JP2945938B2 - Network fraud analysis method, network fraud analysis device using the same, and computer-readable recording medium recording network fraud analysis program - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network fraud analysis method, an apparatus using the same, and a computer-readable recording medium recording a network fraud analysis program. More specifically, the present invention analyzes whether or not data communicated in a network configured to perform communication according to a layered protocol between information communication stations is fraudulent, and checks network security. The present invention relates to a network unauthorized analysis method capable of performing network management and network management, an apparatus using the same, and a computer-readable recording medium storing a network unauthorized analysis program.

[0002] In the present specification, "illegal" in a network means so-called unauthorized access such as cracking.

[0003]

2. Description of the Related Art Conventionally, in a system configured to exchange data between information stations, there have been provided various analysis methods for analyzing whether or not the exchanged data is fraudulent.

First, as a first prior art of the above-mentioned analysis method, for example, it operates on a transport layer (transport layer) of a seven-layer model, receives communication contents from the transport layer, and operates the operating system. An analysis system has been proposed which uses a prepared function to check the source and determine whether or not the source is a registered source that should be permitted (TCP).
WRAPER; Mar 19 1996).

A second prior art of the above analysis method is software which does not use a network communication function, and which uses a predetermined compression method to compress the contents of a huge hard disk and periodically In some cases, unauthorized access to the hard disk is detected by comparing whether the content stored in the hard disk matches the current compressed content (The Design and Implementation of Tripwire).
Feb 23 1995).

Further, as a third conventional technique of the above-mentioned analysis method, a typical fraudulent (cracking) method is stored, and the method is executed on a system to be analyzed, whereby the method is executed. There is one that checks for fraudulent systems (Satan-network securi
ty scanner).

A fourth prior art of the analysis method is to analyze, for each host computer, whether or not there is a setting for cracking by network communication rather than network communication itself. Some of the settings are checked for security risks using operating system commands (COPS; Nov 171991).

A fifth prior art of the above analysis method is as follows.
Checks whether the password of the user used in UNIX is valid, and has a candidate file of the password, encrypts the candidate word, and creates an encrypted word created as a result of the encryption. There is a system that compares the password with the encrypted password and searches for the password by using the fact that the encrypted word is the password if they match (Crac
k Version 4.1; Mar 3 1992).

A sixth prior art of the above analysis method is as follows.
There is one that analyzes physical layer packets (Sniffer
).

A seventh prior art of the above analysis method is a network diagnosis system for performing communication between information stations according to a hierarchical protocol, wherein a service data unit provided from a lower layer filter is provided. There is one that analyzes according to an analysis instruction from input control and creates and provides a service data unit for an upper layer filter (Japanese Patent Laid-Open No. 4-315343).

[0011]

However, according to the first prior art, only data is received from the transport layer and not data from other layers. There are disadvantages that are not enough for analysis. In addition, since the data is reconstructed by the function of the operating system, there is a disadvantage that it is not enough for analyzing the fraud.

According to the second prior art, since it does not have a network communication function, there is a drawback that data of network communication cannot be illegally analyzed.

Furthermore, according to the first and second prior arts, a program for implementing the analysis method is designed to be installed for each monitored host computer or host station (hereinafter simply referred to as "host"). Therefore, it cannot cope with an increase in the number of hosts.

According to the third to fifth prior arts described above, a new analysis is designed for each analysis protocol, so that it is impossible to cope with an increase in the number of protocols.

Further, according to the sixth prior art, since the analysis is performed in units of physical layer packets, it is not possible to analyze in application layer sessions which are indispensable for cracking analysis.

On the other hand, according to the seventh prior art, the filtering and diagnosis of the data of the layer are performed by the same module for each layer of the protocol. There was a drawback that fraud could not be analyzed, and fraud analysis was not sufficient.

Accordingly, a first object of the present invention is to provide a network unauthorized analysis method capable of handling arbitrary data including an application session, a network unauthorized analysis apparatus using the method, and a computer recording a network unauthorized analysis program. It is to provide a readable recording medium.

A second object of the present invention is to deal with arbitrary communication between networks and to easily deal with an increase in the number of protocols, a network unauthorized analysis apparatus and a network unauthorized analysis apparatus using this method. An object of the present invention is to provide a computer-readable recording medium on which an analysis program is recorded.

Further, a third object of the present invention is to provide a network unauthorized analysis method capable of handling an arbitrary protocol, a network unauthorized analysis apparatus using the method, and a computer-readable recording medium storing a network unauthorized analysis program. Is to provide.

[0020]

In order to achieve the first to third objects, the invention according to claim 1 is constructed so that communication is performed between information communication stations by using a hierarchical protocol. A network fraud analysis method for analyzing fraud in a network, the data collecting step of capturing a packet transmitted on the network,
The parameters of the layering module according to the layered protocol are set based on the information specified in the configuration file that has been read in advance, and the packets from the data collection process are filtered by each layering module and the Set the segmented data in advance
Data analysis process to create analysis data by rebuilding to the specified hierarchy, and judge if the analysis data from the data creation process is invalid based on the contents specified in the configuration file read in advance And a data analysis step.

Therefore, in the data creation step, the packets from the data collection step are filtered by each hierarchical module, and the data obtained by segmenting the packets is stored in advance.
Since the analysis data is created by rebuilding up to the set hierarchy , in the data analysis process, the analysis data after the rebuilding that is meaningful as data is to be analyzed. For this reason, it is possible to easily determine the fraud that has occurred in the data portion.

In particular, since fraud in the network often occurs in the data portion, it is effective to analyze this data portion. However, since the data portion is subdivided in the packet transmitted on the network, ,
It is difficult to determine whether the data portion has been fraudulent. On the other hand, in the present invention, since the meaningful data after the reconstruction is to be analyzed, it can be easily determined whether or not the data portion has been fraudulent.

According to a second aspect of the present invention, there is provided a network fraud analyzing apparatus for analyzing fraud in a network constructed to perform communication according to a layered protocol between information communication stations. A data collection unit that captures the packet transmitted by the data collection unit, and sets the parameters of the layered module according to the layered protocol based on the information specified in the configuration file that has been read in advance, and from the data collection unit. Of each packet is filtered by each layering module, and the fragmented data of the packet is set in advance.
Whether the analysis data from the data creation unit based on the contents specified in the configuration file that has been read in advance and the data creation unit that creates the analysis data by rebuilding to the specified hierarchy is incorrect And a data analysis unit for determination.

Therefore, in the data creating section, the packet from the data collecting section is filtered by each hierarchical module, and the data segmented into the packet is set in advance.
Since the analysis data is created by reconstructing the data to the specified hierarchy , the data analysis unit analyzes the reconstructed analysis data that is meaningful as data. For this reason,
Fraud that has occurred in the data portion can be easily determined.

Further, the invention according to claim 3 provides a data collection procedure for taking in a packet transmitted on a network constructed so as to perform communication according to a layered protocol between information communication stations, The parameters of the layering module corresponding to the specified protocol are set based on the information specified in the configuration file that has been read in advance, and the packets from the data collection procedure are filtered by each layering module to fragment the packet. A data creation procedure for creating analysis data by reconstructing the pre-set data to a preset hierarchy, and a data creation procedure based on the contents specified in the configuration file read in advance. Compile data analysis procedures to determine whether fraud has occurred in the analysis data. And a computer-readable recording medium storing a program to be executed by the over data.

Therefore, by reading and installing the program stored in the recording medium by the computer, or by executing the program as it is, it is possible to easily determine the fraud that has occurred in the data portion during the network transmission.

[0027]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The configuration of the present invention will be described below in detail based on an example of an embodiment shown in the drawings. In FIG.
1 shows an example of a network system to which a network unauthorized analysis method according to the present invention is applied.

In FIG. 2, reference numeral 1 denotes a private network (hereinafter referred to as "LAN").
Is connected to a buffer band network 3 via a router 2. This buffer band network 3 is connected to an external network 7 via a router 6.

In this embodiment, the LAN 1 includes a plurality of stations (not shown), a network (not shown) connecting these stations, and an external connection line 11 connected to the outside. This external connection line 11 is connected to the router 2. However, the LAN 1 is not limited to the one described above, and may be a single station.

The buffer band network 3 includes a network fraud analysis system 50 for realizing the network fraud analysis method according to the present invention, a common bus 51, and an external connection line 5.
2, 53. Network Fraud Analysis System 5
0 is connected to the common bus 51. External connection line 5
2 connects the router 2 and the common bus 51. The external connection line 53 connects the common bus 51 and the router 6.

The network fraud analysis system 50
Is composed of a computer system as in a conventional network unauthorized analysis system. Although not shown, the computer system includes, for example, a central processing unit that executes various types of arithmetic processing, a main storage device that stores programs and data required for executing the arithmetic processing, and an input / output port. And various interfaces such as, for example, a hard disk drive device for storing various data and constants necessary for executing a program for realizing the network unauthorized analysis system and its processing, and an input device for inputting data and necessary commands And an output device for outputting a result processed by the central processing unit.

FIG. 3 shows an embodiment of a network unauthorized analysis method according to the present invention. In FIG. 3, the network fraud analysis system 50 is realized by a central processing unit processing a program stored in a main storage device, and uses a protocol layered between information communication stations. This is a system for analyzing fraud in a network constructed to perform communication. That is, the network fraud analysis system 50
Is analyzed by, for example, a data collection unit 55 that executes a data collection step of taking in a packet PT transmitted through the buffer band network 3, and filtering and reconstructing the packet PTa from the data collection unit 55 by each hierarchical module. A data creation unit 56 for executing a data creation process for creating the data DT, and a data analysis unit for executing a data analysis process for determining whether or not the analysis data DT from the data creation unit 56 is invalid and outputting an analysis result CDC And a part 57.

FIG. 1 shows a network unauthorized analysis system 5.
0 shows a detailed configuration. In FIG. 1, the data collection unit 55 includes, for example, a data collection processing unit 551 that captures a packet PT transmitted between the buffer networks 3.
And a data collection control unit 552 for controlling the data collection processing of the data collection processing unit 551.
The data collection processing unit 551 supplies the collected packets PT to the data creation unit 56.

The data creation unit 56 sets the parameters of the layered module according to the layered protocol based on the information specified in the configuration file which has been read in advance. The PTa is filtered by each layering module, and the fragmented data of the packet PTa is converted into the original unit ,
In advance, for example, using a configuration file
This is to execute a data creation step of creating the analysis data DT by reconstructing the analysis data DT up to the specified arbitrary hierarchy .

The data creation section 56 is roughly composed of a hierarchical module 561 and a control management section 562 for controlling and managing the module. Control management unit 562
Can set the parameters of the layering module 561 according to the layered protocol based on the information specified in the configuration file that has been read in advance. Also, the hierarchical module 561 can create the analysis data DT by filtering the packet PTa from the data collection unit 55 based on the setting and reconstructing the fragmented data of the packet PTa into the original unit. Has become.

The layering module 561 includes one-layer modules 61 ₁ ,..., K-layer modules 61 _k ,.
And a plurality of layer modules consisting layer module 61 _N. Here, N is an arbitrary integer, and k is an arbitrary integer between 1 and N.

The first layer module 61 _1, depending on the contents of the read configuration file, first layer filter 61 _1A and 1 layer reconstruction unit 61 _1B is formed. In the k-layer module 61 _k , a k-layer filter 61 _kA and a k-layer reconstructing unit 61 _kB are configured according to the content of the read configuration file. In the N-layer module 61 _N , an N-layer filter 61 _NA and an N-layer reconstructing unit 61 _NB are configured according to the contents of the read configuration file. Then, each layer module 61 ₁ ,.
1 _k, ..., 61 _N are processed in the order from 1 to N.

The control management unit 562, each layer module _{61 1, ..., 61 k,} ..., a data generation control unit 62a that creates data in 61 _N, each layer module 6
_{1 1, ..., 61 k,} ..., and a memory controller 62b for controlling storage of data in the 61 _N, the analyzer management unit 62c for outputting the analysis data DT. Then, the control management unit 562, first layer module 61 _1, ..., k layer module 61 _k, ..., to control and manage the N layer module 61 _N, respectively.

The data analysis unit 57 determines whether or not the analysis data DT from the data creation unit 56 is illegal based on the contents specified in the configuration file read in advance, and outputs the analysis result CDC. The data analysis step is performed.

The data analyzer 57 is provided with an application analyzer 570 for analyzing whether data in the session of the application layer is invalid. And this application analyzer 570
Analyzes whether the filtered and reconstructed data DT is correct based on the contents described in the configuration file read in advance.

FIG. 4 shows an example of a configuration file. In FIG. 4, the configuration file 500 includes data from the data creation unit 56 to the data analysis unit 5.
The information for designating the data DT to be passed to 7 and the information to be analyzed by the data analysis unit 57 can be written therein. For example, the contents shown in FIG. 4 can be described.

FIG. 5 shows an open system interconnection (OS
I: Open System Interconnection (7) model. The hierarchical model 800 shown in this figure is obtained by layering the communication functions of the release system into seven layers, and includes a physical layer 801, a data link layer 802, a network layer 803, a transport layer 804, a session layer 805, and a presentation. Layer 806,
The application layer 807 is hierarchized.

The physical layer 801 defines physical conditions and electrical conditions required for bit transmission. The data link layer 802 defines a data transmission error control procedure and the like. The network layer 803 is for enabling data exchange between the systems at both ends via various communication networks such as public packet switching. The transport layer 804 is for performing transparent and reliable data transfer between the systems at both ends. The session layer 805 is used for synchronization, selection of a transmission mode, and control of a transmission right in order to efficiently perform interaction between application processes at both ends. The presentation layer 806 is for controlling the data format so that the data handled by the application processes at both ends can be transferred accurately and efficiently. The application layer 807 is for executing an application service request such as a file transfer, a message communication processing system, a lower terminal, and a remote database access according to various applications executed by the user.

The operation of the network unauthorized analysis system 50 thus configured will be described with reference to FIGS. FIG.
2 shows a flowchart for explaining the operation of the system 50. 7 and 8 show examples of the contents of data processed by the system.

Here, a plurality of data packets, such as communication data 90a, 90, for constructing one meaningful information or data on the common bus 51 of the buffer zone network 3.
It is assumed that b, 90c, and 90d are flowing.

The communication data 90a, 90b, 90
c and 90d are, for example, as shown in FIG.
a, 91b, 91c, 91d and transmission source IDs 92a, 92
2b, 92c, 92d, and in order 93a, 93b, 93
c, 93d and data 94a, 94b, 94c, 94d
It is composed of

The communication data 90a transmitted on the common bus 51 is configured as follows. That is, for example, the data 95 in the application layer “I am a cracker.” Is subdivided (step (S) 21), and the data 94b “I am” and “a
c) and data 94 “rac”
a and data 94c “ker.”. The communication data 90a, 90b, 90c, and 90 are further subdivided (S22) and have headers.
d, which are transmitted on the network by the hierarchical model 800 shown in FIG. The data unit on the buffer band network 3 is the communication data 90a, 90
0b, 90c, and 90d. This data unit is transmitted on the common bus 51 of the buffer band network 3.

As shown in FIG.
The system 50 reads the configuration file
(S11). As a result, the data creation unit 56
Ear module 61₁One-layer filter 61_1AAnd 1
Layer reconstruction unit 61_1B, ..., k layer module 61_k
K layer filter 61_kAAnd k-layer reconstruction unit 6
1 _kB, ..., N layer module 61_NN layer fill
TA 61_NAAnd N-layer reconstruction unit 61_NBThe data analysis
Data to be passed to the unit 57, filtering and rebuilding
Parameters related to data are set. Also, this
The data analysis unit 57
The content to be analyzed is set in.

Here, the value of N is determined depending on which layer of the hierarchical model 800 shown in FIG. 5 is reconstructed as data. In the present embodiment, the rebuilding is performed up to the application layer session as N = 7. However, it is not limited to N = 7. For example, it is possible to reconstruct up to N = 3 in network layer session units.
In any case, it can be set to reconstruct even the session unit required for data analysis.

Next, under the control of the data collection control unit 552, the data collection unit 55 transmits one packet (for example, the communication data 9) of the packet PT transmitted on the common bus 51.
0a) (S12), and the one packet is copied to a work area in a main storage device or a hard disk drive of the computer system (S1).
3). Thus, the copied one packet was in the working area, incorporated into the first layer module 61 _in the hierarchy module 561, by executing the first layer first processing in accordance with the information of the configuration file layer the next layer Transfer to the module (S14). In the first layer module 61 _1, the values in the various fields of the header portion of the packet, and compares with the filter pass parameters specified in the configuration file, the data specified in the configuration file select Execute processing or pass-through processing. Also,
The data is not changed in the filter passage processing.

[0051] Then, 1 each layer module of the lower layer module 61 _1, respectively executes processing in accordance with the content of the above as well as configuration files.

[0052] The results of the previous module of the k-layer module 61 _k has processed k layer module 61 _k receives.

Here, each layer module 61 ₁ ,.
Since the same processing is executed in 61 _k ,..., 61 _N ,
As an example, the k-layer module 61 _k will be described in detail.

The k-layer module 61 _k operates according to the information of the configuration file read in advance.
Whether to pass the received data through the k-layer filter 61 _kA , whether to operate the k-layer reconstruction unit 61 _kB ,
Alternatively, since a parameter for setting whether to pass reconstructed or non-reconstructed data to the data analyzer 57 is set, the process is executed according to the setting of the parameter (S
15).

For example, in the configuration file
Suppose each parameter is set by specifying information.
Then, the k-layer module 61_kNow, the upper layer model
The data resulting from the processing by Joule is a k-layer filter 6
1_kA(S151; YES), and then
When rebuilding the data (S152; YES), the buffer
And rebuild using the application (S153).
If rebuilding to data at the layer level is not completed
(S154; NO), k-layer module 61 _kThrough
You. Then, the next packet is read (S12).

Further, reconstructing is performed using the buffer (S1).
53) If the reconstruction is completed (S154; YES), the data is stored in the buffer of the k-layer reconstruction unit _61kB . In this case or when the data is not to be reconstructed (S152; NO), when it is time to pass the reconstructed data to the data analyzer 57 (S15)
5; YES), the data stored in the buffer of the k-th layer restructuring unit 61 _kB is passed to the data analyzing unit 57 (S15).
6). When it is time not to pass the data to the data analysis unit 57 (S155: NO), the data is passed to the layer module of the layer above it.

[0057] Thus, k layer module 61 results processed by the upper layer module than _k, is reconstructed as shown in FIG. 8 (S23), the data 94a of "rac" is data analysis as divided data Cross over to section 57.

By repeating the above process for each packet (S13 to S16), the packet PT in the data unit on the network is reconstructed as shown in FIG. 8 (S23), and the data "I am" 94b and "ac"
Data 94d and "rac" data 94a
And data 94c “ker.”. Further, it is reconstructed (S24) and "I am ac
racker. "is the original data 95 in the application layer.

Assuming that each parameter is set in the lower layer module according to the information of the configuration file as described above, the N layer filter 6
Data passes up to 1 _N.

The N-layer filter 61 _N processes the received data according to the parameters set by the information of the configuration file as described above, and passes it to the data analysis unit 57 as analysis data DT (S16).

Using this flowchart,
By setting a plurality of types of filters, an unauthorized access such as a plurality of types of cracking can be simultaneously monitored.

The data analysis section 57 determines whether or not the analysis data DT from the data creation section 56 has an error based on the contents specified by the configuration file read in advance by the application analyzer 570. The result determined by the application analyzer 570 is displayed on a display as a screen 900 as shown in FIG.

Here, the application analyzer 57
0 indicates that one or both of the following are used for the fraud analysis processing. However, it is a matter of course that the present invention is not limited to these processing methods.

(I) It is checked what kind of operation can be executed by using the protocol of interest, and the procedure is described in the configuration file for the application analyzer 570.
Is compared with the procedure described in the configuration file, and if they match, the communication is determined to be invalid and a determination process is executed.

(Ii) Files, programs, and the like that need to be strictly managed in order to ensure security are described in the configuration file for the application analyzer 570, and when the described resources change. Then, a process for determining that the communication is unauthorized is performed.

The above-described network unauthorized analysis system 5
According to 0, for example, the following fraud (cracking) can be prevented.

(1) Guess the sequence number of the TCP protocol, secure a fake session, and illegally access the file of the target host.

(2) Using the SMTP protocol DEBUG command to illegally access the file of the target host.

(3) Rewrite the security management file of the attacking host using MIME so that the attacking host can log in without a password.

(4) To send a large amount of e-mails and news beyond the processing capability of the target host to paralyze the network function.

(5) Attempt to access a distinguished account such as root, guest, etc., guess the password appropriately, and attempt login using the telnet protocol.

(6) Using the TFTP protocol to access files on the target host without a password.

According to the network unauthorized analysis system 50 of the present embodiment configured as described above, there are the following advantages.

(1) The session up to the application layer can be reconstructed, and data that can be easily understood by a person who performs an illegal analysis can be handled. That is, it is difficult to analyze the data in the packet on the network because the data is fragmented. However, the network unauthorized analysis system 50 of the present embodiment reconstructs the session up to the application layer. The analysis data can be meaningful data. This makes it possible to easily determine the presence or absence of fraud in the data. Moreover, since most fraud on the network occurs in the data portion, by detecting fraud in the data portion, efficient fraud analysis can be performed.

(2) By complete modularization for each layer,
It can handle multiple types of protocols. That is, the network protocol can be modeled like a hierarchical model 800 shown in FIG. 5, and the network fraud analysis system 50 of the present embodiment executes fraud analysis using this model based on the settings of the configuration file. Therefore, even if a new protocol is developed, it can be dealt with by changing only some of the layer modules in charge of the layer corresponding to the new protocol of the configuration file and data creation unit 56. For this reason, it is not necessary to change the entire data creation unit 56 in order to make the data creation unit 56 correspond to the newly developed protocol, so that it is possible to easily cope with an increase in the number of protocols.

(3) Since the fraud analysis by the data analysis unit is performed based on the detection method described in the configuration file, the occurrence of a new type of fraud can be determined only by changing the description of the configuration file. Can be detected without changing the software itself.

(4) Arbitrary communication can be handled by combination with the buffer band network 3. For example, when there are a plurality of stations on the LAN 1 and a plurality of external networks 7, unauthorized analysis can be performed on an arbitrary source and destination.

(5) Since the buffer band network 3 is independent of the host, it can easily cope with an increase in the number of hosts.

The above embodiment is an example of a preferred embodiment of the present invention, but the present invention is not limited thereto, and various modifications can be made without departing from the gist of the present invention. For example, as shown in FIG. 10, the network unauthorized analysis system 50 can be provided with a plurality of network interfaces to be multi-homed. For example, 2
When connected to separate networks 4 and 5 with one network interface, communication between the LAN 1 and the external network 7 always passes through the inside of the network unauthorized analysis system 50. For this reason,
The collection of packets in the network unauthorized analysis system 50 can be performed without fail. This makes it possible to detect fraud in the network with high accuracy.

As shown in FIG. 11, the network unauthorized analysis system 50 may be multihomed, and the analysis result may be fed back from the data analysis unit 57 to the data collection unit 55. Note that, in FIG. 11, specific illustrations of the data creation unit 56 and the data analysis unit 57 are omitted. In this case, the processing of the data collection unit 55 is changed according to the analysis result of the data analysis unit 57.
As a result, when a session or a host where an illegal act is performed can be identified as a result of the analysis, the data collection unit 55 can be controlled so that the communication does not pass through the network unauthorized analysis system 50. Therefore, it is possible to prevent unauthorized entry into the LAN 1 on the network.

Further, as shown in FIG. 12, the data creation unit 56 is provided with a layer filter 61 _1A,.
Filtering processing unit 58 having 1 _kA ,..., 61 _NA
When the layer reconstruction unit 61 _1B of the layer structure, ..., 61 _kB, ...,
And a reconstruction processing unit 59 having 61 _NB . In this case, in the data creation unit 56, the filtering processing unit 58 collectively performs the filtering processing by the number of layers first, and then the reconstruction processing unit 59 performs the reconstruction processing for each layer. For this reason, since data that is not to be analyzed is discarded earlier, unnecessary reconstruction processing and memory occupation are eliminated, and the operation of the network unauthorized analysis system 50 can be speeded up.

Further, in each of the above-described embodiments, the network unauthorized analysis system 50 is configured by a computer system (not shown), but is not limited thereto. For example, a computer-readable recording medium storing a program for causing a computer to execute the data collection step, the data creation step, and the data analysis step of the above-described network unauthorized analysis method.
By operating a general-purpose computer using a computer-readable recording medium such as a D-ROM or a floppy disk, the network unauthorized analysis system can be executed.

The program here executes, specifically, a data collection step of taking in a packet transmitted on a network constructed so as to perform communication according to a layered protocol between information communication stations. The data collection procedure and the parameters of the layering module according to the layered protocol are set based on the information specified in the configuration file that has been read in advance, and the packet from the data collection procedure is sent to each layering module. A data creation procedure for executing a data creation step of creating analysis data by filtering and reconstructing the subdivided data of the packet to a preset level, and a configuration file specified by a configuration file which has been read in advance. Incorrect analysis data from data creation procedure based on contents It is intended to execute the data analysis procedure to perform Occurring or determines data analyzing process to the computer.

In the above-described embodiment, the data collection step, the data creation step, and the data analysis step are executed by a general-purpose computer. However, the present invention is not limited to this, and these steps are performed by an independent apparatus including a dedicated computer. It may be executed. Further, in the above-described embodiment, the data collection step, the data creation step, and the data analysis step are executed by a computer. However, the present invention is not limited to this, and these steps may be executed by a sequence circuit. In any case, in the data creation step, the analysis data is created by filtering the packets from the data collection step by each layering module and reconstructing the subdivided data of the packets to a preset layer , In the data analysis step, the analysis data after the reconstruction that is meaningful as data can be an analysis target. For this reason, it is possible to easily determine the fraud that has occurred in the data portion.

[0085]

As described above, according to the method for analyzing fraud in a network according to the first aspect of the present invention, in the data creation step, packets from the data collection step are filtered by each layering module to fragment the packets. The analysis data is created by reconstructing the set data to a preset hierarchy, and in the data analysis process, the analysis data after the reconstruction that is meaningful as data can be set as an analysis target. The generated fraud can be easily determined.

In particular, since fraud in the network often occurs in the data portion, it is effective to analyze the data portion. However, since the data portion is fragmented in packets transmitted on the network, ,
It is difficult to determine whether the data portion has been fraudulent. On the other hand, in the present invention, since the meaningful data after the reconstruction is to be analyzed, it can be easily determined whether or not the data portion has been fraudulent.

Further, according to the unauthorized analysis apparatus in the network according to the second aspect of the present invention, the data generation unit filters the packet from the data collection unit by each hierarchical module and pre-divides the data obtained by segmenting the packet.
Analysis data can be created by rebuilding up to the set hierarchy, and the data analysis unit can analyze the meaningful data after rebuilding as the analysis target, making it easy for fraud that occurred in the data part Can be determined.

Further, according to the recording medium of the third aspect of the present invention, a program for causing a computer to execute the above-described data collection procedure, data creation procedure, and data analysis procedure is read and executed by an arbitrary computer. Therefore, in the data creation procedure, the packets from the data collection procedure are filtered by each layering module, and the subdivided data of the packets is reduced to a preset layer.
In the data analysis procedure, the analysis data that has been meaningfully reconstructed can be targeted for analysis in the data analysis procedure. For this reason, it is possible to easily determine the fraud that has occurred in the data portion.

Therefore, according to the invention described in any one of the first to third aspects, the following effects can be obtained.

(1) The session up to an arbitrary layer such as the application layer can be reconstructed, and data that can be easily understood by a person who conducts unauthorized analysis can be handled. In other words, it is difficult to analyze the packet data on the network because it is fragmented. However, in the network unauthorized analysis system of this embodiment, the session up to the application layer is reconstructed. The data can be meaningful data. This makes it possible to easily determine the presence or absence of fraud in the data. Moreover, since most fraud on the network occurs in the data portion, by detecting fraud in the data portion, efficient fraud analysis can be performed.

(2) By complete modularization for each layer,
It can handle multiple types of protocols. In other words, the protocol of the network can be modeled like the hierarchical model shown in FIG. 5, and the data creation process or the data creation unit creates analysis data using this model based on the settings of the configuration file.
Even if a new protocol is developed, it can be dealt with by changing only some of the layer modules that are responsible for the layer corresponding to the configuration file and the new protocol of the data creation process or data creation unit. Therefore, it is not necessary to change the entire data creation process or the data creation unit in order to make the data creation process or the data creation unit correspond to the newly developed protocol. it can.

(3) Since the fraud analysis in the data analysis step or the data analysis unit is performed based on the detection method described in the configuration file, the occurrence of a new type of fraud is only changed by changing the description in the configuration file. Thus, the detection can be performed without changing the data analysis step or the software itself of the data creation unit.

(4) Arbitrary communication can be handled by combination with the buffer zone network. For example, when there are a plurality of LAN stations and external networks, unauthorized analysis can be performed on an arbitrary source and destination.

(5) Since the buffer band network is independent of the host, it can easily cope with an increase in the number of hosts.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of a network fraud analysis system to which a network fraud analysis method of the present invention is applied.

FIG. 2 is a block diagram showing a connection between a network unauthorized analysis system and a network.

FIG. 3 is a block diagram schematically showing an embodiment of a network fraud analysis system.

FIG. 4 is an explanatory diagram showing an example of a configuration file used in the embodiment.

FIG. 5 is a diagram illustrating an example of layering a protocol according to the embodiment;

FIG. 6 is a flowchart for explaining the operation of the embodiment.

FIG. 7 is a diagram for explaining the operation of the embodiment.

FIG. 8 is a diagram for explaining the operation of the embodiment.

FIG. 9 is a diagram showing a result of processing in the embodiment.

FIG. 10 is a block diagram showing another embodiment of the network fraud analysis system.

FIG. 11 is a block diagram showing another embodiment of the network fraud analysis system.

FIG. 12 is a block diagram showing still another embodiment of the network fraud analysis system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 LAN 3 Buffer band network 7 External network 50 Network fraud analysis system 55 Data collection unit 56 Data creation unit 57 Data analysis unit

Continuation of front page (56) References JP-A-4-315343 (JP, A) JP-A-1-274545 (JP, A) JP-A-10-242976 (JP, A) JP-A-8-88671 (JP) JP-A-5-327826 (JP, A) JP-A-4-345248 (JP, A) JP-A-61-43043 (JP, A) JP-A-1-116750 (JP, A) 1-2227552 (JP, A) JP-A-5-260132 (JP, A) JP-A-4-172720 (JP, A) Supervised by Kawasoe Hiroshi, "Fireall", Softbank, P.A. 128-9 (58) Field surveyed (Int. Cl. ⁶ , DB name) H04L 11/26

Claims (3)

(57) [Claims] 1. A method for analyzing fraud in a network constructed to perform communication according to a layered protocol between information communication stations, comprising: a data collection step of capturing a packet transmitted on the network. And setting the parameters of the layering module according to the layered protocol based on the information specified in the configuration file that has been read in advance, and filtering packets from the data collection step by each of the layering modules. A data creation step of creating analysis data by reconstructing the segmented data of the packet to a preset hierarchy, and the data based on the contents specified in the previously read configuration file. Analysis data from the creation process is invalid And a data analysis step of judging whether or not the network is illegal. 2. An apparatus for analyzing fraud in a network constructed so as to perform communication according to a layered protocol between information communication stations, the data collection unit capturing packets transmitted on the network. And setting the parameters of the layered module according to the layered protocol based on the information specified in the configuration file that has been read in advance, and filtering the packet from the data collection unit by each of the layered modules. A data creation unit for creating analysis data by reconstructing the fragmented data of the packet to a preset hierarchy, and the data based on the content specified in the configuration file read in advance. Determine whether the analysis data from the creation unit is invalid And a data analysis unit. 3. A data collection procedure for capturing a packet transmitted on a network constructed to perform communication between information communication stations according to a layered protocol, and layering according to the layered protocol. The parameters of the module are set based on the information specified in the configuration file that has been read in advance, and the packets from the data collection procedure are filtered by each of the hierarchical modules, and the subdivided data of the packets is stored in advance. Data creation procedure to create analysis data by rebuilding to the set hierarchy , and illegal occurrence of analysis data from the data creation procedure based on the contents specified in the configuration file read in advance The computer to execute a data analysis procedure Readable recording medium on which a program for recording is recorded.