JP3750803B2 - Packet log recording device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a packet log recording apparatus used in a packet path tracking system that records a packet propagating through a network and tracks the propagation path of the packet, and more particularly to a packet log recording apparatus capable of reducing the storage capacity.
[0002]
[Prior art]
On the conventional Internet, DoS (Denial of Service attack: hereinafter simply referred to as DoS) is a problem in which packets are continuously transmitted to a target to stop a service provided by the target. .
[0003]
In particular, DDoS (Distributed DoS: hereinafter simply referred to as DDoS), which performs DoS attacks on a single target simultaneously from a plurality of points, is a big problem.
[0004]
For this reason, in order to prevent such a DDoS attack or the like, a packet path tracking system that identifies the source of an illegal packet has been devised.
[0005]
FIG. 3 is a block diagram showing the configuration of an example of such a conventional packet path tracking system. In FIG. 3, 1 is a terminal operated by an attacker (attacker), 2 is a server that is a target of a DDoS attack or the like, 3 and 4 are ISPs (Internet Service Provider: hereinafter simply referred to as ISP), Reference numerals 5, 6, 7 and 8 denote routers. Reference numerals 9, 10 and 11 denote packet log recording devices for recording information of packets to propagate.
[0006]
The terminal 1 is connected to the ISP 3 via the router 5, and the ISP 3 is connected to the ISP 4 via the router 6 and the router 7. The server 2 is connected to the ISP 4 via the router 8.
[0007]
Further, a packet log recording device 9 is connected to the line between the terminal 1 and the router 5, a packet log recording device 10 is connected to the line between the router 6 and the router 7, and the server 2 and the router 8 The packet log recording device 11 is connected to the line between the two.
[0008]
Here, the operation of the conventional packet path tracking system shown in FIG. 3 will be described with reference to FIGS. FIG. 4 is an explanatory diagram illustrating an attack path of an attacker (attacker), and FIG. 5 is an explanatory diagram illustrating a packet recording state.
[0009]
As shown by “AT01” in FIG. 4, the attacker (attacker) performs a DoS attack or the like from the terminal 1 to the target server 2 via the ISP 3 and ISP 4.
[0010]
On the other hand, the packet log recording devices 9, 10 and 11 acquire packets propagating through the connected lines and sequentially record them in the storage means.
[0011]
For example, as shown by “LG11”, “LG12” and “LG13” in FIG. 5, the packet log recording devices 9, 10 and 11 acquire illegal packets propagated due to DoS attacks and sequentially record them in the storage means. .
[0012]
Then, the illegal packet received by the server 2 subjected to the DoS attack or the like is compared with the packets recorded in the packet log recording devices 9, 10, and 11, respectively, and the path through which the illegal packet propagated is specified.
[0013]
For example, since the illegal packet used in the DoS attack shown in FIG. 4 is recorded in the packet log recording devices 9, 10 and 11, the propagation path of the illegal packet as indicated by “AT01” in FIG. 4 is specified. It becomes possible to do.
[0014]
However, in order to sequentially record all information of packets propagated to the monitored line, the storage means requires a huge storage capacity, and therefore a method for efficiently holding packet information has been devised. .
[0015]
FIG. 6 is a block diagram showing a specific example of such a packet log recording apparatus, wherein 12 is an arithmetic control means, and 13 is a storage means.
[0016]
The input from the line that is the observation point is connected to the calculation control means 12, and the output of the calculation control means 12 is connected to the storage means 13.
[0017]
Here, the operation of the packet log recording apparatus shown in FIG. 6 will be described with reference to FIG. FIG. 7 is an explanatory diagram for explaining a method of recording the acquired packet.
[0018]
As shown by “LG21” in FIG. 6, a packet input from a line as an observation point is taken into the arithmetic control means 12, and a portion that is invariant during propagation is extracted from an IP (Internet Protocol) packet.
[0019]
Then, the arithmetic control means 12 converts the extracted information into a hash value using a hash function, regards this hash value as the address of the storage means 13, and sets a specific packet such as setting a bit at the corresponding address. Records that has been propagated.
[0020]
Here, the hash function is a function that generates a fixed-length pseudo-random number (hash value) from the original text, and since this hash function includes an irreversible one-way function, the original text is generated from the generated hash value. It cannot be reproduced. Also, it is extremely difficult to create different data with the same hash value.
[0021]
For example, the arithmetic control unit 12 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as indicated by “PI31” in FIG. 7, and as indicated by “HV31” in FIG. Assume that a hash value (for example, XXXXH: 16-bit hexadecimal representation) is obtained.
[0022]
In this case, the arithmetic control means 12 regards the obtained hash value (XXXXH) as the address of the storage means 13 and writes data to the address “XXXXH” as indicated by “WD31” in FIG.
[0023]
For example, it is recorded that a specific packet has been propagated by changing the data writing method from “00000000B (8-bit data)” to “00000001B” or the like (setting a bit).
[0024]
If a bit is set in the address of the storage means 13 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack or the like, the illegal packet is recorded in the packet log. This means that the device has propagated through the connected line.
[0025]
As a result, the packet log recording apparatus shown in FIG. 6 does not record all the packet information in the storage means, but records it at the address of the storage means corresponding to the hash value obtained by applying the hash function to a part of the packet. By doing (setting a bit), the storage capacity of the storage means may be small, and packet information can be efficiently held.
[0026]
[Problems to be solved by the invention]
However, although the packet log recording apparatus shown in FIG. 6 can hold packet information more efficiently than the method of recording all packet information, there is a problem in the use efficiency of the storage area of the storage means.
[0027]
That is, as shown in FIG. 7, when a storage means with a data width of 8 bits is used, only 1 bit is sufficient to indicate the presence or absence of packet propagation, so the remaining 7 bits are wasted. There was a problem that said.
[0028]
In other words, in the case of a storage means having a data width of n bits, only the “1 / n” storage area is used.
[0029]
It is also possible to monitor a plurality of observation points (lines) with one packet log recording device, and in this case, there is a problem in the utilization efficiency of the storage means.
[0030]
FIG. 8 is a configuration block diagram showing an example in which a plurality of lines are monitored by one log storage unit. In FIG. 8, 14, 15, 16, and 17 are ISPs, 18, 19, 20, 21, 22, and 23 are routers, and 24 is a packet log recording device. However, the description of the target server and the attacker's (attacker) terminal is omitted for the sake of simplicity.
[0031]
The ISP 14 is connected to the ISP 15 through routers 18 and 21, is connected to the ISP 16 through routers 19 and 22, and is connected to the ISP 17 through routers 20 and 23.
[0032]
A packet log recording device 24 is connected to the line between the router 18 and the router 21, the line between the router 19 and the router 22, and the line between the router 20 and the router 23.
[0033]
In the case of the packet log recording device 24 as shown in FIG. 8, the configuration as shown in FIG. 6 is required for each observation point (line), and three storage means are separately required as the storage means. There was a problem that said.
[0034]
In the case where such three storage units are also storage units having a data width of n bits, only the “1 / n” storage area is used.
Therefore, the problem to be solved by the present invention is to realize a packet log recording apparatus system capable of reducing the storage capacity.
[0035]
[Means for Solving the Problems]
In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording information of the packet; and taking a packet propagating through one of the plurality of observation points, extracting a portion that is invariant during propagation, applying a hash function, and converting the packet at the observation point to the hash value The memory capacity of the packet log recording device for recording packet contents can be reduced by comprising a plurality of operation control means for allocating and recording each bit of the address data of the storage means indicated by Thus, it is possible to improve the utilization efficiency of the storage area of the storage means.
[0036]
The invention according to claim 2
In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording the information of the packet, a plurality of packets propagating through the plurality of observation points, respectively, extracting portions that are invariant during propagation and applying a hash function to each of the packets at the observation points, It is possible to reduce the storage capacity of the packet log recording apparatus for recording packet contents by comprising arithmetic control means for allocating and recording each bit of the address data of the storage means indicated by the hash value. Thus, it is possible to improve the utilization efficiency of the storage area of the storage means.
[0041]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of a log recording device of a packet path tracking system according to the present invention.
[0042]
In FIG. 1, 25, 26 and 27 are arithmetic control means, and 28 is a storage means. Inputs from lines (not shown) as a plurality of different observation points are connected to the calculation control means 25, 26 and 27, and outputs of the calculation control means 25, 26 and 27 are connected to the storage means 28.
[0043]
Here, the operation of the packet log recording apparatus shown in FIG. 1 will be described with reference to FIG. FIG. 2 is an explanatory diagram for explaining a method of recording the acquired packet. However, the description of the basic operation of the packet path tracking system described in the conventional example is omitted.
[0044]
As shown by “LG41”, “LG42”, and “LG43” in FIG. 1, packets input from each line are taken into arithmetic control means 25, 26, and 27, respectively, and are being propagated in IP (Internet Protocol) packets. Extract parts that are invariant to.
[0045]
Then, the arithmetic control means 25, 26 and 27 convert the extracted information into respective hash values using a hash function, regard these hash values as addresses of the storage means 28, and specify the corresponding address. Records that a specific packet has been propagated, such as by setting a bit.
[0046]
For example, the arithmetic control means 25 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as shown by “PI51” in FIG. 2, and as shown by “HV51” in FIG. Assume that a hash value (for example, XXXXH: 16-bit hexadecimal representation) is obtained.
[0047]
In this case, the arithmetic control unit 25 regards the obtained hash value (XXXXH) as the address of the storage unit 28 and sets the most significant bit (MSB) of the address “XXXXH” to “WD51” in FIG. Write data as shown.
[0048]
Similarly, for example, the arithmetic control unit 26 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as indicated by “PI52” in FIG. Assume that a hash value (XXXXH) as shown is obtained.
[0049]
In this case, the arithmetic control means 26 regards the obtained hash value (XXXXH) as the address of the storage means 28, and the sixth bit from the least significant bit of the address “XXXXH” is indicated by “WD52” in FIG. Write data.
[0050]
Further, for example, the arithmetic control means 27 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as indicated by “PI53” in FIG. 2, and is indicated by “HV53” in FIG. Assume that such a hash value (XXXXH) is obtained.
[0051]
In this case, the arithmetic control means 27 regards the obtained hash value (XXXXH) as the address of the storage means 28 and sets the least significant bit (LSB) of the address “XXXXH” to “WD53” in FIG. Write data as shown.
[0052]
That is, in the arithmetic control means 25, 26 and 27, bits to which data is to be written are assigned to “MSB”, “6th bit from LSB” and “LSB” of the address indicated by the hash value.
[0053]
For example, as a data writing method, a bit is set by changing a corresponding specific bit such as MSB or LSB from “0” to “1”.
[0054]
Then, if “1” is set in a specific bit of the address of the storage means 28 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack, etc. An illegal packet propagated at the observation point (line).
[0055]
That is, even when three observation points (lines) are observed, only one storage means is required, and information on three observation points (lines) can be stored in one address, so that the storage area of the storage means can be used. Efficiency is also improved.
[0056]
As a result, it is possible to reduce the storage capacity of the packet log recording device that records packet contents by assigning the data of the address indicated by the hash value to a plurality of observation points (lines) in units of bits and setting the bits. Thus, it is possible to improve the utilization efficiency of the storage area of the storage means.
[0057]
In the log recording apparatus shown in FIG. 1, the arithmetic control means 25, 26, and 27 are illustrated for individual observation points (lines) for the sake of simplicity of explanation. A packet from a certain observation point (line) may be taken in and processed.
[0058]
In the packet log recording apparatus shown in FIG. 1, the arithmetic control means 25, 26, and 27 are assigned to “MSB”, “6th bit from LSB”, and “LSB”. However, the bits for writing data may be appropriately assigned to the arithmetic control means 25 or the like.
[0059]
As for the description of the embodiment, the packet log recording device exemplifies an example in which logs of three observation points (lines) are recorded using a storage means having a data width of “8 bits”. The present invention is not limited to this example, and in the case of a storage means having a data width of n bits, it is possible to record a log of a maximum of “n” observation points (lines).
[0060]
In the description of FIG. 2, the data of the specific bit is directly changed, but the hash value is indicated by calculating the logical sum of all the data of the address indicated by the hash value and the data that sets the specific bit to “1”. You may write to the address again.
[0061]
For example, when data is written as indicated by “WD52” in FIG. 2, the sixth bit from the least significant bit is calculated by calculating the logical sum of all data at the address indicated by the hash value and “00100000B”. The value is forcibly set to “1”, and other bits hold the previous state, so that a specific bit can be substantially set to “1”.
[0062]
In the description of the embodiment, the specific bit of the address of the storage means 28 corresponding to the hash value obtained by applying the hash function to the illegal packet received by the server subjected to the DoS attack or the like is “1”. It is determined whether or not “is standing”, but if the address indicated by the hash value is checked and the data is “0 (= 00H)”, all the observation points (without checking individual bits) It can be seen that illegal packets were not propagated on the line).
[0063]
That is, whether or not an illegal packet is propagated at a plurality of observation points (lines) observed by the packet log recording device by determining whether the data of the address indicated by the hash value is “0 (= 00H)” or otherwise. Can be determined collectively, so that the efficiency of searching for illegal packets is improved.
[0064]
If the data at the address indicated by the hash value is not “0 (= 00H)”, a specific bit is obtained by calculating a logical product of the data and a mask (for example, “00100000B”), and a specific observation point. Whether or not an illegal packet is propagated in the network may be determined.
[0065]
Further, it is described that the specific bit is changed from “0” to “1” when an illegal packet is detected, but of course, it may be changed from “1” to “0”.
[0066]
Further, although the line between the routers is illustrated as the observation point, the observation point may be any point such as a router or a line between the router and the ISP. In addition, observation methods include observation using a hub or circuit branching device for branching, observation via a copy of communication using a mirror port of a switch, or observation inside a network connection device such as a router. It doesn't matter.
[0067]
【The invention's effect】
As is apparent from the above description, the present invention has the following effects.
According to the first and second aspects of the present invention, a packet log recording apparatus for recording packet contents by assigning bits of address data indicated by a hash value to a plurality of observation points (lines) in units of bits. The storage capacity of the storage means can be reduced, and the use efficiency of the storage area of the storage means can be improved.
[Brief description of the drawings]
FIG. 1 is a configuration block diagram showing an embodiment of a log recording device of a packet path tracking system according to the present invention.
FIG. 2 is an explanatory diagram illustrating a method for recording acquired packets.
FIG. 3 is a configuration block diagram showing an example of a conventional packet path tracking system.
FIG. 4 is an explanatory diagram showing an attack path of an attacker (attacker).
FIG. 5 is an explanatory diagram for explaining a packet recording state;
FIG. 6 is a configuration block diagram showing a specific example of a packet log recording apparatus.
FIG. 7 is an explanatory diagram illustrating a method for recording acquired packets.
FIG. 8 is a configuration block diagram showing an example when a plurality of lines are monitored by one log storage unit;
[Explanation of symbols]
1 Terminal 2 Server 3, 4, 14, 15, 16, 17 ISP
5, 6, 7, 8, 18, 19, 20, 21, 22, 23 Router 9, 10, 11, 24 Packet log recording device 12, 25, 26, 27 Arithmetic control means 13, 28 Storage means

Claims (2)

In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording information of the packet;
Each of the data at the address of the storage means indicated by the hash value is obtained by taking a packet propagating through one of the observation points and extracting a portion that is invariant during propagation and applying a hash function. A packet log recording apparatus comprising a plurality of operation control means for allocating and recording in bit units . In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording information of the packet;
A plurality of packets propagating through a plurality of observation points are respectively fetched, portions that are invariant during propagation are extracted, a hash function is applied to each , and the data of the address of the storage means indicated by the hash value for the packet at the observation point A packet log recording apparatus comprising: an arithmetic control means for allocating and recording each bit unit .

Images