Attack detection device, attack detection system, attack detection method, and attack detection program

Abstract

An attack detection device (10) detects a cyberattack in a mobile network (100) equipped with a RAN (2, 3) including RAN communication devices (25, 26, 35, 36) that perform wireless communication with user equipment (UE). The attack detection device (10) includes an information integration unit (11) and an attack detection unit (12). The information integration unit (11) acquires resource information on the RAN communication devices (25, 26, 35, 36) and integrates the resource information. The attack detection unit (12) detects a cyberattack on the basis of the integrated resource information.

Description

[Technical Field]

[0001] The present invention relates to an attack detection device, an attack detection system, an attack detection method, and an attack detection program. [Background technology]

[0002] A mobile network consists of a Radio Access Network (hereinafter also referred to as "RAN"), which includes multiple base stations that communicate with user terminals, and a Core Network (hereinafter also referred to as "CN"), which is a backbone communication network that connects to external networks such as other mobile networks and the Internet. 5G NR is being promoted as the next-generation standard for mobile networks. 5G requires ultra-high speeds, multiple simultaneous connections, and ultra-low latency. RAN is therefore promoting the open design of communication equipment that makes up base stations, as well as virtualization and functional separation.

[0003] In open RAN, communication devices are implemented using virtualization software running on a virtualization platform, instead of traditional dedicated devices. In addition, as an architecture of the RAN, communication devices are functionally separated into a CU (Central Unit), DU (Distributed Unit), and RU (Radio Unit). In addition, in open RAN, for example, the use of a RAN Intelligence Controller (RIC), a type of centralized management controller equipped with AI functions, to perform network control, resource optimization, etc. is being promoted (see, for example, Non-Patent Document 1). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] RAN Intelligence Controller (RIC): https: / / ieeexplore.ieee.org / abstract / document / 9376232 [Non-patent document 2] Trend Micro Mobile Security: https: / / www.trendmicro.com / ja_jp / about / press-release / 2021 / pr-20210408-01.html [Non-patent document 3] RFC 8612 - DDoS Open Threat Signaling (DOTS) Requirements: https: / / datatracker.ietf.org / doc / html / rfc8612 Summary of the Invention [Problem to be solved by the invention]

[0005] However, there are concerns about an increase in cyber attacks that exploit the open specifications of 5G communication equipment. Cyber-attacks include, for example, radio jamming attacks and DDoS attacks that occur at the communication layer between user terminals and base station communication equipment, the wireless physical layer, the RRC protocol layer, etc. These cyber-attacks can result in unauthorized control of user communications and communication equipment, denial of service by squeezing network bandwidth resources, and unauthorized acquisition of confidential information. As a result, users may experience communication disruptions, information leaks, and even strain on the resources of the entire mobile network.

[0006] To counter such cyber attacks, it has been proposed to detect cyber attacks by inserting a security appliance between specific communication devices in the RAN (see, for example, Non-Patent Document 2). In addition, a mechanism has been proposed to deal with DDoS attacks by introducing a client-server into the network and cooperating with the RIC of each RAN (see, for example, Non-Patent Document 3).

[0007] However, as mentioned above, the changes in RAN architecture in 5G have led to diversification of communication device specifications, so detecting a cyber-attack at a single point in the network may not provide sufficient data on the cyber-attack, and may result in inaccurate detection of cyber-attacks that may be carried out in a distributed manner at various points in the network.

[0008] There is a demand for improved detection accuracy in attack detection devices that detect cyber attacks. [Means for solving the problem]

[0009] The attack detection device according to the present invention is an attack detection device that detects cyber-attacks in a mobile network having a wireless access network including a plurality of first communication devices that perform wireless communication with a user terminal, The mobile network includes a core network including a second communication device that controls wireless communication in the wireless access network and relays between the wireless access network and an external network, and the attack detection device: an information integration unit that acquires resource information of the plurality of first communication devices and integrates the resource information; and an attack detection unit that detects the cyber-attack based on the integrated resource information. The information integration unit integrates the resource information by linking the wireless communication control information acquired from the core network to resource information of the plurality of first communication devices. It is characterized by: [Effects of the Invention]

[0010] According to the present invention, it is possible to improve the accuracy of detecting cyber attacks. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram illustrating a mobile network to which an attack detection device according to an embodiment of the present invention is applied. [Figure 2] 1 is a block diagram showing the configuration of an attack detection system including an attack detection device according to an embodiment of the present invention. [Figure 3] FIG. 3 is a sequence diagram illustrating a processing flow of the attack detection system according to the first embodiment. [Figure 4] FIG. 10 is a sequence diagram illustrating the flow of processing performed by the attack detection system according to the second embodiment. [Figure 5] FIG. 2 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of the attack detection device according to the present embodiment. [Figure 6] FIG. 10 is a block diagram showing the configuration of an attack detection system according to a first modified example. [Figure 7] FIG. 10 is a block diagram showing the configuration of an attack detection system according to a second modification. DETAILED DESCRIPTION OF THE INVENTION

[0012] Next, an embodiment of the present invention (hereinafter referred to as "the present embodiment") will be described with reference to the drawings. FIG. 1 is a diagram illustrating a mobile network to which an attack detection device according to this embodiment is applied. FIG. 2 is a block diagram showing the configuration of an attack detection system including an attack detection device according to this embodiment. As shown in Fig. 1, the mobile network 100 is made up of radio access networks RAN2 and RAN3, and a core network 4. RAN2 and RAN3 each cover a set area and perform wireless communication with user equipment (UE) within that area. The core network 4 is a backbone communication network that controls wireless communication in RAN2 and RAN3 and relays between RAN2 and RAN3 and an external network 200 (such as another mobile network or the Internet). FIG. 1 shows an example in which the mobile network 100 includes one core network 4 and two RANs 2 and 3, but the number of core networks and RANs is not limited to the example in FIG.

[0013] As shown in FIG. 2, RAN2 includes RAN communication devices 25 and 26 (first communication devices), and RAN3 includes RAN communication devices 35 and 36 (first communication devices). The RAN communication devices 25, 26, 35, and 36 perform data transfer and protocol processing, respectively. In 5G, the next-generation standard for mobile networks, the RAN architecture separates the RAN communication devices into RUs (Radio Units), DUs (Distributed Units), and CUs (Central Units). The RUs are antennas, and the DUs and CUs are configured on general-purpose server devices. The DUs function as slave stations, and the CUs function as master stations, which are higher-level communication devices. The communication devices that make up the master and slave stations are interconnected by a dedicated network called a fronthaul, enabling high-speed communication.

[0014] Examples of user equipment UE include mobile terminal devices such as mobile phones and smartphones, portable tablet terminal devices, personal computers, and IoT (Internet of Things) devices. The user equipment UE is allocated resources by the RANs 2 and 3 via wireless communication, and communicates with the core network 4 via the RANs 2 and 3.

[0015] The core network 4 performs user equipment UE authentication, location management, radio bearer control, session management, policy control, packet transfer control, data relay, etc. This enables the user equipment UE to connect to the external network 200. 2, the core network 4 includes CN communication devices 45 and 46 (second communication devices). The CN communication devices 45 and 46 perform data transfer and protocol processing between the RAN communication devices 25, 26, 35, and 36 and the external network 200. The number of RAN communication devices in the RANs 2 and 3 and the number of CN communication devices in the core network 4 are not limited to the example in FIG. 2, and can be increased or decreased as appropriate.

[0016] In a 5G mobile network, data communication is achieved by separating signals transmitted and received between the user equipment UE, RANs 2 and 3, and the core network 4 into C-Plane (control plane) signals and U-Plane (user plane) signals. C-Plane signals are control signals that are responsible for session control and management between the user equipment UE and the RAN communication devices 25, 26, 35, and 36. U-Plane signals are signals that transmit actual data (e.g., images, audio, etc.) in communications. Cyber-attacks may be carried out against these signals.

[0017] Examples of cyber attacks include data congestion of U-Plane signals, signaling spoofing attacks of C-Plane signals, radio jamming attacks, and RRC protocol signaling DoS attacks. Furthermore, there are concerns about large-scale, decentralized cyberattacks that exploit the open specifications of 5G communication equipment, such as volume DDoS (Distributed Denial of Service) attacks, which involve controlling a large number of user terminals (UE) infected with bot viruses. Such cyber attacks may result in unauthorized control of the user equipment UE and the RAN communication devices 25, 26, 35, 36, etc., disrupt services by straining the resources of the mobile network 100, or unauthorized acquisition of confidential information, etc. As a result, communication failures of the user equipment UE, information leaks, and the entire service of the mobile network 100 may become unavailable.

[0018] The attack detection device 10 according to this embodiment detects and deals with cyber attacks made against a mobile network 100. As shown in Figure 2, the attack detection device 10 communicates with RAN controllers 20, 30 (first controllers) provided in RANs 2, 3 and a CN controller 40 (second controller) provided in a core network 4, and works together to detect and respond to cyber-attacks. In other words, the attack detection device 10, the RAN controllers 20, 30, and the CN controller 40 constitute an attack detection system 1.

[0019] The RAN controllers 20 and 30 manage the RAN communication devices 25, 26, 35, and 36 provided in the RANs 2 and 3, and acquire resource information of the RAN communication devices 25, 26, 35, and 36. The CN controller 40 manages the CN communication devices 45 and 46 provided in the core network 4, and acquires resource information of the CN communication devices 45 and 46.

[0020] The attack detection device 10, RAN controllers 20 and 30, and CN controller 40 can be configured, for example, on a general-purpose server device equipped with AI functions. The RAN controllers 20 and 30 may be configured, for example, as part of the functions of upper-level communication devices of the RANs 2 and 3, respectively, or may be configured on a separate computer. The CN controller 40 may be configured as part of the functions of either of the CN communication devices 45 and 46, or may be configured on a separate computer.

[0021] 2, the attack detection device 10 includes an information integration unit 11, an attack detection unit 12, and a cooperation control unit 13. Details of the processing performed by each unit will be explained in the embodiments. The RAN controllers 20, 30 and the CN controller 40 are equipped with cooperation control units 21, 31, and 41, respectively. The cooperation control units 21, 31, and 41 share information with the cooperation control unit 13 of the attack detection device 10 and execute processing instructed by the cooperation control unit 13. In other words, the RAN controllers 20, 30 and the CN controller 40 are controlled by the attack detection device 10 via the cooperation control unit 13. Although not shown in the figures, the attack detection device 10, the RAN controllers 20 and 30, and the CN controller 40 each have a memory unit. The memory unit stores information required for processing by each unit, and also temporarily stores the processing results of each unit.

[0022] Security analysis devices 27 and 37 are dynamically deployed in the RANs 2 and 3. The security analysis devices 27 and 37 can be configured, for example, as virtual machines or containers in general-purpose server devices that constitute the RAN controllers 20 and 30, separated from the RAN controllers 20 and 30. The security analysis devices 27 and 37 are started up by the cooperation control units 21 and 31 of the RAN controllers 20 and 30 as needed.

[0023] The RAN 3 is also provided with a hardware accelerator (hereinafter also referred to as "HW accelerator") 38 as a hardware configuration. The HW accelerator 38 can be, for example, an FPGA board, an FPGA SmartNIC, a GPU board, or the like. By offloading specific processing from software to the HW accelerator 38 and executing it, it is possible to reduce processing latency and power consumption. In this embodiment, the HW accelerator 38 performs steering processing to transfer communication data from the RAN communication devices 35 and 36 to the security analysis device 37, and also performs specific processing offloaded from the security analysis device 37.

[0024] [Example 1] FIG. 3 is a sequence diagram illustrating the flow of processing performed by the attack detection system according to the first embodiment. In the first embodiment, an example of processing suitable for detecting cyber-attacks that occur locally between the RAN communication devices 25, 26, 35, and 36 and the user equipment UE, such as radio jamming attacks and RRC protocol signaling DoS attacks, will be described. A radio wave jamming attack is an attack that disables radio communication between the user equipment UE and the RAN communication devices 25, 26, 35, and 36 by transmitting jamming radio waves to the radio waves transmitted from the user equipment UE to the RAN communication devices 25, 26, 35, and 36. Radio wave jamming attacks occur in the communication layer between the user equipment UE and the RAN communication devices 25, 26, 35, and 36, the radio physical layer, the RRC (Radio Resource Control) protocol layer, and the like. Such radio wave jamming attacks can be detected by receiving jamming radio waves. However, as described above, in 5G, upper communication devices do not have antennas due to functional separation, making it difficult for the upper communication devices to receive jamming radio waves and detect radio wave jamming attacks.

[0025] An RRC protocol signaling DoS attack is an attack that disables service provision by sending a large number of packets that falsely represent specific sequences or specific information of the RRC protocol, thereby placing a processing load on the CUs and DUs that constitute higher-level communication devices in the RANs 2 and 3. The RRC protocol is a protocol used for Random Access and RRC Setup procedures, which are sequences for establishing a connection between the RAN communication devices 25, 26, 35, and 36 and user equipment UE, and for resource control after the connection is established. Conventional methods for detecting RRC protocol signaling DoS attacks include conducting investigations based on increases in processing load in communication devices above the RAN or based on reports from users about service provision load, but these methods have issues with detection accuracy and speed.

[0026] In Example 1 of this embodiment, the information integration unit 11 of the attack detection device 10 acquires resource information of multiple RAN communication devices 25, 26, 35, and 36 via the coordination control units 21 and 31 of the RAN controllers 20 and 30, and performs information integration processing to integrate the resource information of the multiple RAN communication devices 25, 26, 35, and 36. The attack detection unit 12 detects cyber attacks in the RANs 2 and 3 based on the resource information integrated by the information integration unit 11. The cooperation control unit 13 shares information (characteristic information and response information) about the cyber attack detected by the attack detection unit 12 with the cooperation control units 21 and 31 of the RAN controllers 20 and 30, and controls the cooperation control units 21 and 31 to respond to the cyber attack.

[0027] Next, the processing of the first embodiment will be described in more detail with reference to FIG. <Information integration processing> 3, the information integrator 11 of the attack detection device 10 acquires resource information of the RAN communication devices 25, 26, 35, and 36 from the RAN controllers 20 and 30, respectively (step S101). The resource information can be acquired, for example, periodically.

[0028] The information integrator 11 performs an information integration process to integrate the resource information of the RAN communication devices 25, 26, 35, and 36 (step S102). The resource information is resource information related to wireless communication with user equipment UE of RAN communication devices 25, 26, 35, and 36, which belong to RAN 2 and 3, respectively. The resource information may change due to a cyber-attack, and serves as a criterion for detecting a cyber-attack. Furthermore, when detecting a radio jamming attack, the resource information may include, for example, radio wave quality information of the user terminal UE, radio wave intensity information of the RAN communication devices 25, 26, 35, and 36, cell resource information, the number of user terminals connected to the cell, the number of signaling requests, and other information. For example, when detecting an RRC protocol signaling DoS attack, the resource information may include information such as the number of RRC Request Messages, the frequency of RRC Requests, the number of connected user terminals, and the number of signaling requests.

[0029] As an example of information integration processing, the information integrator 11 can link resource information with control information for wireless communication between the user equipment UE and the RAN communication devices 25, 26, 35, and 36. The control information is, for example, user equipment UE identification information, radio bearer control information, and the like. As described above, wireless communication in the RANs 2 and 3 is controlled by the core network 4. The information integrator 11 can acquire control information from the CN communication devices 45 and 46 via the cooperation control unit 41 of the CN controller 40. In this way, by linking control information to resource information, information at multiple hierarchical levels of the communication protocol layers constructed in RAN2 and RAN3 is linked, enabling cross-sectional analysis.

[0030] In 5G, IP packets sent and received by user equipment (UE) are mapped to radio bearers, and depending on the location where resource information in the communications protocol layer is obtained, it may not be possible to obtain information that can detect cyber-attacks. As an example, as described above, in 5G, the RAN communication devices 25, 26, 35, and 36 are functionally separated into multiple communication devices called RU, DU, and CU. Therefore, depending on the communication device, for example, it may be impossible to obtain wireless communication quality information or communication frequency, or it may be impossible to obtain mapping information between radio bearers and IP packets. Even in such cases, information integration processing can be performed to link information at multiple hierarchical levels of the communication protocol layer. Therefore, even if there is a location where sufficient resource information is not available, resource information at other protocol layers can be analyzed across the board, making it easier to detect cyberattacks.

[0031] As another example of information integration processing, the information integrator 11 can mutually link the resource information acquired from each of RAN2 and 3. For example, the information integrator 11 mutually links common resource information acquired from RAN2 and 3. If a cyber-attack occurs in RAN3, the resource information of RAN3 will show a significant change compared to the resource information of RAN2, making it easier to detect the cyber-attack in RAN3. The information integration process is not limited to these aspects and can be modified as appropriate. In addition, the information integration process may perform both a process of linking resource information to control information and a process of linking resource information of different RANs 2 and 3 to each other.

[0032] <Attack detection processing> The attack detection unit 12 performs an attack detection process to detect whether a cyber attack has occurred in the RANs 2 and 3 based on the resource information integrated by the information integration unit 11 (step S103). As an example, the attack detection unit 12 can detect cyber attacks by analyzing the integrated resource information across the board using an AI function that has previously learned resource information in a normal state. The attack detection unit 12 detects a cyber-attack when the integrated resource information contains resource information that deviates from a normal state, i.e., resource information in which an abnormality has occurred. The attack detection unit 12 may detect a cyber-attack, for example, when the number of resource information in which an abnormality has occurred exceeds a certain number in the integrated resource information.

[0033] 3 shows an example in which a cyber-attack is detected from the resource information of RAN 2. If a cyber-attack is not detected, the cooperative control process described below is not performed, and the attack detection device 10 ends the process. The attack detection unit 12 creates information about detected cyber-attacks. The cyber-attack information includes characteristic information about the cyber-attacks and information about how to deal with the cyber-attacks. The characteristic information about the cyber-attacks may include, for example, the type of cyber-attack, IP address information about the target of the attack, identification information about the user equipment UE, radio bearer control information, etc. The information about how to deal with the cyber-attacks is information that indicates the measures to be taken in response to the detected cyber-attacks, and includes, for example, blocking or shaping (limiting the amount of communication data) of communication data.

[0034] <Cooperative control processing> The cooperation control unit 13 performs cooperation control on the RAN controller 20 of the RAN 2 in which the cyber-attack has been detected (step S104). The coordination control unit 13 shares the cyber-attack information created by the attack detection unit 12 with the RAN controller 20 of RAN2, thereby taking coordinated measures against the cyber-attack. Specifically, the cooperation control unit 13 outputs a request to take action against the cyber-attack to the cooperation control unit 21 of the RAN controller 20. The response request includes information about the cyber-attack created by the attack detection unit 12.

[0035] The cooperation control unit 21 of the RAN controller 20 takes measures against the cyber attack in accordance with the response request input from the cooperation control unit 13 (step S105). As an example of how to deal with this, the cooperation control unit 21 dynamically deploys, for example, a security analysis device 27. The cooperation control unit 21 performs a steering process to transfer communication data transmitted and received between the RAN communication devices 25, 26 and the user equipment UE to the security analysis device 27. The security analysis device 27 performs an analysis process on each piece of communication data and determines whether there is any communication data that matches the cyber attack information shared by the cooperation control unit 13 (type of cyber attack, IP address information of the attack target, identification information of the user terminal UE, radio bearer control information, etc.).

[0036] The security analysis device 27 can perform security analysis using, for example, U-Plane signals and C-Plane signals as input communication data. For example, a signature analysis can be performed to analyze whether characteristic information contained in the communication data matches characteristic information of a cyber attack. For example, a statistical analysis can be performed using statistical information such as communication volume and the number of signaling transmissions, as well as thresholds. For example, a method can be performed to detect abnormalities in communication data by having an AI learn data from normal communication states in advance.

[0037] When a response request is input to the RAN controller 30 of the RAN 3, the cooperation control unit 31 responds to the cyber-attack in the same manner as the cooperation control unit 21. Here, since the RAN 3 is provided with a HW accelerator 38, the cooperation control unit 31 may cause the HW accelerator 38 to perform the steering process. The cooperation control unit 31 may further offload part of the analysis process performed by the security analysis device 37 and cause the HW accelerator 38 to execute it. This reduces the operational delay of the analysis process and the power consumption required for the analysis process.

[0038] When the security analysis device 27 identifies communication data that is subject to a cyber attack, it notifies the cooperation control unit 21 of information about the identified communication data. Upon receiving the notification from the security analysis device 27, the cooperation control unit 21 takes measures such as blocking or shaping the wireless communication corresponding to the identified communication data in accordance with the handling information shared by the cooperation control unit 13.

[0039] When the cooperation control unit 21 finishes dealing with the cyber-attack, the cooperation control unit 13 of the attack detection device 10 ends the cooperation control process. Although the explanation will be omitted, the attack detection device 10 again acquires resource information from the RAN controllers 20, 30 (step S106), performs information integration processing and attack detection processing, and also performs coordinated control processing if a cyber attack is detected.

[0040] In this way, in the first embodiment, by integrating and cross-sectionally analyzing the resource information of the RAN communication devices 25, 26, 35, and 36, it is possible to detect cyber attacks that are carried out locally in the RANs 2 and 3. In particular, radio jamming attacks, which cannot be received by communication devices higher up the RAN, can be detected based on resource information obtained from the higher-level communication devices. In addition, RRC protocol signaling DoS attacks, which were previously investigated based on resource abnormalities in higher-level communication devices or user reports, can now be detected quickly and accurately by analyzing resource information across the board.

[0041] [Example 2] FIG. 4 is a sequence diagram illustrating the flow of processing performed by the attack detection system according to the second embodiment. In the second embodiment, a process suitable for detecting distributed and large-scale cyber attacks in the mobile network 100, such as a volume DDoS attack, will be described.

[0042] In the second embodiment, when an abnormality is detected in the resource information of the CN communication devices 45 and 46 of the core network 4, the cooperation control unit 13 of the attack detection device 10 controls the RAN controllers 20 and 30 of the RANs 2 and 3 to perform analysis processing of the communication data of the RAN communication devices 25, 26, 35 and 36. Specifically, the cooperation control unit 13 outputs a request for analysis processing to the cooperation control units 21 and 31 of the RAN controllers 20 and 30.

[0043] The cooperation control units 21 and 31 of the RAN controllers 20 and 30 dynamically deploy (start) security analysis devices 27 and 37 in the RANs 2 and 3 in response to the analysis processing request input from the cooperation control unit 13. The cooperation control units 21 and 31 perform steering processing to transfer communication data from the RAN communication devices 25, 26, 35, and 36 to the security analysis devices 27 and 37, and cause the security analysis devices 27 and 37 to perform analysis processing.

[0044] Furthermore, in the RAN 3, the cooperation control unit 31 causes the HW accelerator 38 to perform steering processing, and also offloads part of the analysis processing from the security analysis device 37 and causes the HW accelerator 38 to execute it. The attack detection unit 12 of the attack detection device 10 detects a cyber attack based on the results of the analysis process. The cooperation control unit 13 shares information (countermeasure information) about the cyber-attack detected by the attack detection unit 12 with the cooperation control units 21 and 31 of the RAN controllers 20 and 30, and controls the cooperation control units 21 and 31 to deal with the cyber-attack.

[0045] Next, the processing of the second embodiment will be described in more detail with reference to FIG. <Resource abnormality detection process> 4, the attack detection unit 12 of the attack detection device 10 acquires resource information of the CN communication devices 45 and 46 via the cooperation control unit 41 of the CN controller 40 of the core network 4 (step S201). The resource information of the CN communication devices 45 and 46 may include, for example, the amount of data inflow from each of the RANs 2 and 3.

[0046] The attack detection unit 12 performs an anomaly detection process to detect an anomaly in the resource information of the CN communication devices 45 and 46 (step S202). As with the attack detection process of the first embodiment, the attack detection unit 12 can perform the anomaly detection process using, for example, an AI that has previously learned resource information in a normal state. The attack detection unit 12 detects an anomaly when the resource information of the CN communication devices 45 and 46 contains resource information that deviates from the normal state.

[0047] If an abnormality occurs in the resource information of the CN communication devices 45 and 46, there is a possibility that a distributed cyber-attack such as a volume DDoS attack is being carried out. For example, if the amount of data inflow from the RAN 3 exceeds a threshold, the occurrence of a cyber-attack in the RAN 3 is suspected. However, simply detecting an abnormality in the resource information of the CN communication devices 45 and 46 does not allow the specific location of the cyber-attack in the RAN 3 to be identified. Therefore, in the second embodiment, when an abnormality in the resource information of the CN communication devices 45 and 46 is detected, the location of the cyber-attack is identified by performing an analysis process on the communication data in the RAN where the cyber-attack is suspected.

[0048] <Analysis processing> Figure 4 shows an example in which RAN3 is determined to be a suspect RAN suspected of a cyber attack. The cooperation control unit 13 of the attack detection device 10 outputs an analysis request to the cooperation control unit 31 of the RAN controller 30 of the suspect RAN 3 (step S203). The analysis request instructs that communication data between the RAN communication devices 35 and 36 belonging to the RAN 3 and the user equipment UE be analyzed in detail, and includes information regarding abnormalities in the resource information of the CN communication devices 45 and 46 detected by the attack detection unit 12.

[0049] In response to the analysis request, the cooperation control unit 31 of the RAN controller 30 dynamically deploys the security analysis device 37 (step S204). The cooperation control unit 31 performs a steering process of the communication data to the security analysis device 37 (step S205). Specifically, the cooperation control unit 31 transfers communication data from the RAN communication devices 35 and 36 of the RAN 3 to the security analysis device 37. Here, the RAN 3 is provided with a HW accelerator 38. Therefore, the cooperation control unit 31 offloads the steering process and causes the HW accelerator 38 to execute the process.

[0050] The cooperation control unit 31 causes the security analysis device 37 to perform a security analysis process on each piece of communication data transferred by the steering process (step S206). The security analysis device 37 performs an analysis process on each piece of communication data and determines whether there is communication data related to an abnormality in the resource information of the CN communication devices 45 and 46 shared by the cooperation control unit 13. The security analysis device 37 can perform security analysis using, for example, U-Plane signals and C-Plane signals as input communication data. As in the first embodiment, the analysis method can be signature analysis, statistical analysis, or AI-based anomaly analysis of communication data.

[0051] The cooperation control unit 31 offloads part of the analysis processing performed by the security analysis device 37 to the HW accelerator 38 for execution. In this way, by utilizing the HW accelerator 38 in the RAN 3, the delay in the steering process and the analysis process can be reduced, and the power consumption due to the processes can also be reduced.

[0052] When the security analysis device 37 identifies communication data that has been subjected to a cyber-attack through analysis processing, it notifies the cooperation control unit 31 of information related to the cyber-attack. For example, if the cyber-attack is a DDoS attack, the information related to the attack may include identification information of the user equipment UE that is the source of the attack, information on the network / cell accessed by the user equipment UE, the IP address of the target of the attack, the type of attack, etc.

[0053] When the analysis process is completed, the cooperation control unit 31 inputs the analysis result to the attack detection device 10 (step S207). The analysis result includes information related to the cyber attack notified by the security analysis device 37. When an analysis request is output to the RAN controller 20, the cooperation control unit 21 performs the same processing as the cooperation control unit 31 and causes the security analysis device 37 to perform the analysis processing. Here, since the HW accelerator 38 is not provided in the RAN 2, the cooperation control unit 21 does not offload to the HW accelerator.

[0054] <Attack detection processing> The attack detection unit 12 of the attack detection device 10 performs an attack detection process to detect whether a cyber attack has occurred in the RAN 3 based on the analysis result input from the cooperation control unit 31 (step S208). The attack detection unit 12 detects the occurrence of a cyber-attack when information related to the cyber-attack is included in the analysis result of the RAN 3. The attack detection unit 12 creates response information for the detected cyber-attack.

[0055] <Cooperative control processing> As in the first embodiment, the cooperation control unit 13 performs cooperation control on the RAN 3 in which a cyber-attack has been detected (step S209). The cooperation control unit 13 outputs a response request including response information for the cyber attack created by the attack detection unit 12 to the cooperation control unit 31 of the RAN controller 30 of the RAN 3.

[0056] The cooperation control unit 31 of the RAN controller 30 takes measures against the cyber-attack in accordance with the response request input from the cooperation control unit 13 (step S210). When the cooperation control unit 31 finishes dealing with the cyber-attack, the cooperation control unit 13 of the attack detection device 10 ends the cooperation control process. Although the explanation will be omitted, the attack detection device 10 again acquires resource information from the CN controller 40 (step S211), and if an abnormality in the resource information is detected, performs analysis processing, attack detection processing, and cooperative control processing.

[0057] Identifying the source of a distributed cyber-attack such as a volume DDoS attack requires detailed analysis of communication data from each of the RAN communication devices 25, 26, 35, and 36. However, constantly performing detailed analysis increases communication load and power consumption. On the other hand, distributed and large-scale cyber attacks may affect the resources of the CN communication devices 45 and 46 of the core network 4. Therefore, in Example 2 of this embodiment, when a resource abnormality is detected in the CN communication devices 45 and 46, the security analysis devices 27 and 37 are temporarily started in the RANs 2 and 3 to perform analysis processing. This makes it possible to identify the source of the cyber attack while reducing communication load and power consumption compared to when analysis processing is performed continuously.

[0058] [Hardware configuration] The attack detection device 10 according to this embodiment is realized by a computer 900 as shown in FIG. 5, for example. FIG. 5 is a hardware configuration diagram showing an example of a computer 900 that realizes the functions of the attack detection device 10 according to this embodiment. The computer 900 has a CPU (Central Processing Unit) 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, a HDD (Hard Disk Drive) 904, an input / output I / F (Interface) 905, a communication I / F 906, and a media I / F 907.

[0059] The CPU 901 operates based on a program (attack detection program) stored in the ROM 902 or the HDD 904, and performs processing of each functional unit of the attack detection device 10 shown in Fig. 2. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started up, programs related to the hardware of the computer 900, and the like.

[0060] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0061] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901.

[0062] The media I / F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical disc), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0063] For example, when the computer 900 functions as the attack detection device 10 according to this embodiment, the CPU 901 of the computer 900 realizes the functions of the attack detection device 10 by executing a program loaded onto the RAM 903. In addition, the HDD 904 stores data in the RAM 903. The CPU 901 reads and executes a program related to the target processing from the recording medium 912. In addition, the CPU 901 may read a program related to the target processing from another device via a communication network (NW 920). The RAN controllers 20 and 30 and the CN controller 40 can also be realized by a computer 900 as shown in FIG.

[0064] <Configuration and Effects of the Above-described Embodiment> (1) The attack detection device 10 detects a cyber-attack in a mobile network 100 having RANs 2 and 3 (radio access networks) including RAN communication devices 25, 26, 35, and 36 (plurality of first communication devices) that perform wireless communication with a user equipment UE. The attack detection device 10 includes an information integration unit 11 and an attack detection unit 12 . The information integration unit 11 acquires resource information of the RAN communication devices 25, 26, 35, and 36, and integrates the resource information. The attack detection unit 12 detects cyber attacks based on the integrated resource information.

[0065] The resource information is resource information related to wireless communication between the RAN communication devices 25, 26, 35, and 36 included in the RANs 2 and 3 and the user equipment UE, and may be changed by a cyber-attack. In other words, the resource information is information that serves as a criterion for detecting a cyber-attack. However, due to functional separation of the RAN communication devices in 5G, for example, some RAN communication devices may not be able to acquire sufficient resource information for detecting a cyber-attack. Therefore, in the first embodiment, the information integrator 11 integrates the resource information obtained from the RAN communication devices 25, 26, 35, and 36. This enables the attack detector 12 to analyze the resource information of the RAN communication devices 25, 26, 35, and 36 across the board, thereby improving the accuracy of detecting cyber-attacks. The "plurality of first communication devices" may be a plurality of RAN communication devices provided within the same RAN, or may be a plurality of RAN communication devices provided in different RANs.

[0066] (2) The mobile network 100 includes a core network 4. The core network 4 controls wireless communication in the RANs 2 and 3 and includes CN communication devices 45 and 46 (second communication devices) that relay between the RANs 2 and 3 and the external network 200. The information integrator 11 of the attack detection device 10 can integrate the resource information by, for example, linking the wireless communication control information acquired from the core network 4 to the resource information of the RAN communication devices 25, 26, 35, and 36.

[0067] This allows resource information at multiple levels of the RAN2 and RAN3 communication protocol layers to be linked across the network. Therefore, even if there are areas in the communication protocol layer where sufficient resource information is not available, resource information from other protocol layers can be analyzed across the network, making it easier to detect cyber attacks. Note that the example of the information integration process is not limited to this, and the information integrator 11 may integrate the resource information by, for example, linking the common resource information between the multiple RAN communication devices 25, 26, 35, and 36 with each other.

[0068] (3) The mobile network 100 includes a core network 4. The core network 4 controls wireless communication in the RANs 2 and 3 and includes CN communication devices 45 and 46 (second communication devices) that relay between the RANs 2 and 3 and the external network 200. The attack detection device 10 includes a cooperation control unit 13 . When an abnormality is detected in the resource information of the CN communication devices 45 and 46, the cooperation control unit 13 controls the RAN controllers 20 and 30 (controllers of the radio access network) to perform analysis processing of the communication data of the RAN communication devices 25, 26, 35 and 36. The attack detection unit 12 detects a cyber attack based on the results of the analysis process.

[0069] Identifying the source of a distributed cyber-attack such as a volume DDoS attack requires detailed analysis of communication data from the RAN communication devices 25, 26, 35, and 36. However, constantly performing detailed analysis increases communication load and power consumption. When a resource abnormality is detected in the CN communication devices 45, 46 of the core network 4 that relays between the RANs 2, 3 and the external network 200, the attack detection device 10 performs analysis processing by temporarily activating the security analysis devices 27, 37 in the RAN controllers 20, 30. This makes it possible to identify the source of a cyber attack while reducing communication load and power consumption compared to performing analysis processing continuously. 4, an example in which an analysis request is output only to the RAN controller 30 of the RAN 3 suspected of a cyber-attack has been described, but the example is not limited to this. For example, if the attack detection unit 12 detects an abnormality in the resource information of the CN communication devices 45 and 46 but is unable to identify the suspected RAN, the cooperation control unit 13 may output an analysis request to both the RAN controllers 20 and 30.

[0070] (4) The cooperation control unit 13 shares information about the cyber-attack detected by the attack detection unit 12 with the RAN controllers 20 and 30, and controls the RAN controllers 20 and 30 to deal with the cyber-attack.

[0071] When the attack detection device 10 detects a cyber-attack, it can quickly respond to the cyber-attack by cooperating with the RAN controllers 20 and 30. This reduces the possibility of unauthorized control, communication failure, network resource pressure, etc. due to the cyber-attack.

[0072] (5) The attack detection system 1 detects cyber attacks in a mobile network 100 that includes RANs 2 and 3 (radio access networks) and a core network 4. The attack detection system 1 includes an attack detection device 10, RAN controllers 20 and 30 (first controllers) that manage the RANs 2 and 3, and a CN controller 40 (second controller) that manages the core network 4. When an abnormality is detected in the resource information of the CN communication devices 45, 46 obtained from the CN controller 40, the cooperation control unit 13 of the attack detection device 10 outputs a request to the RAN controllers 20, 30 to analyze the communication data of the RAN communication devices 25, 26, 35, 36. The attack detection unit 12 of the attack detection device 10 detects a cyber attack based on the results of the analysis process.

[0073] Identifying the source of a distributed cyber-attack such as a volume DDoS attack requires detailed analysis of communication data from the RAN communication devices 25, 26, 35, and 36. However, constantly performing detailed analysis increases communication load and power consumption. When a resource abnormality is detected in the CN communication devices 45, 46 of the core network 4 that relays between the RANs 2, 3 and the external network 200, the attack detection system 1 performs analysis processing by temporarily activating the security analysis devices 27, 37 in the RAN controllers 20, 30. This makes it possible to identify the source of a cyber attack while reducing communication load and power consumption compared to performing analysis processing continuously.

[0074] (6) The RAN controller 30 includes a security analysis device 37 and a HW accelerator 38 (hardware accelerator). The security analysis device 37 is started in response to a request for analysis processing and performs the analysis processing. The HW accelerator 38 transfers communication data from the RAN communication devices 35 and 36 to the security analysis device 37 and also executes part of the analysis processing offloaded from the security analysis device 37 .

[0075] This allows the attack detection system 1 to reduce operational delays in the analysis process and reduce power consumption required for the analysis process. In this embodiment, an example in which the HW accelerator 38 is provided only in the RAN3 has been described, but the HW accelerator 38 may also be provided in the RAN2.

[0076] The above-described effects can also be applied to the attack detection method implemented by the attack detection device 10 and the attack detection program for causing the computer 900 to function as the attack detection device 10.

[0077] [Variation 1] FIG. 6 is a block diagram showing the configuration of an attack detection system 1A according to the first modification. In the first modification, an example will be described in which the RAN controllers 20, 30 and the CN controller 40 are provided with attack detection units 22, 32, and . 6, in the first modification, the RAN controller 20 has an attack detection unit 22 in addition to the cooperation control unit 21. The RAN controller 30 has an attack detection unit 32 in addition to the cooperation control unit 31. The CN controller 40 has an attack detection unit 42 in addition to the cooperation control unit 41. In the first modification, the attack detection processing previously performed by the attack detection unit 12 of the attack detection device 10 can be performed by the attack detection units 22 and 32 of the RAN controllers 20 and 30. In addition, the abnormality detection processing of the resource information of the CN communication devices 45 and 46 previously performed by the attack detection unit 12 can be performed by the attack detection unit 42 of the CN controller 40.

[0078] In the attack detection system 1A according to the first modification, when the processing of the first embodiment in FIG. 3 is performed, the attack detection units 22 and 32 of the RAN controllers 20 and 30 can perform the attack detection processing of step S103. In this case, upon completing the information integration process of step S102, the attack detection device 10 outputs the integrated resource information to each of the RAN controllers 20 and 30. The attack detection units 22 and 32 of the RAN controllers 20 and 30 perform attack detection processing based on the input integrated resource information. If the attack detection units 22 and 32 detect a cyber-attack during the attack detection processing, the RAN controllers 20 and 30 can take measures against the attack in step S105, as in the above-described embodiment.

[0079] In the attack detection system 1A according to the first modification, when the processing of the second embodiment in FIG. 4 is performed, the attack detection unit 42 of the CN controller 40 can perform the resource abnormality detection processing of step S202. If the attack detection unit 42 detects an abnormality in the resource information, the attack detection unit 42 inputs the detection result to the attack detection device 10. As in the above-described embodiment, the cooperation control unit 13 of the attack detection device 10 can output an analysis request to the RAN controller of the suspect RAN (step S203). Furthermore, in the first modification, the attack detection units 22 and 32 of the RAN controllers 20 and 30 can perform the attack detection process in step S208 based on the analysis results of the security analysis devices 27 and .

[0080] [Variation 2] FIG. 7 is a block diagram showing the configuration of an attack detection system 1B according to the second modification. In the second modification, an example will be described in which the CN controller 40 is configured as the attack detection device 10 instead of providing an independent attack detection device 10. As shown in FIG. 7, the CN controller 40, which is the attack detection device 10, includes an information integration unit 43 in addition to a cooperation control unit 41 and an attack detection unit . The CN controller 40 communicates with the RAN controllers 20 and 30 and controls cooperation with the RAN controllers 20 and 30.

[0081] In the attack detection system 1B relating to variant example 2, when performing the processing of example 1 in Figure 3, the information integration unit 43 of the CN controller 40 performs the information integration processing of step S102, the attack detection unit 42 performs the attack detection processing of step S103, and the collaboration control unit 104 performs the collaboration control processing of step S104. In the attack detection system 1B according to the second modification, when the processing of the second embodiment in Fig. 4 is performed, the attack detection unit 42 of the CN controller 40 can perform the resource abnormality detection processing of step S202. Furthermore, if an abnormality in the resource information is detected, the cooperation control unit 41 of the CN controller 40 can request the RAN controllers 20 and 30 to perform an analysis of step S203. The attack detection unit 42 of the CN controller 40 can perform the attack detection processing of step S208 based on the analysis results of the RAN controllers 20 and 30. If a cyber-attack is detected, the cooperation control unit 41 can perform the cooperation control processing of step S209.

[0082] The present invention is not limited to the above-described embodiments, and many modifications can be made by a person having ordinary skill in the art within the technical concept of the present invention.

[0083] The following supplementary notes are disclosed regarding the attack detection device 10 shown in this embodiment. (Appendix 1) An attack detection device that detects a cyber-attack in a mobile network that includes a radio access network including a first communication device that performs radio communication with a user equipment (UE), and a core network that controls radio communication in the radio access network and includes a second communication device that relays between the radio access network and an external network, a cooperation control unit that acquires resource information of the second communication device, and when an abnormality is detected in the resource information of the second communication device, controls a controller of the radio access network to perform analysis processing of communication data of the first communication device; An attack detection device characterized by having an attack detection unit that detects the cyber attack based on the results of the analysis processing. [Explanation of symbols]

[0084] 1,1A,1B Attack Detection System 10 Attack detection device 11 Information Integration Department 12 Attack detection unit 13 Coordination control unit 2,3 RAN (Radio Access Network) 20,30 RAN controller (first controller) 21,31 Coordination control unit 22,32 Attack detection unit 25, 26, 35, 36 RAN communication equipment (first communication equipment) 4 Core Network 40 CN controller (second controller) 41 Coordination control unit 42 Attack detection unit 43 Information Integration Department 45,46 CN communication device (second communication device) 100 Mobile Networks 200 External Network

Claims

1. An attack detection device that detects a cyber-attack in a mobile network having a radio access network including a plurality of first communication devices that perform wireless communication with a user terminal, the mobile network includes a core network including a second communication device that controls wireless communication in the radio access network and relays between the radio access network and an external network; The attack detection device an information integration unit that acquires resource information of the plurality of first communication devices and integrates the resource information; an attack detection unit that detects the cyber-attack based on the integrated resource information, The information integrating unit integrates the resource information by linking the wireless communication control information acquired from the core network to resource information of the plurality of first communication devices. An attack detection device characterized by:

2. An attack detection device that detects a cyber-attack in a mobile network having a radio access network including a plurality of first communication devices that perform wireless communication with a user terminal, the mobile network includes a core network including a second communication device that controls wireless communication between the user terminal and the first communication device and relays between the wireless access network and an external network, The attack detection device an information integration unit that acquires resource information of the plurality of first communication devices and integrates the resource information; an attack detection unit that detects the cyber-attack based on the integrated resource information; a cooperation control unit that controls a controller of the radio access network to perform analysis processing of communication data of the first communication device when an abnormality is detected in resource information of the second communication device, The attack detection unit detects the cyber-attack based on the result of the analysis processing. An attack detection device characterized by:

3. The wireless access network controller includes a cooperation control unit that shares information about the cyber-attack detected by the attack detection unit with a controller of the wireless access network and controls the controller of the wireless access network to deal with the cyber-attack.

3. The attack detection device according to claim 1 or 2, wherein:

4. An attack detection system for detecting cyber-attacks in a mobile network including a wireless access network including a first communication device that performs wireless communication with a user terminal, and a core network including a second communication device that controls wireless communication in the wireless access network and relays between the wireless access network and an external network, an attack detection device; a first controller for managing the radio access network; a second controller that manages the core network, The attack detection device a cooperation control unit that, when an abnormality is detected in the resource information of the second communication device acquired from the second controller, outputs a request to the first controller to perform an analysis process on the communication data of the first communication device; an attack detection unit that detects the cyber-attack based on the result of the analysis processing. An attack detection system that features:

5. The first controller a security analysis device that is activated in response to a request for the analysis process and performs the analysis process; a hardware accelerator that transfers the communication data from the first communication device to the security analysis device and executes a part of the analysis process offloaded from the security analysis device. The attack detection system according to claim 4 .

6. An attack detection method for an attack detection device that detects a cyber-attack in a mobile network having a radio access network including a plurality of first communication devices that wirelessly communicate with a user terminal, comprising: the mobile network includes a core network including a second communication device that controls wireless communication in the radio access network and relays between the radio access network and an external network; The attack detection device an information integration process of acquiring resource information of the plurality of first communication devices and integrating the resource information; performing an attack detection process to detect the cyber-attack based on the integrated resource information; In the information integration process, the resource information is integrated by linking the wireless communication control information acquired from the core network to resource information of the plurality of first communication devices. An attack detection method characterized by:

7. An attack detection method for an attack detection device that detects a cyber-attack in a mobile network having a radio access network including a plurality of first communication devices that wirelessly communicate with a user terminal, comprising: the mobile network includes a core network including a second communication device that controls wireless communication between the user terminal and the first communication device and relays between the wireless access network and an external network, The attack detection device an information integration process of acquiring resource information of the plurality of first communication devices and integrating the resource information; an attack detection process for detecting the cyber-attack based on the integrated resource information; performing a cooperative control process of controlling a controller of the radio access network to perform an analysis process of communication data of the first communication device when an abnormality is detected in the resource information of the second communication device; In the attack detection process, the cyber attack is detected based on the result of the analysis process. An attack detection method characterized by:

8. An attack detection program for causing a computer to function as the attack detection device according to claim 1 or 2.

Images