Traffic analysis device, traffic analysis method, and traffic analysis program

Abstract

A traffic analysis device (1) has: a traffic emulator (13) that mirrors the traffic on an actual network system (2) at the current time on a virtual space and carries out protocol control of the traffic on the virtual space so as to calculate the state of the traffic on the actual network system (2) at the next time; and a domain determination unit (11) that, with respect to the mirrored traffic, determines a domain which has presumably been infected by a lateral movement attack and that excludes part of the traffic in the domain from being subject to calculation by the traffic emulator (13).

Description

[Technical field]

[0001] The present invention relates to a traffic analysis device, a traffic analysis method, and a traffic analysis program. [Background technology]

[0002] A technology for predicting future traffic volume has been proposed. For example, Patent Document 1 describes a communication bandwidth calculation device that predicts future user traffic volume and calculates the bandwidth facility amount required for communication services. This improves the economic efficiency of communication service providers by calculating the facility amount of communication resources that is neither excessive nor insufficient. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-150524 A Summary of the Invention [Problem to be solved by the invention]

[0004] We consider the application of technology for predicting future traffic volume to the detection of unauthorized communications. For the detection of unauthorized communications, traffic emulation, which predicts individual traffic flows in detail, is more effective than the rough prediction of traffic volume as in Patent Document 1. The traffic emulator mimics (mirrors) in a virtual space the various traffic flows in a real network at the current time (t) and predicts (ideal) traffic conditions that conform to the protocol regulations in the virtual space at the next time (t+1) using the various traffic flows at the current time (t) as a starting point.

[0005] The current time (t) is the target time at which the real network is observed, and the next time (t+1) is the target time at which the real network is observed the next time after the current time. The traffic emulator can detect user traffic that violates the protocol rules by comparing the ideal traffic state at the next time with the user traffic state in the real world at the next time.

[0006] However, the amount of traffic flowing through a large-capacity backbone network is huge, at 10 Gbps or 100 Gbps per wavelength, and the number of traffic flows that the traffic emulator must calculate is also huge. Therefore, the shorter the calculation interval from the current time (t) to the next time (t+1) is (for example, every 10 seconds), the more the traffic emulator is required to have extremely high (real-time) calculation capabilities.

[0007] Among fraudulent communications, attacks that involve lateral movement (horizontal expansion) within the same domain are particularly in need of countermeasures, as multiple devices within the same domain are affected one after another. WannaCry is a typical example of a lateral movement attack. WannaCry is a worm-type ransomware that targets Microsoft Windows (registered trademark), and the attack spreads within a domain by spreading laterally using SMBv1 (Server Message Block version 1).

[0008] FIG. 6 is an explanatory diagram of a lateral movement attack within a domain. An attacker outside the company domain 90 operates an attacking terminal 81 to gain unauthorized access to the company domain 90 by following the procedure below. (Step 1) The attacker succeeds in invading the GW 91, SW 93, and employee terminal 96 from the attacking terminal 81 via the Internet 82 (arrow 83). However, since the employee using the employee terminal 96 has low authority, no confidential information exists on that terminal (locally), and the employee does not have access rights to the customer server 94 that manages confidential information. (Step 2) Using the employee terminal 96 as a springboard, the infection spreads to the manager terminal 97 (arrow 84). This allows the manager terminal 97, which has higher authority, to gain access to the customer server 94. (Step 3) Using the manager's terminal 97 as a springboard, the infection spreads to the customer's server 94 via SW 93 → GW 91 → SW 92 (arrow 85). As a result, confidential information in the customer's server 94 is obtained.

[0009] As explained above in Figure 6, lateral movement attacks have the characteristic of generating anomalous traffic one after another in a short period of time. Therefore, rather than detecting each anomalous traffic in detail, it is more effective to conduct analysis that increases the number of domains infected by lateral movement attacks at a larger scale, that is, by domain. This is because if infected domains can be predicted, large-scale measures such as network isolation can be implemented on a domain-by-domain basis.

[0010] If a strict detection process were to be performed on each traffic to determine whether it violated the protocol rules, the amount of calculations would be enormous, and the calculations would not be completed in time for the next time (t+1). As a result, the results of the detection of unauthorized communications would not be applicable to the detection of unauthorized communications. Incidentally, in conventional traffic volume prediction technologies such as that described in Patent Document 1, there were no such strict constraints on calculation time, and therefore no consideration had been given to effectively reducing calculation costs while taking into account lateral movement attacks.

[0011] Therefore, the main objective of the present invention is to effectively reduce the computational cost by taking into account lateral movement attacks when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t). [Means for solving the problem]

[0012] In order to solve the above problems, a traffic analysis device of the present invention has the following features. The present invention relates to a traffic emulator that calculates the state of traffic on a real network system at a next time by mirroring each traffic on the real network system at a current time in a virtual space and executing protocol control of each traffic in the virtual space; The traffic emulator is characterized by having a domain determination unit that determines, for each mirrored traffic, a domain that is predicted to be infected with a lateral movement attack, and excludes a portion of the traffic within that domain from the calculation target of the traffic emulator. Effect of the Invention

[0013] According to the present invention, when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t), it is possible to effectively reduce the calculation cost by taking into account lateral movement attacks. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a configuration diagram of a traffic analysis device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a hardware configuration diagram of the traffic analysis device according to the present embodiment. [Diagram 3] FIG. 2 is an explanatory diagram showing an overview of the processing of the traffic analysis device according to the present embodiment. [Figure 4] FIG. 4 is a sequence diagram showing the processing of the traffic analysis device according to the present embodiment. [Diagram 5] 11 is a comparison table showing the effect of the traffic analysis device according to the present embodiment. [Figure 6] FIG. 1 is an explanatory diagram of a lateral movement attack within a domain. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0016] FIG. 1 is a diagram showing the configuration of a traffic analysis device 1. The traffic analysis device 1 includes a domain determination unit 11 , a traffic model management unit 12 , a traffic emulator 13 , an analysis and exclusion unit 14 , and a traffic comparison unit 15 . The real network system 2 is an actual network system to be analyzed by the traffic analysis device 1 .

[0017] The traffic emulator 13 mirrors each traffic on the real network system 2 at the current time (t) in a virtual space and executes protocol control of each traffic in the virtual space, thereby calculating the traffic state on the real network system 2 at the next time (t+1).

[0018] The domain determination unit 11 determines, for each mirrored traffic, a domain predicted to be infected by a lateral movement attack (details will be described later in the explanation of FIG. 4), and determines that a part of the traffic in that domain should be excluded from the calculation target of the traffic emulator 13. The domain determination unit 11 outputs the result of the determination to exclude to the analysis and exclusion unit 14. The analysis and exclusion unit 14 excludes the traffic notified by the domain determination unit 11 from the calculation target of the traffic emulator 13 .

[0019] The traffic model management unit 12 manages, as a traffic model, control information defined in the protocol for the traffic emulator 13 to execute protocol control of each traffic in a virtual space. The traffic emulator 13 reads out a traffic model for each traffic protocol from the traffic model management unit 12 and uses it to calculate the traffic state. If the traffic state on the real network system 2 at the next time does not match the traffic state calculated by the traffic emulator 13, the traffic comparison unit 15 notifies the real network system 2 that the traffic is abnormal traffic.

[0020] FIG. 2 is a diagram showing the hardware configuration of the traffic analysis device 1. As shown in FIG. The traffic analysis device 1 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or its abbreviation, an app) loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

[0021] FIG. 3 is an explanatory diagram showing an overview of the process of the traffic analysis device 1. As shown in FIG. A state 101 is a bar graph showing the calculation time of each traffic in three domains A, B, and C mirrored by the traffic emulator 13 at the current time (t). The black bars for domains A and B indicate that they were infected by a lateral movement attack. The white bars for domain C indicate that they were not infected by a lateral movement attack.

[0022] State 102 is state 101 with one traffic of domain A removed. The domain determination unit 11 predicts that domain A, which has the largest number of virtual traffic flows (three flows), is infected with a lateral movement attack. When the processing load of the simulation becomes high, the domain determination unit 11 reduces the amount of calculation by removing the virtual traffic in domain A from the calculation target of the traffic emulator 13. Here, the domain determination unit 11 removes from the calculation target, among the three virtual traffics in domain A, the virtual traffic that cannot be calculated in time by the next time (t+1). In this way, by early excluding part of domain A infected by a lateral movement attack from the calculation targets, the traffic analysis device 1 can allocate calculation power to other domains B, C, D, ..., thereby increasing the number of domains that can be calculated by the next time (t+1).

[0023] FIG. 4 is a sequence diagram showing the process of the traffic analysis device 1. As shown in FIG. In S101, the traffic emulator 13 receives real traffic (or information indicating the state thereof) at the current time from the real network system 2, and notifies the analysis and exclusion unit 14 of the real traffic as a candidate for the exclusion process in S106.

[0024] In S102a, the traffic emulator 13 acquires the protocol operation contents of the actual traffic at the next time from the traffic model management unit 12 using the protocol information of the actual traffic at the current time received in S101 as a search key.

[0025] The traffic emulator 13 calculates the traffic state at the next time from the traffic state at the current time by simulating in a virtual space the protocol operation for each traffic flow on the real network system 2. This calculation process transitions in the order of calculation start in S103a → calculation in progress in S103b → calculation completion in S103c. At the start of the calculation in S103a, the traffic emulator 13 mirrors the actual traffic at the current time notified in S101 onto the virtual space. After that, the traffic emulator 13 starts a calculation to transition each traffic in the virtual space to the traffic state at the next time when the network conditions in the virtual space are changed, by reflecting the protocol operation contents acquired in S102a.

[0026] In S104a, the traffic emulator 13 notifies the domain determination unit 11 of the list of virtual traffics mirrored in the virtual space in S103a as analysis targets. The domain determination unit 11 classifies the notified virtual traffics into domain units based on the destination information and source information of each traffic (S104b: sorting by domain). In S104c, the traffic emulator 13 appropriately notifies the domain determination unit 11 of the current load status of the simulation process (being calculated in S103b).

[0027] In S105a, the domain determination unit 11 determines whether the current load status exceeds the load threshold of the traffic emulator 13 using the determination formula "load status>load threshold". The load threshold is set according to the calculation capacity of the traffic emulator 13, and is, for example, a general number of flows that the traffic emulator 13 can complete calculation by the next time. In this case, the load status=the number of mirrored virtual traffic flows. For example, when the judgment formula is (load status flow number=2000)>(load threshold flow number=1500), the calculation of the 500 flow numbers will not be completed in time for the next time (Yes in S105a). Therefore, it is necessary to exclude the 500 flow numbers from the calculation before the next time.

[0028] In S105b, if the calculation is not completed in time (Yes in S105a), the domain determination unit 11 notifies the analysis exclusion unit 14 of the virtual traffic in the domain predicted to be infected with a lateral movement attack from the list of virtual traffic organized by domain in S104b as traffic to be excluded. An example of a method for determining a domain infected with a lateral movement attack will be described below.

[0029] (Determination method 1) A domain that has a larger number of traffic flows within the domain (or the total traffic volume per domain) than other domains is determined to be infected with a lateral movement attack. The domain determination unit 11 then arranges the domains in order of the number of traffic flows, and sequentially selects domains with the largest number of flows as traffic to be excluded. The domain determination unit 11 determines traffic to be excluded by giving priority to domains with the largest number of flows, for example, using weighted round robin or the like.

[0030] (Determination method 2) A domain with a higher rate of increase per unit time (time t-2 → time t-1 → time t → time t+1) in the number of traffic flows within the domain is determined to be infected with a lateral movement attack. After that, the process is performed by replacing the "number of flows" in (Determination method 1) with the "increase rate."

[0031] (Determination method 3) Traffic conditions within a domain are compared, and the more matching or similar traffic conditions a domain has, the more likely it is to be determined to have been infected by a lateral movement attack. This is because in a lateral movement attack, there are multiple terminals that have been subjected to the same attack, and the results of analyzing the traffic of that same attack as traffic to be excluded are also likely to show the same attack results.

[0032] In S106, the analysis exclusion unit 14 decides to exclude some or all of the exclusion target traffic notified in S105b from the calculation target of the traffic emulator 13. Here, the analysis exclusion unit 14 may determine in advance the priority at the next time for each terminal that transmits and receives traffic, and perform exclusion control according to the priority. The exclusion control may, for example, make it easier for traffic of a terminal with a lower priority to be excluded from the calculation target, or interrupt the calculation of traffic in the earliest order.

[0033] In S107, the analysis exclusion unit 14 notifies the traffic emulator 13 of an instruction to exclude the traffic determined in S106 from the calculation target. The traffic emulator 13 interrupts (or forcibly terminates) the calculation of the traffic that has been excluded in S107 from the traffic being calculated in S103b. This allows the excess computing power of the computer on which the traffic emulator 13 runs to be utilized for calculating the traffic of other domains that have not been excluded, thereby increasing the number of domains for which calculations are completed by the next time (S103c).

[0034] In S108, the traffic emulator 13 notifies the traffic comparison unit 15 of the virtual traffic in the virtual space at the next time when the calculation is completed (Yes in S103c). As described above, each of the processes from S101 to S108 is executed during the period from the current time (t) to the next time (t+1). Below, S111 and onwards are processes that are executed from the next time (t+1) onwards.

[0035] In step S111, the traffic comparison unit 15 receives from the real network system 2 the actual traffic at the next time (t+1). In S112, the traffic comparison unit 15 compares the actual traffic at the next time received in S111 with the virtual traffic at the next time received in S108. If the comparison results in a mismatch, the traffic comparison unit 15 determines that the actual traffic at the next time (t+1) is abnormal traffic.

[0036] In S113, the traffic comparison unit 15 assigns an abnormality flag indicating an abnormality to the abnormal traffic found in the comparison result of S111. Note that, in the case of traffic in a domain predicted to be infected with a lateral movement attack in S105b, the traffic comparison unit 15 may add, as an abnormality flag, information indicating that the domain is predicted to be infected with a lateral movement attack and the basis for the prediction (such as which of the determination methods 1 to 3 was used).

[0037] In S114, the traffic comparison unit 15 returns the abnormal traffic at the next time when the abnormality flag was added to the real network system 2. This allows each device in the real network system 2 to execute countermeasures against the abnormality, such as discarding the real traffic with the abnormality flag added, displaying the contents of the abnormality flag on the administrator's screen, or isolating a domain infected by a lateral movement attack from the network. Alternatively, a second analysis device that analyzes intra-domain traffic separate from the traffic analysis device 1 may be provided in each domain of the real network system 2, and upon receiving a notification that its own domain has been infected with a lateral movement attack, the second analysis device may analyze abnormal traffic within its own domain.

[0038] FIG. 5 is a comparison table showing the effect of the traffic analysis device 1. The first column (Time) of the comparison table indicates the time of each state during the calculation. The second column (real network) of the comparison table is a list of real traffic that exists on the real network system 2. The first letter of the real traffic identifier (for example, "RTa(t)") is R (Real) for real traffic or V (Virtual) for virtual traffic, and the second letter is T (Traffic) for traffic. This is followed by the flow identifier (a, b1, b2, ...) and the time information in the first column, such as (t), in parentheses. Traffic with the word "infected" at the end of the identifier indicates traffic within a domain infected with a lateral movement attack.

[0039] The third column (Virtual 1) in the comparison table shows the virtual traffic when the traffic analysis device 1 is in a computer environment (such as a supercomputer) that provides sufficient computing power, and the calculation of all traffic is completed by the next time. The fourth and fifth columns (Virtual 2, 3) of the comparison table show the virtual traffic when the calculation of some traffic is not completed by the next time due to a computer environment (such as a general personal computer) with limited calculation capacity of the traffic analysis device 1. The difference between the fourth column (Virtual 2) and the fifth column (Virtual 3) is that the process of excluding some traffic from the calculation target shown in Fig. 3 is not applied (Virtual 2) and is applied (Virtual 3).

[0040] The first row of the comparison table indicates that the real traffic existing on the real network system 2 at the current time (t) is mirrored to each of the virtual networks (1, 2, 3). In other words, three sets of mirroring are performed: RTa(t) → VTa(t), RTb1(t) → VTb1(t), and RTb2(t) → VTb2(t). Note that RTa(t) of domain A is not infected with a lateral movement attack, and RTb1(t) and RTb2(t) of domain B are infected with a lateral movement attack.

[0041] The second row of the comparison table shows the traffic state at the next time (t+1). From the real network system 2, RTa(t) in domain A remains unchanged as normal traffic, but RTb3(t) and RTb4(t) are derived in domain B as abnormal traffic. With sufficient computing power, (Virtual 1) at the next time (t+1) can calculate three sets of traffic states, VTa(t) → VTa(t+1), VTb1(t) → VTb1(t+1), and VTb2(t) → VTb2(t+1), by the next time. Therefore, by comparing the second and third columns at the next time (t+1), abnormal traffic can be detected as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb1(t+1)=VTb1(t+1) →Normal traffic ·RTb2(t+1)=VTb2(t+1) →Normal traffic ·RTb3(t+1) mismatch → Abnormal traffic ·RTb4(t+1) mismatch → Abnormal traffic

[0042] Due to insufficient computing power for (Virtual 2) at the next time (t+1), only one set of traffic states, VTa(t) → VTa(t+1), was calculated by the next time. Therefore, by comparing the second and fourth columns at the next time (t+1), abnormal traffic can be detected as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb1(t+1) mismatch → Abnormal traffic ·RTb2(t+1) mismatch → Abnormal traffic ·RTb3(t+1) mismatch → Abnormal traffic ·RTb4(t+1) mismatch → Abnormal traffic

[0043] Although (Virtual 3) at the next time (t+1) has insufficient calculation capacity, by applying a process that excludes traffic from the calculation, it is possible to calculate two sets of traffic states, VTa(t) → VTa(t+1) and VTb1(t) → VTb1(t+1), by the next time, and to add an abnormality flag to VTb1(t+1) indicating that it has been infected with a lateral movement attack. Therefore, by comparing the second column with the fifth column at the next time (t+1), it is possible to detect abnormal traffic as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb1(t+1)=VTb1(t+1) → Abnormal traffic (infected domain B) ·RTb2(t+1) mismatch → Abnormal traffic (infected domain B) ·RTb3(t+1) mismatch → Abnormal traffic (infected domain B) ·RTb4(t+1) mismatch → Abnormal traffic (infected domain B) In other words, the detection results for (Virtual 3) allowed for more detailed analysis of domain-by-domain infections caused by lateral movement attacks than the detection results for (Virtual 1, 2).

[0044] [effect] The traffic analysis device 1 of the present invention includes a traffic emulator 13 that calculates the state of traffic on the real network system 2 at the next time by mirroring each traffic on the real network system 2 at the current time in a virtual space and executing protocol control of each traffic in the virtual space; The system is characterized by having a domain determination unit 11 that determines, for each mirrored traffic, a domain predicted to be infected with a lateral movement attack, and excludes a portion of the traffic within that domain from the calculation target of the traffic emulator 13.

[0045] As a result, when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t), traffic within domains predicted to be infected with lateral movement attacks can be excluded from the calculation, thereby taking lateral movement attacks into account and effectively reducing computational costs. Furthermore, by efficiently allocating computational resources that were wasted by duplicating a large amount of traffic within an infected domain to traffic within another domain, the number of detections of domains infected by lateral movement attacks can be increased.

[0046] The present invention is characterized in that the domain determination unit 11 determines that a domain having a larger number of intra-domain traffic flows than other domains is a domain infected with a lateral movement attack.

[0047] This allows for early identification of domains infected with lateral movement attacks.

[0048] The present invention is characterized in that the domain determination unit 11 determines that a domain having a higher rate of increase in the number of intra-domain traffic flows than other domains is a domain infected with a lateral movement attack.

[0049] This makes it possible to identify domains infected with lateral movement attacks with a high degree of accuracy by detecting unnatural increases in the number of flows within a domain.

[0050] The present invention is characterized in that the domain determination unit 11 determines that a domain that has a larger set of matching or similar traffic states than other domains is a domain infected with a lateral movement attack.

[0051] This makes it possible to identify domains infected by lateral movement attacks with a high degree of accuracy based on the phenomenon of similarities between traffic infected by lateral movement attacks.

[0052] In the present invention, the traffic analysis device 1 further includes a traffic comparison unit 15. The traffic comparison unit 15 compares the traffic state at the next time calculated by the traffic emulator 13 with the traffic state on the real network system 2 at the next time, and notifies the real network system 2 of any inconsistent traffic as abnormal traffic.

[0053] This makes it possible to detect unauthorized communications from the traffic on the real network system 2 at the next time. [Explanation of symbols]

[0054] 1 Traffic analysis device 2. Actual network system 11 Domain Judgment Section 12 Traffic Model Management Department 13 Traffic Emulator 14 Analysis exclusion section 15 Traffic Comparison Section

Claims

1. a traffic emulator that calculates a state of traffic on the real network system at a next time by mirroring each traffic on the real network system at a current time in a virtual space and executing a protocol control of each traffic on the virtual space; and a domain determination unit that determines a domain that is predicted to be infected by a lateral movement attack for each mirrored traffic and excludes a part of the traffic in the domain from the calculation target of the traffic emulator. Traffic analysis equipment.

2. The domain determination unit is characterized in that it determines that a domain having a larger number of intra-domain traffic flows than other domains is a domain infected with a lateral movement attack. The traffic analysis device according to claim 1 .

3. The domain determination unit is characterized in that it determines that a domain having a higher rate of increase in the number of traffic flows within the domain is a domain infected with a lateral movement attack than other domains. The traffic analysis device according to claim 1 .

4. The domain determination unit determines that a domain having a larger number of sets of traffic states that match or are similar to each other is infected with a lateral movement attack. The traffic analysis device according to claim 1 .

5. The traffic analysis device further includes a traffic comparison unit, The traffic comparison unit compares the traffic state at the next time calculated by the traffic emulator with the traffic state on the real network system at the next time, and notifies the real network system of any inconsistent traffic as abnormal traffic.

5. A traffic analysis device according to claim 1, wherein the traffic analysis device is a communication device.

6. The traffic analysis device includes a traffic emulator and a domain determination unit, the traffic emulator mirrors each traffic on the real network system at the current time in a virtual space and executes protocol control of each traffic in the virtual space to calculate a state of traffic on the real network system at a next time; The domain determination unit determines a domain that is predicted to be infected by a lateral movement attack for each mirrored traffic, and excludes a part of the traffic in the domain from the calculation target of the traffic emulator. Traffic analysis methods.

7. A traffic analysis program for causing a computer to function as the traffic analysis device according to any one of claims 1 to 5.

Images