WO2022249399A1

WO2022249399A1 - Denial-of-service attack detection device, method, and program

Info

Publication number: WO2022249399A1
Application number: PCT/JP2021/020232
Authority: WO
Inventors: 伸之千綿; 寛吉田
Original assignee: 日本電信電話株式会社
Priority date: 2021-05-27
Filing date: 2021-05-27
Publication date: 2022-12-01
Also published as: JPWO2022249399A1

Abstract

One aspect of this invention is such that when the number of multiple responses transmitted from a second communication device at an arbitrary cycle are counted, the responses being those to a first request transmitted from a first communication device, and the count value per unit time thereof has been determined to exceed a first threshold value, the multiple responses are determined to be a sequence suspected to be an attack and an attack suspicion monitoring state is set. In said state, when a second request has been transmitted from the first communication device, the second request is transferred to the second communication device after having been delayed for a prescribed period of time. In addition, when the number of multiple responses to the second request transmitted from the second communication device are counted, and the count value per unit time thereof has been determined to exceed a second threshold value, the multiple responses to the second request are determined to be an attack sequence and information indicating the same is output.

Description

Denial of service attack detection device, method and program

One aspect of the present invention is to interfere with the services provided by the website by intentionally overloading resources such as the server device and network of the website and exploiting vulnerabilities, so-called DoS (Denial of Service) attack detection device, method and program used to detect denial of service attacks.

In recent years, DoS attacks have become more serious and complex, and security measures against DoS attacks have become essential. As a method for detecting DoS attacks, for example, as disclosed in Non-Patent Document 1, flow monitoring that centrally monitors the traffic of the entire network to detect malicious attacks, and monitoring the content (payload) of all IP packets There is known packet monitoring for detecting malicious attacks by viruses and the like.

By the way, DoS attacks targeting server devices of specific websites include, for example, request attacks using requests and response attacks using responses. Among these, the request attack is to send a large number of malicious attack requests to a specific site. For request attacks, for example, the number of identical requests received within a certain period of time is counted, and when the number of received requests exceeds a threshold, the group of requests is regarded as an attack request and blocked. It is possible.

On the other hand, a response attack sends a large amount of malicious attack responses from the communication destination to the server device in response to a request sent from the server device of a specific site. For response attacks, the tuple of the response is detected, for example, by a firewall (Fire Wall: FW) placed on the communication path, and if the response is determined to be invalid based on the detection result, the response is blocked. It is possible to respond by

However, when malicious responses are valid and sent in large numbers, it is generally difficult for the firewall to determine whether the large number of responses are due to retransmission of normal responses or for attack purposes. is. The reason for this is that normally, the response retransmission cycle is arbitrarily set for each communication partner terminal, and the transmission delay in the network is not constant, so it is difficult to judge normality/attack by monitoring only the response retransmission interval. . In this case, the attack response can be determined by analyzing in detail the content of the received response packet by the server device. However, since the analysis process requires a large processing load and processing time, the processing capacity of the server apparatus is used, and there is a problem that countermeasures against attack responses tend to be delayed.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and aims to provide a technique for detecting a malicious attack using valid responses on a communication path in a short period of time with relatively simple processing. .

One aspect of the denial of service attack detection device or method according to the present invention for solving the above problems is a system that transmits data via a communication path between a first communication device and a second communication device, The denial of service attack detection device arranged in the communication path includes a first count processing unit, a first determination processing unit, a request delay processing unit, and a second count processing. and a second determination processing unit.

A first count processing unit counts the number of a plurality of responses transmitted from the second communication device in an arbitrary cycle in response to the first request transmitted from the first communication device, get the count value of The first determination processing unit determines whether the first count value per predetermined unit time exceeds a preset first threshold value, and determines whether the first count value exceeds the When it is determined that the first threshold is exceeded, the plurality of responses to the first request are determined as a sequence suspected of an attack, and a suspected attack monitoring state is set. A request delay processing unit delays a second request transmitted from the first communication device by a preset time while the suspected attack monitoring state is set, and then transmits the second request to the second communication device. Forward. The second count processing unit counts the number of responses transmitted from the second communication device to the second request to obtain a second count value. determining whether or not the second count value per unit time exceeds a second threshold, and determining that the second count value exceeds the second threshold case, the plurality of responses to the second request are determined to be an attack sequence, and information indicating that an attack has been detected is output.

According to one aspect of the present invention, it is possible to provide a technology that enables a malicious attack using valid responses to be detected on a communication path in a short period of time with relatively simple processing.

Furthermore, by applying the technology according to one aspect of the present invention to the inter-network connection device, it is possible to reduce the processing load in the server device when performing analysis processing for detecting malicious attacks using valid responses. It becomes possible.

FIG. 1 is a diagram showing an example of a sequence when a response is normally transmitted from a communication destination device. FIG. 2 is a diagram showing an example of a sequence when an attack response is sent from a communication destination device. FIG. 3 is a sequence diagram showing an example of detection processing according to an embodiment of the present invention when a response suspected of an attack is sent from a communication destination device. FIG. 4 is a schematic block diagram of a data communication system provided with an inter-network connection device having the function of a denial of service attack detection device according to one embodiment of the present invention. FIG. 5 is a block diagram showing the hardware configuration of the inter-network connection device shown in FIG. FIG. 6 is a block diagram showing the software configuration of the inter-network connection device shown in FIG. FIG. 7 is a flow chart showing a processing procedure and processing contents of packet transfer processing by the inter-network connection device shown in FIG. FIG. 8 is a flow chart showing a processing procedure and processing contents of determination processing by the inter-network connection device shown in FIG. FIG. 9 is a flow chart showing a processing procedure and processing contents of a suspected attack detection judgment processing in the judgment processing shown in FIG. FIG. 10 is a flowchart showing a processing procedure and processing contents of attack detection determination processing in the determination processing shown in FIG. FIG. 11 is a sequence diagram showing overall processing operations by the inter-network connection device shown in FIG.

[Application example]
First, an application example of the present invention will be described.
1 and 2 show an example of the connection sequence executed between the server device SV and the communication destination device TM. FIG. 2 shows the sequence when the malicious communication destination device TM(N) transmits the attack response.

If the communication destination device TM is a device TM(T) used by a legitimate user, the communication destination device TM(T) sends a response SYN-ACK to the request SYN sent by the server device SV, as shown in FIG. to send. In this case, after transmission of the response SYN-ACK, the communication destination device TM(T), in consideration of network delays, performs a retransmission sequence indicated by ACK(T) each time a predetermined time set in the timer elapses. send a response SYN-ACK to . The timing of the timer is arbitrarily set for each communication destination device TM(T). When the server device SV receives a valid response SYN-ACK, it returns an acknowledgment ACK, after which a communication link is established between the server device SV and the communication destination device TM, enabling data transmission between the devices. become.

On the other hand, suppose that a malicious service disruptor repeatedly sends a large number of attack responses SYN-ACK in response to requests SYN from the communication destination device TM(N), as shown in ACK(N) in Fig. 2, for example. In this case, an excessive load is applied to the server device SV and the communication path leading to the server device SV, and the server device SV falls into a state where it is difficult to perform data communication. In this case, for example, if the inter-network connection device LT arranged between the server device SV and the network has a firewall (FW) function, the firewall function enables/disables the attack response SYN-ACK. is determined. Then, if the response is determined to be invalid, the attack response SYN-ACK is blocked thereafter. However, if the attack response SYN-ACK is determined to be valid, the attack response SYN-ACK continues to be transmitted to the server device SV, and the server device SV continues to be disturbed.

Therefore, in one application example of the present invention, for example, the following measures are taken. FIG. 3 is a sequence diagram showing an example thereof.

That is, the network connecting device LT counts the number of responses SYN-ACK sent from the communication destination device TM. Then, when the number of counts per unit time exceeds the threshold value, the response SYN-ACK is determined to be a "response suspected of attack", and the "suspected attack monitoring state" is set.

Subsequently, when the next request SYN is transmitted from the server device SV while the above-described "suspected attack monitoring state" is set, the network connection device LT receives the request SYN by a predetermined amount TD within a range that does not result in a communication error. After being delayed, it is transferred to the destination device TM. Then, if the number of responses SYN-ACK per unit time transmitted from the communication destination device TM in response to the request SYN decreases below a predetermined value, the response SYN-ACK is determined to be a normal response, and the "attack Suspicious monitoring state” is canceled and the normal connection sequence continues. On the other hand, if the number of responses SYN-ACK per unit time is still equal to or greater than the predetermined value, the response SYN-ACK is determined to be an attack response and notified to that effect to the server device SV.

As described above, when a DoS attack in which a large number of attack responses SYN-ACK is sent from a malicious communication destination device TM(N) is performed, the network connection device LT retransmits the above DoS attack with normal responses. can be detected by distinguishing from

Moreover, even if a response suspecting an attack is detected, it is not immediately determined to be a DoS attack, and if the number of responses SYN-ACK received after that changes, it is determined to be a normal response. Therefore, it is possible to accurately determine whether or not it is an attack, and if it is determined to be normal, communication can be continued. That is, it is possible to achieve both detection of a DoS attack using a valid response and continuation of normal communication.

[One embodiment]
An embodiment according to the present invention will be described below with reference to the drawings.

(Configuration example)
(1) System FIG. 4 is a diagram showing an example of a data communication system in which the functions of a denial of service attack detection device according to an embodiment of the present invention are provided in an inter-network connection device.
A data communication system according to one embodiment enables transmission of information data, for example, between an internal network LNW operated by a company or organization and a communication destination device TM used by an external general user via a wide area network INW. It is intended to be The wide area network INW comprises, for example, the Internet and an access network for accessing the Internet.

The in-house network LNW is composed of, for example, a LAN (Local Area Network) and a wireless LAN. The in-house network LNW is provided with a server device SV and an inter-network connection device LT. The server device SV has functions as, for example, a Web server device, and includes, for example, a service for providing various information, a service for collecting, accumulating, and managing various user data, and performing predetermined analysis and processing on data collected from users. It provides a service that performs editing processing and provides it to the user.

The network connection device LT is composed of, for example, a gateway or a router. The inter-network connection device LT has, as basic functions, a data transmission function between the server device SV and a plurality of communication terminals (not shown) provided in the in-house network LNW; and a data transmission function to and from the wide area network INW.

The in-house network LNW may be, for example, a home network operated by an individual user other than one operated by a company or organization. In this case, a user terminal such as a personal computer is used instead of the server apparatus SV be done.

The communication destination device TM is, for example, a personal computer or a server device computer, and is originally used to receive various services provided by the server device SV of the internal network LNW. A mobile information terminal such as a smart phone or a tablet terminal may be used as the communication destination device TM.

(2) Inter-network connection device LT
5 and 6 are block diagrams showing the hardware configuration and software configuration of the network connection device LT, respectively.

The network connection device LT includes a control section 1 using a hardware processor such as a central processing unit (CPU). A storage unit having a program storage section 2 and a data storage section 3 and a communication I/F 4 are connected to the control section 1 via a bus 5 .

Under the control of the control unit 1, the communication I/F 4 transmits and receives data to and from an external communication destination device TM connected to the wide area network INW according to the communication protocol defined by the wide area network INW and the in-house network LNW. , and data transmission/reception between the server device SV and the communication terminal in the in-house network LNW. In addition, communication I/F4 is provided with the buffer which temporarily stores a received packet for transmission/reception of the said data.

The program storage unit 2 includes, for example, a non-volatile memory such as a HDD (Hard Disk Drive) or SSD (Solid State Drive) that can be written and read at any time as a storage medium, and a non-volatile memory such as a ROM (Read Only Memory). In addition to middleware such as an OS (Operating System), it stores programs necessary for executing various control processes according to one embodiment of the present invention.

The data storage unit 3 is, for example, a combination of a non-volatile memory such as an HDD or an SSD that can be written and read at any time and a volatile memory such as a RAM (Random Access Memory) as a storage medium. A counter information storage unit 31, a delay information storage unit 32, and a suspected attack monitoring state storage unit 33 are provided as main data storage areas necessary for carrying out the embodiment.

The counter information storage unit 31 is used to store a count value representing the number of responses transmitted from the communication destination device TM in the connection sequence. Specifically, this count value is a value obtained by counting the number of responses received per unit time for each of the same 5-tuples.

The delay information storage unit 32 is used to store a "request delay state" indicating whether or not a request transmitted from the server device SV in the connection sequence is to be delayed.

The suspected attack monitoring state storage unit 33 is used to store the "suspected attack monitoring state" indicating that a suspected attack is being monitored.

The control unit 1 includes a packet monitoring processing unit 11, a response number counting processing unit 12, a request delay processing unit 13, and a determination process as processing functions necessary for executing various processes according to one embodiment of the present invention. and an attack detection notification processing unit 15 . The processes by these processing units 11 to 15 are realized by causing the CPU to execute the programs stored in the program storage unit 2. FIG.

Every time a packet is received by the communication I/F 4, the packet monitoring processing unit 11 monitors the contents of the received packet and determines whether the received packet is a request or a response. If the received packet is determined to be a response, the validity/invalidity of the response is determined based on the 5-tuple of the received packet. Then, when it is determined to be valid, the 5-tuple of the number of responses is passed to the response number count processing unit 12 . The 5-tuple of a packet is header information including the source IP/port number, destination IP/port number, and protocol number of the packet.

Also, when the received packet is determined to be a request, the packet monitor processing unit 11 notifies the request delay processing unit 13 of a request delay processing request. Then, when a request delay processing completion notification is returned from the request delay processing unit 13 in response to this notification, a process of instructing the communication I/F 4 to transfer the received packet is performed.

When receiving the 5 tuples of the received response from the packet monitoring processing unit 11, the response number count processing unit 12 counts the same 5 tuples as the 5 tuples stored in the counter information storage unit 31 per unit time. The count value per unit time of the received responses with the same value, that is, the 5-tuple, is added.

The request delay processing unit 13 stores information representing the "request delay state" in the delay information storage unit 32 when receiving a request delay instruction from the determination processing unit 14, which will be described later. When a request delay processing request is received from the packet monitoring processing unit 11 in this state, waiting processing is performed according to the delay time information stored in the delay information storage unit 32, and when the waiting processing is completed, request delay processing is performed. A process of returning a completion notification to the packet monitoring processing unit 11 is performed.

The determination processing unit 14 is periodically activated at a preset cycle, and has the following various processing functions.
(1) First, based on the state information stored in the suspected attack monitoring state storage unit 33, it is determined whether or not the suspected attack is being monitored. Then, if the suspected attack is not being monitored, the count value per unit time of the received responses having the same 5-tuple stored in the counter information storage unit 31 is compared with the first threshold, and the received response is a response that suspects an attack. As a result of this determination, when it is determined that the response is suspected of an attack, the information indicating the state of suspected attack monitoring is stored in the attack suspected monitoring state storage unit 33, and the request delay processing unit 13 is notified of the request delay. The process of notifying instructions.

(2) When the information indicating the state of the suspected attack monitoring state storage unit 33 is set, the 5-tuples stored in the counter information storage unit 31 are the same per unit time of the received response. is compared with a second threshold to determine whether the received response is a normal response or an attack response. Then, if it is an attack response, a process of transmitting information representing the detection result to that effect to the attack detection notification processing unit 15 .

(3) On the other hand, if the received response is a normal response, the information indicating the state of suspected attack monitoring set in the suspected attack monitoring state storage unit 33 is changed to information indicating the normal monitoring state, and the request A process of sending a request delay instruction cancellation notification to the delay processing unit 13 .

When the attack detection notification processing unit 15 receives information indicating that an attack response has been detected from the determination processing unit 14, it performs processing for transmitting an attack detection notification to the server device SV.

(Operation example)
Next, an operation example of the inter-network connection device LT configured as described above will be described.
7 to 10 are flow charts showing processing procedures and processing contents of processing executed by the control unit 1 of the network connection device LT, and FIG. 11 is a sequence diagram showing the overall processing operation of the network connection device LT.

(1) Transfer processing of requests at normal time When a packet is received by the communication I/F 4, the network connection device LT saves the received packet in the buffer of the communication I/F 4 and sends it to the control unit 1. hand over.

Under the control of the packet monitoring processing unit 11, the control unit 1 monitors reception of packets in step S10 shown in FIG. Then, when the received packet is passed from the communication I/F 4, it is determined whether the received packet is a request or a response based on the content of the received packet in step S11. As a result of this determination, if the received packet is a request transmitted from the server device SV, the request delay processing request is notified to the request delay processing unit 13 in step S12.

Upon receiving the request delay processing request from the packet monitor processing unit 11, the request delay processing unit 13 determines whether or not the information representing the "request delay state" is stored in the delay information storage unit 32 in steps S13 and S14. do. Then, if the information indicating the "request delay state" is not saved, the processing completion notification is sent to the packet monitor processing unit 11 without executing the delay processing. When the packet monitoring processing unit 11 receives the processing completion notification, it gives a received packet transfer instruction to the communication I/F 4 in step S17. As a result, the received packet held in the buffer of communication I/F4 is transmitted from communication I/F4 to wide area network INW.

(2) Counting the Number of Responses Received When the received packet is determined to be a response in step S11, the packet monitoring processing unit 11 determines whether the response is valid or invalid based on the received 5-tuple of the response. Determine whether it is As a result of this determination, if the response is invalid, the response is discarded without being transferred.

On the other hand, if the received response is valid, the packet monitor processing unit 11 passes the 5-tuple of the received response to the response count processing unit 12 as received response information in step S21. When the 5 tuples of the received response are delivered, the response count processing unit 12 reads the count value per unit time of the same 5 tuples as the 5 tuples from the counter information storage unit 31 in step S22. Then, the read count value is added, that is, incremented in step S23. As a result, the number of reception responses with the same 5-tuple received per unit time is counted.

Also, the packet monitoring processing unit 11 gives a received packet transfer instruction to the communication I/F 4 in step S24. As a result, the reception response packet held in the buffer of the communication I/F 4 is transmitted from the communication I/F 4 to the wide area network INW.

(3) Determining Process of Received Response The control unit 1 of the inter-network connection device LT executes the following determining process for the received response in parallel with the process of monitoring the received packet.

(3-1) Determining whether to execute suspected attack detection determination or attack detection determination The control unit 1 of the inter-network connection device LT, under the control of the determination processing unit 14, performs step Whether or not the determination timing has come is monitored at a cycle preset by S30. In this state, when the determination timing comes, the determination processing unit 14 reads the count value for each 5-tuple of the received response from the counter information storage unit 31 in step S31. Further, in step S32, the determination processing unit 14 determines whether the information indicating the "attack suspected monitoring state" or the "normal monitoring state" is stored in the suspected attack monitoring state storage unit 33. . As a result of this determination, if the information indicating the "normal monitoring state" is stored, the process proceeds to step S33, and the "suspected attack detection determination" for determining whether or not the received response is a response suspecting an attack process". On the other hand, if the information indicating the "suspected attack monitoring state" is stored, the process proceeds to step S34 to determine whether the received response is an attack response or a normal response. Judgment processing” is executed.

(3-2) Suspected Attack Detection Determination Processing The determination processing unit 14, as shown in FIG. Determine whether a threshold of 1 is exceeded. Here, the first threshold is set to, for example, the maximum number of normal responses received per unit time. As a result of the determination, if the count value is equal to or less than the first threshold value, the determination processing unit 14 determines that the received response is not a response suspecting an attack, and terminates the determination processing as it is.

On the other hand, it is assumed that the count value exceeds the first threshold value as a result of the above determination. In this case, the determination processing unit 14 determines that the received response corresponds to a response suspected of an attack, and first notifies the request delay processing unit 13 of a request delay instruction in step S333. Upon receiving the request delay instruction, the request delay processing unit 13 causes the delay information storage unit 32 to store information representing the "request delay state" in step S334.

Also, the determination processing unit 14 changes the "normal monitoring state" stored in the attack suspected monitoring state storage unit 33 to the "attack suspected monitoring state" in step S335. Then, in step S336, the determination processing unit 14 updates the count value of the number of received corresponding responses stored in the counter information storage unit 31 from the previous value to the current value.

(3-3) Request Delay Processing When the control unit 1 of the inter-network connection device LT detects that the next request is received in step S11 of FIG. 7 under the control of the packet monitoring processing unit 11, step S12. notifies the request delay processing unit 13 of the request delay processing request. Then, the request delay processing unit 13 determines whether or not information representing the "request delay state" is stored in the delay information storage unit 32 in steps S13 and S14.

Assume that as a result of this determination, information representing the "request delay state" is currently stored in the delay information storage unit 32. Then, the request delay processing unit 13 proceeds to step S15 and performs a waiting process for delaying transfer of the request by the delay time according to the delay time information stored in the delay information storage unit 32 . Here, the delay time is set within a range in which the communication destination device TM does not judge the request as a communication error. Upon completion of the waiting process, the request delay processing unit 13 sends a request delay processing completion notice to the packet monitor processing unit 11 at that time.

Upon receiving the request delay processing completion notification, the packet monitoring processing unit 11 issues a received packet transfer instruction to the communication I/F 4 in step S17. As a result, the received packet held in the buffer of communication I/F4 is transmitted from communication I/F4 to wide area network INW.

That is, when the next request is sent from the server device SV while a suspected attack is being monitored, this request is delayed for a certain period of time by the network connection device LT and then transferred to the communication destination device TM.

(3-4) Attack detection determination process If the transfer timing of the request is delayed as described above, if the communication destination device TM is a device TM(T) that operates normally, the retransmission timer will follow the operation of the retransmission timer. Reduces the number of retransmitted responses. On the other hand, if the communication destination device TM is a device TM(N) used by a malicious interferer, the response is transmitted ignoring the operation of the retransmission timer, so the number of responses retransmitted per unit time is not decrease.

Therefore, when the judgment processing unit 14 shifts to the attack detection judgment processing, as shown in FIG. It is determined whether or not the second threshold is exceeded. Here, the second threshold value is set to the maximum number of retransmissions of normal responses per unit time by the communication destination device TM according to the retransmission timer after the delay processing of the request. Note that the second threshold may be set to the same value as the first threshold.

If the result of the above determination is that the count value is equal to or less than the second threshold value, the determination processing unit 14 determines that the received response is a response transmitted from the normal communication destination device TM(T). Then, the determination processing unit 14 shifts to step S344, and changes the information indicating the state of suspected attack monitoring set in the attack suspected monitoring state storage unit 33 to information indicating the normal monitoring state. Further, in step S345, the request delay processing unit 13 is sent a cancellation notification of the request delay instruction previously notified in the attack suspect detection determination processing.

On the other hand, if it is determined that the count value exceeds the second threshold value as a result of determination in steps S341 and S342, the determination processing unit 14 determines that the received response is malicious communication destination device TM(N). determined to be an attack response sent from Then, in step S343, the attack detection notification processing unit 15 is notified of information indicating that the attack response has been detected.

When notified of the detection result information, the attack detection notification processing unit 15 transmits an attack detection notification to, for example, the server device SV. When the server device SV receives the attack detection notification, the server device SV performs a corresponding process such as refusing to receive the attack response.

(action/effect)
As described above, in one embodiment, the network connection device LT counts the number of responses SYN-ACKs transmitted from the communication destination device TM, and the number of counts per unit time exceeds the first threshold value. In this case, the above response SYN-ACK is judged to be a "response suspected of an attack" and the "suspected attack monitoring state" is set. In this state, when the next request SYN is transmitted from the server device SV, the request SYN is delayed by a predetermined amount TD within a range that does not cause a communication error, and then transferred to the communication destination device TM. On the other hand, if the number of response SYN-ACKs sent from the communication destination device TM per unit time decreases, the above response SYN-ACK is judged to be a normal response, the above "suspected attack monitoring state" is canceled, and normal operation is resumed. Continue the connection sequence. On the other hand, if the number of response SYN-ACKs per unit time is still equal to or greater than the predetermined value, the response SYN-ACK is determined as an attack response, and the server device SV is notified to that effect.

Therefore, according to one embodiment, when a DoS attack in which a large number of attack responses SYN-ACK is sent from a malicious communication destination device TM(N) is carried out, the network connecting device LT can perform the above-mentioned DoS attack. It is possible to detect the retransmission of a response to be detected while distinguishing it from the retransmission of a normal response.

Moreover, when a response suspected of an attack is detected, it is not immediately determined to be a DoS attack. It is possible to accurately determine whether or not there is an attack that could not be determined based only on the initial retransmission cycle of the response SYN-ACK. If the result is a normal response SYN-ACK, the connection sequence can be continued thereafter. That is, when a DoS attack using a valid response is performed, it is possible to achieve both detection of the attack and continuation of normal communication.

In one embodiment, the number of responses received is counted based on the 5-tuple of the received packet, and the presence or absence of an attack is determined based on the count value, so detailed monitoring and analysis of the contents of the payload of the packet It is possible to determine whether or not there is an attack without performing any processing. As a result, the processing load and processing delay of the network connection device LT can be suppressed, thereby reducing the price of the network connection device LT. It is possible to reduce the processing load when performing analysis processing for detecting attacks.

[Other embodiments]
(1) In the above embodiment, the case where the threshold value for detecting a response suspected of an attack and determining whether or not there is an attack during subsequent attack suspected monitoring is fixed in advance has been described as an example. However, for example, the control unit 1 of the network connection device LT may be provided with a verification processing unit for verifying the determination result of the presence or absence of an attack, and the threshold value may be variably controlled based on the verification result by this verification processing unit. good.

(2) In the above embodiment, when a DoS attack is determined, the server device SV is notified to that effect. transfer to the server device SV thereafter may be blocked.

(3) In the above embodiment, the case where the function of the denial-of-service attack detection device according to the present invention is provided in the inter-network connection device LT in the in-house network LNW such as a gateway or router has been described as an example. However, the function of the denial-of-service attack detection device is not limited to this, and the function of the denial-of-service attack detection device may be provided in a communication device in the wide area network INW or a relay device or the like arranged on the communication path between the wide area network INW and the in-house network LNW. good. In addition, the type and functional configuration of the denial-of-service attack detection device, the processing procedure and processing contents of the denial-of-service attack detection processing, etc. can be variously modified without departing from the gist of the present invention.

Although the embodiments of the present invention have been described in detail above, the above description is merely an example of the present invention in all respects. It goes without saying that various modifications and variations can be made without departing from the scope of the invention. That is, in implementing the present invention, a specific configuration according to the embodiment may be appropriately adopted.

In short, the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the gist of the invention at the implementation stage. Also, various inventions can be formed by appropriate combinations of the plurality of constituent elements disclosed in the above embodiments. For example, some components may be omitted from all components shown in the embodiments. Furthermore, constituent elements of different embodiments may be combined as appropriate.

LNW...In-house network SV...Server device LT...Inter-network connection device INW...Wide area network TM, TM(T), TM(N)...Communication destination device 1...Control unit 2...Program storage unit 3...Data storage unit 4...Communication interface
5 Bus 11 Packet monitoring processor 12 Response count processor 13 Request delay processor 14 Judgment processor 15 Attack detection notification processor 31 Counter information storage 32 Delay information storage 33 Suspected attack Monitoring state storage

Claims

A denial-of-service attack detection device arranged in a communication path of a system that performs data transmission via a communication path between a first communication device and a second communication device,
a first counting method for obtaining a first count value by counting a plurality of responses transmitted from the second communication device in an arbitrary cycle in response to a first request transmitted from the first communication device; a count processing unit;
determining whether the first count value per predetermined unit time exceeds a preset first threshold value, and determining whether the first count value exceeds the first threshold value; a first determination processing unit configured to set a suspected-attack monitoring state by determining that the plurality of responses to the first request are a sequence suspected of being an attack when it is determined that an attack is suspected;
A request delay processing unit that delays a second request transmitted from the first communication device by a preset time and then transfers the second request to the second communication device while the suspected attack monitoring state is set. When,
a second count processing unit for obtaining a second count value by counting the number of responses transmitted from the second communication device in response to the second request;
determining whether or not the second count value per unit time exceeds a second threshold, and determining that the second count value exceeds the second threshold a denial-of-service attack detection apparatus, comprising: a second judgment processing unit that judges the plurality of responses to the second request as an attack sequence and outputs information indicating that an attack has been detected.
The second determination processing unit determines that the plurality of responses to the second request are a normal sequence when it is determined that the second count value does not exceed the second threshold value. 2. The denial-of-service attack detection device according to claim 1, wherein the setting of said attack suspected monitoring state is cancelled.
3. The service according to claim 1, wherein said first and second count processing units count the number of said responses for each tuple having the same content based on tuples included in packets representing said responses. Jamming attack detector.
2. The processing units are provided in an inter-network connection device installed between the local area network and the communication path when the first communication device is accommodated in the local area network. 4. A denial of service attack detection device according to any one of 1 to 3.
A denial of service attack detection method performed by a device arranged on a communication path of a system in which data transmission is performed between a first communication device and a second communication device via the communication path, the method comprising:
a step of counting the number of a plurality of responses transmitted from the second communication device in an arbitrary cycle in response to the first request transmitted from the first communication device to obtain a first count value;
determining whether the first count value per predetermined unit time exceeds a preset first threshold value, and determining whether the first count value exceeds the first threshold value; a step of determining the plurality of responses to the first request as a sequence suspected of an attack and setting a suspected attack monitoring state when it is determined that an attack is suspected;
a step of delaying a second request transmitted from the first communication device by a preset time and then transferring the second request to the second communication device in the state where the suspected attack monitoring state is set;
a step of counting the number of responses transmitted from the second communication device to the second request to obtain a second count value;
determining whether or not the second count value per unit time exceeds a second threshold, and determining that the second count value exceeds the second threshold a denial of service attack detection method comprising: judging the plurality of responses to the second request as an attack sequence, and outputting information indicating that an attack has been detected.
The step of outputting information indicating that the attack has been detected outputs the plurality of responses to the second request when it is determined that the second count value does not exceed the second threshold. 6. The denial-of-service attack detection method according to claim 5, wherein the sequence is determined to be normal and the setting of the suspected attack monitoring state is canceled.
A program that causes a processor included in the denial of service attack detection device to execute processing by each of the processing units included in the denial of service attack detection device according to any one of claims 1 to 4.