SWITCH, NETWORK CONTROLLER, COMMUNICATION CONTROL METHOD, AND COMMUNICATION CONTROL PROGRAM

Abstract

This switch in a communication network comprises a controller that controls communication flows in the communication network. Suspicious flows are communication flows that are suspected of being related to Distributed Denial of Service (DDoS) attacks. Normal flows are the communication flows other than the suspicious flows. The controller is configured to execute temporary measures when having received, from the network controller, an instruction of temporary measures indicating identification information of a suspicious flow. The temporary measures include: processing of setting the priority level of the suspicious flow to a specified priority level; and processing of setting the priority level of a normal flow to a higher level than the specified priority level.

Description

[Technical field]

[0001] The present invention relates to a communication system including a switch that controls a communication flow in a communication network, and more particularly to a method for dealing with a Distributed Denial of Service (DDoS) attack in a communication system including a switch that controls a communication flow in a communication network. [Background technology]

[0002] Patent Document 1 discloses a communication control system having a plurality of layer 2 switches and a network controller. A communication (relay) network is configured by the plurality of layer 2 switches. Terminals such as IoT terminals communicate with a server via the layer 2 switches. Each layer 2 switch controls the communication flow in the communication network. A network controller is communicatively connected to each layer 2 switch and controls each layer 2 switch.

[0003] DDoS attacks are known in which a large amount of attack traffic is sent from a terminal infected with malware, etc. When a DDoS attack occurs, the network bandwidth becomes congested, and there is a risk that frames of normal communication flows (normal flows) will be discarded. For this reason, DDoS attack detection servers are provided to detect DDoS attacks. When a DDoS attack is detected, a switch blocks the attack traffic. However, it may take some time for the DDoS attack detection server to detect an attack, in which case frames of normal flows will continue to be discarded until the attack traffic is blocked.

[0004] According to the technology disclosed in Patent Document 1, before a DDoS attack detection server detects an attack, a network controller detects a communication flow suspected to be related to an attack as a "suspect flow." The network controller then transmits a command to a target switch that handles the suspect flow to lower the priority of the forwarding process for the suspect flow. The target switch lowers the priority of the forwarding process for the suspect flow in accordance with the command from the network controller. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2020-31363 A Summary of the Invention [Problem to be solved by the invention]

[0006] According to the technology described in Patent Document 1, the priority of a suspect flow is lowered before an attack is detected by a DDoS attack detection server. As a result, data discarding of normal flows with a higher priority than the suspect flow after the lowering is suppressed. However, data discarding of normal flows with a lower priority than the suspect flow after the lowering still continues.

[0007] One object of the present invention is to provide a technique capable of suppressing data discarding of normal communication flows that are not related to DDoS attacks in a communication system including a switch that controls communication flows. [Means for solving the problem]

[0008] The first aspect relates to a switch in a communication network. The switch comprises a controller that controls the flow of communication in the communication network. A suspect flow is a communication flow suspected to be related to a DDoS attack. A normal flow is a communication flow other than a suspect flow. The controller is configured to execute a provisional action when it receives a provisional action instruction indicating identification information of a suspect flow from the network controller. The interim solution is A process of setting the priority of the suspected flow to a specified priority; A process to set the priority of normal flows higher than the specified priority. Includes.

[0009] A second aspect relates to a network controller coupled to a switch that controls communication flow in a communication network. The network controller includes a controller that communicates with the switch. A suspected flow is a communication flow suspected to be related to a DDoS attack. A normal flow is a communication flow other than a suspect flow. The controller is acquiring feature information indicating a feature of each communication flow from the switch; A process of detecting a suspicious flow based on the feature amount information; If a suspicious flow is detected, the switch is instructed to take provisional action. The apparatus is configured to execute the following steps: The interim solution is A process of setting the priority of the suspected flow to a specified priority; A process to set the priority of normal flows higher than the specified priority. Includes.

[0010] A third aspect relates to a communication control method in a communication system including a switch that controls a communication flow in a communication network. The communication control method is A process of acquiring feature information indicating a feature of each communication flow; A process of detecting a suspicious flow, which is a communication flow suspected to be related to a DDoS attack, based on the feature information; If a suspicious flow is detected, a provisional action is taken. Includes. The interim solution is A process of setting the priority of the suspected flow to a specified priority; A process of setting the priority of normal flows, which are communication flows other than suspect flows, higher than the specified priority. Includes.

[0011] The fourth aspect relates to a communication control program for controlling a switch in a communication network. The communication control program, when executed by a computer included in the switch, causes the switch to control communication flow in the communication network. A suspect flow is a communication flow suspected to be related to a DDoS attack. A normal flow is a communication flow other than a suspect flow. The communication control program further causes the switch to execute a provisional solution when a provisional solution instruction indicating identification information of a suspect flow is received from the network controller. The interim solution is A process of setting the priority of the suspected flow to a specified priority; A process to set the priority of normal flows higher than the specified priority. Includes. Effect of the Invention

[0012] According to the present disclosure, when a suspicious flow is detected, a provisional response is performed. In the provisional response, the priority of the suspicious flow is set to a specified priority, and the priority of the normal flow is set to a higher priority than the specified priority. This makes it possible to suppress data discarding of normal flows even in a situation where the network bandwidth is congested due to a DDoS attack. In particular, it becomes possible to suppress data discarding of normal flows that were originally assigned a low priority. [Brief description of the drawings]

[0013] [Figure 1] 1 is a block diagram illustrating a schematic configuration example of a communication system according to an embodiment of the present disclosure. [Diagram 2]FIG. 1 is a conceptual diagram for explaining a provisional measure according to an embodiment of the present disclosure. [Diagram 3] 1 is a conceptual diagram for explaining an example of a method for controlling the priority of a communication flow according to an embodiment of the present disclosure. [Figure 4] FIG. 13 is a conceptual diagram for explaining a formal action according to an embodiment of the present disclosure. [Diagram 5] FIG. 2 is a block diagram illustrating a configuration example of a switch according to an embodiment of the present disclosure. [Figure 6] FIG. 2 is a block diagram illustrating a configuration example of a network controller according to an embodiment of the present disclosure. [Figure 7] 1 is a block diagram showing an example of a functional configuration related to a provisional solution and a formal solution according to an embodiment of the present disclosure. [Figure 8] FIG. 2 is a conceptual diagram illustrating an example of feature amount information according to an embodiment of the present disclosure. [Figure 9] 1 is a conceptual diagram illustrating an example of abnormality feature amount information according to an embodiment of the present disclosure. [Figure 10] 1 is a flowchart illustrating an overview of processing related to a provisional action and a formal action according to an embodiment of the present disclosure. [Figure 11] FIG. 2 is a block diagram for explaining a first example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 12] FIG. 2 is a conceptual diagram for explaining a first example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 13] FIG. 11 is a conceptual diagram for explaining a second example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 14] 13 is a flowchart illustrating a third example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 15] FIG. 11 is a block diagram for explaining a fourth example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 16] 11 is a conceptual diagram for explaining an example of queue length information according to an embodiment of the present disclosure. FIG. [Figure 17]FIG. 13 is a conceptual diagram for explaining a fourth example of priority control in a provisional response according to an embodiment of the present disclosure. [Figure 18] 1 is a block diagram showing an example of a functional configuration related to a provisional measure taking into account a suspected section according to an embodiment of the present disclosure. FIG. [Figure 19] 11 is a conceptual diagram for explaining an example of a provisional measure taking into consideration a suspected section according to an embodiment of the present disclosure. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] An embodiment of the present invention will be described with reference to the accompanying drawings.

[0015] 1. Overview 1 is a block diagram showing a schematic configuration example of a communication system 1 according to the present embodiment. The communication system 1 includes a plurality of terminals 5, a plurality of switches 10, a network controller 20, a Distributed Denial of Service (DDoS) attack detection server, and a server 40. Examples of the terminals 5 include Internet of Things (IoT) terminals and mobile terminals. Examples of the switches 10 include Layer 2 (L2) switches. Examples of the servers 40 include IoT servers.

[0016] A communication (relay) network is configured by a plurality of switches 10. A plurality of terminals 5 are accommodated in the communication network. The terminals 5 communicate with a server 40 via the switches 10. Each switch 10 controls the communication flow in the communication network. A network controller 20 is communicatively connected to each switch 10 and controls each switch 10.

[0017] The DDoS attack detection server 30 detects DDoS attacks in which a large amount of attack traffic is transmitted from a terminal 5 infected with malware or the like. The DDoS attack detection server 30 is communicably connected to each switch 10 and the network controller 20. In the example shown in FIG. 1, the DDoS attack detection server 30 is installed in front of the server 40.

[0018] When a DDoS attack occurs, the network bandwidth becomes congested, and some data of normal communication flows may be discarded. Since packet retransmission due to data discard consumes the limited battery of the terminal 5, it is desirable to quickly suppress data discard of normal communication flows. However, it may take time for the DDoS attack detection server 30 to detect an attack, and it may also take time to block the attack traffic. Therefore, according to this embodiment, in order to quickly suppress data discard of normal communication flows, a "provisional measure" described below is implemented before the DDoS attack detection server 30 detects an attack.

[0019] 2 is a conceptual diagram for explaining a provisional measure according to this embodiment. A communication flow that is highly likely to be related to a DDoS attack, although it is not confirmed, i.e., a communication flow suspected to be related to a DDoS attack, is hereinafter referred to as a "suspect flow FS." A communication flow other than the suspect flow FS, i.e., a communication flow not related to a DDoS attack, is hereinafter referred to as a "normal flow FN." Note that a "suspect flow" may be rephrased as a "suspect traffic" and a "normal flow" may be rephrased as a "normal traffic."

[0020] The network controller 20 receives information about the communication flows handled by each switch 10 from each switch 10. Then, the network controller 20 determines whether or not a suspicious flow FS exists based on the information about the communication flows. An example of a method for determining whether or not a suspicious flow FS exists will be described in detail later.

[0021] When a suspicious flow FS is detected, the network controller 20 transmits a "provisional handling instruction INS1" to at least one target switch 10T. The target switch 10T is a switch 10 that handles the suspicious flow FS. For example, the target switch 10T is a switch 10 that serves as an entrance for the suspicious flow FS in the communication network. The provisional handling instruction INS1 is information that instructs the target switch 10T to execute provisional handling, and includes at least identification information of the suspicious flow FS. The identification information is, for example, a VLAN ID (VID).

[0022] Upon receiving the provisional action instruction INS1 from the network controller 20, the target switch 10T executes provisional action in accordance with the provisional action instruction INS1. In the provisional action, the target switch 10T adjusts the "priority" of the suspected flow FS and the normal flow FN.

[0023] 3 is a conceptual diagram for explaining the priority of a communication flow. Each communication flow is assigned one of N levels of priority P0 to P(N-1), where N is an integer equal to or greater than 2. Priority P0 is the lowest and priority P(N-1) is the highest. The higher the priority, the higher the priority the switch 10 gives to transferring data (frames) of that communication flow. In other words, the higher the priority, the higher the data transfer rate by the switch 10.

[0024] For example, as shown in Fig. 3, a queue 11 is provided for each priority. That is, the switch 10 has multiple types of queues 11-0 to 11-(N-1) provided for each of multiple priorities P0 to P(N-1). Data (frames) of a communication flow are stored in a queue 11 associated with the priority of the communication flow. The frequency of data transmission from each queue 11 depends on the priority, and the higher the priority of the queue 11, the higher the data transmission frequency. As a result, the higher the priority of the communication flow, the higher the data transfer rate. Conversely, the lower the priority of the communication flow, the lower the data transfer rate.

[0025] As shown in FIG. 2, in the provisional response, the target switch 10T sets the priority of the suspected flow FS to a "designated priority PS." The designated priority PS is a relatively low priority. For example, the designated priority PS is the lowest priority P0. Furthermore, the target switch 10T sets the priority of the normal flow FN to a priority higher than the designated priority PS. For example, when the designated priority PS is the lowest priority P0, the target switch 10T sets the priority of the suspected flow FS to the lowest priority P0, and sets the priority of the normal flow FN to a priority higher than the lowest priority P0. This makes it possible to quickly suppress data discarding of the normal flow FN even in a situation where the network bandwidth is congested due to a DDoS attack. In particular, it becomes possible to quickly suppress data discarding of the normal flow FN, which originally had a low priority.

[0026] While taking provisional measures, the DDoS attack detection server 30 precisely determines whether the suspect flow FS is the result of a DDoS attack based on the data of the suspect flow FS. Then, the DDoS attack detection server 30 notifies the network controller 20 of information indicating the determination result. Depending on the determination result by the DDoS attack detection server 30, a "formal measure" described below is implemented.

[0027] 4 is a conceptual diagram for explaining the formal handling according to the present embodiment. The network controller 20 receives information indicating the determination result by the DDoS attack detection server 30. If it is determined that the suspected flow FS is an abnormal flow that carries out a DDoS attack, the network controller 20 transmits a "formal handling instruction INS2" to the target switch 10T. The formal handling instruction INS2 is information that instructs the target switch 10T to execute formal handling, and includes at least identification information of the suspected flow FS (abnormal flow). The identification information is, for example, a source IP address.

[0028] When the target switch 10T receives the formal action instruction INS2 from the network controller 20, it executes formal action in accordance with the formal action instruction INS2. Specifically, the target switch 10T blocks the suspected flow FS (abnormal flow) by discarding frames of the suspected flow FS (abnormal flow). The target switch 10T also returns the priority of the normal flow FN to its original priority (i.e., the priority before the provisional action).

[0029] If it is determined that the suspected flow FS is not intended to perform a DDoS attack, the network controller 20 transmits a "restore instruction" to the target switch 10T. The restore instruction instructs the switch 10T to revert the priority changed in the provisional response to the original priority before the provisional response. In accordance with the restore instruction, the target switch 10T reverts the priority of the suspected flow FS from the designated priority PS to the original priority, and also reverts the priority of the normal flow FN to the original priority.

[0030] As described above, according to this embodiment, when a suspicious flow FS is detected by the network controller 20, a provisional response is performed. In the provisional response, the priority of the suspicious flow FS is set to the designated priority PS, and the priority of the normal flow FN is set to a priority higher than the designated priority PS. This makes it possible to prevent data discarding of normal flows FN even in a situation where the network bandwidth is congested due to a DDoS attack. In particular, it becomes possible to prevent data discarding of normal flows FN, which originally had a low priority.

[0031] Moreover, the above-mentioned provisional measures are implemented before the attack is detected by the DDoS attack detection server 30. Therefore, it is possible to quickly prevent data discarding of normal flows FN.

[0032] Packet retransmission caused by data discarding consumes the limited battery of the terminal 5. According to the present embodiment, data discarding is suppressed, and therefore packet retransmission caused by data discarding is also suppressed, and battery consumption in the terminal 5 is also suppressed.

[0033] 2. Basic configuration and processing 2-1.Basic configuration 2-1-1. Switch 5 is a block diagram showing an example of the configuration of a switch 10 according to this embodiment. The switch 10 includes a port 12, a port 15, and a controller 100. The port 12 is connected to a network controller 20. The port 15 is connected to a terminal 5, another switch 10, a server 40, and the like.

[0034] The controller 100 controls the communication flow. For example, the controller 100 performs a flow transfer process to receive communication flow data (frames) from a certain port 15 and output the data from another port 15. The controller 100 holds a transfer table indicating a combination of an input port and an output port for each communication flow, and performs the flow transfer process based on the transfer table.

[0035] Furthermore, the controller 100 may receive instructions from the network controller 20 via the port 12 and execute various processes according to the instructions. For example, the controller 100 performs provisional measures according to provisional measure instructions INS1. As another example, the controller 100 performs formal measures according to formal measure instructions INS2. As yet another example, the controller 100 may rewrite the forwarding table.

[0036] The controller 100 includes one or more processors 101 (hereinafter simply referred to as "processor 101") and one or more storage devices 102 (hereinafter simply referred to as "storage devices 102"). The processor 101 performs various types of information processing. For example, the processor 101 includes a CPU (Central Processing Unit). The storage device 102 stores various types of information required for processing by the processor 101. Examples of the storage device 102 include a volatile memory, a non-volatile memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), and the like.

[0037] The communication control program 103 is a computer program executed by the processor 101. The functions of the controller 100 are realized by cooperation between the processor 101, which executes the communication control program 103, and the storage device 102. The communication control program 103 is stored in the storage device 102. The communication control program 103 may be recorded in a computer-readable recording medium. The communication control program 103 may be provided to the controller 100 via a network.

[0038] As another example, the controller 100 may be realized using hardware such as an Application Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a Field Programmable Gate Array (FPGA).

[0039] 2-1-2.Network controller 6 is a block diagram showing an example of the configuration of the network controller 20 according to this embodiment. The network controller 20 includes a communication interface 21 and a controller 200. The communication interface 21 is connected to a plurality of switches 10 and a DDoS attack detection server 30.

[0040] The controller 200 communicates with the DDoS attack detection server 30 via the communication interface 21. The controller 200 also communicates with each switch 10 via the communication interface 21 to control each switch 10. For example, the controller 200 detects a suspicious flow FS and transmits a provisional action instruction INS1 or a formal action instruction INS2 to the target switch 10T.

[0041] The controller 200 includes one or more processors 201 (hereinafter simply referred to as "processor 201") and one or more storage devices 202 (hereinafter simply referred to as "storage devices 202"). The processor 201 performs various types of information processing. For example, the processor 201 includes a CPU. The storage device 202 stores various types of information required for processing by the processor 201. Examples of the storage device 202 include volatile memory, non-volatile memory, HDD, SSD, etc.

[0042] The communication control program 203 is a computer program executed by the processor 201. The functions of the controller 200 are realized by cooperation between the processor 201, which executes the communication control program 203, and the storage device 202. The communication control program 203 is stored in the storage device 202. The communication control program 203 may be recorded in a computer-readable recording medium. The communication control program 203 may be provided to the controller 200 via a network.

[0043] As another example, the controller 200 may be implemented using hardware such as an ASIC, a PLD, or an FPGA.

[0044] 2-1-3. Example of functional configuration Fig. 7 is a block diagram showing an example of a functional configuration of the communication system 1 according to the present embodiment. Fig. 7 particularly shows an example of a functional configuration related to the provisional solution and the formal solution.

[0045] The switch 10 includes, as functional blocks, a flow feature amount accumulator 110, a reference information storage unit 120, a suspected flow priority controller 130, a normal flow priority controller 140, and a flow discarder 150. These functional blocks are realized by the controller 100.

[0046] The network controller 20 includes, as functional blocks, a flow feature amount management unit 210, a suspected flow determination unit 220, a provisional solution instruction unit 230, and a formal solution instruction unit 250. These functional blocks are realized by the controller 200.

[0047] The processes related to the provisional and formal measures according to this embodiment will be described in detail below.

[0048] 2-2. Suspect flow determination The flow feature storage unit 110 of the switch 10 stores information on the "feature" of the communication flow handled by the switch 10. Examples of the feature include the number of arriving frames, data rate, destination MAC (Media Access Control) address, source MAC address, Ethernet (registered trademark) type number, frame length, number of session connection frames for each flow, IP (Internet Protocol) address, port number, etc.

[0049] The flow feature amount management unit 210 of the network controller 20 periodically requests the flow feature amount storage unit 110 of each switch 10 to provide information. The flow feature amount storage unit 110 of each switch 10 transmits feature amount information indicating the feature amount of each communication flow to the flow feature amount management unit 210. The flow feature amount management unit 210 includes a feature amount storage unit 211 and an abnormal feature amount storage unit 212. The feature amount storage unit 211 stores feature amount information collected from each switch 10. The abnormal feature amount storage unit 212 stores abnormal feature amount information related to communication flows that have been previously determined to be abnormal flows by the DDoS attack detection server 30.

[0050] FIG. 8 is a conceptual diagram showing an example of feature information stored in the feature storage unit 211. The feature information indicates a feature for each communication flow. The flow ID is identification information for the communication flow, for example, a VLAN ID (VID). In the example shown in FIG. 8, the feature information indicates the feature for the past five cycles for each communication flow. Feature X ij represents the feature amount in cycle j of the communication flow of identification information i.

[0051] 9 is a conceptual diagram showing an example of abnormal feature information stored in the abnormal feature storage unit 212. The abnormal feature information is feature information related to past abnormal flows, and the basic content is the same as that shown in FIG. 8. In FIG. 9, the feature XD ij represents the feature amount of the abnormal flow of identification information i in cycle j.

[0052] The suspicious flow determination unit 220 of the network controller 20 determines whether or not a suspicious flow FS exists. For example, the suspicious flow determination unit 220 determines whether or not a suspicious flow FS exists from the viewpoint of whether or not the characteristic amount of the current communication flow is similar to the characteristic amount of a past anomalous flow. When the characteristic amount of a certain communication flow is similar to the characteristic amount of a past anomalous flow, the suspicious flow determination unit 220 detects (identifies) the communication flow as a suspicious flow FS.

[0053] As an example, a method for determining a suspected flow based on the feature amount information shown in FIG. 8 and the abnormal feature amount information shown in FIG. 9 will be described. For example, Aj and the feature quantity XD of the abnormal flow (flow ID=E). Ej Mean square error MSE with AE is expressed by the following equation (1).

[0054]

number

[0055] The suspected flow determination unit 220 calculates the mean square error MSE AE Compare the mean squared error (MSE) to a given threshold. AE is less than a predetermined threshold, the suspicious flow determination unit 220 determines that the communication flow (flow ID=A) is similar to the anomalous flow (flow ID=E). That is, the suspicious flow determination unit 220 detects the communication flow (flow ID=A) as a suspicious flow FS. The same determination is made for all combinations of the current communication flow and past anomalous flows.

[0056] When a suspicious flow FS is detected, the suspicious flow determination unit 220 notifies the provisional handling instruction unit 230 of the identification information (eg, VID) of the suspicious flow FS and the switch 10 that is handling the suspicious flow FS.

[0057] 2-3.Temporary measures The provisional handling instruction unit 230 of the network controller 20 selects at least one target switch 10T from among the switches 10 handling the suspicious flow FS. For example, the target switch 10T is a switch 10 that serves as an entrance of the suspicious flow FS in the communication network. The provisional handling instruction unit 230 then transmits a provisional handling instruction INS1 to the selected target switch 10T. The provisional handling instruction INS1 is information that instructs the target switch 10T to execute a provisional handling, and includes at least identification information (e.g., VID) of the suspicious flow FS.

[0058] The suspected flow priority control unit 130 and the normal flow priority control unit 140 of the target switch 10T receive the provisional action instruction INS1 from the provisional action instruction unit 230. The suspected flow priority control unit 130 and the normal flow priority control unit 140 execute provisional action in accordance with the provisional action instruction INS1.

[0059] Specifically, the suspicious flow priority control unit 130 sets the priority of the suspicious flow FS to a designated priority PS. The designated priority PS is a relatively low priority. For example, the designated priority PS is the lowest priority P0.

[0060] On the other hand, the normal flow priority control unit 140 sets the priority of the normal flow FN higher than the designated priority PS. At this time, there is a possibility that both normal flows FNs whose priorities need to be changed and normal flows FNs whose priorities do not need to be changed exist. The "reference information" stored in the reference information storage unit 120 is information that is referenced when determining the normal flow FN whose priority is to be changed. The normal flow priority control unit 140 determines how to change the priority of which normal flow FN based on the reference information. A specific example of the reference information and a method for determining the reference information will be described later. In any case, the normal flow priority control unit 140 sets the priority of the normal flow FN higher than the designated priority PS.

[0061] The priority of a communication flow is determined, for example, by a CoS (Class Of Service) value in the header. In this case, the priority of a communication flow is changed by rewriting the CoS value. For example, an L2 frame is encapsulated by another L2 frame. During the encapsulation, the CoS value is rewritten to a value different from the original value.

[0062] As shown in Fig. 3, each switch 10 has a queue 11 provided for each priority. Data (frames) of a communication flow are stored in the queue 11 associated with the priority of that communication flow. The frequency of data transmission from each queue 11 depends on the priority, and the higher the priority of the queue 11, the higher the data transmission frequency. As a result, the higher the priority of the communication flow, the higher the data transfer rate. Conversely, the lower the priority of the communication flow, the lower the data transfer rate.

[0063] 2-4.DDoS attack determination While taking provisional measures, the DDoS attack detection server 30 precisely determines whether the suspect flow FS is the result of a DDoS attack based on the data of the suspect flow FS. Then, the DDoS attack detection server 30 notifies the formal action instruction unit 250 of the network controller 20 of information indicating the determination result.

[0064] 2-5. Formal action The formal action instruction unit 250 of the network controller 20 receives information indicating the determination result by the DDoS attack detection server 30. If it is determined that the suspected flow FS is an abnormal flow that is causing a DDoS attack, the formal action instruction unit 250 transmits a formal action instruction INS2 to the target switch 10T. The formal action instruction INS2 is information that instructs the target switch 10T to execute a formal action, and includes at least identification information of the suspected flow FS (abnormal flow).

[0065] The suspected flow priority control unit 130, normal flow priority control unit 140, and flow discard unit 150 of the target switch 10T receive the formal handling instruction INS2 from the formal handling instruction unit 250. The suspected flow priority control unit 130, normal flow priority control unit 140, and flow discard unit 150 execute formal handling in accordance with the formal handling instruction INS2.

[0066] Specifically, the suspicious flow priority control unit 130 returns the priority of the suspicious flow FS (abnormal flow) to its original priority (i.e., the priority before the provisional action). Furthermore, the flow discard unit 150 blocks the suspicious flow FS (abnormal flow) by discarding frames of the suspicious flow FS (abnormal flow). Meanwhile, the normal flow priority control unit 140 returns the priority of the normal flow FN to its original priority (i.e., the priority before the provisional action).

[0067] Furthermore, the formal handling instruction unit 250 notifies information about the abnormal flow to the abnormal feature amount accumulation unit 212. The abnormal feature amount accumulation unit 212 acquires feature amount information about the communication flow determined to be an abnormal flow from the feature amount accumulation unit 211, and newly stores the feature amount information as abnormal feature amount information. In other words, the abnormal feature amount accumulation unit 212 updates the abnormal feature amount information.

[0068] 2-6.Recovery process If it is determined that the suspected flow FS is not a DDoS attack, the formal action instruction unit 250 transmits a restoration instruction to the target switch 10T. The restoration instruction instructs that the priority changed in the provisional action be restored to the original priority before the provisional action.

[0069] The suspected flow priority control unit 130 and normal flow priority control unit 140 of the target switch 10T receive a return instruction from the formal action instruction unit 250. The suspected flow priority control unit 130 and normal flow priority control unit 140 execute return processing in accordance with the return instruction. Specifically, the suspected flow priority control unit 130 returns the priority of the suspected flow FS from the specified priority PS to the original priority (i.e., the priority before the provisional action). In addition, the normal flow priority control unit 140 returns the priority of the normal flow FN to the original priority (i.e., the priority before the provisional action).

[0070] 2-7. Processing flow FIG. 10 is a flowchart outlining the processing related to the provisional and formal measures according to the present embodiment.

[0071] In step S100, each switch 10 acquires feature information related to the communication flow. The network controller 20 acquires the feature information from each switch 10.

[0072] In step S200, the network controller 20 determines whether or not a suspicious flow FS exists based on the feature information (see Section 2-2 above). If a suspicious flow FS exists, that is, if a suspicious flow FS has been detected (step S200; Yes), the process proceeds to step S300. Otherwise (step S200; No), the process returns to step S100.

[0073] In step S300, a provisional response is executed (see Section 2-3 above). The network controller 20 transmits a provisional response instruction INS1 to the target switch 10T. In accordance with the provisional response instruction INS1, the target switch 10T sets the priority of the suspected flow FS to a designated priority PS, and sets the priority of the normal flow FN to a priority higher than the designated priority PS.

[0074] In step S400, the DDoS attack detection server 30 judges whether the suspected flow FS is the result of a DDoS attack (see Section 2-4 above). If the suspected flow FS is judged to be an abnormal flow that is causing a DDoS attack (step S400; Yes), the process proceeds to step S500. Otherwise (step S400; No), the process proceeds to step S600.

[0075] In step S500, formal handling is performed (see section 2-5 above). The network controller 20 transmits a formal handling instruction INS2 to the target switch 10T. In accordance with the formal handling instruction INS2, the target switch 10T blocks the suspected flow FS (abnormal flow) and returns the priority of the normal flow FN to the original priority.

[0076] In step S600, the restoration process is executed (see Section 2-6 above). The network controller 20 transmits a restoration instruction to the target switch 10T. In accordance with the restoration instruction, the target switch 10T restores the priority of the suspected flow FS from the designated priority PS to the original priority, and also restores the priority of the normal flow FN to the original priority.

[0077] 3. Various examples of priority control Various examples of priority control in the provisional response (step S300) will be described below. In the following examples, it is assumed that the designated priority PS is the lowest priority P0 among a plurality of priorities.

[0078] 3-1. First Example 11 is a block diagram for explaining a first example of priority control in provisional handling. In the first example, the reference information storage unit 120 is a priority information storage unit 120A that stores "priority information." The priority information indicates the priority of each communication flow handled by the switch 10. The priority here is the priority at the time when data (frames) of the communication flow are input to the switch 10. The priority information storage unit 120A monitors the communication flow and updates the priority information periodically.

[0079] The suspected flow priority control unit 130 sets the priority of the suspected flow FS to the lowest priority P0. The normal flow priority control unit 140A sets the priority of the normal flow FN to be higher than the lowest priority P0, based on the priority information stored in the priority information storage unit 120A.

[0080] FIG. 12 is a conceptual diagram for explaining a first example of priority control. The horizontal axis represents time, and the vertical axis represents priority. Here, a case is considered in which there are multiple priorities P0 to P3 and three types of normal flows FN1 to FN3. Frames of each of the normal flows FN1 to FN3 arrive at the switch 10. Before the provisional handling, the priority of the normal flow FN1 is P0, the priority of the normal flow FN2 is P3, and the priority of the normal flow FN3 is P1. The priority P2 is an "empty priority" that is not assigned to any normal flow FN. In this case, in the provisional handling, the normal flow priority control unit 140A increases the priority of each of the normal flows FN1 and FN3, which have a lower priority than the empty priority P2, by one step. As a result, the priority of the normal flow FN1 increases to P1, and the priority of the normal flow FN3 increases to P2. As a result, the priority of all of the normal flows FN1 to FN3 becomes higher than the priority of the suspected flow FS, that is, the lowest priority P0.

[0081] Generalized, it is as follows. The priority information indicates the status of priority allocation to communication flows before provisional measures are taken. The normal flow priority control unit 140A searches for an "empty priority" that is not assigned to a normal flow FN from among multiple priorities other than the lowest priority P0, based on the priority information. For example, the normal flow priority control unit 140A searches for an empty priority from the low priority side toward the high priority side. When an empty priority is found, the search ends. When an empty priority is found, the normal flow priority control unit 140A increases by one level the priority of the normal flow FN whose priority before provisional measures is lower than the empty priority.

[0082] In this way, according to the first example of priority control, the priorities of all normal flows FN are higher than the priority of the suspicious flow FS, i.e., the lowest priority P0. Furthermore, even if a provisional response is taken, the magnitude relationship of priorities among multiple normal flows FN is maintained.

[0083] As a modified example, the network controller 20 may search for an available priority based on priority information instead of the switch 10. In this case, the provisional handling instruction INS1 includes information on the available priority that has been found.

[0084] 3-2. Second Example FIG. 13 is a conceptual diagram for explaining a second example of priority control. Here, a case is considered in which there are a plurality of priorities P0 to P3 and three types of normal flows FN1 to FN4. Frames of the normal flows FN1 to FN4 arrive at the switch 10. Before the provisional handling, the priority of the normal flow FN1 is P0, the priority of the normal flow FN2 is P3, the priority of the normal flow FN3 is P2, and the priority of the normal flow FN4 is P1. In the provisional handling, the normal flow priority control unit 140A increases the priority of at least the normal flow FN1 from the lowest priority P0. For example, the normal flow priority control unit 140A increases the priority of the normal flow FN1 by one step. As a result, the priority of the normal flow FN1 increases to P1. As a result, the priority of all the normal flows FN1 to FN4 becomes higher than the priority of the suspected flow FS, that is, the lowest priority P0.

[0085] This can be generalized as follows. A "lowest priority flow" is a normal flow FN whose priority before the provisional action is taken is the lowest priority P0. The normal flow priority control unit 140A determines whether or not a lowest priority flow exists based on the priority information. If a lowest priority flow exists, the normal flow priority control unit 140A increases the priority of the lowest priority flow from the lowest priority P0. For example, the normal flow priority control unit 140A increases the priority of the lowest priority flow by one step.

[0086] In this way, according to the second example of priority control, the priorities of all normal flows FN are higher than the priority of the suspicious flow FS, that is, the lowest priority P0. Furthermore, priority control is achieved through simple processing.

[0087] As a modification, the network controller 20 may determine whether or not there is a lowest priority flow based on the priority information instead of the switch 10. In this case, the interim handling instruction INS1 includes identification information of the lowest priority flow.

[0088] 3-3.Third Example 14 is a flowchart showing a third example of priority control. The third example is a combination of the first and second examples.

[0089] In step S305, the normal flow priority control unit 140A searches for an available priority based on the priority information. If an available priority is found (step S305; Yes), the normal flow priority control unit 140A performs priority control according to the first example (step S310). On the other hand, if an available priority is not found (step S305; No), the normal flow priority control unit 140A performs priority control according to the second example (step S320).

[0090] From the start to the end of the provisional response, the normal flow priority control unit 140A repeatedly executes the above process at regular intervals. In other words, the normal flow priority control unit 140A repeatedly executes the above process based on the latest priority information. This makes it possible to execute priority control appropriately according to the situation.

[0091] 3-4. Fourth Example 15 is a block diagram for explaining a fourth example of priority control in provisional handling. In the fourth example, the reference information storage unit 120 is a queue length information storage unit 120B that stores "queue length information." The queue length is the amount of data of a communication flow stored in each queue 11 provided for each priority. The queue length information is information indicating the queue length for each queue, that is, the queue length for each priority. The queue length information storage unit 120B monitors each queue 11 and periodically updates the queue length information.

[0092] The suspected flow priority control unit 130 sets the priority of the suspected flow FS to the lowest priority P0. The normal flow priority control unit 140B sets the priority of the normal flow FN to be higher than the lowest priority P0, based on the queue length information stored in the queue length information storage unit 120B.

[0093] 16 is a conceptual diagram for explaining an example of queue length information. Here, a case is considered in which there are a plurality of priorities P0 to P3 and a plurality of queues 11-0 to 11-3. The queue length upper limit QL_MAX is the upper limit of the queue length of one queue 11. The sum of the queue length of the queue 11-1 associated with the priority P1 and the queue length of the queue 11-2 associated with the priority P2 is equal to or less than the queue length upper limit QL_MAX. In this case, even if data stored in the queue 11-1 is transferred to the queue 11-2, the queue 11-2 will not overflow.

[0094] Fig. 17 is a conceptual diagram for explaining priority control in the case of the queue length information shown in Fig. 16. Before the provisional handling, the priority of normal flow FN1 is P0, the priority of normal flow FN2 is P3, the priority of normal flow FN3 is P2, and the priority of normal flow FN4 is P1. In the provisional handling, the normal flow priority control unit 140B increases the priority of each of normal flows FN1 and FN4, which are equal to or lower than the priority P1, by one step. As a result, the priority of normal flow FN1 increases to P1, and the priority of normal flow FN4 increases to P2. As a result, the priorities of all normal flows FN1 to FN4 become higher than the priority of the suspected flow FS, i.e., the lowest priority P0.

[0095] The generalized form is as follows. The first queue length Q1 is the queue length of the first queue in which data of the communication flow with the first priority is stored. The second queue length Q2 is the queue length of the second queue in which data of the communication flow with the second priority, which is one step higher than the first priority, is stored. The normal flow priority control unit 140B searches for a combination of the first priority and the second priority in which the sum of the first queue length Q1 and the second queue length Q2 is equal to or less than the queue length upper limit value QL_MAX, based on the queue length information. For example, the normal flow priority control unit 140B searches for such a combination of the first priority and the second priority from the lower priority side to the higher priority side. When such a combination of the first priority and the second priority is found, the normal flow priority control unit 140B increases the priority of the normal flow FN, whose priority before the provisional action is equal to or less than the first priority, by one step.

[0096] If a combination of the first priority and the second priority in which the sum of the first queue length Q1 and the second queue length Q2 is equal to or less than the queue length upper limit QL_MAX is not found, the normal flow priority control unit 140B may search for a combination of the first priority and the second priority in which the sum of the first queue length Q1 and the second queue length Q2 is the smallest. Then, the normal flow priority control unit 140B may increase by one level the priority of a normal flow FN whose priority before the provisional action is equal to or less than the first priority.

[0097] Alternatively, if a combination of the first priority and the second priority is not found in which the sum of the first queue length Q1 and the second queue length Q2 is less than or equal to the queue length upper limit value QL_MAX, the normal flow priority control unit 140B may perform priority control according to the second example described above.

[0098] In this way, according to the fourth example of priority control, the priorities of all normal flows FN are higher than the priority of the suspicious flow FS, that is, the lowest priority P0. Also, the priority control can be appropriately performed by taking the queue length into consideration.

[0099] As a modified example, the network controller 20 may search for a combination of the first priority and the second priority based on the queue length information instead of the switch 10. In this case, the provisional handling instruction INS1 includes information on the found first priority.

[0100] 4. Temporary measures considering suspected sections A section in a communication network where communication of a suspected flow FS is taking place will hereinafter be referred to as a “suspected section SS.” A provisional measure that takes the suspected section SS into consideration will be described below.

[0101] 18 is a block diagram showing an example of a functional configuration related to a tentative measure taking into account the suspected section SS. Descriptions that overlap with those already given will be omitted as appropriate. The network controller 20 further includes a suspected section identification unit 260 that identifies the suspected section SS.

[0102] The suspected section identification unit 260 holds switch connection information indicating the connection relationships between the switches 10. The switch connection information is provided by, for example, a network administrator. As another example, the switch connection information may be acquired by utilizing an existing network management protocol or routing control protocol. The suspected section identification unit 260 receives information on the suspected flow FS and information on the switch 10 handling the suspected flow FS from the suspected flow determination unit 220. Then, the suspected section identification unit 260 identifies a suspected section SS in the communication network based on the switch connection information and the information from the suspected flow determination unit 220.

[0103] 19 is a conceptual diagram for explaining an example of a suspicious section SS. The suspicious flow FS arrives at the server 40-B from the terminal 5-A via the switches 10-2, 10-3, and 10-4. Therefore, the suspicious section SS is the section between the terminal 5-A and the server 40-B via the switches 10-2, 10-3, and 10-4.

[0104] Here, we will explain the suspected port 15S and the non-suspected port 15N. The suspected port 15S is a port 15 of the switch 10 that is connected to the suspected section SS. On the other hand, the non-suspected port 15N is a port 15 of the switch 10 that is not connected to the suspected section SS.

[0105] In the example shown in Fig. 19, a normal flow FNA arrives at the server 40-A from the terminal 5-A via the switches 10-1, 10-2, 10-3, 10-4, and 10-5. The section through which this normal flow FNA flows partially overlaps with the suspected section SS. Priority control is performed only in the suspected section SS for this normal flow FNA. In other words, the priority of the normal flow FNA is controlled to be high at the switch 10-2, which is the entrance to the suspected section SS, and is returned to the original priority at the switch 10-4, which is the exit from the suspected section SS.

[0106] The switch 10-2 has not only a suspected port 15S but also a non-suspected port 15N to which a normal flow FNA is input. The switch 10-4 has not only a suspected port 15S but also a non-suspected port 15N to which a normal flow FNA is output. The provisional action instruction unit 230 acquires identification information (e.g., IP address) of the switch 10 having both the suspected port 15S and the non-suspected port 15N from the suspected section identification unit 260. The provisional action instruction unit 230 identifies the switches 10-2 and 10-4 based on information on each switch 10 and each communication flow. Then, the provisional action instruction unit 230 instructs each of the switches 10-2 and 10-4 to perform priority control of the normal flow FNA.

[0107] This can be generalized as follows. The "first switch" is a switch 10 having a non-suspected port 15N to which the first normal flow is input, and a suspected port 15S to which the first normal flow is output. The provisional action instruction unit 230 instructs the normal flow priority control unit 140 of the first switch to execute a provisional action to set the priority of the first normal flow higher than the designated priority PS. The method of increasing the priority may be any of the first to fourth examples described in Section 3 above.

[0108] The "second switch" is the switch 10 having a suspected port 15S to which the second normal flow is input and a non-suspected port 15N to which the second normal flow is output. The provisional handling instruction unit 230 instructs the normal flow priority control unit 140 of the second switch to return the priority of the second normal flow to the original priority (i.e., the priority before the provisional handling was performed).

[0109] In this way, by taking provisional measures while considering the suspect section SS, it is possible to minimize the effect on the normal flow FN. [Explanation of symbols]

[0110] 1...communication system, 5...terminal, 10...switch, 10T...target switch, 11...queue, 12...port, 15...port, 15N...non-suspect port, 15S...suspect port, 20...network controller, 21...communication interface, 30...DDoS attack detection server, 40...server, 100...controller, 101...processor, 102...storage device, 103...communication control program, 110...flow feature accumulation unit, 120...reference information storage unit, 120A...priority information storage unit, 120B...queue length information storage unit, 130...suspect flow priority control unit, 140,140A,140B...normal flow priority control unit, 150...flow discard unit, 200...controller, 201...processor, 202...storage device, 203...communication control program, 210...flow feature management unit, 211...feature accumulation unit, 212...abnormal feature accumulation unit, 220...suspect flow determination unit, 230...provisional action instruction unit, 250...formal action instruction unit, 260...suspect section identification unit, FN...normal flow, FS...suspect flow, INS1...provisional action instruction, INS2...formal action instruction, P0~P(N-1)...priority, SS...suspect section

Claims

1. A switch in a communications network, comprising: a controller for controlling a communication flow in the communication network; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, the controller is configured to execute a provisional action when a provisional action instruction indicating identification information of the suspect flow is received from a network controller; The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; setting the priority of the normal flow to be higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, The provisional solution is: A process of searching for an available priority level not assigned to the normal flow from among the plurality of priorities other than the lowest priority level; When the empty priority is found, a process of increasing the priority of the normal flow, the priority of which is lower than the empty priority before the provisional action is taken, by one step. Includes switch.

2. A switch in a communications network, comprising: a controller for controlling a communication flow in the communication network; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, the controller is configured to execute a provisional action when a provisional action instruction indicating identification information of the suspect flow is received from a network controller; The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; setting the priority of the normal flow to be higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, the lowest priority flow is the normal flow whose priority is the lowest priority before the provisional action is taken, The provisional action includes at least a process of increasing the priority of the lowest priority flow from the lowest priority. switch.

3. A switch in a communications network, comprising: a controller for controlling communication flow in the communication network; Queues for each priority Equipped with The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, the controller is configured to execute a provisional action when a provisional action instruction indicating identification information of the suspect flow is received from a network controller; The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; setting the priority of the normal flow to be higher than the designated priority; Including, The queue length is the amount of data of the communication flow stored in each queue, the first queue length is the queue length of the queue in which data of the communication flow having a first priority is stored; the second queue length is the queue length of the queue in which data of the communication flow having a second priority level that is one level higher than the first priority level is stored; the designated priority is the lowest priority among a plurality of priorities, The provisional solution is: a process of searching for a combination of the first priority and the second priority in which the sum of the first queue length and the second queue length is equal to or less than a queue length upper limit value, or a combination of the first priority and the second priority in which the sum of the first queue length and the second queue length is minimum; when the combination of the first priority and the second priority is found, a process of increasing by one step the priority of the normal flow whose priority before the provisional action is taken is equal to or lower than the first priority; Includes switch.

4. A network controller coupled to a switch that controls communication flow in a communication network, a controller in communication with the switch; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, The controller: acquiring feature information indicating a feature of each of the communication flows from the switch; A process of detecting the suspicious flow based on the feature amount information; a process of instructing the switch to execute a provisional action when the suspect flow is detected; configured to run The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; changing the priority of the normal flow, the priority of which is equal to or lower than the designated priority before the provisional action is taken, to a priority higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, The provisional solution is: A process of searching for an available priority level not assigned to the normal flow from among the plurality of priorities other than the lowest priority level; When the empty priority is found, a process of increasing the priority of the normal flow, the priority of which is lower than the empty priority before the provisional action is taken, by one step. Includes Network controller.

5. A network controller coupled to a switch that controls communication flow in a communication network, a controller in communication with the switch; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, The controller: acquiring feature information indicating a feature of each of the communication flows from the switch; A process of detecting the suspicious flow based on the feature amount information; a process of instructing the switch to execute a provisional action when the suspect flow is detected; configured to run The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; changing the priority of the normal flow, the priority of which is equal to or lower than the designated priority before the provisional action is taken, to a priority higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, the lowest priority flow is the normal flow whose priority is the lowest priority before the provisional action is taken, The provisional action includes at least a process of increasing the priority of the lowest priority flow from the lowest priority. Network controller.

6. A network controller coupled to a switch that controls communication flow in a communication network, a controller in communication with the switch; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, The controller: acquiring feature information indicating a feature of each of the communication flows from the switch; A process of detecting the suspicious flow based on the feature amount information; a process of instructing the switch to execute a provisional action when the suspect flow is detected; configured to run The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; setting the priority of the normal flow to be higher than the designated priority; Including, The controller further executes a process of identifying a suspicious section in the communication network where communication of the suspicious flow is taking place, The suspected port is a port of the switch that is connected to the suspected section, A non-suspected port is a port of the switch that is not connected to the suspected section, the first switch is a switch having the non-suspect port to which a first normal flow is input and the suspect port to which the first normal flow is output, the second switch is the switch having the suspected port to which the second normal flow is input and the non-suspected port to which the second normal flow is output, The controller: instructing the first switch to execute the provisional action of setting the priority of the first normal flow higher than the designated priority; Instruct the second switch to restore the priority of the second normal flow to the original priority before the provisional handling was performed. Network controller.

7. A communication control method in a communication system including a switch that controls a communication flow in a communication network, comprising: A process of acquiring feature information indicating a feature of each of the communication flows; A process of detecting a suspicious flow, which is the communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, based on the feature information; If the suspected flow is detected, a process of taking provisional measures is performed. Including, a normal flow is a communication flow other than the suspect flow, The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; changing the priority of the normal flow, the priority of which is equal to or lower than the designated priority before the provisional action is taken, to a priority higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, The provisional solution is: A process of searching for an available priority level not assigned to the normal flow from among the plurality of priorities other than the lowest priority level; When the empty priority is found, a process of increasing the priority of the normal flow, the priority of which is lower than the empty priority before the provisional action is taken, by one step. Includes Communications control method.

8. A communication control program for controlling a switch in a communication network, the communication control program is executed by a computer included in the switch to cause the switch to control a communication flow in the communication network; The suspected flow is a communication flow suspected to be related to a Distributed Denial of Service (DDoS) attack, a normal flow is a communication flow other than the suspect flow, the communication control program further causes the switch to execute a provisional action when a provisional action instruction indicating identification information of the suspect flow is received from a network controller; The provisional solution is: A process of setting the priority of the suspect flow to a designated priority; changing the priority of the normal flow, the priority of which is equal to or lower than the designated priority before the provisional action is taken, to a priority higher than the designated priority; Including, the designated priority is the lowest priority among a plurality of priorities, The provisional solution is: A process of searching for an available priority level not assigned to the normal flow from among the plurality of priorities other than the lowest priority level; When the empty priority is found, a process of increasing the priority of the normal flow, the priority of which is lower than the empty priority before the provisional action is taken, by one step. Includes Communications control program.

Images