WO2008050651A1

WO2008050651A1 - Communication device, communication method, and program

Info

Publication number: WO2008050651A1
Application number: PCT/JP2007/070254
Authority: WO
Inventors: Yoshiaki Okuyama; Takuya Murakami
Original assignee: Nec Corporation
Priority date: 2006-10-26
Filing date: 2007-10-17
Publication date: 2008-05-02
Also published as: JP2010033100A

Abstract

Provided is a mechanism for optimizing an unauthorized intrusion detection rule in accordance with an application program communication request process or an internal state of a terminal such as an application start/end. In order to achieve mechanism, the communication device includes: a mechanism for detecting the internal state of the terminal and automatically deciding the an unauthorized intrusion detection rule; and a mechanism for validating only the necessary detection rule.

Description

Specification

COMMUNICATION DEVICE, COMMUNICATION METHOD, AND PROGRAM

Technical field

TECHNICAL FIELD [0001] The present invention relates to a communication device having a network intrusion detection program, and in particular, a technology for optimizing the operation of an intrusion detection program according to the internal state of a device connected to a network or the state of a terminal on the network. About.

Background art

[0002] Network attacks as the first step of unauthorized intrusion into the system, such as Web page alteration and Dos attack (denial of service attack), are increasing! /. These attacks are difficult to defend with conventional firewalls alone.

[0003] As a countermeasure against such an attack, there is an IDS (Network Intrusion Detection Device) that detects a network abnormality and notifies a network administrator. While reconnaissance behavior and actual intrusion attempts to find intruders have become daily routines and hacking is increasing, IDS is becoming an indispensable part of network management.

[0004] IDS has a mechanism for detecting network anomalies by matching communication packets with patterns for detecting unauthorized intrusion. This pattern is hereinafter referred to as unauthorized intrusion detection rule. When network abnormalities increase, the processing load for matching with intrusion detection rules increases, and hardware resources such as processor and memory resources on the equipment are consumed significantly.

[0005] Even if IDS is incorporated in a server device or the like, if the number of unauthorized intrusion detection rules to be matched in the future increases, the processing load may increase beyond the assumed processor and memory resources. For this reason, especially when installing IDS in devices with limited hardware resources such as processor performance and memory capacity, such as mobile terminals, network home appliances, and sensor devices, the processor load increases due to IDS, memory There is a possibility of deteriorating the processing performance that should be performed by the device due to the increase in consumption.

[0006] Therefore, it is unlikely to occur or harmless to devices and networks It is desirable to reduce the number of intrusion detection rules to minimize the performance degradation caused by IDS.

[0007] As a technical document filed prior to the present invention in order to solve this problem, there is a technique related to automatic generation of an intrusion detection rule based on an access log described in Japanese Patent Publication No. 2005-316779. .

[0008] In this patent publication 2005-316779, the network unauthorized entry to the terminal is detected, and when there is an unauthorized access, an abnormal bucket detection process corresponding to the access is automatically performed. This is a terminal device to be added. For this reason, it is not necessary to set a number of unauthorized intrusion detection rules in the device in advance.

[0009] Patent Publication 2003-9260 3 is a technical document for reducing the number of intrusion detection rules by removing harmless intrusion detection rules and minimizing performance degradation caused by IDS. There is a host configuration automatic detection type IDS system described in.

[0010] The one described in this patent publication 2003-92603 has a function of reducing unauthorized intrusion detection rules by the configuration of the monitored host.

[0011] In the technology described in the above-mentioned Patent Publication 2005-316779, an abnormal packet detection process is newly added in the case of unauthorized access, so there is no effect on the first unauthorized access! /, There is a problem!

[0012] Therefore, the network administrator and terminal user cannot know the trace of unauthorized access, and there is a risk that a new security problem will occur using the intruded terminal as a stepping stone.

[0013] In addition, in the technology described in Japanese Patent Publication No. 2003-92603, a method for converting data scanned by a configuration scanner into an IDS rule set! / Is mentioned! / . The present invention provides a method for avoiding such security risks and minimizing performance degradation due to IDS.

[0014] The first conventional problem is that, in devices such as mobile terminals, network home appliances, and sensor devices, which have restrictions on hardware resources such as processor performance and memory capacity, the IDS processing is used for the device. The performance may be significantly reduced. Also, IDS processing consumes a great deal of load processing even on a device with sufficient hardware resources, so if the number of types of unauthorized network access increases, it may become impossible to process. There is ten lives.

[0015] The reason is that if a large number of unauthorized intrusion detection rules are set, the unauthorized intrusion detection processing may consume a large amount of processor memory resources and the desired processing may not be performed. In addition, processing efficiency, response time, and communication efficiency are reduced.

[0016] The second problem is that if the number of unauthorized intrusion detection rules is reduced to solve the first problem, the security risk increases.

[0017] The reason is that unless an intrusion detection rule is set in advance, it cannot be protected when the first attack corresponding to the intrusion detection rule comes. Disclosure of the invention

[0018] An object of the present invention is to minimize the degradation in processing performance due to IDS by optimizing the intrusion detection rule according to the communication request, the internal state of the terminal such as the application state, or the state of the terminal on the network. It is.

[0019] In addition, since the development cost is increased when a conventional application is modified, the conventional application provides a means for performing the above operation without modifying the application.

[0020] In order to achieve the above-described object, the device according to the present invention changes the intrusion detection rule during device operation according to the communication request processing of the application program, the activation and termination of the application, the state of the external terminal, and the like. Provide a mechanism. To realize this mechanism, there are a mechanism that detects the internal state of the terminal and automatically determines the necessary intrusion detection rules, and a mechanism that only the necessary intrusion detection rules are matched with the intrusion detection rules. It is characterized by having.

[0021] The present invention makes effective use of hardware resources (processor, memory, etc.) of a communication device that performs unauthorized intrusion detection processing of networks and terminals by enabling only necessary unauthorized intrusion detection rules. As a result, according to the present invention, it is possible to execute the unauthorized intrusion detection process even in an apparatus with limited hardware resources such as a portable terminal.

[0022] Further, according to the present invention, it is not necessary to perform a comparison process with an unnecessary intrusion detection rule at the time of communication, so that there is an effect of improving communication efficiency.

Brief Description of Drawings FIG. 1 is a block diagram showing a first embodiment for carrying out the present invention.

FIG. 2 is a diagram showing an example of a conversion table for a port detection rule database that converts port numbers into detection rule identifiers.

FIG. 3 is a diagram showing an example of a detection rule database for converting a detection rule identifier into a detection rule and determining whether the detection rule is valid / invalid.

FIG. 4 is a diagram showing an operation sequence from waiting for a port number until an IDS configuration change is performed in the first embodiment of the present invention.

FIG. 5 is a block diagram for carrying out a second embodiment of the present invention.

FIG. 6 is a diagram illustrating an example of a conversion table of a port detection rule database that converts an application identifier to a detection rule identifier.

FIG. 7 is a diagram showing an operation sequence until an IDS configuration change is performed when an application is activated in the second embodiment of the present invention.

FIG. 8 is a block diagram for carrying out a third embodiment of the present invention.

FIG. 9 is a diagram showing an operation sequence until an IDS configuration change is performed when an application is activated in the third embodiment of the present invention.

FIG. 10 is a block diagram for carrying out a fourth embodiment of the present invention.

FIG. 11 is a diagram showing an example of a conversion table of a protocol / detection rule database for converting protocol identifiers to detection rule identifiers.

FIG. 12 is a diagram showing an operation sequence until an IDS configuration change is performed when an application is activated in the fourth embodiment of the present invention.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[0025] The apparatus of the present invention will be described with reference to FIG.

FIG. 1 is a block diagram showing a first embodiment for carrying out the present invention.

1 describes the internal configuration in detail.

[0027] The terminal 1 includes an application 11, a socket 12, a communication request detection unit 13, a port 'detection rail database 14, a detection node configuration change unit 15, and a detection rule database 1.

6 and IDS 17 and so on. The application 11 is an application built in the mobile terminal 1.

[0029] The socket 12 is a communication library such as a socket library often used in a general OS. In addition to normal communication processing, the socket 12 notifies the communication request detection unit 13 of a port number to be used when a standby or connection request is received.

[0030] The communication request detection unit 13 receives the port number from the socket 12, refers to the port 'detection rule database 14, and converts the received port number into a corresponding intrusion detection rule number. In addition, the intrusion detection rule number is notified to the detection rule configuration change unit 15.

[0031] The port 'detection rule database 14 is a database for converting the port number and the corresponding unauthorized intrusion detection rule number.

The detection rule configuration change unit 15 receives the unauthorized intrusion detection rule number and instructs the detection rule database 16 to validate / invalidate the unauthorized intrusion detection rule. It also instructs IDS 17 to change the intrusion detection rules.

[0033] The detection rule database 16 converts the intrusion detection rule number and the corresponding intrusion detection rule, and stores a flag indicating whether the intrusion detection rule is valid or invalid. The intrusion detection rule valid / invalid flag can be changed with.

[0034] IDS 17 receives an intrusion detection rule change instruction and validates / invalidates the intrusion detection rule.

Next, the overall operation of the present embodiment will be described in detail with reference to FIG. 1, FIG. 2, FIG. 3 and FIG.

FIG. 2 is an example of a conversion table of the port detection rule database 14 that converts port numbers into detection rule identifiers.

FIG. 3 shows an example of the detection rule database 16 for converting the detection rule identifier into a detection rule and determining the validity / invalidity of the detection rule.

FIG. 4 is an operation sequence from the port number standby until the IDS configuration change is performed in the first embodiment of the present invention.

[0039] Application 11 power When listening on a specific port number, wait for socket 12 Call start / end functions (for example, POSIX accept (), close () standby functions). Here, the case of starting / ending standby on port 80 is described as an example (see Fig. 4).

[0040] In step al, the application 11 inputs the standby port number 80, calls the socket 12, and requests a communication standby start 'end process.

In step a2, the socket 12 notifies the communication request detection unit 13 of the port number 80 given as an input. Wait until communication start / end is not executed until the configuration of the intrusion detection rule is changed.

[0042] In step a3, the communication request detection unit 13 inquires of the port detection rule database 14 about the unauthorized intrusion detection rule number by using the given port number 80 as an input.

[0043] In step a4, the port detection rule database 14 returns the intrusion detection rule number corresponding to the port number. If the table contents are as shown in Figure 2

The port detection rule database 14 returns the intrusion detection rule numbers 1 and 2 corresponding to the port number 80 to the communication request detection unit 13.

[0044] In step a5, the communication request detection unit 13 uses the unauthorized intrusion detection rule number (here, 1 and 2) returned from the port 'detection rule database 14 as an argument to the detection rule configuration change unit 15 for unauthorized intrusion. Instructs detection rule change.

[0045] In the case of standby start, the detection rule configuration changing unit 15 detects the intrusion detection rule numbers 1 and 2 in step a6 so as to validate the intrusion detection rule numbers 1 and 2 (see Fig. 3).

).

[0046] When the standby is completed, the detection rule configuration changing unit 15 instructs the detection rule database 16 to invalidate the unauthorized intrusion detection rule numbers 1 and 2 in step a6.

[0047] Since the configuration change of the intrusion detection rule has been performed, the detection rule configuration change unit 15 sends the configuration change notification of the intrusion detection rule to IDS 17 in step a7.

[0048] In step a8, IDS 17 loads the intrusion detection rule for which the valid / invalid flag is valid. The detection rule configuration change unit 15 transmits a configuration change completion notification to the socket 12 in step a9.

[0050] Socket 12 performs standby start / end processing at port 80 in step alO.

Five.

[0051] Next, a second embodiment for carrying out the invention will be described in detail with reference to the drawings.

FIG. 5 is a block diagram for carrying out the second embodiment of the present invention, and describes the internal configuration of the terminal 1 of the present embodiment.

[0053] Terminal 1 includes application 11, application activation monitor 18, application detection rule database 19, detection rule configuration change unit 15, detection rule database 16, IDS 17, and the like. The

The application activation monitor 18 monitors the activation / termination of the application, and converts the activated application to the identifier of the corresponding intrusion detection rule. In addition, the detection rule configuration change unit 15 is notified of the intrusion detection rule identifier.

The application detection rule database 19 is a database that performs conversion between an application identifier and a corresponding intrusion detection rule.

[0056] The detection rule configuration changing unit 15, the detection rule database 16, and the IDS 17 are the same as those in the first embodiment.

Next, the overall operation of the present exemplary embodiment will be described in detail with reference to FIGS. 5, 6, and 7. FIG.

FIG. 6 is an example of a conversion table of the port 'detection rule database 14 that converts application identifiers to detection rule identifiers.

FIG. 7 shows an operation sequence until an IDS configuration change is performed when an application is activated in the second embodiment of the present invention.

[0060] When the application 11 is activated 'terminated, the application activation monitor 18 acquires the identifier of the application that has been activated' terminated in step bl. Here, an http server application is described as an example.

[0061] The application activation monitor 18 determines from the application identifier in step b2. In order to convert to the intrusion detection rule identifier, the application 'detection routine database 19 is inquired about the intrusion detection rule identifier with the application identifier as an argument.

[0062] The application 'detection rule database 19 returns an intrusion detection rule corresponding to the application identifier in step b3. If the contents of the table are as shown in FIG. 6, the application detection rule database 19 returns the intrusion detection rule identifiers 1 and 2 corresponding to the http server application to the application activation monitor 18.

[0063] In step b4, the application activation monitoring unit 18 uses the identifier of the intrusion detection rule returned from the application 'detection rule database 19 (here, 1 and 2) as an argument to the detection rule configuration changing unit 15. Instructs the intrusion detection rule change.

[0064] Thereafter, processing similar to steps a6 to a8 in the first embodiment is performed.

[0065] Next, a third embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 8 is a block diagram for carrying out the third embodiment of the present invention, and describes the internal configuration of terminal 1 and terminal 2 of the present example.

[0067] The terminal 1 includes an external communication request detection unit la, a port 'detection rule database 14, a detection rule configuration change unit 15, a detection rule database 16, and an IDS 17.

The terminal 2 includes an application 21 and a socket 22.

[0069] The external communication request detection unit la receives a communication start / completion request type and a port number from an external terminal, and converts the port number into a corresponding intrusion detection rule number. In addition, the intrusion detection rule number is notified to the detection rule configuration change unit 15.

[0070] The application 21 is an application built in the mobile terminal.

[0071] The socket 22 is a communication library such as a socket library often used in a general OS. In addition to normal communication processing, the socket 22 notifies the external communication request detection unit la of the port number to be used when a standby or connection request is received.

[0072] Port 1 of terminal 1 'detection rule database 14, detection rule configuration changing unit 15, detection rule database 16, and IDS 17 use the same ones as in the first embodiment. Next, the overall operation of the present exemplary embodiment will be described in detail with reference to FIGS. 8 and 9.

FIG. 9 shows an operation sequence until an IDS configuration change is performed when an application is activated in the third embodiment of the present invention.

In step cl, the application 21 inputs the standby port number 80, calls the socket 22, and requests communication standby start / end processing.

[0076] Socket 22 starts communication with port number 80 given as input in step c2.

• Notify the external communication request detection unit la of the type of completion request. Wait until communication start / end is not executed until the configuration of the intrusion detection rule is changed.

[0077] In step c3, the external communication request detection unit la makes an inquiry about the unauthorized intrusion detection rule number to the port 'detection rule database 14 by using the given port number 80 as an input.

[0078] The port detection rule database 14 returns the intrusion detection rule number corresponding to the port number in step c4. If the contents of the table are as shown in FIG. 2, the port detection rule database 14 returns the intrusion detection rule numbers 1 and 2 corresponding to the port number 80 to the communication request detection unit la.

[0079] The external communication request detection unit la changes the detection rule configuration by using the intrusion detection rule number (here, 1 and 2) returned as the argument in step c5. Instructs part 15 to change the intrusion detection rule.

[0080] Thereafter, the same processing as in steps a6 to a8 in the first embodiment is performed.

The detection rule configuration change unit 15 transmits a configuration change completion notification to the socket 22 in step c6.

[0082] Socket 22 performs standby start / end processing at port 80 in step c7.

Yes

[0083] Next, a fourth embodiment for carrying out the invention will be described.

FIG. 10 is a block diagram for carrying out the fourth embodiment of the present invention.

[0085] This fourth embodiment is an improvement of the first embodiment, in which the port number is dynamically changed and RTP or the like is supported so as to correspond to various data formats such as audio and video protocols. It is embodiment for implementing with the protocol of.

Next, the overall operation of the fourth exemplary embodiment of the present invention will be described in detail with reference to FIG. 10, FIG. 11, and FIG.

FIG. 11 is an example of a conversion table of a protocol.detection rule database le that performs conversion into protocol identifier power and detection rule identifier.

FIG. 12 shows the ID when the application is activated in the fourth embodiment of the present invention.

This is an operation sequence until the S configuration change is performed.

[0089] The telephone application lb instructs the socket lc to transmit communication permission data (for example, 200 OK of the SIP protocol) to step dl to start communication such as voice and video. . Communication permission data (for example, SDP) contains the type of audio and video protocol used and the standby port.

[0090] The socket lc receives the transmission instruction from the telephone application lb, analyzes the SDP in step d2, and extracts the audio and video protocol identifier and the port number.

In step d3, the socket lc delivers the protocol identifier and the port number extracted by the analysis in step d2 to the communication request detection unit Id.

[0092] In step d4, the communication request detection unit Id searches the protocol detection rule database le (see Fig. 11) using the protocol identifier as a key to convert the protocol identifier delivered from the socket lc into a detection rule. I do.

[0093] In step d5, the protocol 'detection rule database le returns the detection rule number corresponding to the protocol identifier to the communication request detection unit Id.

[0094] Thereafter, the same processing as in steps a6 to al0 in the first embodiment is performed.

Examples of utilization of the present invention include devices that require an input operation unit such as a computer, a portable information terminal, and a mobile phone.

[0096] The network unauthorized intrusion detection device that is effective in the present invention can be applied to a communication device.

[0097] As described above, the power of explaining the present invention with reference to the embodiments The present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0098] This application (based on the Japanese Patent Application No. 2006-290906 filed on October 26, 2006) Claim the foundational priority and incorporate all of its disclosure here.

Claims

The scope of the claims

[1] Network and terminal intrusion detection function,

A communication device that has the function of optimizing detection rules used to detect unauthorized intrusions into networks and terminals.

[2] In the communication device according to claim 1,

Detection rule determining means for detecting a state change inside or outside the device and determining an intrusion detection rule to be used in response to the state change;

A communication apparatus comprising: an unauthorized intrusion detection unit configured to detect an unauthorized intrusion according to the unauthorized intrusion detection rule.

[3] In the communication device according to claim 2,

The detection rule determining means receives a communication request from an application of its own terminal and determines an unauthorized intrusion detection rule to be used based on a communication source / destination address or a port number.

[4] In the communication device according to claim 3,

The detection rule determining means has storage means for storing a communication source / destination address or port number and an unauthorized intrusion detection rule in association with each other, and determines the unauthorized intrusion detection rule using the storage means. Communication device.

[5] In the communication device according to claim 2,

The detection rule determining means detects activation / termination of an application, and determines an unauthorized intrusion detection rule based on the activated / terminated application.

[6] The communication device according to claim 5,

The communication device characterized in that the detection rule determining means has storage means for storing an application identifier and an unauthorized intrusion detection rule in association with each other, and determines an unauthorized intrusion detection rule using the storage means.

[7] In the communication device according to claim 2,

The detection rule determination means receives a communication request of another terminal and determines an unauthorized intrusion detection rule to be used based on a communication source / destination address or a port number. Communication device.

[8] The communication device according to claim 2,

The communication device characterized in that the detection rule determination means monitors communication data of the terminal itself and determines an intrusion detection rule based on the communication data.

[9] A first process for detecting a state change inside or outside the device and determining an intrusion detection rule to be used in response to the state change;

And a second process for detecting unauthorized intrusion in accordance with the unauthorized intrusion detection rule.

[10] In the communication method according to claim 9,

The communication method is characterized in that the first process receives a communication request from an application and determines an intrusion detection rule to be used based on a communication source / destination address or a port number.

[11] In the communication method according to claim 10,

The first process includes a third process for storing a communication source / destination address or port number and an unauthorized intrusion detection rule in association with each other, and determines an unauthorized intrusion detection rule using the third process. A communication method characterized by the above.

[12] In the communication method according to claim 9,

The communication method according to claim 1, wherein the first process detects activation / termination of an application and determines an intrusion detection rule based on the activated / terminated application.

[13] In the communication method according to claim 12,

The first process includes a third process for storing an application identifier and an unauthorized intrusion detection rule in association with each other, and determines an unauthorized intrusion detection rule using the third process. Communication method.

[14] In the communication method according to claim 9,

The communication method is characterized in that the first process receives a communication request from another terminal and determines an unauthorized intrusion detection rule to be used based on a communication source / destination address or a port number.

[15] In the communication method according to claim 9, The first process is characterized in that the communication data of the terminal is monitored and an unauthorized intrusion detection rule is determined based on the communication data.

[16] On the computer,

A first procedure for detecting a state change inside or outside the device and determining an intrusion detection rule to be used in response to the state change;

A program for executing a second procedure for detecting unauthorized intrusion according to the unauthorized intrusion detection rule.

[17] In the program according to claim 16,

The first procedure is a program that accepts a communication request from an application and determines an intrusion detection rule to be used based on a communication source / destination address or a port number.

[18] In the program according to claim 17,

The first procedure includes a third procedure for storing a communication source / destination address or port number in association with an unauthorized intrusion detection rule, and determining an unauthorized intrusion detection rule using the third procedure. A program characterized by that.

[19] In the program according to claim 16,

The first procedure is a program for detecting activation / termination of an application and determining an intrusion detection rule based on the activated / terminated application.

[20] In the program according to claim 19,

The first procedure includes a third procedure for storing an application identifier and an unauthorized intrusion detection rule in association with each other, and determining an unauthorized intrusion detection rule using the third procedure. Program.

[21] In the program according to claim 20,

The first procedure is characterized in that a communication request from another terminal is received and an intrusion detection rule to be used is determined based on a communication source / destination address or a port number.

[22] In the program according to claim 17,

The first procedure monitors the communication data of the terminal itself and detects unauthorized intrusion using the communication data.