Monitoring system

Abstract

In this monitoring system (1), a collection unit (21) of an xFlow proxy (2) collects, in an IPv6 network, flow information including the relevant IPv6 address information for communication between IPv4 addresses via the IPv6 network. A detection unit (31) of a flow collector (3) detects information on attack traffic from within the collected flow information. When notified of a targeted address of the detected attack traffic, an extraction unit (41) of an IPv6 network controller (4) extracts the information of an IPv6 address from the information of the targeted address.

Description

surveillance system

[0001] The present invention relates to a surveillance system.

[0002] Conventionally, IPv4-over-IPv6 technologies such as MAP-E (Mapping of Address and Port Encapsulation, RFC 7697) and DS-Lite (Dual-Stack Lite, RFC 6333) have been widely used in carrier networks as technologies for sharing IPv4 addresses in IPv6 networks. For example, in MAP-E, each user IPv4 network is assigned a range of available port numbers, and a global IPv4 address is shared among multiple IPv4 networks. In addition, in DS-Lite, a private IPv4 address is shared among multiple IPv4 networks by using a NAT function that converts a global IPv4 address on the ISP side into a private IPv4 address. With these technologies, there is a possibility that the IPv4 addresses of IPv4 networks observed in the carrier IPv6 network may overlap between the IPv4 networks.

[0003] In recent years, networks using IPv4 over IPv6 technology have been experiencing a high frequency of large-scale, short-term Distributed Denial of Service (DDoS) attacks, creating a need for rapid and accurate countermeasures. Conventionally, attacks have been detected from netFlow output by an xFlow proxy, and the link between the IPv4 address in the Inner information included in netFlow and the IPv6 address in the Outer information representing a tunnel in an IPv6 network has been resolved, and countermeasures such as filtering and bandwidth restriction have been implemented using the IPv6 address (see Patent Documents 1 to 4).

[0004] Japanese Patent Application Publication No. 2021-090161 International Publication No. 2022 / 172456 International Publication No. 2021 / 149245 Japanese Patent Application Publication No. 2020-174257

[0005] However, with conventional technology, it has been difficult to quickly and accurately respond to DDoS attacks in networks that use IPv4-over-IPv6 technology. For example, it takes time to respond because it is necessary to resolve the association between the IPv6 address in the outer information, which represents a tunnel within the IPv6 network, and the IPv4 address in the inner information. Furthermore, because there is a possibility that the IPv4 addresses of IPv4 networks observed by the carrier IPv6 network may overlap with other IPv4 networks, there is a possibility that the IPv6 addresses of normal communications that are not part of an attack may also be mistakenly responded to.

[0006] The present invention has been made in view of the above, and has as its object to deal with DDoS attacks quickly and accurately in a network that uses IPv4 over IPv6 technology.

[0007] In order to solve the above-mentioned problems and achieve the object, the monitoring system of the present invention is characterized by having a collection unit that collects flow information including IPv6 address information regarding communications between IPv4 addresses passing through an IPv6 network within the IPv6 network, a detection unit that detects information on attack communications from the collected flow information, and an extraction unit that, when a victim address of the detected attack communications is notified, extracts information on the IPv6 address from the information on the victim address.

[0008] According to the present invention, it is possible to deal with DDoS attacks quickly and with high accuracy in a network that uses IPv4 over IPv6 technology.

[0009] FIG. 1 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 2 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 3 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 4 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 5 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 6 is a diagram for explaining an overview of the monitoring system of this embodiment. FIG. 7 is a schematic diagram illustrating an example of the overall configuration of the monitoring system of this embodiment. FIG. 8 is a diagram for explaining processing by a collection unit. FIG. 9 is a sequence diagram showing a monitoring processing procedure. FIG. 10 is a diagram illustrating an example of a computer that executes a monitoring program.

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0011] [Overview of Monitoring System] Figures 1 to 6 are diagrams for explaining an overview of the monitoring device of this embodiment. First, Figure 1 illustrates DS-Lite and MAP-E, which are IPv4 over IPv6 technologies. In DS-Lite, as illustrated in Figure 1(a), a private IPv4 address is shared among multiple IPv4 networks by a Network Address Translation (NAT) function that converts a global IPv4 address on the ISP side into a private IPv4 address. In this case, because the IPv4 address is a private address, there is a possibility that it may overlap among multiple user IPv4 networks corresponding to different B4 (Basic Bridging Broadband).

[0012] In MAP-E, as shown in Fig. 1(b), each user IPv4 network is assigned a range of available port numbers, and a global IPv4 address is shared among multiple user IPv4 networks. In this case, since the IP address is shared among user IPv4 networks corresponding to multiple CEs (Customer Edges), there is a possibility of duplication among multiple user IPv4 networks.

[0013] 2 illustrates an example of a DDoS attack on DS-Lite. As illustrated in Fig. 2, when an attack occurs, the specific attack destination by the attacker is converted into multiple private addresses of B4s by NAPT (Network Address Port Translation) in AFTR (Address Family Transition Router). As a result, attacks occur simultaneously on multiple B4s, and congestion occurs within the carrier IPv6 network.

[0014] Therefore, Fig. 3 shows an example of a conventional countermeasure against DDoS attacks in DS-Lite. Conventionally, as shown in Fig. 3, a flow collector detects an attack from the netFlow output by the xFlow proxy and notifies the controller (Ctr, Controller) of the IPv4 address of the inner information included in the netFlow (see (1)). The Ctr resolves the association from the IPv4 address to the IPv6 address of the outer information (see (2)), and takes measures such as filtering and bandwidth restriction using the IPv6 address (see (3)).

[0015] In this case, it takes time to resolve the association from the IPv4 address to the IPv6 address in the outer information. Furthermore, the association resolution may result in incorrectly dealing with IPv6 addresses for normal communication that are not attacks.

[0016] 4 to 6 illustrate the processing of the monitoring system of this embodiment. First, FIG. 4 illustrates a case in which the flow collector can notify only the victim address in DS-Lite. In this case, the monitoring system embeds the IPv6 address (outer information) and the IPv4 address (inner information) in the IPv6 address of the netFlow output by the xFlow proxy 2. The flow collector 3 detects the attack and notifies the IPv6 network controller (Ctr) 4, which controls the IPv6 network, of the victim address (see (1)). The IPv6 network Ctr 4 extracts the IPv6 address to be addressed (see (2)) and takes action such as filtering or bandwidth restriction using the IPv6 address (see (3)). This makes it possible to accurately, automatically, and quickly notify the IPv6 network of the IPv6 address involved in the attack communication. This enables rapid and accurate response to attacks.

[0017] 5 also illustrates a case in which the flow collector 3 can notify detailed attack information in DS-Lite. In this case, the flow collector 3 detects an attack and notifies the IPv6 control unit 4 of detailed information such as the 7-tuple of the attack (see (1)). The control unit 4 of the IPv6 network notifies the IPv4 control unit 5, which controls the IPv4 network, of the detailed information of the attack (see (2)). The control unit 5 of the IPv4 network resolves the 5-tuple of the attack for the victim address to be dealt with (see (3)) and takes action against the victim address (see (4)). This enables more accurate and prompt action to be taken.

[0018] Similarly, Figure 6 illustrates a case in which the flow collector in MAP-E can notify detailed attack information. In this case, as in the case of DS-Lite shown in Figure 5, the flow collector 3 detects the attack and notifies the IPv6 network Ctr4 of detailed information such as the 7-tuple of the attack (see (1)). The IPv6 network Ctr4 notifies the IPv4 network Ctr5 of the detailed information of the attack (see (2)). The IPv4 network Ctr5 resolves the 5-tuple of the attack for the victim address to be dealt with (see (3)) and takes action on the victim address (see (4)). This enables more accurate and prompt action to be taken.

[0019] [Configuration of Monitoring System] Fig. 7 is a schematic diagram illustrating the overall configuration of a monitoring system of this embodiment. As illustrated in Fig. 7, the monitoring system 1 of this embodiment includes an xFlow proxy 2, a flow collector 3, and an IPv6 network controller (Ctr) 4. The monitoring system 1 may further include an IPv4 network controller (Ctr) 5.

[0020] The xFlow proxy 2 includes a control unit implemented by a CPU (Central Processing Unit), NP (Network Processor), FPGA (Field Programmable Gate Array), etc., and functions as a collection unit 21 by executing a processing program stored in memory. The control unit may also include other functional units. The xFlow proxy 2 also includes a storage unit (not shown) implemented by a semiconductor memory element such as RAM or flash memory. The xFlow proxy 2 also includes a communication control unit (not shown), and communicates with network devices such as the flow collector 3 and a CR (Core Router) in the IPv6 network via the communication control unit.

[0021] The collection unit 21 collects flow information including IPv6 address information regarding communications between IPv4 addresses passing through the IPv6 network, and outputs the collected flow information to the flow collector 3.

[0022] For example, communication between IPv4 addresses passing through an IPv6 network, that is, communication using IPv4 over IPv6 technology, is communication using, for example, DS-Lite or MAP-E.

[0023] 8A and 8B are diagrams for explaining the processing of the collection unit 21. As illustrated in Fig. 8A, the collection unit 21 collects traffic information in the IPv6 network from a CR (Core Router) using, for example, IPFIX (IP Flow Information Export), and outputs NetFlow as flow information to the flow collector 3.

[0024] As shown in Fig. 8, the traffic information includes information such as source and destination addresses in the IPv6 network as outer information, and source and destination addresses in the IPv4 network as inner information. Specifically, the collection unit 21 collects 7-tuple information of the traffic information using a statistical collection HASH table as shown in Fig. 8(1). Here, the 7-tuple information refers to information obtained by adding a 5-tuple of the IPv4 network as inner information to the source and destination addresses in the IPv6 network as outer information.

[0025] Then, the collection unit 21 outputs the flow information in NetFlow format including the IPv6 address information to the flow collector 3. In the example shown in Fig. 8 (2), IPv6 prefix information, which is outer information, and IPv4 address information, which is inner information, are embedded in a 5-tuple field of NetFlow.

[0026] Returning to the explanation of Fig. 7, the flow collector 3 includes a control unit realized by a CPU, NP, FPGA, or the like, and functions as a detection unit 31 by executing a processing program stored in memory. The control unit may also include other functional units. The flow collector 3 also includes a storage unit (not shown) realized by a semiconductor memory element such as RAM or flash memory. The flow collector 3 also includes a communication control unit (not shown), and communicates with the xFlow proxy 2, IPv6 network controller 4, and other network devices via the communication control unit.

[0027] The detection unit 31 detects information about attack communications from the collected flow information. When the detection unit 31 detects information about attack communications, it notifies the IPv6 network controller 4 of information about victim addresses of the attack communications. For example, in the example shown in Fig. 4, the IPv6 network controller 4 is notified of IPv6 address M + IPv4 private address α and IPv6 address N + IPv4 private address α as victim addresses of the attack communications.

[0028] The IPv6 network controller 4 includes a control unit implemented by a CPU, NP, FPGA, or the like, and functions as an extraction unit 41 and a handling unit 42 by executing a processing program stored in memory. The IPv6 network controller 4 may also include other functional units. The IPv6 network controller 4 also includes a storage unit (not shown) implemented by a semiconductor memory element such as a RAM or flash memory. The IPv6 network controller 4 also includes a communication control unit (not shown), and communicates with the flow collector 3, the IPv4 network controller 5, and other network devices via the communication control unit.

[0029] When the victim address of the detected attack communication is notified, the extraction unit 41 extracts IPv6 address information from the victim address information. For example, in the example shown in Figure 4, IPv6 addresses M and N are extracted from the victim addresses of the attack communication as IPv6 addresses to be dealt with.

[0030] The countermeasure unit 42 uses the extracted IPv6 address information to counter the attack communication. For example, in the example shown in Fig. 4, countermeasures are taken against the IPv6 addresses M and N of the victim addresses by filtering, bandwidth control, etc. in the ER (Edge Router). This makes it possible to accurately counter only the victim address without erroneously countering normal communication of the IPv6 address O + IPv4 private address α shown in Fig. 4.

[0031] The detection unit 31 may notify the extraction unit 41 of detailed information such as 7-tuple information of the attack communication. In this case, the extraction unit 41 notifies the IPv4 network of the notified detailed information of the attack communication. Specifically, the extraction unit 41 notifies the IPv4 network controller 5 of the notified detailed information such as 7-tuple of the attack communication. For example, in the examples shown in FIGS. 5 and 6, the 7-tuple information of the attack communication is notified to the IPv4 network controller 5.

[0032] The IPv4 network controller 5 includes a control unit implemented by a CPU, NP, FPGA, or the like, and functions as an extraction unit 51 and a handling unit 52 by executing a processing program stored in memory. The control unit may also include other functional units. The IPv4 network controller 5 also includes a storage unit (not shown) implemented by a semiconductor memory element such as RAM or flash memory. The IPv4 network controller 5 also includes a communication control unit (not shown), and communicates with the IPv6 network controller 4 and network devices such as an Address Family Transition Router (AFTR) or a Border Relay (BR) in the IPv4 network via the communication control unit.

[0033] The extraction unit 51 resolves the 5-tuple information based on detailed information such as the 7-tuple information of the notified attack communication. For example, in the example shown in Figures 5 and 6, the 5-tuple information of the attack communication is extracted from the 7-tuple information of the attack communication as the address of the IPv4 network to be dealt with.

[0034] The countermeasure unit 52 uses the 5-tuple information of the attack communication to counter the attack communication. For example, in the example shown in Figures 5 and 6, the 5-tuple information of the IPv4 source address B, destination address A, etc. of the attack communication is used to counter the attack communication by filtering, bandwidth control, etc. in the ISP's IPv4 network. This makes it possible to accurately counter only the victim address without erroneously countering normal communications, as in the case of Figure 4.

[0035] [Monitoring Process] Next, the monitoring process performed by the monitoring system 1 according to this embodiment will be described with reference to Fig. 9. Fig. 9 is a sequence diagram showing the procedure of the monitoring process. The sequence in Fig. 9 starts, for example, when the user performs an operation input to instruct the start of the process.

[0036] In the xFlow proxy 2, the collector 21 collects flow information including IPv6 address information regarding communications between IPv4 addresses passing through the IPv6 network (step S1), and outputs the collected flow information to the flow collector 3 (step S2).

[0037] In the flow collector 3, the detection unit 31 detects information about attack communications from the collected flow information (step S3). When the detection unit 31 detects information about attack communications, it notifies the IPv6 network controller 4 of information about the victim addresses of the attack communications (step S4).

[0038] In the IPv6 network controller 4, when the victim address of the detected attack communication is notified, the extraction unit 41 extracts the IPv6 address information from the victim address information (step S5).

[0039] The countermeasure unit 42 then uses the extracted IPv6 address information to implement countermeasures against the attacking communications, such as filtering or bandwidth control (step S6), thereby completing the series of monitoring processes.

[0040] In the flow collector 3, the detection unit 31 may notify the extraction unit 41 of the IPv6 network controller 4 of detailed information such as 7-tuple information of the attack communication. In this case, the extraction unit 41 of the IPv6 network controller 4 notifies the IPv4 network controller 5 of the notified detailed information of the attack communication.

[0041] In the IPv4 network controller 5, the extraction unit 51 resolves the 5-tuple information based on the notified detailed information of the attack communication, such as the 7-tuple information. The countermeasure unit 52 then takes countermeasures against the attack communication using the 5-tuple information of the attack communication. This completes the series of monitoring processes.

[0042] [Effects] As described above, in the monitoring system 1 of this embodiment, the collection unit 21 of the xFlow proxy 2 collects flow information including IPv6 address information regarding communications between IPv4 addresses passing through the IPv6 network within the IPv6 network. The detection unit 31 of the flow collector 3 detects information about attack communications from the collected flow information. When the extraction unit 41 of the IPv6 network controller 4 is notified of a victim address of the detected attack communications, it extracts information about the IPv6 address from the information about the victim address.

[0043] Specifically, communication between IPv4 addresses via an IPv6 network is communication using DS-Lite or MAP-E.

[0044] In this way, by automatically notifying the information on the IPv6 addresses to be dealt with, it is possible to accurately deal with only the victim addresses without mistakenly dealing with normal communications. In this way, it is possible to deal with DDoS attacks quickly and with high accuracy in networks that use IPv4 over IPv6 technology.

[0045] Furthermore, the countermeasure unit 42 of the IPv6 network controller 4 uses the extracted IPv6 address information to take measures against attacking communications, thereby making it possible to prevent damage from DDoS attacks.

[0046] The detection unit 31 may also notify the extraction unit 41 of detailed information about the attack communication, such as 7-tuple information. In this case, the extraction unit 41 notifies the IPv4 network controller 5 of the notified detailed information about the attack communication. In this way, it becomes possible to accurately and quickly deal with the attack by using the 5-tuple information about the attack communication.

[0047] [Program] A program written in a computer-executable language may be created to execute the processes performed by each device in the monitoring system 1 according to the above embodiment. In one embodiment, the xFlow proxy 2, flow collector 3, IPv6 network controller 4, and IPv4 network controller 5 can be implemented by installing a monitoring program that executes the above monitoring processes as package software or online software on a desired computer. For example, by executing the monitoring program on an information processing device, the information processing device can function as the xFlow proxy 2, flow collector 3, IPv6 network controller 4, and IPv4 network controller 5. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the monitoring device 10 may also be implemented on a cloud server.

[0048] 10 is a diagram showing an example of a computer that executes a monitoring program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0049] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0050] Here, the hard disk drive 1031 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or the memory 1010, for example.

[0051] The monitoring program is stored in the hard disk drive 1031 as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the monitoring device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0052] Furthermore, data used for information processing by the monitoring program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0053] The program module 1093 and program data 1094 related to the monitoring program are not limited to being stored in the hard disk drive 1031, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the monitoring program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0054] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0055] REFERENCE SIGNS LIST 1 Monitoring system 2 xFlow proxy 3 Flow collector 4 IPv6 network controller 5 IPv4 network controller 21 Collection unit 31 Detection unit 41, 51 Extraction unit 42, 52 Response unit

Claims

1. A monitoring system comprising: a collection unit that collects flow information including IPv6 address information regarding communications between IPv4 addresses passing through an IPv6 network; a detection unit that detects information on attack communications from the collected flow information; and an extraction unit that, when notified of a victim address of the detected attack communications, extracts IPv6 address information from the victim address information.

2. The monitoring system according to claim 1, further comprising a countermeasure unit that uses the extracted IPv6 address information to implement countermeasures against the attack communication.

3. The monitoring system according to claim 1, characterized in that the detection unit notifies the extraction unit of detailed information about the attack communication, and the extraction unit notifies the notified detailed information about the attack communication to an IPv4 network.

4. The monitoring system according to claim 1, wherein the communication between IPv4 addresses passing through the IPv6 network is communication using DS-Lite or MAP-E.

Images