WO2023112175A1

WO2023112175A1 - Traffic monitoring device, traffic monitoring method, and program

Info

Publication number: WO2023112175A1
Application number: PCT/JP2021/046135
Authority: WO
Inventors: 悠介関原; 奈美子池田; 晶子大輝; 寛之鵜澤
Original assignee: 日本電信電話株式会社
Priority date: 2021-12-14
Filing date: 2021-12-14
Publication date: 2023-06-22

Abstract

A traffic monitoring device (10) is provided with: a cutting-out unit (12) that cuts out first identification information identifying a flow from a packet received by a reception unit (11), on the basis of an offset that specifies a cutting-out position of the packet; a rule identification unit (13) that identifies rules including information that matches the first identification information cut out by the cutting-out unit (12); and a counting unit (14) that counts the number of times rules are identified, etc., by the rule identification unit (13). The traffic monitoring device (10) is further provided with an offset control unit (17) that, when the number of times rules are identified, etc., exceeds a prescribed reference value, generates a new offset for cutting out second identification information that can be used to identify attack traffic, in addition to the first identification information. The rule identification unit (13) identifies rules including information that matches the first identification information and the second identification information cut out by the cutting-out unit, and the counting unit (14) counts the number of times rules including information that matches the first identification information and the second identification information are identified. This configuration allows for identification of attack traffic through low load processing.

Description

TRAFFIC MONITORING DEVICE, TRAFFIC MONITORING METHOD, AND PROGRAM

The present invention relates to a traffic monitoring device, a traffic monitoring method, and a program.

There are flood attacks that attack network devices by sending excessive traffic on the network. Conventionally, against attacks called DoS (Denial of Services), attack traffic was blocked by analyzing the header of the IP packet field called 5-tuple and specifying the attack source based on that analysis. . Recently, however, a method called DDos (Distributed Denial of Services) has emerged, in which a Layer 4 protocol mechanism such as TCP or UDP is exploited to attack from multiple attack sources. Since it is difficult to deal with such DDoS attacks with 5-tuple analysis, we have identified attack traffic by adding protocol information of Layer 4 or higher to 5-tuple and analyzing it.

On the other hand, as the speed of the network increases, the number of flowing flows increases explosively. It is difficult to identify attack traffic by analyzing all traffic, and in order to efficiently identify attack traffic, methods such as estimating attack traffic from past attack data using machine learning have been proposed (for example, Non-Patent Document 1).

Inference methods that use machine learning, etc., require learning time to generate rules, and the processing load of the machine learning process itself increases the time lag between an attack and its detection.

The object of the present invention is to identify attack traffic with light load processing.

In order to solve the above problems, a traffic monitoring device according to the present invention is a traffic monitoring device for monitoring traffic in a communication network, comprising a receiving unit for receiving packets flowing through the communication network, and a packet received by the receiving unit. Identifying a clipping section for clipping first identification information for identifying a flow from the packet based on an offset that specifies the packet clipping position, and a rule having information matching the first identification information clipped by the clipping section. an aggregating unit for aggregating at least one of the specified number of times for each rule specified by the rule specifying unit and the amount of data of the packet specified as the rule, and the aggregating a new offset for extracting not only the first identification information but also the second identification information that can be used to identify attack traffic when the aggregation result by the unit satisfies a predetermined criterion; and a new offset control unit that generates a new offset control unit that has information that matches the first identification information and the second identification information extracted based on the new offset by the extracting unit. A rule is specified, and the aggregation unit aggregates at least one of a specified number of times of the new rule or a data amount of the packet specified with the new rule.

Further, the traffic monitoring method according to the present invention includes a receiving step of receiving packets flowing through the communication network, and a third step of identifying a flow from the packets based on an offset specifying a cut-out position of the packets received in the receiving step. a step of extracting 1 identification information; a rule specifying step of specifying a rule having information matching the first identification information extracted by the extracting step; a totaling step of totaling at least one of the specified number of times and the data amount of the packet identified as the rule; and an offset control step of generating a new offset as the offset to be used by the extraction unit for also extracting second identification information that can be used to identify attack traffic, wherein the rule specifying step comprises the extraction step. identifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset, and the tallying step includes counting the specified number of times of the new rule or the new At least one of a valid rule and the amount of data of the identified packets is aggregated.

Further, the program according to the present invention comprises: a receiving step of receiving a packet flowing through the communication network; a step of extracting information; a rule specifying step of specifying a rule having information that matches the first identification information extracted by the extracting step; and specifying the rule for each rule specified by the rule specifying step. a tallying step of tallying at least one of the number of times and the amount of data of the packet identified as the rule; and attack traffic in addition to the first identification information when the tallied result of the tallying step satisfies a predetermined criterion. an offset control step of generating a new offset for also cutting out second identification information that can be used to identify the rule as the offset used by the cutting unit, and the rule specifying step is performed by the cutting step Identifying a new rule having information that matches the first identification information and the second identification information extracted based on the new offset; At least one of the rules and the amount of data in the identified packets is aggregated.

According to the present invention, attack traffic is identified with light load processing.

FIG. 1 is a configuration diagram of a traffic monitoring device according to one embodiment of the present invention. FIG. 2 is a diagram showing an example of the data structure of a packet. FIG. 3 is a diagram for explaining a method of extracting packets by offset. FIG. 4 is a diagram showing a configuration example of a rule table. FIG. 5 is a diagram showing a configuration example of a rule table. FIG. 6 is a diagram for explaining a method of extracting packets based on offsets. FIG. 7 is a configuration diagram when the traffic monitoring apparatus of FIG. 1 is configured by a computer.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The traffic monitoring device 10 according to the present embodiment includes a receiving unit 11, an extracting unit 12, a rule specifying unit 13, an aggregating unit 14, and an output unit 15, as shown in FIG. The traffic monitoring device 10 includes a rule control section 16 , an offset control section 17 and a storage section 19 . The traffic monitoring device 10 having such a configuration is configured to monitor traffic on the communication network NW.

At least part of each of the above units 11 to 17 is composed of a logic circuit written in, for example, FPGA (Field-Programmable Gate Array), ASIC (Application Specific Integrated Circuit), or the like. At least part of each unit 11 to 17 may be configured by a processor such as a CPU (Central Processing Unit) that executes programs. The storage unit 19 is composed of an appropriate non-volatile storage device such as a flash memory or SSD (Solid State Drive). The storage unit 19 may be composed of at least a part of memory such as FPGA (Field-Programmable Gate Array), ASIC (Application Specific Integrated Circuit), or the like. Each of the units 11 to 17 may include a memory that temporarily holds data being processed.

The receiving unit 11 sequentially receives a plurality of packets (more specifically, mirroring packets) flowing through the communication network NW one by one and outputs them to the extracting unit 12 . As shown in FIG. 2, a packet consists of data (also called payload) and a header placed before the data. The header includes a source MAC address and a destination MAC address, as shown in FIG. The header also includes arbitrary information such as source and destination IP addresses, source and destination port addresses, VLANID, communication protocol, and the like.

Returning to FIG. 1, the extraction unit 12 extracts a portion of the packet. This clipping position is specified by the offset stored in the storage unit 19 . Based on this offset, the clipping unit 12 clips a part of the packet at the clipping position specified by the offset. Here, the clipped part is a bit delimiter and is also called a field value. A group of packets with matching field values is also called a flow. In other words, the field value is also identification information that identifies the flow. The clipping position specified by the offset is set so that the clipped field value includes a necessary and sufficient portion to specify the flow to be monitored. The extracted field values include various addresses, VLANIDs, communication protocols, and the like. The field value does not necessarily have to match the protocol field in the packet header, and may span multiple header fields (eg, the L2 and L3 headers in FIG. 2).

Fig. 3 shows an example of clipping based on the offset. In FIG. 3, offsets 1 to 4 are prepared as one offset, and these are used to cut out the field values of the positions labeled with fields 1 to 4 in the packet. Offsets 1 to 4 indicate the beginning of the region to be cut out, from which a certain number of bits of data are cut out. A plurality of offsets may be prepared according to the data structure of the header of the packet to be monitored. In this case, the clipping unit 12 copies packets by the number of offsets, and applies each offset to each packet to clip. The extraction unit 12 may extract each field value based on each offset by copying the data at the extraction position specified by each offset from a single packet. After that, the following processing is performed for a plurality of clipped portions.

The field value extracted by the extraction unit 12 is input to the rule identification unit 13. The rule identification unit 13 compares the input field values with rules prepared for each flow. The rules are registered in the rule table 19A stored in the storage unit 19, and the rule specifying unit 13 selects a value that matches the input field value from among the rules registered in the rule table 19A. Identify the rules you have.

A configuration example of the rule table 19A is shown in FIG. A "*" in the rule table 19A indicates that any value (even no value) of the corresponding portion of the field value to be compared with the rule is treated as a match. For example, a field value where the value of field 3 is "12" and the value of field 4 is "8080" is any other value (for example, the field value without field 5 extracted by the offset in FIG. 3). ), rule #2 in FIG. 4 is specified.

The rule identifying unit 13 supplies the rule number of the identified rule (here, one of #1 to #3) to the counting unit 14. The tallying unit 14 counts the number of times the rule number is supplied from the rule identifying unit 13 (that is, the number of packets input to the receiving unit 11) for each rule number. In this way, the tallying unit 14 tallies the number of rules specified by the rule specifying unit 13 for each rule. Here, rules are prepared for each logical network. When there is a flood attack on a certain logical network, the number of counts (specific number of rules) by the totaling unit 14 for the rules of that logical network increases. In order to detect this, the tallying unit 14 notifies the rule control unit 16 of the rule number of the rule exceeding the threshold when the number of counts per predetermined period exceeds the threshold.

Here, it is assumed that the storage unit 19 or the like stores a rule number and a packet header configuration (more specifically, information specifying which data is located at which position in the header). When the rule number is notified, the rule control unit 16 acquires the packet header configuration corresponding to the rule number from the storage unit 19 or the like as the packet header configuration of the network under attack. The packet header configuration may be identifiable by the content of rules (contents of fields 1 to 5) registered in the rule table 19A. In this case, the rule with the notified rule number is referenced. Based on the specified packet header structure, the rule control unit 16 creates a new rule by adding identification information to be compared with new identification information that can be used to identify the type of DDoS attack among the information contained in the packet. is generated as a monitoring rule and registered in the rule table 19A. The information added here is, for example, a TCP flag indicating the type of TCP. When the count number for rule #2 in the rule table 19A of FIG. 4 increases, as shown in FIG. 6 is newly registered.

Furthermore, the rule control unit 16 notifies the offset control unit 17 of the specified packet header configuration. Based on the packet header structure, the offset control unit 17 generates a new offset for extracting identification information (value of field 5) that can identify a DDoS attack from the packet in addition to other identification information. The offset is stored in storage unit 19 . This offset, for example, is obtained by adding an offset 5 for cutting out the field 5 to the stationary offset in FIG. 3, and consists of offsets 1 to 5 (see FIG. 6).

From now on, subsequent traffic will continue to be monitored by processing subsequent packets based on the new monitoring rule and offset. In particular, the number of packets received by the receiving unit 11 (the number of times the rule number is supplied from the rule identifying unit 13) is counted for each of the rules #4 to #6 to which information necessary for identifying traffic attacks has been added. Therefore, the type of attack (ACK, SYN, FIN) is specified by the count number. Here, the attack is being carried out against the logical network of the rule with the large count number.

The output unit 15 outputs the specified number of times for each rule by the rule specifying unit 13, which is counted by the counting unit 14, as a counting result. The output unit 15 displays the tally result on a display device provided in the traffic monitoring device 10 or an external display device of the traffic monitoring device 10, for example. As a result, the presence or absence of attack traffic and its type can be presented to the user. The output unit 15, for example, outputs the aggregated result to a processing unit provided inside or outside the traffic monitoring device 10, and the processing unit identifies the presence or absence of attack traffic and its type based on the aggregated result. may The processing unit may execute a process of displaying the logical network determined to have attack traffic on the display device and/or a process of blocking communication in the logical network.

In the above description, the TCP flag is used as identification information that can be used to identify DDoS attacks, that is, to identify attack traffic (for example, the presence or absence of attack traffic, and at least the former of its types). Information that can specify the traffic type using packet format bit string information, such as ICMP, UDP, NTP, and HTTP requests, may be adopted as the information.

The aggregation unit 14 may aggregate the packet data amount for each rule instead of or in addition to the specific number of times of the rule. In this case, the receiving unit 11 or the clipping unit 12 specifies the data amount of the received packet, and supplies the specified data amount of the packet to the counting unit 14 via the rule specifying unit 13 or directly. The totaling unit 14 is supplied with the data amount together with the rule number from the rule specifying unit 13 . The tallying unit 14 tallies the data amount by accumulating the supplied data amount for each rule number. In this way, for each rule specified by the packet rule specifying unit 13, the tallying unit 14 tallies at least one of the number of times the rule is specified and the data amount of the packet specified as the rule. do. The rule control unit 16 generates the new rule as a monitoring rule and registers it in the rule table 19A when the result of counting by the counting unit 14 satisfies a predetermined criterion. At this time, the offset control unit 17 also generates the new offset and stores it in the storage unit 19 . When the result of counting by the counting unit 14 satisfies a predetermined criterion is, for example, when one of the specific number of times per predetermined period and the amount of data exceeds a predetermined threshold value set for one of them. Alternatively, it is acceptable if both the specific number of times per predetermined period and the data amount exceed respective threshold values set for both of them.

As described above, the extraction unit 12 extracts the first identification information (field value) for identifying the flow from the packet received by the reception unit 11 based on the offset specifying the extraction position of the packet. The rule identifying unit 13 also identifies a rule having information that matches the first identification information extracted by the extracting unit 12 . For each rule specified by the rule specifying unit 13, the tallying unit 14 tallies at least one of the specified number of times for the rule and the data amount of the packet specified for the rule. The offset control unit 17 cuts out not only the first identification information but also the second identification information (for example, the TCP flag in field 5) that can be used to identify the attack traffic when the aggregation result by the aggregation unit 14 satisfies a predetermined criterion. generates a new offset for , as the offset used by the segmenter 12 . Then, the rule specifying unit 13 creates a new rule having information that matches the first identification information and the second identification information extracted based on the new offset by the extracting unit 12 (for example, rules #4 to #6). either). The tallying unit 14 tallies at least one of the specified number of times of the new rule or the amount of data of the packet specified as the new rule. In such a configuration, the load processing for specifying the rule by the rule specifying unit 13 is light due to the clipping by the offset. In addition, when the aggregation result satisfies a predetermined criterion, a new offset is generated for extracting the second identification information, and the rules are specified and aggregated based on the second identification information extracted by this offset. It can be seen that rules or flows with a certain number of times and/or a large amount of data are targeted for attack traffic. Therefore, according to the present embodiment, attack traffic is identified with light load processing.

Furthermore, the rule identifying unit 13 identifies, from among the one or more rules, a rule having information that matches the first identification information extracted by the extracting unit 12, and the rule controlling unit 16 collects the result obtained by the totalizing unit 14. satisfies a predetermined criterion, the new rule is generated and added to the one or more rules, so the number of rules before the totalized result satisfies the predetermined criterion can be suppressed. This realizes light load handling.

Further, the rule identifying unit 13 identifies a rule having information matching the first identification information from among the one or more rules registered in the rule table, and the rule control unit 16 identifies the newly generated new A rule is registered in the rule table. By managing the rules in a table in this way, the management of the rules becomes easy.

Furthermore, the output unit 15 may output a tally result of tallying at least one of the specified number of times of the new rule or the amount of data of the packet specified as the new rule. It is possible to notify the presence or the like.

FIG. 7 shows a hardware configuration diagram when the traffic monitoring device 10 is configured by a computer. The traffic monitoring device 10 includes a processor 101 such as a CPU, a main memory 102 of the processor 101, and a non-volatile storage device 103 that stores programs and various data and constitutes the storage unit 19 in FIG. Furthermore, the traffic monitoring device 10 includes a NIC (Network Interface Card) 104 that is connected to the communication network NW and relays packets. The processor 101 executes or uses programs and data stored in the storage device 103 and read out to the main memory 102 to operate as the units 11 to 17 described above. Note that the receiving unit 11 and the output unit 15 may be implemented by a combination of the processor 101 executing the program and the NIC 104 .

[Scope of the present invention]
The present invention is not limited to the above embodiments and modifications. For example, the present invention includes various modifications to the above embodiments and modifications that can be understood by those skilled in the art within the scope of the technical idea of the present invention. The configurations described in the above embodiments and modified examples can be appropriately combined within a consistent range. It is also possible to delete any configuration among the above configurations. The various programs described above may be stored not only in the non-volatile storage device 103 but also in a non-temporary computer-readable storage medium. "Apparatus" and "unit" refer to an object whose configuration realizing its operation is housed in a plurality of housings, even if the configuration realizing its operation is housed in a single housing ( system).

DESCRIPTION OF SYMBOLS 10... Traffic monitoring apparatus 11... Reception part 12... Extraction part 13... Rule identification part 14... Aggregation part 15... Output part 16... Rule control part 17... Offset control part 19... Storage part 19A ... rule table, 101 ... processor, 102 ... main memory, 103 ... storage device, NW ... communication network.

Claims

A traffic monitoring device for monitoring traffic in a communication network,
a receiving unit that receives packets flowing through the communication network;
a clipping unit for clipping first identification information for identifying a flow from the packet based on an offset specifying a clipping position of the packet received by the receiving unit;
a rule specifying unit that specifies a rule having information that matches the first identification information extracted by the extracting unit;
an aggregation unit that aggregates, for each rule specified by the rule specifying unit, at least one of the specified number of times of the rule and the amount of data of the packet specified as the rule;
The extracting unit uses a new offset for extracting not only the first identification information but also the second identification information that can be used to identify the attack traffic when the aggregation result by the aggregation unit satisfies a predetermined criterion. and an offset control unit that generates the offset,
The rule identifying unit identifies a new rule having information that matches the first identification information and the second identification information cut out by the cutout unit based on the new offset,
The aggregation unit aggregates at least one of a specific number of times of the new rule or a data amount of the packet identified as the new rule,
traffic monitoring equipment.
The rule identifying unit identifies, from among one or more rules, a rule having information that matches the first identification information extracted by the extracting unit;
Further comprising a rule control unit that generates the new rule and adds it to the one or more rules when the counted result satisfies the predetermined criterion,
A traffic monitoring device according to claim 1.
The rule identifying unit identifies the rule having information that matches the first identification information from among the one or more rules registered in the rule table,
the rule control unit registers the new rule in the rule table;
3. A traffic monitoring device according to claim 2.
further comprising an output unit configured to output an aggregation result obtained by aggregating at least one of the specified number of times of the new rule or the amount of data of the packet identified as the new rule by the aggregating unit;
A traffic monitoring device according to any one of claims 1 to 3.
A traffic monitoring method for monitoring traffic in a communication network, comprising:
a receiving step of receiving packets flowing through the communication network;
a clipping step of clipping first identification information for identifying a flow from the packet based on the offset specifying the clipping position of the packet received in the receiving step;
a rule specifying step of specifying a rule having information that matches the first identification information extracted by the extracting step;
an aggregating step of aggregating at least one of a specified number of times for each rule specified by the rule specifying step and a data amount of the packet specified as the rule;
A new offset for extracting not only the first identification information but also second identification information that can be used to identify attack traffic when the aggregation result of the aggregation step satisfies a predetermined criterion is used by the extraction unit. and an offset control step for generating the offset,
The rule specifying step specifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset by the extraction step,
The counting step counts at least one of a specific number of times of the new rule or a data amount of the packet identified as the new rule.
Traffic monitoring method.
A computer that monitors traffic on a communications network,
a receiving step of receiving packets flowing through the communication network;
a clipping step of clipping first identification information for identifying a flow from the packet based on the offset specifying the clipping position of the packet received in the receiving step;
a rule specifying step of specifying a rule having information that matches the first identification information extracted by the extracting step;
an aggregating step of aggregating at least one of a specified number of times for each rule specified by the rule specifying step and a data amount of the packet specified as the rule;
A new offset for extracting not only the first identification information but also second identification information that can be used to identify attack traffic when the aggregation result of the aggregation step satisfies a predetermined criterion is used by the extraction unit. and an offset control step for generating the offset,
The rule specifying step specifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset by the extraction step,
The counting step counts at least one of a specific number of times of the new rule or a data amount of the packet identified as the new rule.
program.