Extraction device

Abstract

Provided is an extraction device (10), wherein a collection unit (15a) collects packets flowing through a prescribed network device (20). A selection unit (15b) selects a prescribed information item from header sample information (14a) of the collected packets, at a prescribed frequency which is in accordance with an intended use.

Description

extraction device

[0001] The present invention relates to an extraction device.

[0002] Conventionally, technologies called xFlow, such as NetFlow, IPFIX, and sFlow, sample packets flowing through a network at a fixed frequency, and transmit the statistical information and a portion of the sampled packets as flow statistical information to a collector for analysis (see Non-Patent Document 1).

[0003] At this time, a technology (hereinafter referred to as xFlow conversion technology) has been disclosed for extracting the packet inside the capsule and converting it into an analyzable format for the encapsulated packet (see Patent Documents 1 and 2).

[0004] JP 2019-97069 A JP 2021-90161 A

[0005] “Cisco Systems NetFlow Services Export Version 9”, 2004, RFC3954

[0006] However, with conventional techniques, it may be difficult to collect flow statistics with different amounts of information depending on the purpose of analysis. For example, a collector receives and analyzes flow statistics with an amount of information depending on the purpose of analysis. If a collector collects and analyzes multiple patterns of flow statistics with different amounts of information, multiple collectors corresponding to each pattern are required, which increases costs.

[0007] The present invention has been made in view of the above, and has an object to easily enable collection of flow statistical information with different amounts of information depending on the analytical purpose.

[0008] In order to solve the above-mentioned problems and achieve the objectives, the extraction device of the present invention is characterized by having a collection unit that collects packets circulating through a specified network device, and a selection unit that selects specified information items from the collected packets at a specified frequency according to the application.

[0009] According to the present invention, it is possible to easily collect flow statistical information with different amounts of information depending on the purpose of analysis.

[0010] Fig. 1 is a diagram for explaining an overview of an extraction device of this embodiment. Fig. 2 is a schematic diagram illustrating a general configuration of the extraction device of this embodiment. Fig. 3 is a diagram for explaining extraction processing. Fig. 4 is a diagram for explaining extraction processing. Fig. 5 is a flowchart showing the extraction processing procedure. Fig. 6 is a diagram showing an example of a computer that executes an extraction program.

[0011] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to this embodiment. In addition, in the description of the drawings, the same parts are designated by the same reference numerals.

[0012] [Outline of Extraction Device] Fig. 1 is a diagram for explaining an outline of the extraction device of this embodiment. As shown in Fig. 1(a), the extraction device of this embodiment samples packets circulating in a carrier network and generates flow statistics information from the collected header sample information.

[0013] In this case, since the amount of information required varies depending on the purpose of analysis, the extraction device 10 generates flow statistical information with different amounts of information depending on the purpose, as shown in Fig. 1(b) , and then transmits each piece of flow statistical information to the flow collector 30 separately.

[0014] Here, examples of the purpose of analysis include overall trend analysis, attack detection such as DDoS, and analysis of each application by application identification. The amount of information required for each purpose of analysis is determined by the frequency of packet sampling and the information items. In this embodiment, the information items are, for example, either the outer information or the inner information of an encapsulated packet, such as IPv6 over IPv4, or both. In other words, the extraction device has a function of extracting the packet inside the capsule from the encapsulated packet and converting it into an analyzable format.

[0015] In this way, the extraction device 10 can transmit the amount of flow statistical information required depending on the purpose of analysis to a single flow collector 30. This eliminates the need for multiple flow collectors, and makes it easy to collect flow statistical information with a reduced amount of information depending on the purpose at low cost.

[0016] [Configuration of Extraction Apparatus] Fig. 2 is a schematic diagram illustrating the general configuration of an extraction apparatus according to this embodiment. As illustrated in Fig. 2, an extraction apparatus 10 according to this embodiment is realized by a general-purpose computer such as a personal computer, and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0017] The input unit 11 is realized using input devices such as a keyboard and a mouse, and inputs various instruction information such as a command to start processing to the control unit 15 in response to input operations by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, etc. For example, the output unit 12 displays the results of the extraction process described below.

[0018] The communication control unit 13 is realized by a network interface card (NIC) or the like, and controls communication between the control unit 15 and external devices via telecommunication lines such as a local area network (LAN) or the Internet. For example, the communication control unit 13 controls communication between the control unit 15 and the network device 20 to be processed, a flow collector 30 that analyzes flow statistical information generated in an extraction process described later, and the like.

[0019] The storage unit 14 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores in advance the processing program that operates the extraction device 10, data used during execution of the processing program, and the like, or temporarily stores the data each time processing is performed. The storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13. In this embodiment, the storage unit 14 stores header sample information 14a, flow statistical information 14b, and the like that are generated in the extraction process described below.

[0020] The control unit 15 is realized using a CPU (Central Processing Unit), an NP (Network Processor), an FPGA (Field Programmable Gate Array), or the like, and executes a processing program stored in memory. As a result, the control unit 15 functions as a collection unit 15a, a selection unit 15b, and a generation unit 15c, as illustrated in FIG. 2, to execute the extraction process. Note that these functional units may be implemented individually or in part on different hardware. For example, the collection unit 15a may be implemented on hardware different from the other functional units. The control unit 15 may also include other functional units.

[0021] The collection unit 15a collects packets circulating through a predetermined network device 20. Specifically, the collection unit 15a collects packets at a predetermined frequency from the network device 20 to be processed via the input unit 11 or the communication control unit 13. The collection unit 15a also extracts information from the collected packets using, for example, IPFIX, and adds the extracted header sample information 14a to the packets, which are then stored in the storage unit 14.

[0022] 3 and 4 are diagrams for explaining the extraction process. In the example shown in Fig. 3, the collection unit 15a collects IPv4 over v6 packets and extracts header sample information 14a from the collected packets using IPFIX. As shown in Fig. 3, the collection unit 15a adds IPFIX to the header sample information 14a.

[0023] The collection unit 15a may transfer this information to the selection unit 15b described below without storing it in the storage unit 14.

[0024] Returning to the explanation of FIG. 2 , the selection unit 15b selects predetermined information items from the collected packets at a predetermined frequency according to the intended use. Specifically, the selection unit 15b selects predetermined information items from the header sample information 14a of the collected packets at a predetermined frequency set according to the intended use. Here, examples of the intended use include overall trend analysis, attack detection such as DDoS, and analysis for each application by application identification.

[0025] Examples of the predetermined frequency include a period (interval) of selecting one out of every 10 pieces of collected header sample information, one out of every five pieces of header sample information, or all of the header sample information.

[0026] The predetermined information item is, for example, at least one of the outer information and inner information of an encapsulated packet, such as IPv6 over IPv4, etc. That is, as described above, the extraction device 10 has a function of extracting the packet inside the capsule from an encapsulated packet and converting it into an analyzable format.

[0027] 3 illustrates the process (resampling process) of the selection unit 15b. In the example illustrated in FIG. 3, for example, for overall trend analysis, only outer information is selected with a frequency of 1 / 10. For DDoS detection, both outer information and inner information are selected with a frequency of 1 / 5. For application identification, only inner information is selected with a frequency of all header sample information.

[0028] In this way, resampling (selection) is performed by limiting the amount of information to only that required for the purpose of analysis. The resampling frequency and information items can be set by an administrator through configuration settings. Alternatively, the selection unit 15b may be configured to be able to change the predetermined frequency and predetermined information items depending on the purpose.

[0029] Returning to the explanation of FIG. 2, the generation unit 15c generates predetermined flow statistical information according to the intended use using the selected predetermined information items. Specifically, the generation unit 15c generates information necessary for analysis as flow statistical information from the header sample information 14a of the collected and selected packets according to the intended use of the analysis. Here, the flow statistical information refers to a portion of the header sampling information of the collected and selected packets, traffic statistical information derived from the header sampling information, etc.

[0030] Furthermore, the generating unit 15c distinguishes each of the predetermined flow statistical information according to the generated purpose and transmits it to the flow collector 30. For example, the generating unit 15c attaches a tag that can identify the purpose to each piece of flow statistical information, thereby distinguishing each piece of flow statistical information and transmitting it to a single flow collector 30.

[0031] Here, Fig. 4 illustrates the processing (flow statistical information generation processing) of the generation unit 15c. In the example shown in Fig. 4, flow statistical information is generated for each application using selected header sample information according to the frequency and information items set in the resampling processing by the selection unit 15b. For example, for overall trend analysis, flow statistical information is generated using only outer information with a frequency of 1 / 10. For DDoS detection, flow statistical information is generated using both outer information and inner information with a frequency of 1 / 5. For application identification, flow statistical information is generated using only inner information of all header sample information.

[0032] In this way, by generating flow statistical information from header sample information with an amount of information that is restricted according to the purpose of analysis, it is possible to reduce the processing load.

[0033] [Extraction Process] Next, the extraction process performed by the extraction device 10 according to this embodiment will be described with reference to Fig. 5. Fig. 5 is a flowchart showing the extraction process procedure. The flowchart in Fig. 5 starts, for example, when the user performs an operation input to instruct the start of the process.

[0034] First, the collection unit 15a collects packets circulating through a predetermined network device 20 (step S1). Specifically, the collection unit 15a collects packets at a predetermined frequency from the network device 20 to be processed via the input unit 11 or the communication control unit 13. The collection unit 15a also extracts information from the collected packets using, for example, IPFIX, and adds the extracted header sample information 14a to the packets, which are then stored in the storage unit 14.

[0035] Next, the selection unit 15b selects predetermined information items from the collected packets at a predetermined frequency according to the intended use (step S2).

[0036] Here, the term "use" refers to, for example, overall trend analysis, attack detection such as DDoS, analysis for each application by application identification, etc. The predetermined frequency refers to, for example, one out of every 10 pieces of collected header sample information, one out of every five pieces of header sample information, or the period (interval) for selecting all the header sample information, etc. The predetermined information item is, for example, either the outer information or the inner information of an encapsulated packet, such as IPv6 over IPv4, or both.

[0037] As a result, for example, the selection unit 15b selects only the outer information with a frequency of 1 / 10 for overall trend analysis, selects both the outer information and the inner information with a frequency of 1 / 5 for DDoS detection, or selects only the inner information with a frequency of all header sample information for application identification.

[0038] Next, the generating unit 15c generates predetermined flow statistical information according to the intended use using the selected predetermined information items (step S3). Specifically, the generating unit 15c extracts information necessary for analysis as flow statistical information using the selected header sample information in accordance with the settings of the frequency and information items of the resampling process by the selecting unit 15b.

[0039] For example, for overall trend analysis, the generation unit 15c generates flow statistics using only outer information with a frequency of 1 / 10. For DDoS detection, the generation unit 15c generates flow statistics using both outer information and inner information with a frequency of 1 / 5. For application identification, the generation unit 15c generates flow statistics using only inner information of all header sample information.

[0040] The generating unit 15c then distinguishes each of the predetermined flow statistical information according to the generated purpose and transmits it to the flow collector 30 (step S4). For example, the generating unit 15c assigns a tag that can identify the purpose to each flow statistical information, thereby distinguishing each piece of flow statistical information and transmitting it to a single flow collector 30. This completes the series of extraction processes.

[0041] [Effects] As described above, in the extraction device 10 of this embodiment, the collection unit 15a collects packets circulating through a predetermined network device 20. The selection unit 15b selects predetermined information items from the collected packets at a predetermined frequency according to the intended use.

[0042] Specifically, the predetermined information item is at least one of the outer information and the inner information of the encapsulated packet.

[0043] This makes it possible to easily collect flow statistical information with a reduced amount of information depending on the purpose of analysis at a reduced cost.

[0044] The generation unit 15c generates predetermined flow statistical information according to the intended use by using the selected predetermined information items. In this way, by generating flow statistical information from header sample information with an amount of information suppressed according to the intended use of analysis, it is possible to suppress the processing load.

[0045] Furthermore, the generating unit 15c distinguishes between the generated predetermined flow statistical information according to the intended use and transmits them to the flow collector 30. This makes it possible to collect flow statistical information with a single flow collector 30 while keeping costs down.

[0046] [Program] A program written in a computer-executable language may be created to execute the processes performed by the extraction device 10 according to the above embodiment. In one embodiment, the extraction device 10 can be implemented by installing an extraction program that executes the extraction process as package software or online software on a desired computer. For example, by executing the extraction program on an information processing device, the information processing device can function as the extraction device 10. The information processing device referred to here includes desktop and notebook personal computers. Other examples of information processing devices include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants). The functions of the extraction device 10 may also be implemented on a cloud server.

[0047] 6 is a diagram showing an example of a computer that executes an extraction program. The computer 1000 includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0048] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to a display 1061, for example.

[0049] Here, the hard disk drive 1031 stores, for example, an OS (Operating System) 1091, an application program 1092, a program module 1093, and program data 1094. The various pieces of information described in the above embodiments are stored in the hard disk drive 1031 or the memory 1010, for example.

[0050] The extraction program is stored in the hard disk drive 1031 as a program module 1093 in which instructions to be executed by the computer 1000 are written. Specifically, the program module 1093 in which each process executed by the extraction device 10 described in the above embodiment is written is stored in the hard disk drive 1031.

[0051] Furthermore, data used for information processing by the extraction program is stored as program data 1094, for example, in the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as necessary, and executes each of the above-described procedures.

[0052] The program module 1093 and program data 1094 related to the extraction program are not limited to being stored in the hard disk drive 1031, and may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1041. Alternatively, the program module 1093 and program data 1094 related to the extraction program may be stored in another computer connected via a network such as a LAN or a WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0053] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention.

[0054] REFERENCE SIGNS LIST 10 Extraction device 11 Input unit 12 Output unit 13 Communication control unit 14 Storage unit 14a Header sample information 14b Flow statistical information 15 Control unit 15a Collection unit 15b Selection unit 15c Generation unit 20 Network device 30 Flow collector

Claims

1. An extraction device comprising: a collection unit that collects packets circulating through a specified network device; and a selection unit that selects specified information items from the collected packets at a specified frequency according to the intended use.

2. The extraction device according to claim 1, wherein the predetermined information item is at least one of outer information and inner information of an encapsulated packet.

3. The extraction device according to claim 1, further comprising a generation unit that generates predetermined flow statistical information according to said intended use by using said selected predetermined information items.

4. The extraction device according to claim 3, characterized in that the generating unit distinguishes between the generated predetermined flow statistical information corresponding to the intended use and transmits them to a collector.

Images