Traffic monitoring device, traffic monitoring method, and program

Abstract

A traffic monitoring device (10) is provided with: a cutting-out unit (12) that cuts out first identification information identifying a flow from a packet received by a reception unit (11), on the basis of an offset that specifies a cutting-out position of the packet; a rule identification unit (13) that identifies rules including information that matches the first identification information cut out by the cutting-out unit (12); and a counting unit (14) that counts the number of times rules are identified, etc., by the rule identification unit (13). The traffic monitoring device (10) is further provided with an offset control unit (17) that, when the number of times rules are identified, etc., exceeds a prescribed reference value, generates a new offset for cutting out second identification information that can be used to identify attack traffic, in addition to the first identification information. The rule identification unit (13) identifies rules including information that matches the first identification information and the second identification information cut out by the cutting-out unit, and the counting unit (14) counts the number of times rules including information that matches the first identification information and the second identification information are identified. This configuration allows for identification of attack traffic through low load processing.

Description

[Technical Field]

[0001] The present invention relates to a traffic monitoring device, a traffic monitoring method, and a program. [Background technology]

[0002] Flood attacks exist, which attack network devices by sending excessive traffic over a network. Traditionally, attacks known as classic DoS (Denial of Services) have been blocked by analyzing the headers of IP packet fields called 5-tuple and identifying the source of the attack based on that information. However, a new method known as DDoS (Distributed Denial of Services) has recently emerged, which exploits Layer 4 protocol mechanisms such as TCP or UDP to launch attacks from multiple sources. Because 5-tuple analysis is difficult to use to counter such DDoS attacks, attack traffic has been identified by adding Layer 4 and higher protocol information to the 5-tuple and analyzing it.

[0003] On the other hand, as network speeds increase, the number of flows is exploding. It is difficult to identify attack traffic by analyzing all traffic, and methods such as predicting attack traffic from past attack data using machine learning have been proposed to efficiently identify attack traffic (e.g., Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yuhei Hayashi, Hikofumi Suzuki, Takeo Nishioka, “Low-bandwidth L3, L4 DDoS detection feature based on the number of 5-tuple flows among 3-tuple flows,” IEICE Technical Report, ICM2019-5(2019-05) Summary of the Invention [Problem to be solved by the invention]

[0005] Inference methods using machine learning, etc., have the problem that they require learning time to generate rules, and the processing load of the machine learning process itself results in a large time lag between an attack and its detection.

[0006] An object of the present invention is to identify attack traffic with a light processing load. [Means for solving the problem]

[0007] In order to solve the above problem, the traffic monitoring device of the present invention is a traffic monitoring device that monitors traffic in a communication network, and includes: a receiving unit that receives packets flowing through the communication network; an extraction unit that extracts first identification information that identifies a flow from the packet based on an offset that specifies the extraction position of the packet received by the receiving unit; a rule identification unit that identifies a rule having information that matches the first identification information extracted by the extraction unit; an aggregation unit that aggregates, for each rule identified by the rule identification unit, at least one of the number of times the rule has been identified and the data volume of the packet identified as the rule; and an offset control unit that generates, as the offset to be used by the extraction unit, a new offset for extracting second identification information that can be used to identify attack traffic in addition to the first identification information when the aggregation result by the aggregation unit meets a predetermined standard, wherein the rule identification unit identifies a new rule that has information that matches the first identification information and the second identification information extracted by the extraction unit based on the new offset, and the aggregation unit aggregates at least one of the number of times the new rule has been identified or the data volume of the packet identified as the new rule.

[0008] Furthermore, a traffic monitoring method according to the present invention comprises: a receiving step of receiving packets flowing through the communication network; an extraction step of extracting first identification information for identifying a flow from the packets based on an offset that specifies the extraction position of the packets received in the receiving step; a rule identification step of identifying a rule having information that matches the first identification information extracted by the extraction step; an aggregation step of tallying, for each rule identified by the rule identification step, at least one of the number of times the rule has been identified and the data volume of the packets identified as the rule; and an offset control step of generating, as the offset to be used by the extraction unit, a new offset for extracting second identification information that can be used to identify attack traffic in addition to the first identification information when the aggregation result by the aggregation step satisfies a predetermined criterion, wherein the rule identification step identifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset by the extraction step, and the aggregation step aggregates at least one of the number of times the new rule has been identified or the data volume of the packets identified as the new rule.

[0009] Furthermore, the program of the present invention executes the following steps: a receiving step of receiving packets flowing through the communication network; an extraction step of extracting first identification information that identifies a flow from the packets based on an offset that specifies the extraction position of the packets received in the receiving step; a rule identification step of identifying a rule having information that matches the first identification information extracted by the extraction step; an aggregation step of tallying, for each rule identified by the rule identification step, at least one of the number of times the rule has been identified and the data volume of the packets identified as the rule; and an offset control step of generating, as the offset to be used by the extraction unit, a new offset for extracting, in addition to the first identification information, second identification information that can be used to identify attack traffic when the aggregation result by the aggregation step satisfies a predetermined criterion, wherein the rule identification step identifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset by the extraction step, and the aggregation step aggregates at least one of the number of times the new rule has been identified or the data volume of the packets identified as the new rule. [Effects of the Invention]

[0010] According to the present invention, attack traffic is identified with a light processing load. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a configuration diagram of a traffic monitoring device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating an example of the data structure of a packet. [Figure 3] FIG. 3 is a diagram for explaining a method of extracting a packet using an offset. [Figure 4] FIG. 4 is a diagram illustrating an example of the structure of the rule table. [Figure 5] FIG. 5 is a diagram illustrating an example of the structure of the rule table. [Figure 6] FIG. 6 is a diagram for explaining a method of extracting a packet using an offset. [Figure 7] FIG. 7 is a diagram showing the configuration of the traffic monitoring device of FIG. 1 when configured by a computer. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] 1, a traffic monitoring device 10 according to this embodiment includes a receiving unit 11, a cutout unit 12, a rule identifying unit 13, a counting unit 14, and an output unit 15. The traffic monitoring device 10 also includes a rule control unit 16, an offset control unit 17, and a storage unit 19. The traffic monitoring device 10 having such a configuration is configured to monitor traffic in a communication network NW.

[0014] At least a part of each of the above units 11 to 17 is configured by a logic circuit written in, for example, an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). At least a part of each of the units 11 to 17 may be configured by a processor such as a CPU (Central Processing Unit) that executes a program. The storage unit 19 is made up of an appropriate non-volatile storage device such as a flash memory or an SSD (Solid State Drive). The storage unit 19 may be configured by at least a part of a memory such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). Each of the units 11 to 17 may be configured to include a memory that temporarily stores data being processed.

[0015] The receiver 11 sequentially receives a plurality of packets (more specifically, mirroring packets) flowing through the communication network NW one by one and outputs them to the extractor 12. As shown in Fig. 2, a packet is composed of data (also called payload) and a header placed before the data. As shown in Fig. 2, the header includes a source MAC address and a destination MAC address. The header further includes any information such as source and destination IP addresses, source and destination port addresses, VLAN ID, and communication protocol.

[0016] Returning to FIG. 1, the cutout unit 12 cuts out a portion from a packet. This cutout position is specified by an offset stored in the storage unit 19. Based on this offset, the cutout unit 12 cuts out a portion from the packet at the cutout position specified by the offset. Here, the cutout portion is a bit-delimited portion, also referred to as a field value. A group of packets with matching field values ​​is also referred to as a flow. In other words, the field value is also identification information that identifies a flow. The cutout position specified by the offset is set so that the cutout field value includes a portion necessary and sufficient to identify the flow to be monitored. The cutout field value includes various addresses, VLAN ID, communication protocol, etc. The field value does not necessarily have to match the protocol field in the packet header, and may be a value that spans multiple header fields (for example, the L2 header and L3 header in FIG. 2).

[0017] FIG. 3 shows an example of offset-based extraction. In FIG. 3, offsets 1 to 4 are provided as one offset, and these are used to extract field values ​​at positions in the packet that are assigned fields 1 to 4. Offsets 1 to 4 indicate the beginning of the extraction area, and a certain number of bits of data are extracted from that beginning. Note that multiple offsets may be provided depending on the data structure of the header of the packet to be monitored. In this case, the extraction unit 12 copies the packet by the number of offsets and applies each offset to each packet to extract it. The extraction unit 12 may extract each field value based on each offset by copying data from a single packet at the extraction position specified by each offset. Thereafter, the following process is performed for the multiple extracted parts.

[0018] The field value extracted by the extraction unit 12 is input to the rule identification unit 13. The rule identification unit 13 compares the input field value with rules prepared for each flow. The rules are registered in a rule table 19A stored in the storage unit 19, and the rule identification unit 13 identifies a rule having a value that matches the input field value from among the rules registered in the rule table 19A.

[0019] An example of the configuration of rule table 19A is shown in Figure 4. An "*" in rule table 19A indicates that the value of the corresponding part of the field value compared with the rule will be treated as a match regardless of the value (including no value). For example, a field value where field 3 has a value of "12" and field 4 has a value of "8080" will identify rule #2 in Figure 4 regardless of the other values ​​(including, for example, the missing field value of field 5 extracted by the offset in Figure 3).

[0020] The rule identification unit 13 supplies the rule number of the identified rule (here, any one of #1 to #3) to the counting unit 14. The counting unit 14 counts the number of times the rule number is supplied from the rule identification unit 13 (i.e., the number of packets input to the receiving unit 11) for each rule number. In this way, the counting unit 14 counts the number of times the rule is identified by the rule identification unit 13 for each rule. Here, rules are prepared for each logical network. When a flood attack occurs on a certain logical network, the number of times the counting unit 14 counts the rules of that logical network (the number of times the rule is identified) increases. To detect this, when the count number per predetermined period exceeds a predetermined threshold, the counting unit 14 notifies the rule control unit 16 of the rule number of the rule that exceeds the threshold.

[0021] Here, it is assumed that the storage unit 19 or the like stores rule numbers and packet header configurations (more specifically, information specifying which data is located at which position in the header). When the rule control unit 16 is notified of a rule number, it acquires the packet header configuration corresponding to the rule number from the storage unit 19 or the like as the packet header configuration of the network under attack. The packet header configuration may be identifiable based on the content of rules (contents of fields 1 to 5) registered in the rule table 19A. In this case, the rule corresponding to the notified rule number is referenced. Based on the identified packet header configuration, the rule control unit 16 generates a new rule as a monitoring rule by adding identification information to be compared with new identification information that can be used to identify the type of DDoS attack from among the information contained in the packet, and registers the new rule in the rule table 19A. The added information here is, for example, a TCP flag indicating the type of TCP. When the count for rule #2 in the rule table 19A of FIG. 4 increases, rules #4 to #6 are newly registered, with the value of the TCP flag (e.g., “010000”) added to field 5 of rule #2, as shown in FIG. 5.

[0022] Furthermore, rule control unit 16 notifies offset control unit 17 of the identified packet header configuration. Offset control unit 17 generates a new offset for extracting, from the packet, identification information (value of field 5) that can identify a DDoS attack in addition to other identification information, based on the packet header configuration, and stores the generated offset in storage unit 19. This offset is, for example, the offset in the normal state in FIG. 3 plus offset 5 for extracting field 5, and consists of offsets 1 to 5 (see FIG. 6).

[0023] After this, subsequent packets are processed based on the new monitoring rule and offset, and monitoring of subsequent traffic continues. In particular, for each of rules #4 to #6 to which information necessary for identifying traffic attacks has been added, the number of packets received by the receiving unit 11 (the number of times rule numbers are supplied from the rule identification unit 13) is counted, and the type of attack (ACK, SYN, FIN) is identified from the count number. In this case, an attack is being carried out against the logical network of the rule with the large count number.

[0024] The output unit 15 outputs the counted number of times each rule has been identified by the rule identification unit 13, which is counted by the counting unit 14, as the counted result. The output unit 15 displays the counted result, for example, on a display device provided in the traffic monitoring device 10 or external to the traffic monitoring device 10. This makes it possible to present to a user the presence or absence of attack traffic and its type. The output unit 15, for example, outputs the counted result to a processing unit provided inside or external to the traffic monitoring device 10, and the processing unit may identify the presence or absence of attack traffic and its type based on the counted result. The processing unit may execute a process of displaying a logical network determined to contain attack traffic on the display device, and / or a process of blocking communication on the logical network.

[0025] In the above explanation, TCP flags are used as identification information that can be used to identify DDoS attacks, i.e., to identify attack traffic (for example, the presence or absence of attack traffic and at least the former of its type), but the identification information may also be information that can identify the traffic type using bit string information in packet formats such as ICMP, UDP, NTP, and HTTP requests.

[0026] The counting unit 14 may count the packet data volume for each rule, instead of or in addition to the number of times the rule is specified. In this case, the receiving unit 11 or the extracting unit 12 specifies the data volume of the received packet and supplies the specified packet data volume to the counting unit 14 directly or via the rule specifying unit 13. The counting unit 14 receives the data volume along with the rule number from the rule specifying unit 13. The counting unit 14 accumulates the supplied data volume for each rule number, thereby counting the data volume. In this way, the counting unit 14 counts at least one of the number of times the rule is specified and the data volume of the packet identified by the rule, for each rule specified by the packet rule specifying unit 13. When the counting result by the counting unit 14 satisfies a predetermined criterion, the rule control unit 16 generates the new rule as a monitoring rule and registers it in the rule table 19A. At this time, the offset control unit 17 also generates the new offset and stores it in the memory unit 19. The aggregation result by the aggregation unit 14 satisfies a predetermined standard when, for example, one of the specific number of times per specified period and the amount of data exceeds a predetermined threshold set for that one, or when both the specific number of times per specified period and the amount of data exceed the threshold set for each of them.

[0027] As described above, the cutout unit 12 cuts out first identification information (field value) for identifying a flow from a packet received by the receiving unit 11, based on an offset that identifies the cutout position of the packet. The rule identification unit 13 identifies a rule having information that matches the first identification information cut out by the cutout unit 12. The counting unit 14 counts, for each rule identified by the rule identification unit 13, at least one of the number of times the rule has been identified and the amount of data of the packet identified as the rule. When the counting result by the counting unit 14 satisfies a predetermined criterion, the offset control unit 17 generates a new offset to be used by the cutout unit 12, for cutting out not only the first identification information but also second identification information (e.g., TCP flag in field 5) that can be used to identify attack traffic. The rule identification unit 13 then identifies a new rule (e.g., any of rules #4 to #6) having information that matches the first identification information and second identification information cut out by the cutout unit 12 based on the new offset. The counting unit 14 counts at least one of the number of times the new rule is identified or the data volume of the packets identified by the new rule. In this configuration, the rule identification unit 13 performs rule identification with a low load due to the offset-based extraction. Furthermore, when the counting result satisfies a predetermined criterion, a new offset is generated for extracting second identification information, and rules are identified and counted based on the second identification information extracted using this offset. This identifies that the rule, i.e., flow, with a large number of counted identifications and / or a large data volume is the target of attack traffic. Therefore, according to this embodiment, attack traffic is identified with a low processing load.

[0028] Furthermore, the rule identification unit 13 identifies, from among the one or more rules, a rule having information that matches the first identification information extracted by the extraction unit 12, and when the counting result by the counting unit 14 satisfies a predetermined criterion, the rule control unit 16 generates the new rule and adds it to the one or more rules, thereby reducing the number of rules before the counting result satisfies the predetermined criterion, thereby realizing light load processing.

[0029] Furthermore, the rule identification unit 13 identifies a rule having information matching the first identification information from among one or more rules registered in the rule table, and the rule control unit 16 registers the newly generated rule in the rule table. Managing rules in a table in this way makes it easier to manage the rules.

[0030] Furthermore, the output unit 15 may output a count result of counting at least one of the number of times the new rule is specified or the data volume of the packet specified with the new rule, thereby making it possible to notify the presence or absence of attack traffic, etc.

[0031] 7 shows a hardware configuration diagram of the traffic monitoring device 10 when configured as a computer. The traffic monitoring device 10 includes a processor 101 such as a CPU, a main memory 102 of the processor 101, and a non-volatile storage device 103 that stores programs and various data and constitutes the storage unit 19 of FIG. 1. The traffic monitoring device 10 further includes a network interface card (NIC) 104 that is connected to the communication network NW and relays packets. The processor 101 executes or uses the programs and data stored in the storage device 103 and read into the main memory 102 to operate as the above-mentioned units 11 to 17. The receiving unit 11 and the output unit 15 may be realized by a combination of the processor 101 that executes programs and the NIC 104.

[0032] [Scope of the present invention] The present invention is not limited to the above-described embodiments and modifications. For example, the present invention includes various modifications to the above-described embodiments and modifications that are understandable to those skilled in the art within the scope of the technical concept of the present invention. The configurations listed in the above-described embodiments and modifications can be combined as appropriate to the extent that no contradictions exist. Furthermore, any of the above-described configurations can be deleted. The various programs described above may be stored not only in the non-volatile storage device 103 but also in a non-transitory computer-readable storage medium. The "device" and "unit" may be an entity in which the configuration that realizes the operation is housed in a single housing, or an entity (system) in which the configuration that realizes the operation is housed distributed across multiple housings. [Explanation of symbols]

[0033] 10...traffic monitoring device, 11...receiving unit, 12...extraction unit, 13...rule identification unit, 14...aggregation unit, 15...output unit, 16...rule control unit, 17...offset control unit, 19...storage unit, 19A...rule table, 101...processor, 102...main memory, 103...storage device, NW...communication network.

Claims

1. A traffic monitoring device for monitoring traffic in a communication network, comprising: a receiving unit that receives packets flowing through the communication network; an extracting unit that extracts first identification information for identifying a flow from the packet based on an offset that specifies an extracting position of the packet received by the receiving unit; a rule identifying unit that identifies a rule having information that matches the first identification information extracted by the extraction unit; a counting unit that counts, for each rule identified by the rule identifying unit, at least one of the number of times the rule is identified and the data amount of the packet identified for that rule; an offset control unit that generates a new offset to be used by the cutout unit to cut out second identification information that can be used to identify attack traffic in addition to the first identification information when the counting result by the counting unit satisfies a predetermined criterion, the rule identification unit identifies a new rule having information that matches the first identification information and the second identification information extracted by the extraction unit based on the new offset; the counting unit counts at least one of the number of times the new rule is specified and the data amount of the packet specified by the new rule; Traffic monitoring equipment.

2. the rule specifying unit specifies, from a group of one or more rules, a rule having information that matches the first identification information cut out by the cutout unit and either the first identification information or the second identification information; a rule control unit that, when the counting result satisfies the predetermined criterion, generates the new rule and adds it to the rule group, thereby increasing the number of rules in the rule group; 2. The traffic monitoring device according to claim 1.

3. The rule group is registered in a rule table, the rule control unit increases the number of rules in the rule group by additionally registering the new rule in the rule table; 3. The traffic monitoring device according to claim 2.

4. an output unit that outputs a count result obtained by the counting unit counting at least one of the number of times the new rule has been specified or the data amount of the packet specified by the new rule, 4. A traffic monitoring device according to claim 1.

5. A traffic monitoring method for monitoring traffic in a communication network by a traffic monitoring device, comprising: The traffic monitoring device a receiving step of receiving packets flowing through the communication network; an extraction step of extracting first identification information for identifying a flow from the packet based on an offset that specifies an extraction position of the packet received in the receiving step; a rule specifying step of specifying a rule having information that matches the first identification information extracted by the extraction step; a counting step of counting, for each rule identified by the rule identifying step, at least one of the number of times the rule is identified and the data amount of the packets identified as the rule; an offset control step of generating, as the offset to be used by the cutout unit, a new offset for cutting out second identification information that can be used to identify attack traffic in addition to the first identification information when the counting result by the counting step satisfies a predetermined criterion; In the rule identifying step, a new rule having information that matches the first identification information and the second identification information extracted based on the new offset in the extraction step is identified; In the counting step, at least one of the number of times the new rule is specified and the data amount of the packet specified by the new rule is counted. Traffic monitoring methods.

6. A computer that monitors traffic on a communications network a receiving step of receiving packets flowing through the communication network; an extraction step of extracting first identification information for identifying a flow from the packet based on an offset that specifies an extraction position of the packet received in the receiving step; a rule specifying step of specifying a rule having information that matches the first identification information extracted by the extraction step; a counting step of counting, for each rule identified by the rule identifying step, at least one of the number of times the rule is identified and the data amount of the packets identified as the rule; an offset control step of generating, as the offset to be used by the cutout unit, a new offset for cutting out second identification information that can be used to identify attack traffic in addition to the first identification information when the counting result by the counting step satisfies a predetermined criterion; the rule identifying step identifies a new rule having information that matches the first identification information and the second identification information extracted based on the new offset in the extraction step; the counting step counts at least one of the number of times the new rule is specified and the data amount of the packet specified by the new rule; program.

Images