Analysis device, analysis method, and analysis program

Abstract

An analysis server (10) acquires observation information from respective sensing devices (2), the observation information including transmission source IP addresses, transmission source MAC addresses, transmission destination IP addresses, and transmission destination MAC addresses for communications. Then the analysis server (10) estimates the topology of a network on the basis of the acquired observation information. The analysis server (10): creates a monitoring list on the basis of the estimated topology such that observation information for every communication over the network will be transmitted by any one sensing device (2) that is on the path of the communication, the monitoring list indicating the communications for which every sensing device (2) is to transmit observation information; and transmits the monitoring list to the sensing devices (2). Then each sensing device (2) transmits observation information for the communications to the analysis server (10) on the basis of the monitoring list.

Description

[Technical field]

[0001] The present invention relates to an analysis device, an analysis method, and an analysis program for analyzing network communications. [Background technology]

[0002] Conventionally, in order to thoroughly monitor network communications, there is a technology that observes network communications using multiple sensing devices and obtains observed information. This observed information indicates the results of communication observations, and includes the source and destination IP addresses, source and destination MAC addresses, etc. of the communications. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 4809880 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when network communications are observed by multiple sensing devices, the same communications may be observed by multiple sensing devices. In such a case, the analysis server receives duplicated observation information of the same communications from the multiple sensing devices, resulting in poor reception efficiency of the observation information.

[0005] In addition, when multiple sensing devices observe communications across multiple L3NWs (layer 3 networks), different MAC addresses are set for the interfaces of the routers installed at the boundaries of the networks, and the analysis server may receive observation information with different MAC addresses associated with IP addresses from multiple sensing devices.

[0006] In such cases, the analysis server cannot determine whether the difference in MAC address associated with the IP address is due to routing or spoofing of the terminal. Therefore, if the analysis server tries to detect a spoofed terminal using the IP address and MAC address pair shown in the communication observation information, it may make a false positive.

[0007] Therefore, an object of the present invention is to solve the above-mentioned problems and to appropriately monitor communications within a network. [Means for solving the problem]

[0008] In order to solve the above-mentioned problems, the present invention is characterized by comprising: an acquisition unit that acquires, from each communication observation device that observes communications on a network, observation information of the communications, including a source IP address, a source MAC address, a destination IP address, and a destination MAC address of the communications; an estimation unit that estimates a topology of the network based on the acquired observation information; an allocation unit that assigns communication observation devices based on the estimated topology, the installation positions of the communication observation devices, and the communication observation information acquired from the communication observation devices, so that, for each communication flowing through the network, one of the communication observation devices on a path of the communication transmits observation information of the communication; a list creation unit that creates, based on a result of the allocation, a monitoring list for each communication observation device indicating communications to which the communication observation device will transmit observation information; and a list transmission unit that transmits the created monitoring list for each communication observation device to each of the communication observation devices. Effect of the Invention

[0009] According to the present invention, it is possible to appropriately monitor communications within a network. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining an outline of the analysis system. [Diagram 2]FIG. 2 is a diagram illustrating an example of the configuration of the analysis system. [Diagram 3] FIG. 3 is a diagram for explaining the watch list. [Figure 4] FIG. 4 is a diagram for explaining router MAC address estimation 1. In FIG. [Diagram 5] FIG. 5 is a diagram for explaining estimation 2 of the MAC address of a router and estimation of the IP address of an external terminal. [Figure 6] FIG. 6 is a diagram for explaining the estimation of the topology. [Figure 7] FIG. 7 is a sequence diagram illustrating an example of a processing procedure of the analysis system. [Figure 8] FIG. 8 is a flowchart showing the details of the processes in S13 and S14 in FIG. [Figure 9] FIG. 9 is a diagram for explaining the estimation of the L2 topology by the analysis server. [Figure 10] FIG. 10 is a diagram for explaining the estimation by the analysis server of the topology of a network in which routers are arranged hierarchically. [Figure 11] FIG. 11 is a diagram showing an example of a network configured with white box switches (WB SW) equipped with the functions of a sensing device. [Figure 12] FIG. 12 is a diagram illustrating an example of the configuration of a computer that executes an analysis program. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, a mode (embodiment) for carrying out the present invention will be described with reference to the drawings. The present invention is not limited to the embodiment described below.

[0012] [overview] First, an overview of the operation of an analysis system 1 including an analysis device (analysis server) 10 will be described with reference to Fig. 1. The analysis system 1 includes a sensing device 2 (e.g., sensing devices 2A, 2B, 2C) and an analysis server 10. In addition, SWs (switching hubs, e.g., SW1, SW2, SW3) are installed within the network.

[0013] Each sensing device (communication observation device) 2 observes communications within a network to be monitored. For example, each sensing device 2 observes communications between PCs (terminals) passing through SW within the network to be monitored by a port mirror or the like, and creates observation information. Then, each sensing device 2 transmits the created observation information to the analysis server 10. This observation information includes, for example, the source IP address, source MAC address, destination IP address, and destination MAC address of the communication to be monitored.

[0014] The analysis server 10 estimates the topology (see FIG. 1) of the network to be monitored based on the observation information received from each sensing device 2. Then, based on the estimated topology, the analysis server 10 creates a monitoring list for each sensing device 2 indicating communications to which the sensing device 2 should send (collect) observation information.

[0015] For example, based on the estimated topology, the analysis server 10 assigns sensing devices 2A, 2B, and 2C for each communication flowing within the network so that one of the sensing devices 2 on the path of the communication transmits observation information of the communication (see symbol 100).

[0016] Then, for example, based on the allocation result indicated by the reference symbol 100, the analysis server 10 creates a monitoring list (e.g., monitoring lists 101, 102, 103) indicating communications to which the sensing device 2 is to transmit observation information for each sensing device 2. Then, the analysis server 10 transmits the created monitoring list to the sensing devices 2A, 2B, 2C.

[0017] For example, analysis server 10 transmits monitoring list 101 to sensing device 2A, transmits monitoring list 102 to sensing device 2B, and transmits monitoring list 103 to sensing device 2C. Then, sensing devices 2A, 2B, and 2C each transmit communication observation information to analysis server 10 based on the monitoring list transmitted from analysis server 10.

[0018] 1, for example, sensing device 2A transmits observation information of communications from PC1 to PC5 and from PC1 to PC3 to analysis server 10 based on monitoring list 101. Furthermore, sensing device 2B transmits observation information of communications from PC3 to PC1 to analysis server 10 based on monitoring list 102. Furthermore, sensing device 2C transmits observation information of communications from PC5 to an external terminal and from an external terminal to PC5 to analysis server 10 based on monitoring list 103.

[0019] In this way, the analysis server 10 can avoid receiving duplicate observation information of the same communication from each sensing device 2 as much as possible.

[0020] Furthermore, the analysis server 10 can estimate the IP address and MAC address of the network router and the IP address of the terminal (external terminal) installed outside the network (i.e., outside the network separated by the router) based on the observation information received from each sensing device 2. As a result, the analysis server 10 can reduce false positives when detecting spoofed terminals using the IP address and MAC address indicated in the observation information from each sensing device 2.

[0021] Furthermore, the analysis server 10 transmits to each sensing device 2 a monitoring list indicating communications for which the sensing device 2 should transmit observation information to that sensing device 2. This allows each sensing device 2 to determine which observation information to transmit without inquiring of other devices.

[0022] [Configuration example] Next, a configuration example of the analysis system 1 will be described with reference to Fig. 2. The analysis system 1 includes a plurality of sensing devices 2 and an analysis server 10.

[0023] The sensing device 2 transmits to the analysis server 10 observation information on the communications indicated in the monitoring list transmitted from the analysis server 10 (see monitoring lists 101 to 103 in FIG. 1).

[0024] The analysis server 10 includes a communication unit 11, a storage unit 12, and a control unit 13. The communication unit 11 serves as a communication interface with external devices. The communication unit 11 receives observation information from the sensing device 2 and transmits a monitoring list to the sensing device 2, for example, via a network such as the Internet.

[0025] The storage unit 12 stores data referenced by the control unit 13 when the control unit 13 executes various processes and data created by the control unit 13 executing various processes. For example, the storage unit 12 stores observation information acquired from each sensing device 2 and information indicating the topology of the network created by the control unit 13 (topology information).

[0026] The control unit 13 is responsible for overall control of the analysis server 10. The control unit 13 includes an acquisition unit 130, an estimation unit 131, an allocation unit 132, a list creation unit 133, a list transmission unit 134, an analysis unit 135, and a control processing unit 136.

[0027] The acquiring unit 130 acquires communication observation information from each sensing device 2. The acquiring unit 130 stores the acquired observation information in the storage unit 12.

[0028] The estimation unit 131 estimates the topology of the network based on the observation information acquired from each sensing device 2. That is, the estimation unit 131 estimates how the routers, devices (e.g., SW), and terminals (e.g., PCs) of the monitored network are arranged and connected, and what IP addresses and MAC addresses are assigned to each of them. The estimation unit 131 also estimates through which router an external terminal of the monitored network is connected, and what IP address is assigned to the external terminal.

[0029] For example, the estimation unit 131 estimates the IP addresses and MAC addresses of terminals in the monitored network, the IP addresses and MAC addresses of routers, and the IP addresses of external terminals based on the differences between the observation information acquired from each sensing device 2. Then, the estimation unit 131 uses the estimation results to estimate the topology of the L2 network in the subnet (for example, the topology shown in FIG. 1). Details of the topology estimation by the estimation unit 131 will be described later with reference to the figures.

[0030] The allocation unit 132 allocates communications to which each sensing device 2 transmits observation information based on the topology estimated by the estimation unit 131, the installation position of each sensing device 2, and observation information of communications of each sensing device 2.

[0031] For example, based on the topology estimated by the estimation unit 131, the installation position of each sensing device 2, and the observation information of the communication of each sensing device 2, the allocation unit 132 allocates each sensing device 2 such that, for each communication flowing through the network, one of the sensing devices 2 of the SW on the path of the communication transmits the observation information of the communication.

[0032] For example, the allocation unit 132 allocates the sensing device 2A as the sensing device 2 that transmits the observation information of the communication from PC1 to PC5 among the sensing devices 2 (2A, 2B, 2C) of SW1, SW2, SW3 on the path from PC1 to PC5 shown in Fig. 1. Also, the list creation unit 133 allocates the sensing device 2C as the sensing device 2 that transmits the observation information of the communication from PC5 to PC1 among the sensing devices 2 (2A, 2B, 2C) of SW1, SW2, SW3 on the path from PC5 to PC1.

[0033] The allocation unit 132 performs the above-mentioned allocation process of the sensing device 2 for each communication passing through the network. In this way, each sensing device 2 is assigned a communication to which observation information should be transmitted.

[0034] Based on the allocation result by the allocation unit 132, the list creation unit 133 creates a monitoring list indicating communications to which observation information is to be sent for each sensing device 2. This monitoring list is information indicating source IP addresses of communications to which the sensing device 2 is to send observation information and source IP addresses of communications to which the sensing device 2 is not to send observation information, as shown in monitoring lists 101 to 103 in Fig. 1, for example.

[0035] The monitoring list will be described in detail with reference to Fig. 3. Here, a case will be considered in which list creation unit 133 has created monitoring list 301 for sensing device 2A, monitoring list 302 for sensing device 2B, and monitoring list 303 for sensing device 2C, as shown in Fig. 3.

[0036] For example, the monitoring list 301 indicates that communications whose senders are PC1 and PC2 are targets for sending observation information, but that communications whose senders are PC3, PC4, and PC5 are not targets for sending observation information. It also indicates that all communications whose senders are other than PC3, PC4, and PC5 are targets for sending observation information.

[0037] The monitoring list 302 also indicates that communications whose senders are PC3 and PC4 are targets for sending observation information, but that communications whose senders are PC1, PC2, and PC5 are not targets for sending observation information. It also indicates that all communications whose senders are other than PC1, PC2, and PC5 are targets for sending observation information.

[0038] Furthermore, the monitoring list 303 indicates that communications whose source is PC5 are targets for sending observation information, but that communications whose source is PC1, PC2, PC3, and PC4 are not targets for sending observation information, and indicates that all communications whose source is other than PC1, PC2, PC3, and PC4 are targets for sending observation information.

[0039] For example, based on the monitoring list 301, the sensing device 2A transmits observation information of communication from PC1 to PC3 to the analysis server 10, but does not transmit observation information of communication from PC3 to PC1.

[0040] Furthermore, based on the monitoring list 302, the sensing device 2B transmits to the analysis server 10 observation information on communication from PC3 to PC1, but does not transmit observation information on communication from PC1 to PC3.

[0041] Furthermore, based on the watch list 303, the sensing device 2C transmits to the analysis server 10 both the observation information of the communication from W2 (external terminal) to PC5 and the observation information of the communication from PC5 to W2.

[0042] This allows the analysis server 10 to reduce the possibility of receiving duplicated observation information of the same communication from each sensing device 2. Furthermore, for example, when there is only one sensing device 2 on the communication path, such as the communication between W2 and PC5 shown in Fig. 3, the analysis server 10 creates a monitoring list 303 in which the sensing device 2 (i.e., sensing device 2C) transmits observation information of the communication from W2 to PC5 and PC5 to W2, and transmits the list to the sensing device 2C. This allows the analysis server 10 to receive all observation information of the communication within the network to be monitored.

[0043] Returning to the explanation of Fig. 2, the list transmission unit 134 transmits the monitoring list created by the list creation unit 133 to each sensing device 2. For example, the list transmission unit 134 transmits monitoring list 301 shown in Fig. 3 to sensing device 2A, transmits monitoring list 302 to sensing device 2B, and transmits monitoring list 303 to sensing device 2C.

[0044] Returning to the explanation of Fig. 2, the analysis unit 135 analyzes communications in the network based on the observation information of each communication in the network acquired by the acquisition unit 130.

[0045] For example, when the analysis unit 135 acquires observation information via the acquisition unit 130, the analysis unit 135 detects communication by a spoofed terminal by comparing the source IP address and source MAC address pair in the observation information with the IP address and MAC address pairs of each terminal, router, etc. shown in the topology information stored in the memory unit 12.

[0046] Furthermore, for example, the analysis unit 135 detects a change in the topology based on the observation information of the communication acquired by the acquisition unit 130. For example, the analysis unit 135 detects the presence or absence of a change in the topology by comparing a newly estimated topology based on the observation information acquired by the acquisition unit 130 with the topology stored in the storage unit 12. Then, when the analysis unit 135 detects that there has been a change in the topology, it outputs the detection result (for example, which terminal has been added to the network or which terminal has moved).

[0047] This allows the user of the analysis server 10 to know that an unauthorized terminal may have been connected to the network, or that the network configuration has changed due to the movement of a terminal or device.

[0048] The control processing unit 136 controls each unit of the control unit 13. For example, when the analysis unit 135 detects that there has been a change in the topology of the network, and the user of the analysis server 10 determines that the change in topology is not unauthorized, the control processing unit 136 instructs the allocation unit 132 to allocate communications to which each sensing device 2 is to transmit observation information, based on the newly estimated topology and observation information.

[0049] Then, based on the instruction, the list creation unit 133 reallocates communications to which each sensing device 2 transmits observation information, based on the newly estimated topology and observation information. Next, the list creation unit 133 uses the results of the reallocation to re-create a monitoring list for each sensing device 2. Thereafter, the list transmission unit 134 transmits the re-created monitoring list to each sensing device 2. Thereafter, each sensing device 2 transmits observation information based on the new monitoring list.

[0050] This allows the analysis server 10 to properly receive observation information from each sensing device 2 even if there is a change in the network configuration.

[0051] [Processing example] Next, the estimation of the network topology by the estimation unit 131 and the creation of the monitoring list by the list creation unit 133 will be described with reference to FIGS.

[0052] (Router MAC address estimation 1) First, the estimation of the IP address of a router and the MAC address associated with the IP address by the estimation unit 131 will be described with reference to FIG.

[0053] Here, an example will be described in which the sensing device 2 acquires observation information from SW1, SW2, and SW3 in a network indicated by reference numeral 401. Note that the arrows indicated by reference numeral 401 indicate communication within the network. In addition, in the network indicated by reference numeral 401, W1 and W2 indicate external terminals, and RT indicates a router.

[0054] The estimation unit 131 creates a list 402 indicating the observation information (the source IP address (Src IP), the source MAC address (Src MAC), the destination IP address (Dst IP), and the destination MAC address (Dst MAC) of the communication) of the communication passing through SW1, SW2, and SW3 acquired by the acquisition unit 130. Then, based on the list 402, the estimation unit 131 creates a list 403 indicating, for each MAC address, the IP address associated with that MAC address.

[0055] Here, the router replaces the MAC address of the IP address of the packet to be routed with the MAC address assigned to the router itself. Therefore, the MAC address assigned to the router is associated with multiple IP addresses. Therefore, the MAC address of the router is associated with multiple IP addresses in list 403. Therefore, the estimation unit 131 estimates that R1 and R2, which are MAC addresses associated with multiple IP addresses in list 403, are the MAC addresses of the router.

[0056] (Router MAC address estimation 2) 5. Next, the estimation unit 131 creates a list 501 indicating, for each pair of (source IP address (Src IP), destination IP address (Dst IP)) in the list 402, a pair of (source MAC address (Src MAC), destination MAC address (Dst MAC)) corresponding to the pair.

[0057] Here, in list 501, if there are multiple pairs of (source MAC address, destination MAC address) for the same (source IP address, destination IP address), and the destination MAC address in any of the pairs is the MAC address of the router estimated in (Estimation of Router MAC Address 1) described in Figure 4, the source MAC addresses of the other pairs can be considered to be the MAC addresses of the router's egress IF (interface) (see symbol 502).

[0058] For example, the pairs of (source MAC address, destination MAC address) for (PC1, PC5) in list 501 are (PC1, R1) and (R3, PC5). Of these, the destination MAC address (R1) in the pair (PC1, R1) is the MAC address of the router estimated in (Estimation 1 of the router MAC address) described in FIG.

[0059] Here, the source MAC address (R3) in the other pair (R3, PC5) was not estimated to be the MAC address of the router in the manner described in FIG. 4 (Estimation of the Router MAC Address 1), but can be considered to be the MAC address of the router's egress IF (see reference numeral 502).

[0060] Therefore, the estimation unit 131 estimates that R3 in the above pair (R3, PC5) is the MAC address of the router (see (1) in list 501). By performing the above process, the estimation unit 131 can also estimate the MAC address of the router that could not be estimated by (Estimation 1 of the MAC address of the router) described in FIG. 4.

[0061] (External terminal assumption) Furthermore, in list 501 shown in FIG. 5, if there is only one pair of (source MAC address, destination MAC address) for the same (source IP address, destination IP address) and it is known that the destination MAC address in that pair is the MAC address of a router, then that (source IP address, destination IP address) pair can be considered to be a pair with the IP address of an external terminal (see symbol 502 and (2) in list 501).

[0062] Therefore, for example, the IP address pairs (PC1, W1) and (PC1, W2) in the list 501 can be considered as pairs indicating communication with an external terminal. Therefore, the estimation unit 131 estimates that W1 and W2 are IP addresses of the external terminal.

[0063] (Topology Inference) Next, the estimation of the network topology by the estimation unit 131 will be described with reference to Fig. 6. The estimation unit 131 estimates the network topology using the MAC addresses of the routers estimated by the above process and the IP addresses of the external terminals.

[0064] For example, the estimation unit 131 estimates the network topology shown by reference symbol 602 using the observation information of SW1, SW2, and SW3 (the source IP address (Src IP), the source MAC address (Src MAC), the destination IP address (Dst IP), and the destination MAC address (Dst MAC) of the communication) shown by reference symbol 601 in FIG. 6, and the MAC addresses of the routers and the IP addresses of the external terminals estimated by the above processing.

[0065] Then, based on the estimated topology, the allocation unit 132 assigns, for each communication flowing through the network, one of the sensing devices 2 capable of transmitting observation information of that communication to transmit the observation information of that communication.

[0066] For example, in the topology indicated by the reference numeral 601, the allocation unit 132 allocates communication between PC1 and PC2 to the sensing device 2 of SW1, communication between PC3 and PC4 to the sensing device 2 of SW2, and communication between PC5 to the sensing device 2 of SW3.

[0067] Then, the list creation unit 133 creates monitoring lists 603-605 based on the above allocation results. That is, the list creation unit 133 creates a monitoring list 603 for the sensing device 2 of SW1, a monitoring list 604 for the sensing device 2 of SW2, and a monitoring list 605 for the sensing device 2 of SW3. Thereafter, the list transmission unit 134 transmits the monitoring lists 603-605 to the target sensing device 2. Then, each sensing device 2 transmits observation information of the communications indicated in the received monitoring list to the analysis server 10.

[0068] In this way, the analysis server 10 can properly receive, from each sensing device 2, observed information on communications within the network.

[0069] [Example of processing procedure] Next, an example of a processing procedure of the analysis system 1 will be described with reference to Fig. 7. First, the acquisition unit 130 of the analysis server 10 transmits an instruction to each sensing device 2 to transmit observation information of communication (S1). Based on the instruction, each sensing device 2 creates observation information of communication passing through SW in the monitored network, and transmits it to the analysis server 10 (S2).

[0070] Then, the estimation unit 131 of the analysis server 10 creates a list (e.g., see list 402 in Figure 4) of communications observed at each device (e.g., SW) in the monitored network based on the observation information of the communications transmitted from each sensing device 2.

[0071] Then, based on the created list, the estimation unit 131 estimates the MAC addresses of routers in the network to be monitored by the method described above in (Router MAC Address Estimation 1) (S3: Router Estimation 1). The estimation unit 131 also estimates the MAC addresses of routers by the method described above in (Router MAC Address Estimation 2) (S4: Router Estimation 2). This allows the estimation unit 131 to estimate the MAC addresses of routers that could not be estimated in S3.

[0072] Furthermore, the estimation unit 131 estimates the IP address of the external terminal based on the created list by the method described above in (External Terminal Estimation) (S5: External Terminal Estimation). Then, the estimation unit 131 records the estimation result of the router's MAC address and the estimation result of the external terminal's IP address obtained by the above process in the above list (see list 601 in FIG. 6).

[0073] After S5, if there is an update to the above list (for example, an update to the estimated result of the MAC address of the router or an update to the estimated result of the IP address of the external terminal) due to the processing up to S5 (Yes in S6), the estimation unit 131 executes the processing from S4 onwards again.

[0074] On the other hand, if there has been no update to the above list (for example, an update to the estimated result of the MAC address of the router or an update to the estimated result of the IP address of the external terminal) in the processing up to S5 (No in S6), the estimation unit 131 estimates the topology of the network based on the above list (S7).

[0075] After S7, the allocation unit 132 allocates communications to which each sensing device 2 transmits observation information based on the topology estimation result in S7. Then, the list creation unit 133 creates a monitoring list for each sensing device 2 based on the allocation result (S8). Thereafter, the list transmission unit 134 transmits the monitoring list for each sensing device 2 to each sensing device 2.

[0076] Thereafter, each sensing device 2 starts monitoring communications based on the transmitted monitoring list (S9). Then, if the observed communications are subject to transmission of observation information indicated in the monitoring list (Yes in S10), each sensing device 2 transmits the observation information of the communications to the analysis server 10. On the other hand, if the observed communications are not subject to transmission (No in S10), each sensing device 2 continues monitoring (S11) and returns to S10.

[0077] Thereafter, when the acquisition unit 130 of the analysis server 10 receives observation information from the sensing device 2 (S12), the analysis unit 135 identifies a device (e.g., a PC, etc.) included in the observation information from the topology estimation result (topology information) in S7 (S13). Then, the analysis unit 135 performs a process of detecting an abnormality in communication using information on the device identified in S13 (S14). The analysis unit 135 executes the processes of S13 and S14 described above every time it receives observation information from the sensing device 2.

[0078] The processes of S13 and S14 in Fig. 7 will be described in detail with reference to Fig. 8. For example, the analysis unit 135 identifies the device ID and the current installation location (network configuration) of each device from the device ID, device IP (device IP address), and device MAC (device MAC address) of the sensing device 2 indicated in the observation information received in S12 in Fig. 7 (S131 in Fig. 8).

[0079] Then, the analysis unit 135 determines whether or not there is a difference between the NW configuration identified in S131 and the topology information held in the storage unit 12 (S132).

[0080] Here, if the analysis unit 135 determines that there is no difference between the NW configuration identified in S131 and the topology information held in the storage unit 12 (No in S132), the process proceeds to S141. S141 will be described later.

[0081] On the other hand, if the analysis unit 135 determines that there is a difference between the NW configuration identified in S131 and the topology information stored in the storage unit 12 (Yes in S132), it outputs information about the difference via the communication unit 11 (S133). This allows the user of the analysis server 10 to know that there has been a change in the configuration of the monitored network. Thereafter, the analysis server 10 accepts an input from the user of the result of the determination as to whether or not the change in the network configuration is a normal change. Here, if the analysis unit 135 accepts an input from the user indicating that the change in the network configuration is a normal change (Yes in S134), it updates the topology information based on the NW configuration identified in S131 (S135).

[0082] After that, the analysis unit 135 performs a process of detecting communication contents based on the topology information updated in S135 and the observation information received in S12 of Fig. 7 (S141). For example, when a pair of an IP address and a MAC address of a terminal indicated in the observation information received in S12 of Fig. 7 does not match a pair of an IP address and a MAC address indicated in the topology information, the analysis unit 135 detects the communication indicated in the observation information as a communication by a spoofed terminal.

[0083] Then, when the analysis unit 135 detects an abnormality in the communication contents (for example, communication by a spoofed terminal) in the detection process of S141 (Yes in S142), it notifies the user that the abnormality has been detected via the communication unit 11 (S143: Abnormality detection notification). After that, the user takes action against the network abnormality based on the notification.

[0084] On the other hand, if the analysis unit 135 does not detect an abnormality in the communication content in the detection process of S141 (No in S142), and if the topology information has been updated in S135 (Yes in S151), the process proceeds to S8 in Fig. 7. That is, the allocation unit 132 reallocates the communications to which each sensing device 2 transmits observation information, based on the topology information updated in S135. Then, the list creation unit 133 recreates a monitoring list for each sensing device 2, based on the result of the above-mentioned reallocation (S8 in Fig. 7). Thereafter, the list transmission unit 134 transmits the recreated monitoring list to each sensing device 2.

[0085] On the other hand, if the topology information has not been updated in S135 (No in S151 in FIG. 8), the process returns to S12 in FIG.

[0086] In addition, the analysis unit 135 outputs information regarding the difference between the network configuration identified in S131 of FIG. 8 and the topology information stored in the memory unit 12 (S133), and if the user determines that the change in the network configuration is abnormal in some way (No in S134), the user takes action to address the network abnormality.

[0087] According to such an analysis server 10, the sensing devices 2 are assigned using the estimated topology so that the sensing device 2 of any one of the SWs on the communication path transmits the observation information of the communication. This allows the analysis server 10 to reduce duplication of the observation information transmitted from the sensing devices 2.

[0088] Also, for example, when there is only one sensing device 2 capable of transmitting observation information of a communication, such as the communication between W2 and PC5 in Fig. 3 described above, that sensing device 2 transmits the observation information of the communication to the analysis server 10. That is, the sensing device 2C in Fig. 3 transmits the observation information of W2 → PC5 and the observation information of PC → W2 to the analysis server 10. This allows the analysis server 10 to receive all the observation information of the communication within the network to be monitored.

[0089] 9, if multiple SWs (SW1, SW2, SW3) are installed in the same subnet and a sensing device 2 is installed in each SW, the analysis server 10 can estimate the L2 topology by comparing the observation information of each sensing device 2 (sensing devices 2A, 2B, 2C). For example, the analysis server 10 can estimate the L2 topology by comparing the observation information using the methods described above in (Estimation 1 of Router's MAC Address) and (Estimation 2 of Router's MAC Address).

[0090] Furthermore, the analysis server 10 can estimate the IP address and MAC address of the router and the IP address of the external terminal by comparing the observation information using the methods described above in (Router MAC Address Estimation 1) and (Router MAC Address Estimation 2). As a result, when the analysis server 10 detects a spoofed terminal using the IP address and MAC address shown in the observation information from each sensing device 2, it can reduce false positives.

[0091] Furthermore, according to the analysis server 10, even if routers (RT1, RT2) are installed hierarchically as shown in FIG. 10 and a sensing device 2 is not installed under any of the routers (RT2), the topology can be estimated using the same algorithm as above.

[0092] For example, PC1 and PC2 shown in Fig. 10 are terminals in a network different from the network to which SW1 belongs, but the sensing device 2A of SW1 always observes communications with PC1 and PC2 as the source or destination. From this, the analysis server 10 estimates that PC1 and PC2 are under SW1. The analysis server 10 then estimates the topology of the network, for example, the topology shown in Fig. 10.

[0093] Thereafter, the analysis server 10 uses the above topology estimation result to create a monitoring list, for example, as indicated by reference numeral 1001, for the sensing device 2A of SW1. The analysis server 10 also creates a monitoring list, for example, as indicated by reference numeral 1002, for the sensing device 2B of SW2. The analysis server 10 then acquires the observation information transmitted from the sensing devices 2A and 2B based on the above observation lists. This allows the analysis server 10 to acquire observation information on the communications between PC1 and PC2.

[0094] In this way, the analysis server 10 can monitor communications between terminals in a complex network, such as a network in which routers are installed hierarchically as shown in Fig. 10. Furthermore, in the conventional technology that only monitors a local network, it is not possible to monitor communications between terminals outside the local network, such as PC1 and PC2 in Fig. 10. However, the analysis server 10 of this embodiment can monitor communications between terminals outside the local network, such as PC1 and PC2 in Fig. 10.

[0095] Furthermore, the analysis unit 135 of the analysis server 10 may output information on monitoring locations that are insufficient for monitoring network communications, based on the estimated network topology and information on installation locations of the sensing devices 2 in the network.

[0096] For example, in the network shown in Fig. 10, since the current configuration makes it impossible to obtain observation information on the communication between PC1 and PC2, the analysis unit 135 recommends installing a new sensing device 2 at a location (e.g., RT2) that can monitor the communication between PC1 and PC2. This allows the user of the analysis server 10 to know where to add a sensing device 2 in order to thoroughly monitor each communication in the network.

[0097] Furthermore, the analysis server 10 can estimate a topology that is consistent with the actual network configuration, based on the observation information transmitted from each sensing device 2. For example, if there is insufficient observation information or depending on the installation locations of the sensing devices 2, there may be locations where the analysis server 10 cannot accurately estimate the network configuration, but sensing (obtaining communication observation information from each sensing device 2) can be performed without problems.

[0098] Furthermore, even if the analysis server 10 is unable to completely estimate the topology due to a lack of information, at least one sensing device 2 transmits observation information for each communication, so that no observation information is missed.

[0099] Furthermore, the analysis server 10 can detect new observation information and changes in the network configuration, and therefore can detect unauthorized device connections and device movements. After detecting a change in the network configuration, the analysis server 10 updates the topology information, and can perform communication detection processing based on the updated topology information and communication observation information (see S141 in FIG. 7). This allows the analysis server 10 to appropriately perform communication detection processing.

[0100] Furthermore, after detecting a change in the network configuration, the analysis server 10 can re-create and transmit a monitoring list for each sensing device 2 based on the updated topology information. This allows the analysis server 10 to appropriately receive observation information from each sensing device 2.

[0101] Furthermore, the network monitored by the analysis server 10 may be a network configured with white box switches (WB SW) equipped with the functions of the sensing device 2 (FIG. 11). In this case, the analysis server 10 transmits a monitoring list to each WB SW. Then, each WB SW transmits communication observation information to the analysis server 10 based on the monitoring list transmitted from the analysis server 10. The analysis server 10 monitors the network communications based on the communication observation information transmitted from each WB SW.

[0102] [System configuration, etc.] In addition, each component of each unit shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed and integrated in any unit according to various loads, usage conditions, etc. Furthermore, each processing function performed by each device can be realized in whole or in part by a CPU and a program executed by the CPU, or can be realized as hardware using wired logic.

[0103] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by a known method. In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed arbitrarily unless otherwise specified.

[0104] [program] The above-mentioned analysis server 10 can be implemented by installing a program as package software or online software on a desired computer. For example, the above-mentioned program can be executed by an information processing device, causing the information processing device to function as the analysis server 10. The information processing device here includes desktop and notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and further terminals such as PDAs (Personal Digital Assistants).

[0105] The analysis server 10 can also be implemented as a server device that provides services related to the above-mentioned processes to a client, the client being a terminal device used by the user. In this case, the server device may be implemented as a Web server, or may be implemented as a cloud that provides services related to the above-mentioned processes by outsourcing.

[0106] 12 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0107] The memory 1010 includes a read only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0108] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process executed by the above-mentioned analysis server 10 are implemented as program modules 1093 in which computer-executable codes are written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the analysis server 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0109] Data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary and executes them.

[0110] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or wide area network (WAN)). The program module 1093 and the program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070. [Explanation of symbols]

[0111] 1. Analysis system 2(2A,2B,2C) Sensing device 10 Analysis Server 11 Communications Department 12 Storage section 13 Control section 130 Acquisition Department 131 Estimation Department 132 Allocation Section 133 List Creation Department 134 List Transmission Unit 135 Analysis Department 136 Control processing section

Claims

1. an acquisition unit that acquires, from each communication observation device that observes communications on a network, observation information of the communications, including a source IP address, a source MAC address, a destination IP address, and a destination MAC address in the communications; an estimation unit that estimates a topology of the network based on the acquired observation information; an allocation unit that allocates communication observation devices based on the estimated topology, the installation positions of the communication observation devices, and communication observation information acquired from the communication observation devices, so that, for each communication flowing through the network, any one of the communication observation devices on a path of the communication transmits the communication observation information; a list creation unit that creates, for each of the communication observation devices, a monitoring list that indicates communications to be monitored by the communication observation device based on a result of the allocation; a list transmission unit that transmits the created monitoring list for each of the communication observation devices to each of the communication observation devices; An analytical device comprising:

2. The estimation unit is estimating a topology of the network, including IP addresses and MAC addresses of devices in the network, based on the acquired observation information; The analysis device further comprises: an analysis unit that detects communication by an impersonated device by comparing a pair of an IP address and a MAC address of a device included in the acquired communication observation information with a pair of an IP address and a MAC address of a device included in the estimated topology; The analysis device according to claim 1 , further comprising:

3. The analysis unit further comprises: The estimated topology of the network is compared with a past topology of the network to detect whether or not there is a change in the topology of the network.

3. The analysis device according to claim 2 .

4. When the analysis unit detects that there has been a change in the topology of the network, The list creation unit includes: regenerating a monitoring list for each of the communication observation devices based on the estimated topology and the observation information; The list transmission unit is The reconstructed monitoring list for each of the communication observation devices is transmitted to each of the communication observation devices.

4. The analysis device according to claim 3.

5. The analysis unit further comprises: Based on the estimated topology of the network and information on the installation locations of the communication monitoring device in the network, a monitoring location that is insufficient for monitoring each communication in the network is identified, and the identified monitoring location is output.

3. The analysis device according to claim 2 .

6. When multiple communication monitoring devices are installed in the same subnetwork in the network, The estimation unit is A topology of an L2 network within the subnet is estimated based on a difference between the pieces of observation information acquired from each of the communication observation devices.

2. The analysis device according to claim 1 .

7. An analytical method performed by an analytical device, comprising: acquiring, from each of the communication observation devices that observe communications on a network, observation information of the communications, including a source IP address, a source MAC address, a destination IP address, and a destination MAC address in the communications; estimating a topology of the network based on the acquired observation information; a step of allocating the communication observation devices based on the estimated topology, the installation positions of the communication observation devices, and the communication observation information acquired from the communication observation devices, so that for each communication flowing through the network, any one of the communication observation devices on the path of the communication transmits the communication observation information; creating, for each of the communication observation devices, a monitoring list indicating communications to which the communication observation device is to transmit observation information based on a result of the allocation; transmitting the created monitoring list for each of the communication observation devices to each of the communication observation devices; An analytical method comprising the steps of:

8. acquiring, from each of the communication observation devices that observe communications on a network, observation information of the communications, including a source IP address, a source MAC address, a destination IP address, and a destination MAC address in the communications; estimating a topology of the network based on the acquired observation information; a step of allocating the communication observation devices based on the estimated topology, the installation positions of the communication observation devices, and the communication observation information acquired from the communication observation devices, so that for each communication flowing through the network, any one of the communication observation devices on the path of the communication transmits the communication observation information; creating, for each of the communication observation devices, a monitoring list indicating communications to which the communication observation device is to transmit observation information based on a result of the allocation; transmitting the created monitoring list for each of the communication observation devices to each of the communication observation devices; An analysis program for running the above on a computer.

Images