DDoS detection apparatus and method

Abstract

A DDoS detection device comprises: a statistical information acquisition unit (1) that identifies a flow to which a packet received from a network (4) belongs, and acquires statistical information for each flow registered in a flow table (15); a DDoS detection unit (2) that determines, on the basis of the statistical information, whether a DDoS attack is occurring; and a flow selection unit (3) which, in each sampling section of each prescribed period, preferentially selects, as a flow for which statistical information should be collected, a new flow from among flows to which the received packet belongs, and registers the new flow in the flow table (15).

Description

[Technical Field]

[0001] The present invention relates to a DDoS detection device and method for detecting DDoS attacks in which a large amount of traffic is sent from multiple terminals to a website or server that is the target of the attack. [Background technology]

[0002] A DDoS (Distributed Denial of Service) attack is a cyber-attack method that disables service by sending a large amount of traffic from multiple terminals to a target website or server. One method of detecting DDoS is to monitor the degree of source address variation and determine that a DDoS has occurred when the degree of variation increases suddenly (see Non-Patent Document 1). The formula for calculating the degree of source address variation H (entropy) using the method disclosed in Non-Patent Document 1 is shown below.

[0003]

number

[0004] In equation (1), i represents one source IP (Internet Protocol) address, Fi represents the frequency of source IP address i, and Fa represents the total number of frequencies. The method disclosed in Non-Patent Document 1 is said to have fewer false positives than methods that determine whether a DDoS attack is occurring based solely on an increase in traffic volume.

[0005] However, as can be seen from equation (1), in order to calculate the degree of source IP address variation H, it is necessary to count the frequency Fi (number of packets per flow) of source IP address i and the total number of frequencies Fa (total number of packets). DDoS traffic generally contains tens of thousands to hundreds of thousands of flows. Therefore, counting the number of packets for each of tens of thousands to hundreds of thousands of source IP addresses to calculate the degree of source IP address variation H poses the problem of increased memory capacity requirements. [Prior art documents] [Non-patent literature]

[0006] [Non-Patent Document 1] Honda Shuichi et al., "Feature Extraction of Unauthorized Access IP Packets Based on Entropy," Proceedings of the Kumamoto Prefectural Industrial-Academic-Government Technology Exchange Conference, 22nd (2007), No. 42, 2008. <https: / / dl.ndl.go.jp / view / download / digidepo_9592220_po_341-1029.pdf?contentNo=42&alternativeNo=> Summary of the Invention [Problem to be solved by the invention]

[0007] The present invention has been made to solve the above-mentioned problems, and aims to provide a DDoS detection device and method that can realize DDoS attack detection with few false positives while reducing memory capacity. [Means for solving the problem]

[0008] The DDoS detection device of the present invention includes a statistical information acquisition unit configured to identify a flow to which a packet received from a network belongs and acquire statistical information for each flow registered in a flow table; a DDoS detection unit configured to determine whether a DDoS attack is occurring based on the statistical information acquired by the statistical information acquisition unit; and a flow selection unit configured to select, in each sampling interval at each predetermined period, a new flow from among the flows to which the received packet belongs as a flow for which the statistical information should be collected and register the flow in the flow table. the statistical information acquisition unit comprises the flow table, a packet reception unit configured to receive packets from a network, a flow identification unit configured to identify a flow to which the packet received by the packet reception unit belongs, and a statistical information collection unit configured to acquire statistical information for each flow registered in the flow table based on an identification result by the flow identification unit; the DDoS detection unit comprises a variation calculation unit configured to calculate a degree of variation of a flow at regular intervals based on the statistical information acquired by the statistical information acquisition unit, and a DDoS determination unit configured to determine that a DDoS attack has occurred when the degree of variation calculated by the variation calculation unit exceeds a threshold; and the flow selection unit selects, in each sampling interval, a flow to which the received packet belongs, The system includes a flow determination unit configured to select a new flow not previously selected as a flow for which statistical information should be collected, and a table update unit configured to update flows registered in the flow table to the flows newly selected by the flow determination unit, wherein the flow determination unit, in each sampling interval, preferentially selects a predetermined number of different flows not previously selected from among flows to which received packets belong, as flows for which statistical information should be collected, and if the number of flows not previously selected is less than the predetermined number, selects flows such that the total number of flows not previously selected and flows selected in the past becomes the predetermined number, and if there is no flow not previously selected from among flows to which received packets belong, selects flows such that the number of flows selected in the past becomes the predetermined number. It is characterized by the following. [Effects of the Invention]

[0009] According to the present invention, by preferentially selecting new flows from among the flows to which packets received in each sampling interval belong and registering them in the flow table, it becomes possible to detect DDoS attacks that involve a huge number of flows while suppressing the memory capacity that constitutes the flow table. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating the principle of the present invention. [Figure 2] FIG. 2 is a block diagram showing the configuration of a DDoS detection device according to an embodiment of the present invention. [Figure 3] FIG. 3 is a flowchart illustrating the operation of the DDoS detection device according to the embodiment of the present invention. [Figure 4] FIG. 4 is a flowchart illustrating the operation of the DDoS detection device according to the embodiment of the present invention. [Figure 5] FIG. 5 is a block diagram showing an example of the configuration of a computer that realizes a DDoS detection device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] [Principle of the Invention] In this invention, as shown in Figure 1, input traffic flows are sampled in each sampling interval 100 at regular intervals, and new flows included in the sampled flows are registered in the flow table as flows for which statistical information should be collected. For example, 10,000 flows that have not been selected in the past are registered in the flow table. t1, t2, t3, t4... in Figure 1 indicate the timing when the flow table is updated.

[0012] Then, the statistical information (number of packets) of the flows registered in the flow table is acquired, and the degree of flow variation (degree of variation in source addresses) is calculated based on the statistical information, and the DDoS attack butBy thus preferentially selecting new flows and registering and updating the flow table at each sampling interval, it is possible to obtain approximate statistical information on these flows even when a DDoS attack involving a number of flows exceeding the number that can be registered in the flow table is occurring. As a result, this invention makes it possible to detect DDoS attacks involving a huge number of flows while minimizing the memory capacity that constitutes the flow table.

[0013] [Example] An embodiment of the present invention will be described below with reference to the drawings. Fig. 2 is a block diagram showing the configuration of a DDoS detection device according to this embodiment. The DDoS detection device includes a statistical information acquisition unit 1 that identifies the flow to which a packet received from a network 4 belongs and acquires statistical information for each flow registered in a flow table, and a DDoS attack detection unit 2 that detects a DDoS attack based on the statistical information. but The system is equipped with a DDoS detection unit 2 that determines whether a DDoS has occurred, and a flow selection unit 3 that, in each sampling interval at a predetermined period, preferentially selects a new flow from among the flows to which the received packet belongs as a flow for which statistical information should be collected and registers it in a flow table.

[0014] The statistical information acquisition unit 1 is composed of a packet receiving unit 10, a header analysis unit 11, a flow identification unit 12, a statistical information collection unit 13, a statistical information storage unit 14, and a flow table 15. The DDoS detection unit 2 is composed of a variation calculation unit 20 and a DDoS determination unit 21. The flow selection unit 3 is composed of a capture unit 30, a flow determination unit 31, a table update unit 32, and a storage unit 33.

[0015] 3 and 4 are flowcharts illustrating the operation of the DDoS detection device of this embodiment. The packet receiving unit 10 of the statistical information acquiring unit 1 receives packets from the network 4 (step S101 in FIG. 3). The header analysis unit 11 analyzes the header of the packet received by the packet receiving unit 10 for each field (such as a MAC (Media Access Control) address or an IP address) (step S102 in FIG. 3).

[0016] The flow identification unit 12 identifies the flow to which the packet received by the packet receiving unit 10 belongs, based on the header field information analyzed by the header analysis unit 11 (step S103 in FIG. 3). Here, a flow refers to a group of packets defined by a combination of header field information such as a source address and a destination address.

[0017] In this embodiment, packets with the same source IP address are considered to be packets of the same flow. Also, in this embodiment, the number of packets is collected as statistical information. The statistical information collection unit 13 counts the number of packets for each flow for which statistical information should be collected, based on the flow table 15 in which the flows for which statistical information should be collected are registered and the identification result by the flow identification unit 12 (step S104 in FIG. 3). The flow table 15 registers flow IDs (source IP addresses) that indicate flows for which statistical information should be collected. The method of registration in the flow table 15 will be described later.

[0018] As will be described later, since the DDoS detection unit 2 needs a value for the total number of packets, the statistical information collection unit 13 may count the total number of packets of the flows for which statistical information is to be collected, separately from the number of packets for each flow. Also, the DDoS detection unit 2 may calculate the total number of packets by adding up the packet count values ​​for each flow. Note that the statistical information collection unit 13 does not count the number of packets when a flow is not registered in the flow table 15.

[0019] The statistical information storage unit 14 stores the statistical information collected by the statistical information collection unit 13 (step S105 in FIG. 3). The statistical information storage unit 14 stores the number of packets for each flow counted by the statistical information collection unit 13 in association with the flow ID (source IP address). When the statistical information collection unit 13 counts the total number of packets for the flow for which statistical information is to be collected as described above, this total number of packets may be stored separately. Since the processing of steps S101 to S105 is performed each time the packet receiving unit 10 receives a packet from the network 4, the number of packets for each flow is stored in chronological order in the statistical information storage unit 14.

[0020] Next, when the variation calculation unit 20 of the DDoS detection unit 2 determines that a certain period of time has elapsed (YES in step S106 in FIG. 3), it calculates the degree of variation H of the flow (the degree of variation in source IP addresses) using equation (1) (step S107 in FIG. 3), where Fi is the number of packets per certain period of time for each flow held in the statistical information holding unit 14, and Fa is the total number of packets per certain period of the flow for which statistical information should be collected. As described above, i represents one source IP address. The total number of flows registered in the flow table 15 is n in equation (1). If the statistical information holding unit 14 does not hold the total number of packets, the variation calculation unit 20 may calculate the total number of packets by adding up the number of packets for each flow held in the statistical information holding unit 14.

[0021] The DDoS determination unit 21 compares the degree of variation calculated by the variation calculation unit 20 with a predetermined threshold, and if the degree of variation exceeds the threshold (YES in step S108 in FIG. 3), it determines that a DDoS attack has occurred (step S109 in FIG. 3). If the degree of variation is equal to or less than the threshold (NO in step S108), the DDoS determination unit 21 determines that a DDoS attack has not occurred (step S110 in FIG. 3). The DDoS determination unit 21 transmits the determination result to the outside (step S111 in FIG. 3).

[0022] After the determination is completed, the variation calculation unit 20 resets the number of packets held in the statistical information holding unit 14 to 0, and also resets the count value of the timer that measures a fixed time to 0 (step S112 in FIG. 3). In this way, in this embodiment, every time a certain period of time has passed, the DDoS attack but Determine whether or not this has occurred.

[0023] Meanwhile, when a sampling interval occurs that occurs at a predetermined cycle (YES in step S200 in FIG. 4), the capture unit 30 of the flow selector 3 saves the flow ID (source IP address) indicating the flow identified by the flow identifier 12 (step S201 in FIG. 4). During the sampling interval, flows may be thinned out according to a rule such that one flow is saved for every 100 flows received, or one flow is saved each time an interval time elapses. In the present invention, the sampling method is not limited to a specific method. Alternatively, all flows may be saved without sampling.

[0024] When the flow determination unit 31 determines a flow for the first time and no flow has been registered in the flow table 15 yet (YES in step S202 in FIG. 4), it selects N (N is a natural number, e.g., 10,000) different flows included in the flows saved by the capture unit 30 during the sampling period as targets for registration in the flow table 15 (step S203 in FIG. 4). N is the number of flows that can be registered in the flow table 15.

[0025] A possible method for selecting flows is to select N flows in descending order of the number of packets, but the method is not limited to this and any method that can select N flows may be used. Also, the number of flows to be selected does not necessarily have to be N, as long as it is N or less.

[0026] The flow determination unit 31 records the flow ID indicating the selected flow in the storage unit 33 (step S204 in FIG. 4). The table update unit 32 registers the flow ID indicating the flow selected by the flow determination unit 31 in the flow table 15 (step S205 in FIG. 4).

[0027] In the case of flow determination for the second and subsequent times when the registration of the flow in the flow table 15 has already been performed (NO in step S202), the flow determination unit 31 preferentially selects N different flows that have not been selected in the past among the flows newly stored by the capture unit 30 during the sampling interval as the objects to be registered in the flow table 15 (step S206 in FIG. 4). As described above, the IDs of the flows selected by the flow determination unit 31 in the past are recorded in the storage unit 33.

[0028] Also, when the number of different flows that have not been selected in the past among the flows newly stored by the capture unit 30 is M (M < N), the flow determination unit 31 preferentially selects M different flows that have not been selected in the past, and further selects L different flows (L = N - M) that have been selected in the past. Thereby, N (= M + L) flows can be selected as the objects to be registered in the flow table 15. As a method for selecting the L flows, for example, a method of selecting L flows in descending order of the number of packets can be considered, but it is not limited to this method, and any method for selecting L arbitrary flows may be used.

[0029] Also, when there are no flows that have not been selected in the past among the flows newly stored by the capture unit 30, the flow determination unit 31 selects N different flows that have been selected in the past. As a method for selecting the N flows, for example, a method of selecting N flows in descending order of the number of packets can be considered, but it is not limited to this method, and any method for selecting N arbitrary flows may be used.

[0030] The flow determination unit 31 additionally records the flow ID indicating the selected flow in the storage unit 33 (step S207 in FIG. 4). The table update unit 32 updates the flow ID registered in the flow table 15 to a flow ID indicating the flow newly selected by the flow determination unit 31 (step S208 in FIG. 4). In this way, the flow table 15 is updated for each sampling interval at a fixed period.

[0031] With the above configuration, this embodiment makes it possible to detect DDoS attacks involving a huge number of flows while suppressing the memory capacity that constitutes the flow table 15.

[0032] The DDoS detection device described in this embodiment can be realized by a computer equipped with a CPU (Central Processing Unit), a storage device, and an interface, and a program that controls these hardware resources. An example of the configuration of this computer is shown in Figure 5.

[0033] The computer includes a CPU 200, a storage device 201, and an interface device (I / F) 202. A communication circuit and the like for connecting to a network 4 are connected to the I / F 102. In such a computer, a program for implementing the DDoS detection method of the present invention is stored in the storage device 201. The CPU 200 executes the processing described in this embodiment in accordance with the program stored in the storage device 201. At least a part of the DDoS detection device may be implemented in hardware.

[0034] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes.

[0035] (Supplementary Note 1) The DDoS detection device of the present invention includes a statistical information acquisition unit configured to identify a flow to which a packet received from a network belongs and acquire statistical information for each flow registered in a flow table, and a DDoS attack detection unit configured to detect a DDoS attack based on the statistical information acquired by the statistical information acquisition unit. butand a DDoS detection unit configured to determine whether a DDoS has occurred or not, and a flow to which a received packet belongs in each sampling interval at each predetermined period, the new flow being determined as a flow for which the statistical information should be collected. Select and a flow selector configured to select a flow and register it in the flow table.

[0036] (Supplementary Note 2) In the DDoS detection device according to Supplementary Note 1, the statistical information acquisition unit comprises the flow table, a packet reception unit configured to receive packets from a network, a flow identification unit configured to identify a flow to which the packet received by the packet reception unit belongs, and a statistical information collection unit configured to acquire statistical information for each flow registered in the flow table based on an identification result by the flow identification unit, the DDoS detection unit comprises: a variation calculation unit configured to calculate a degree of variation of a flow at regular intervals based on the statistical information acquired by the statistical information acquisition unit; and a DDoS determination unit configured to determine that a DDoS attack has occurred when the degree of variation calculated by the variation calculation unit exceeds a threshold, and the flow selection unit selects, in each sampling interval, a new flow that has not been selected in the past from among the flows to which the received packet belongs, as a flow for which the statistical information should be collected. Select and a table update unit configured to update a flow registered in the flow table to a flow newly selected by the flow determination unit.

[0037] (Supplementary Note 3) In the DDoS detection device described in Supplementary Note 2, the variation calculation unit calculates the degree of variation in the source addresses of packets as the degree of variation of the flow based on the statistical information for each flow and total statistical information which is the sum of the statistical information for each flow.

[0038] (Appendix 4) In the DDoS detection device described in Appendix 2, the flow determination unit, in each sampling interval, preferentially selects a predetermined number of different flows that have not been selected in the past from among the flows to which the received packets belong, as flows from which the statistical information should be collected, and if the number of flows that have not been selected in the past is less than the predetermined number, selects flows so that the total number of flows that have not been selected in the past and flows that have been selected in the past becomes the predetermined number, and if there are no flows that have not been selected in the past from among the flows to which the received packets belong, selects flows so that the number of flows that have been selected in the past becomes the predetermined number.

[0039] (Appendix 5) The present invention A DDoS detection method for detecting DDoS attacks using a computer equipped with a CPU and a storage device, A first step of identifying the flow to which a packet received from a network belongs and acquiring statistical information for each flow registered in a flow table; and a second step of detecting a DDoS attack based on the statistical information acquired in the first step. but A second step of determining whether a new flow has occurred or not, and determining, in each sampling interval for each predetermined period, a new flow among the flows to which the received packet belongs as a flow for which the statistical information should be collected. Select and a third step of selecting and registering the selected flow in the flow table. The CPU executes the program stored in the storage device.

[0040] (Supplementary Note 6) In the DDoS detection method according to Supplementary Note 5, the first step includes a fourth step of receiving packets from a network, a fifth step of identifying a flow to which the packet received in the fourth step belongs, and a sixth step of acquiring statistical information for each flow registered in the flow table based on the identification result in the fifth step; the second step includes a seventh step of calculating a degree of flow variation at regular intervals based on the statistical information acquired in the first step, and an eighth step of determining that a DDoS attack has occurred if the degree of variation calculated in the seventh step exceeds a threshold; and the third step includes selecting, in each sampling interval, a new flow that has not been selected in the past among the flows to which the received packet belongs, as a flow for which the statistical information should be collected. Selectand a tenth step of updating the flow registered in the flow table with the flow newly selected in the ninth step.

[0041] (Appendix 7) In the DDoS detection method described in Appendix 6, the seventh step includes a step of calculating the degree of variation in source addresses of packets as the degree of variation in the flow based on the statistical information for each flow and total statistical information which is the sum of the statistical information for each flow.

[0042] (Appendix 8) In the DDoS detection method described in Appendix 6, the ninth step includes the steps of: in each sampling interval, preferentially selecting a predetermined number of different flows that have not been selected in the past from among the flows to which the received packets belong, as flows from which the statistical information should be collected; if the number of flows that have not been selected in the past is less than the predetermined number, selecting flows so that the total number of flows that have not been selected in the past and flows that have been selected in the past becomes the predetermined number; and if there is no flow that has not been selected in the past from among the flows to which the received packets belong, selecting flows so that the number of flows that have been selected in the past becomes the predetermined number. [Industrial Applicability]

[0043] The present invention can be applied to technology for detecting cyber attacks. [Explanation of symbols]

[0044] 1...Statistical information acquisition unit, 2...DDoS detection unit, 3...Flow selection unit, 4...Network, 10...Packet reception unit, 11...Header analysis unit, 12...Flow identification unit, 13...Statistical information collection unit, 14...Statistical information storage unit, 15...Flow table, 20...Variation calculation unit, 21...DDoS judgment unit, 30...Capture unit, 31...Flow determination unit, 32...Table update unit, 33...Memory unit.

Claims

1. a statistical information acquisition unit configured to identify a flow to which a packet received from a network belongs and to acquire statistical information for each flow registered in the flow table; a DDoS detection unit configured to determine whether a DDoS attack is occurring based on the statistical information acquired by the statistical information acquisition unit; and a flow selection unit configured to select a new flow from among flows to which received packets belong as a flow for which statistical information should be collected and to register the flow in the flow table, in each sampling interval for each predetermined period; The statistical information acquisition unit the flow table; a packet receiver configured to receive packets from a network; a flow identification unit configured to identify a flow to which a packet received by the packet receiving unit belongs; a statistical information collection unit configured to acquire statistical information for each flow registered in the flow table based on an identification result by the flow identification unit, The DDoS detection unit a variation calculation unit configured to calculate a degree of variation of a flow at regular intervals based on the statistical information acquired by the statistical information acquisition unit; a DDoS determination unit configured to determine that a DDoS attack has occurred when the degree of variation calculated by the variation calculation unit exceeds a threshold; The flow selection unit a flow determination unit configured to select, in each sampling interval, a new flow that has not been selected in the past among flows to which received packets belong, as a flow for which statistical information should be collected; a table update unit configured to update the flow registered in the flow table to the flow newly selected by the flow determination unit, The flow determination unit, in each sampling interval, preferentially selects a predetermined number of different flows that have not been selected in the past from among the flows to which the received packets belong as flows from which statistical information should be collected, and if the number of flows that have not been selected in the past is less than the predetermined number, selects flows so that the total number of flows that have not been selected in the past and flows that have been selected in the past becomes the predetermined number, and if there are no flows that have not been selected in the past from among the flows to which the received packets belong, selects flows so that the number of flows that have been selected in the past becomes the predetermined number.

2. 2. The DDoS detection device according to claim 1, A DDoS detection device characterized in that the variation calculation unit calculates the degree of variation in the source addresses of packets as the degree of variation of the flow based on the statistical information for each flow and the total statistical information which is the sum of the statistical information for each flow.

3. A DDoS detection method for detecting a DDoS attack using a computer having a CPU and a storage device, comprising: a first step of identifying a flow to which a packet received from a network belongs and acquiring statistical information for each flow registered in a flow table; a second step of determining whether a DDoS attack is occurring based on the statistical information acquired in the first step; a third step of selecting a new flow from among flows to which received packets belong as a flow for which statistical information should be collected and registering the flow in the flow table in each sampling interval of a predetermined period, and causing the CPU to execute the third step in accordance with a program stored in the storage device; The first step comprises: a fourth step of receiving packets from the network; a fifth step of identifying the flow to which the packet received in the fourth step belongs; a sixth step of acquiring statistical information for each flow registered in the flow table based on the identification result of the fifth step; The second step includes: a seventh step of calculating a degree of flow variation at regular intervals based on the statistical information acquired in the first step; an eighth step of determining that a DDoS attack has occurred when the degree of variation calculated in the seventh step exceeds a threshold; The third step includes: a ninth step of selecting, in each sampling interval, a new flow that has not been selected in the past among flows to which received packets belong, as a flow for which statistical information should be collected; a tenth step of updating the flow registered in the flow table with the flow newly selected in the ninth step; The ninth step is a DDoS detection method characterized by including the steps of: in each sampling interval, preferentially selecting a predetermined number of different flows that have not been selected in the past from among the flows to which the received packets belong, as flows from which the statistical information should be collected; if the number of flows that have not been selected in the past is less than the predetermined number, selecting flows so that the total number of flows that have not been selected in the past and flows that have been selected in the past is the predetermined number; and if there are no flows that have not been selected in the past from among the flows to which the received packets belong, selecting flows so that the number of flows that have been selected in the past is the predetermined number.

4. The DDoS detection method according to claim 3, The seventh step is a DDoS detection method characterized in that it includes a step of calculating the degree of variation in the source addresses of packets as the degree of variation in the flow based on the statistical information for each flow and total statistical information which is the sum of the statistical information for each flow.

Images