WO2020158896A1

WO2020158896A1 - Communication device

Info

Publication number: WO2020158896A1
Application number: PCT/JP2020/003542
Authority: WO
Inventors: 岡田　和也
Original assignee: 国立大学法人東京大学
Priority date: 2019-01-31
Filing date: 2020-01-30
Publication date: 2020-08-06
Also published as: JP2022049717A

Abstract

The present invention relates to a communication device which determines, when a terminal connected to a network accesses a server device, whether the server device is a malicious host. The terminal transmits to a DNS server a name resolution request including an absolute domain name of the server device, and starts communication with the server device on the basis of a name resolution result transmitted from the DNS server. The communication device is provided with a determination unit which determines whether the server device is a malicious host, and, upon receiving the name resolution request transmitted to the DNS server, determines whether the server device is a malicious host on the basis of the absolute domain name included in the name resolution request. At this time, the name resolution request is transmitted to the DNS server regardless of whether a determination result as to whether the server device is a malicious host has been derived. Further, upon receiving a name resolution result from the DNS server, the communication device determines whether the server device is a malicious host on the basis of the determination result.

Description

Communication device

The present invention relates to a technique for detecting unauthorized communication in a network.

In recent years, cyber attacks aimed at individuals and organizations against network services have caused enormous damage. Various attack detection methods have been proposed in order to protect communication devices such as Web servers connected to the network from these attacks, but attackers frequently change or refine their attack methods. It was difficult to detect. The conventional attack detection method detects a method that has been attacked in the past, and it has been difficult to detect an attack by a new method.

Therefore, there has been proposed a technique for identifying an attacking host (malicious host) by detecting an IP address group of a terminal that performs abnormal communication from large-scale traffic data (see, for example, Patent Document 1). ).

JP, 2018-148270, A

However, it is necessary to detect cyber attacks as early as possible, but it took a lot of processing time to analyze large-scale traffic data. In particular, in order to detect an unknown attack, it is difficult to detect an attack in real time by machine learning of a packet to be communicated.

The present invention has been made in view of the above circumstances, and an object thereof is to provide a technology for detecting a cyber attack in real time.

According to a typical aspect of the present invention, a communication device for determining whether the server device is a malicious host when accessing the server device from a terminal connected to a network, wherein the terminal is A name resolution request including the absolute domain name of the server device is transmitted to a DNS server that specifies an IP address corresponding to the absolute domain name, and the DNS server corresponds to the absolute domain name included in the name resolution request. An IP address is specified, a name resolution result including the specified IP address is transmitted to the terminal, and the terminal starts communication with the server device based on the name resolution result transmitted from the DNS server. However, the communication device, the data receiving unit that receives the data transmitted from the terminal regardless of the destination of the data, a determination unit that determines whether the server device is a malicious host, A data transmitting unit that transmits the data received by the data receiving unit to a destination of the data, and when the data receiving unit receives a name resolution request to be transmitted to the DNS server, the determining unit determines , Based on the absolute domain name included in the name resolution request, to determine whether the server device is a malicious host, the data transmission unit, the determination result of whether the server device is a malicious host Irrespective of whether or not the name resolution request is sent to the DNS server, and the data receiving unit receives the name resolution result from the DNS server, the determining unit determines that the name resolution result It is determined whether or not the server device is a malicious host based on the determination result by the name resolution request corresponding to.

According to the representative embodiment of the present invention, it is possible to detect a cyber attack in real time without making the user feel a decrease in communication speed.

It is a figure explaining the outline of the communication system containing the packet classification device (communication device) which detects the access to the malicious host of the embodiment of the present invention in real time. It is a figure which shows an example of the network structure of embodiment of this invention. It is a figure which shows an example of the hardware constitutions and software constitutions of the packet classification apparatus of embodiment of this invention. It is a figure which shows an example of a structure for the packet classification apparatus of this embodiment to transfer a packet. It is a figure which shows the processing time of each process until a terminal starts communication with a Web server in this embodiment. It is a figure explaining the timing which detects a malignant host in an embodiment of the invention. FIG. 6 is a diagram illustrating a configuration for detecting a malicious host at a timing T1 when a terminal transmits a name resolution request to a DNS server in the embodiment of the present invention. It is a figure explaining the composition for a terminal to detect a malicious host at timing T2 which receives a name resolution result from a DNS server in an embodiment of the present invention. FIG. 6 is a diagram illustrating a configuration for detecting a malicious host at a timing T3 when a terminal accesses a connection destination Web server in the embodiment of the present invention.

When accessing a server device (for example, a WEB server) connected to another network from a terminal connected to a network, first, the IP address of the connection destination is specified from the DNS server by the server name (absolute domain name) of the connection destination. Yes (name resolution). In the present embodiment, it is determined whether the server device of the connection destination is a malicious host (computer that performs cyber attack) while performing name resolution. When it is determined that the server device of the connection destination is not a malicious host (benign host), communication is continued as it is, and when it is determined that the host is a malicious host, communication is cut off. Since the time for name resolution is the time required for normal communication, even if the process for detecting a malicious host is performed during this time, the user is unlikely to experience a delay. Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating an outline of a communication system including a packet classification device (communication device) that detects access to a malicious host in real time according to the embodiment of this invention. In this embodiment, TCP/IP communication is targeted, but the present invention can also be applied to communication using other protocols. Further, in the present embodiment, it is assumed that the user operates the terminal to access a server device (for example, a Web server) connected to an external network.

When a user operates a terminal to access a web server connected to an external network, first, the DNS server is queried to identify the IP address of the destination web server, and then based on the identified IP address. Communication with the Web server is started. At this time, the time to wait until the user refers to the specified site from the operation of the terminal is the time required for name resolution, the communication time with the Web server, and the time to process the data received from the Web server on the terminal. Become. Therefore, it is possible to prevent access to a malicious host by determining whether the connected web server is a malicious host until the name resolution is completed and communication with the connected web server is started. You can

Next, a network configuration example to which the malicious host detection method according to the embodiment of the present invention is applied will be described. FIG. 2 is a diagram showing an example of a network configuration according to the embodiment of the present invention. In the present embodiment, communication is performed between the Web server 11 connected to the external network (first network) 10 and the terminal 21 connected to the internal network (second network) 20.

Between the external network 10 and the internal network 20, a communication device (router 40) interconnecting each network is arranged. Further, a packet classification device (communication device) 100 that determines whether or not the Web server 11 to which the terminal 21 is connecting is a malicious host is arranged between the router 40 and the internal network 20. The packet classification device 100 may be installed inside the internal network 20. In the present embodiment, when connecting from the terminal 21 to a computer such as the Web server 11 connected to the external network 10, the connection is made to the DNS cache server (DNS server) 30 via the packet classification device 100, and the computer of the communication destination. Specify the IP address of. If the DNS cache server 30 cannot specify the server name (absolute domain name) of the connection destination, it recursively queries a plurality of authoritative DNS servers 60 via the network to resolve the absolute domain name. Hereinafter, the DNS cache server 30 and the authoritative DNS server 60 will be collectively referred to as a DNS server.

When the connection destination (Web server 11) of the terminal 21 is determined to be a malicious host (classified as a malicious host), the packet classification device 100 cuts off communication with the Web server 11 connected to the external network 10. At this time, a classification result (alarm) is notified to a management computer (not shown) for managing network devices such as the router 40 and the packet classification device 100, and a warning message is displayed to notify the administrator. You may Further, the packet classification device 100 may instruct the router 40 to block communication with a malicious host without blocking communication.

Also, in the present embodiment, it is not necessary to selectively determine whether or not the host is a malicious host. For example, if the judgment value of a malicious host is 100, the judgment value of a benign host is 0, and the possibility of being a malicious host is judged from the judgment values of 0 to 100, if the judgment value is greater than or equal to a predetermined threshold, Communication may be interrupted, and if the judgment value is within a predetermined range, a warning message may be displayed and the user may judge whether to connect or not. In this case, it is preferable to record a log of the determination result of the malicious host in the packet classification device 100 so that it can be determined whether or not the host is actually the malicious host. Further, the management computer may be notified and the management computer may record the log. Further, the packet classification device 100 may record a communication log and notify the management computer only when there is a possibility of a malicious host.

The packet classification device 100 is arranged at a place where a packet always passes when accessing an external network in order to prevent connection of a malicious host. Further, the packet classification device 100 arranged in the network may be single or plural. When arranging a plurality of packets, in order to prevent an increase in traffic, it is preferable to arrange the packets so as to avoid passing through the plurality of packet classification devices 100.

Next, the hardware and software configurations of the packet classification device 100 will be described. FIG. 3 is a diagram illustrating an example of a hardware configuration and a software configuration of the packet classification device 100 according to the embodiment of this invention. The packet classification device 100 includes a communication interface (IF) 101, a processor (CPU) 110, a memory 120, and a storage device 160, and each component is connected by a bus.

The communication interface (IF) 101 receives a packet transferred from the terminal 21, the DNS cache server 30, etc., and receives a command input from the management computer. The processor (CPU) 110 provides various functions by executing various programs stored in the memory 120, for example, a function of determining whether the connection destination (Web server 11) of the terminal 21 is a malicious host. I will provide a. The memory 120 stores various programs executed by the processor 110 and temporarily stores data necessary for executing the programs. The storage device 160 uses the information of the packet received via the communication interface (IF) 101 (for example, the absolute domain name of the connection destination (Web server 11) included in the name resolution request, the connection destination (Web) included in the name resolution result. For example, the IP address of the server 11) is accumulated, or the processing result by the program (the determination result of whether the connection destination of the terminal 21 is a malicious host or the like) is stored.

Next, the configurations of the memory 120 and the storage device 160 will be described. The memory 120 stores a communication control unit 121 that controls packet communication, and a detection unit (determination unit) 130 that determines whether or not the computer that communicates with the terminal 21 is a malicious host. In this embodiment, any method may be used to determine (classify) a malicious host, but by storing and learning information such as the absolute domain name and IP address of the server device that is the destination of the packet, the malicious host can be learned. The method of determining whether or not is adopted. The memory 120 also stores a learning unit 140 that collects and generates learning data in order to improve the accuracy of detecting a malicious host. The detection unit 130 and the learning unit 140 are composed of a program and data for executing the program. The storage device 160 provides a packet data storage unit 161 and a learning data storage unit 162. Each configuration will be described below.

The detection unit 130 determines whether the connection destination of the terminal 21 is a malicious host. The detection unit 130 includes an analysis unit 131, a feature extraction unit 132, and a classification unit 133. The analysis unit 131 temporarily stores the packet acquired from the communication IF 101, analyzes the information acquired from the received packet, and stores the analysis result in the packet data storage unit 161 as necessary.

The feature extraction unit 132 extracts feature information from the analysis result of the analysis unit 131. The analysis result by the analysis unit 131 may be directly acquired from the analysis unit 131, or the analysis result stored in the packet data storage unit 161 may be acquired.

The classifying unit 133 inputs the feature information extracted by the feature extracting unit 132 to the neural network, and based on the learning data stored in the learning data storage unit 162, the connection destination of the terminal 21 (the packet transmission destination, the Web server 11). ) Is a benign host or a malignant host (classification).

The learning unit 140 adjusts a parameter for improving the accuracy of the determination by the neural network based on the collected learning data in order to improve the classification (determination) accuracy by the classification unit 133, and stores the learning result in the learning data. This is reflected in the section 162. The learning data collection unit 141 collects learning data from the packet data storage unit 161 and the learning data storage unit 162. The neural network learning unit 142 carries out learning of the neural network based on the learning data collected by the learning data collection unit 141. At this time, the learning data before reflecting the learning result is acquired from the learning data storage unit 162, and after the learning is performed, the learning data reflecting the learning result is stored in the learning data storage unit 162. The learning data are parameters and data necessary for classifying the connection destination of the terminal 21 into a benign host or a malignant host by the neural network.

The learning of the neural network may be executed based on the execution instruction from the management computer, or may be executed periodically. Further, it may be executed when the unlearned data is accumulated in the packet data storage unit 161 by a predetermined amount or more.

The classifying unit 133 classifies (determines) the connection destination of the terminal 21 into a benign host or a malignant host using a neural network. In this embodiment, a machine learning library such as TensorFlow or LIBSVM is used as an algorithm for classifying the connection destination of the terminal 21.

Next, a procedure for transferring the packet received by the packet classification device 100 to the external network will be described. FIG. 4 is a diagram showing an example of a configuration for the packet classification device 100 of the present embodiment to transfer a packet. The packet classification device 100 of the present embodiment uses an Intel (registered trademark) data plane development kit (DPDK; Data Plan Development Kit) technology to speed up network processing. The DPDK provides specialized functionality that bypasses kernel functionality for specific applications. A solution other than DPDK may be applied as long as it has equivalent functions.

The packet received by the communication IF 101 is temporarily stored in the reception buffer RX (data reception unit) 102 provided by the DPDK and delivered to the detection unit 130. The reception buffer RX (data reception unit) 102 has a queue structure and sends out the packets to the detection unit 130 in the order of reception. Then, the analysis unit 131, the feature extraction unit 132, and the classification unit 133 classify (determine) the transmission destination of the packet (the connection destination of the terminal 21; the Web server 11) as a benign host or a malignant host.

Further, the packet is stored in the transmission buffer TX (data transmission unit) 103 and transmitted to the external network 10 via the communication IF 101. At this time, if the destination of the packet is a malicious host, the packet may be discarded without being stored in the transmission buffer TX103. With this configuration, it is possible to use general network equipment other than the packet classification device 100, such as the function of discarding the packet designated on the router side, and it is possible to reduce the introduction cost. On the other hand, the router that transfers the packet to the external network 10 may be notified that the destination is a malicious host, and the router may discard the packet.

Next, an application example of the real-time detection system to which the present invention is applied will be specifically described. As described above, the method for detecting a malicious host in the present embodiment employs an existing technique, and specifically uses a machine learning library such as TensorFlow or LIBSVM. The detection of malicious hosts by these methods has been improved in accuracy due to technological advances and the accumulation of learning data. On the other hand, since it takes time to extract and analyze the feature amount based on the information extracted from the received packet, it is difficult to detect the malicious host in real time. The present embodiment aims to achieve both a practical packet transfer speed and high attack detection accuracy.

On the other hand, it is not easy to maintain a practical packet transfer rate while increasing the detection accuracy of malicious hosts by speeding up algorithms and improving hardware performance. As described above, since the existing technology is used for the detection accuracy of the malicious host, the present invention aims to maintain the packet transfer rate. Here, the result of measuring the processing time of each process executed to start communication from the terminal 21 to the connection destination server device (Web server 11) is shown.

FIG. 5 is a diagram showing the processing time of each process until the terminal 21 starts communication with the Web server 11 in this embodiment. The graph is a box-and-whisker diagram, the vertical axis is the processing time (μsec) and the logarithmic axis, and the horizontal axis is the process. In FIG. 5, the processing time of each process is shown for each algorithm when LIBSVM is applied to the classification unit 133 (left) and TensorFlow is applied (right). Each process is reception (RX), analysis (parse, Parser), feature extraction (Extractor Processing), classification (Classifier parts), and total (Total).

As shown in Figure 5, the classification (dashed line) requires more processing time than other processes. Further, in the steps other than classification, there is little difference in processing time between algorithms, but in the classification step, applying TensorFlow is faster than applying LIBSVM. The total processing time for one packet is 0.4231 μs (2.118 Gbps) when no malicious host is detected, 557.8 μs (1.264 Mbps) when LIBSVM is applied, and TensorFlow is applied. Is 72.492 μs (9.60 Mbps). The algorithm for classification may be selected according to the required processing speed and detection accuracy.

As described above, the process of detecting a malicious host becomes a bottleneck during packet transfer, so it is necessary to increase the speed by 100 to 1000 times in order to realize a practical packet transfer speed. Therefore, in the present invention, focusing on the communication procedure, while the terminal device 21 is performing name resolution of the server device connected to the external network with which the terminal 21 is trying to communicate, the connection destination server device is a malicious host or a benign host. Determine (classify) whether there is. The feature of the present invention is that the detection of the malicious host is started based on the information (absolute domain name, etc.) included in the name resolution request of the server device (Web server 11) of the connection destination transmitted from the terminal 21, and By completing the detection of the malicious host until the IP address of the server device of the connection destination is specified, it is possible to prevent the terminal 21 from actually connecting to the malicious host.

FIG. 6 is a diagram explaining the timing of detecting a malicious host in the embodiment of the present invention. The packet classification device 100 includes (1) a timing T1 at which the terminal 21 sends a name resolution request to the DNS cache server 30, (2) a timing T2 at which the DNS cache server 30 sends a result of name resolution to the terminal 21, (3). At timing T3 when the terminal 21 starts communication with the Web server 11, it is determined whether the Web server 11 is a malicious host. By determining whether or not the connection destination (Web server 11) is a malicious host at timings T1, T2, and T3, communication can be blocked before connecting to the malicious host (before being attacked by a cyber attack). The configuration for detecting a malicious host at each timing will be described below.

FIG. 7 is a diagram illustrating a configuration for detecting a malicious host at a timing T1 when the terminal 21 transmits a name resolution request to the DNS cache server 30 in the embodiment of the present invention. At timing T1, the terminal 21 transmits a name resolution request (DNS query) for specifying the IP address of the connection destination (Web server 11) to the DNS cache server 30. The packet classification device 100 receives the name resolution request transmitted from the terminal 21, and determines whether the connection destination (Web server 11) is a malicious host based on the information included in the name resolution request.

Upon receiving the name resolution request from the terminal 21, the packet classification device 100 stores the packet corresponding to the name resolution request in the reception buffer RX 102 via the communication IF 101. The analysis unit 131 refers to the content of the received name resolution request and extracts the absolute domain name (FQDN). Further, the domain white list in which the absolute domain name of the benign host is recorded is referred to, and it is determined whether or not the extracted absolute domain name is included in the domain white list. If the extracted absolute domain name is included in the domain white list (“legitimate”), the connection destination is a benign host, and therefore the packet corresponding to the name resolution request is stored in the transmission buffer TX103. The packet stored in the transmission buffer TX103 is transmitted to the DNS cache server 30 by the communication control unit 121.

When the extracted absolute domain name is not included in the domain whitelist (“not matched”), the analysis unit 131 refers to the domain blacklist in which the absolute domain name of the malicious host is recorded and is extracted. Determine if the absolute domain name is included in the domain blacklist. When the extracted absolute domain name is included in the domain black list (“malicious”), the connection destination is a malicious host, so the packet to be transmitted is discarded. At this time, a message indicating that the terminal 21 cannot be connected may be returned to the terminal 21.

If the extracted absolute domain name is not included in the domain blacklist (“not matched”), it is not possible to identify whether the connection destination is a malicious host or a benign host, so the feature extraction unit 132 Characteristic information is extracted from the information included in the name resolution request, and the connection destination is classified by the classification unit 133 into a malicious host or a benign host. Also, since processing time is required to classify a malicious host or a benign host, a packet corresponding to a name resolution request is stored in the transmission buffer TX103 in order to prevent a delay in access to a connection destination. As a result, a name resolution request is sent to the DNS cache server 30, and connection destination classification can be performed in parallel while the DNS cache server 30 is performing name resolution. When the classification result is derived, the classification unit 133 reflects the classification result in the domain white list (“legitimate”) if the classification result is a benign host, and reflects the domain black list in the case of the malicious host (“malicious”). ).

As described above, when the name resolution request is transmitted from the terminal 21 to the DNS cache server 30, the packet classification device 100 determines whether the connection destination is a benign host based on the information such as the absolute domain name included in the name resolution request. Determine if it is a malicious host. When the absolute domain name is not included in the domain black list or the domain white list and it is not possible to identify whether it is a benign host or a malicious host, the detection unit 130 determines based on the characteristic information and the learning data of the connection destination. It classifies (determines) whether the connection destination is a malicious host or a benign host. At this time, a name resolution request is transmitted to the DNS cache server 30, the connection destinations are classified while the DNS cache server 30 is performing name resolution, and the classification result is reflected in the domain black list or the domain white list. In this way, by classifying the absolute domain name of the connection destination while the DNS cache server 30 is performing name resolution, communication delay can be minimized.

Upon receiving the name resolution request sent from the terminal 21, the DNS cache server 30 identifies the IP address of the connection destination and sends the name resolution result including the identified IP address to the terminal 21. Upon receiving the name resolution result from the DNS cache server 30 (timing T2), the packet classification device 100 determines again whether or not the connection destination is a malicious host. Hereinafter, the processing at the timing T2 will be described.

FIG. 8 is a diagram illustrating a configuration for detecting a malicious host at the timing T2 when the terminal 21 receives the name resolution result from the DNS cache server 30 in the embodiment of the present invention. Upon receiving the name resolution result from the DNS cache server 30, the packet classification device 100 stores the packet corresponding to the name resolution result in the reception buffer RX102 via the communication IF101.

The analysis unit 131 determines again whether or not the connection destination is a malicious host based on the domain black list and the domain white list that reflect the result of classifying the absolute domain names when the name resolution request is received (timing T1). To do. More specifically, first, it is determined whether or not the absolute domain name of the connection destination is included in the domain white list. At this time, if the absolute domain name of the connection destination is included in the domain white list (“legitimate”), the connection destination is a benign host, and therefore a packet corresponding to the name resolution result is stored in the transmission buffer TX103. .. The packet stored in the transmission buffer TX103 is transmitted to the terminal 21 by the communication control unit 121.

When the absolute domain name is not included in the domain white list (“not matched”), the analysis unit 131 determines whether the absolute domain name is included in the domain black list. If the absolute domain name is included in the domain blacklist (“malicious”), the connection destination is a malicious host, and the packet corresponding to the name resolution result is discarded. Furthermore, when the IP address of the domain of the connection destination is included in the name resolution result (“domainexist”), it is added (updated) to the IP black list in which the IP address of the malicious host is recorded.

On the other hand, when the absolute domain name is not included in the domain blacklist (“not matched”), the processor 110 stores the packet corresponding to the name resolution result in the transmission buffer TX103, and the communication controller 121 causes the terminal 21 Send to.

As described above, when the name resolution result is transmitted from the DNS cache server 30 to the terminal 21, while the DNS cache server 30 is performing the name resolution, the domain blacklist and the domain blacklist in which the classification result of the connection destination domain is reflected and Based on the domain whitelist, it is judged (classified) again whether it is a benign host or a malignant host. Since it is determined whether or not the connection can be made in parallel with the name resolution of the connection destination domain, the user can operate the terminal 21 without being aware of the time required to determine the malicious host. If the connection destination is not classified at the time of responding the name resolution result, the detection accuracy may be prioritized and wait until the classification is completed, or the malicious host may be prioritized to suppress the communication time delay. The determination may be omitted.

Upon receiving the name resolution result from the DNS cache server 30, the terminal 21 accesses the connection destination Web server 11 based on the connection destination IP address included in the name resolution result. Upon receiving the access request to the Web server 11 (timing T3), the packet classification device 100 determines whether the computer corresponding to the connection destination IP address is a malicious host. The processing at timing T3 will be described below.

FIG. 9 is a diagram illustrating a configuration for detecting a malicious host at the timing T3 when the terminal 21 accesses the connection destination Web server 11 in the embodiment of the present invention. Upon receiving an access request (connection request) to the connection destination Web server 11 from the terminal 21, the packet classification device 100 stores the packet corresponding to the access request in the reception buffer RX102 via the communication IF 101.

The analysis unit 131 extracts the IP address of the connection destination (Web server 11) included in the access request and determines whether the IP address is included in the IP black list. If the extracted IP address is included in the IP blacklist (“domainexist”), the connection destination is a malicious host, so the packet to be transmitted (access request) is discarded. On the other hand, when the extracted IP address is not included in the IP blacklist (“not matched”), the transmission buffer TX103 stores the packet corresponding to the access request to the connection destination, and the communication control unit 121 connects the packet. It is sent to the destination (Web server 11).

As described above, according to the embodiment of the present invention, when the terminal 21 starts communication with the web server 11, it is possible to determine whether the connected web server 11 is a malicious host while performing name resolution. Since it is possible to make a determination, it is possible to detect a cyber attack in real time without making the user feel a decrease in communication speed.

Although the embodiment of the present invention has been described above, the above embodiment merely shows a part of the application example of the present invention, and the technical scope of the present invention is limited to the specific configuration of the above embodiment. Absent.

10 External network (first network)
11 Web server (server device)
20 Internal network (second network)
21 terminal 30 DNS cache server (DNS server)
40 router 60 authoritative DNS server 100 packet classification device (communication device)
101 Communication Interface (IF)
102 reception buffer RX (data reception unit)
103 Transmission buffer TX (data transmission unit)
110 processor (CPU)
120 memory 121 communication control unit 130 detection unit (determination unit)
131 Analysis Unit 132 Feature Extraction Unit 133 Classification Unit 140 Learning Unit 141 Learning Data Collection Unit 142 Neural Network Learning Unit 160 Storage Device 161 Packet Data Storage Unit 162 Learning Data Storage Unit

Claims

A communication device for determining whether the server device is a malicious host when accessing the server device from a terminal connected to a network,
The terminal transmits a name resolution request including an absolute domain name of the server device to a DNS server that specifies an IP address corresponding to the absolute domain name,
The DNS server identifies an IP address corresponding to an absolute domain name included in the name resolution request, and sends a name resolution result including the identified IP address to the terminal,
The terminal starts communication with the server device based on the name resolution result transmitted from the DNS server,
The communication device is
A data receiving unit that receives the data transmitted from the terminal regardless of the destination of the data,
A determination unit that determines whether the server device is a malicious host;
A data transmitting unit that transmits the data received by the data receiving unit to a destination of the data;
Equipped with
When the data receiving unit receives the name resolution request sent to the DNS server, the determining unit determines whether the server device is a malicious host based on the absolute domain name included in the name resolution request. Determine whether
The data transmission unit transmits the name resolution request to the DNS server regardless of whether a determination result as to whether the server device is a malicious host has been derived,
When the data receiving unit receives the name resolution result from the DNS server, the determination unit determines that the server device is a malicious host based on the determination result by the name resolution request corresponding to the name resolution result. A communication device characterized by determining whether or not.
The communication device according to claim 1,
When the determination result by the name resolution request is not derived at the timing when the data receiving unit receives the name resolution result from the DNS server, the name resolution result is transmitted to the terminal,
When the data receiving unit receives an access request for the server device from the terminal, the determining unit determines whether the server device is a malicious host based on the determination result by the name resolution request. A communication device characterized by:
In the communication device according to claim 1 or 2,
Further comprising a communication control unit for controlling communication between the terminal and the server device,
The communication device, wherein the communication control unit cuts off communication between the terminal and the server device when it is determined that the server device is a malicious host.
The communication device according to any one of claims 1 to 3,
A learning unit is further provided, which generates learning data based on the determination result by the determination unit, and accumulates the learning data.
The communication device, wherein the determination unit determines whether the server device is a malicious host based on the accumulated learning data.
The communication device according to claim 4,
The determination unit,
It has a domain whitelist that stores the absolute domain names of server devices that are not malicious hosts,
Reflect the determination result based on the learning data in the domain whitelist,
A communication device, which determines that the server device is not a malicious host based on the domain whitelist.
The communication device according to claim 4 or 5,
The determination unit,
It has a domain blacklist that stores the absolute domain names of server devices that are malicious hosts.
Reflect the determination result based on the learning data in the domain blacklist,
A communication device, characterized in that the server device is determined to be a malicious host based on the domain blacklist.
The communication device according to claim 6,
The determination unit,
It has an IP blacklist that stores the IP addresses of server devices that are malicious hosts.
Reflecting the determination result based on the domain blacklist in the IP blacklist,
A communication device, characterized in that the server device is determined to be a malicious host based on the IP blacklist.