the signature creation unit 24 will be described below. Upon receiving the packet information of the packet determined to be the attack packet 701 from the attack packet extraction unit 22, the signature creation unit 24 performs the following processing.

If the attack packet extraction unit 22 can find only one attack packet, the signature creation unit 24 creates a signature that identifies the single packet. In this case, in FIG. 9, only signature 1 is created.

The signature creation unit 24 creates, as a signature, a common item signature having items common to a plurality of candidate packets determined as attack packets. Specifically, it is as follows.
When the attack packet extraction unit 22 determines a plurality of packets such as packet C, packet D, and packet E as the attack packets 701 and acquires the packet information of each packet from the attack packet extraction unit 22, signature creation is performed. A unit 24 creates a common term signature that is a signature common to a plurality of packets. The signature creation unit 24 extracts common item values from the packet information of each packet, converts items with mismatched values into variables, creates common item signatures, and registers the common item signatures in the signature DB 15 . An example is as follows.
The following shows the packet information for packet C and packet D.
Packet C: source 1: 1.1.1, protocol: UDP, destination port: 500, size: 210 bytes.
Packet D: source 1: 1.1.2, protocol: UDP, destination port: 500, size: 210 bytes
The signature creation unit 24 creates a common term signature of source 1.1.1.0/24, protocol: UDP, destination port: 500, size: 210 bytes.

Note that the signature creation unit 24 compares the packet information of the attack packet determined this time by the attack packet extraction unit 22 with the signatures already registered in the signature DB 15 as a signature creation method. A signature may be updated using packet information of a packet newly determined as an attack packet.

Further, the signature creation unit 24 compares the event that occurred in the log stored in the log storage DB 12 with the event that occurred in the registered vulnerability information 140A, and from the log stored in the log storage DB 12, suspected Extract vulnerability information. In practice, the signature creation unit 24 compares the event occurrence log 14c set in advance with the newly output log of the log DB 12, confirms whether or not there is a match except for the variable part, and confirms whether or not the event matches. is extracted as vulnerability information.

*** Effect of Embodiment 1 ***
According to the router attack detection device 100 of Embodiment 1, it is possible to provide a router attack detection device that prevents attacks on routers from the announcement of the router's vulnerability until the router implements vulnerability countermeasures.
Moreover, since the router attack detection device 100 can be incorporated into existing software as the router attack detection program 101, it can be applied to existing devices without changing the hardware configuration.

Although the first embodiment has been described above, one of the first embodiments may be partially implemented. Alternatively, two or more of the first embodiment may be partially combined and implemented. The present invention is not limited to Embodiment 1, and various modifications are possible as required.

11 Packet storage DB, 11a Storage packet information, 12 Log storage DB, 12a Storage log information, 13 Whitelist DB, 13a Whitelist, 14 Vulnerability information DB, 14a Attack packet requirements, 14b Occurrence event, 14c Occurrence log, 15 Signature DB, 21 event occurrence determination unit, 21a actual event occurrence notification, 22 attack packet extraction unit, 23 virtual router, 24 signature creation unit, 100 router attack detection device, 101 router attack detection program, 110 processor, 120 main storage device, 130 Auxiliary Storage Device, 140 Input IF, 150 Output IF, 160 Communication IF, 210 Switch, 220 Switch, 300 Router, 400 Attacker, 500 Internal IP Network, 600 Internet.

Claims (7)

A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. an attack event determination unit that
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router an attack packet determination unit that determines a candidate packet to be the attack packet based on the timing;
A router attack detection device, comprising: a signature creation unit that generates a signature specifying whether the packet input to the router is the attack packet, using packet information of the candidate packet determined to be the attack packet. The attack packet determining unit, as the candidate packet,
2. The router attack detection device according to claim 1, wherein the packets stored in said packet storage device are extracted during a certain period of time determined from a judgment time when said attack event is judged to exist in said first operation log. The attack packet determination unit,
By comparing the packet information of the whitelist in which the packet information of the safe secure packet is described with the packet information of the candidate packet, the candidate packet that is the secure packet is determined, and the candidate packet is determined as the secure packet. 3. The router attack detection device according to claim 1, wherein said candidate packet is excluded from input to said alternative router. The attack packet determination unit,
Using attack packet prediction information that describes information for predicting the possibility of being an attack packet, the probability that the candidate packet is the attack packet is determined, and the candidate packet is sent to the alternative router in descending order of probability that it is the attack packet. , the router attack detection device according to any one of claims 1 to 3, wherein the candidate packet is input. The signature creation unit
The router attack detection device according to any one of claims 1 to 4, wherein, as the signature, a common item signature having items common to the plurality of candidate packets determined as the attack packet is created. to the computer,
A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. an attack event determination process to
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router an attack packet determination process for determining a candidate packet to be the attack packet based on the timing;
A router attack detection program for executing a signature creation process for creating a signature specifying whether the packet input to the router is the attack packet using packet information of the candidate packet determined to be the attack packet. . the computer
A determination is made as to whether or not the attack event exists in the first operation log by comparing a first operation log generated by a router with packet input and an occurrence log describing an attack event to the router. death,
If it is determined that the attack event exists in the first operation log, a candidate packet that is a candidate for the attack packet is extracted from a packet storage device that stores packets input to the router, and sent to an alternative router that substitutes for the router. The candidate packet is input, the second operation log generated by the alternative router is obtained in accordance with the input of the candidate packet, and the second operation log is obtained by comparing the occurrence log and the second operation log. determining whether or not an attack event exists, and if the attack event exists in the second operation log, inputting timing of occurrence of the attack event in the second operation log and input of the candidate packet to the alternative router determining a candidate packet to be the attack packet based on the timing;
A router attack detection method for generating a signature identifying whether the packet input to the router is the attack packet, using packet information of the candidate packet determined to be the attack packet.

Images