JP3797308B2 - Packet log recording device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a packet log recording device used in a packet path tracking system that records a packet propagating through a network and tracks a packet propagation path, and particularly presents recorded information and the accuracy of the information. The present invention relates to a packet log recording apparatus capable of
[0002]
[Prior art]
Prior art documents related to a packet log recording device used in a packet path tracking system that records a packet propagating through a conventional network and tracks a packet propagation path include the following.
[0003]
[Patent Document 1]
JP-A-10-164064 [0004]
On the conventional Internet, a DoS attack (Denial of Service attack: hereinafter simply referred to as DoS) is a problem in which packets are continuously transmitted to a target to stop a service provided by the target. Yes.
[0005]
In particular, DDoS (Distributed DoS: hereinafter simply referred to as DDoS), which performs DoS attacks on a single target simultaneously from a plurality of points, is a big problem.
[0006]
For this reason, in order to prevent such a DDoS attack or the like, a packet path tracking system that identifies the source of an illegal packet has been devised.
[0007]
FIG. 4 is a block diagram showing an example of such a conventional packet path tracking system. In FIG. 4, 1 is a terminal operated by an attacker (attacker), 2 is a target server for DDoS attacks and the like, 3 and 4 are ISPs (Internet Service Providers: hereinafter simply referred to as ISPs), Reference numerals 5, 6, 7 and 8 denote routers. Reference numerals 9, 10 and 11 denote packet log recording devices for recording information of packets to propagate.
[0008]
The terminal 1 is connected to the ISP 3 via the router 5, and the ISP 3 is connected to the ISP 4 via the router 6 and the router 7. The server 2 is connected to the ISP 4 via the router 8.
[0009]
Further, a packet log recording device 9 is connected to the line between the terminal 1 and the router 5, a packet log recording device 10 is connected to the line between the router 6 and the router 7, and the server 2 and the router 8 The packet log recording device 11 is connected to the line between the two.
[0010]
Here, the operation of the conventional packet path tracking system shown in FIG. 4 will be described with reference to FIGS. FIG. 5 is an explanatory diagram showing an attack path of an attacker (attacker), and FIG. 6 is an explanatory diagram explaining a packet recording state.
[0011]
As shown by “AT01” in FIG. 5, an attacker (attacker) performs a DoS attack or the like from the terminal 1 to the target server 2 via the ISP 3 and ISP 4.
[0012]
On the other hand, the packet log recording devices 9, 10 and 11 acquire packets propagating through the connected lines and sequentially record them in the storage means.
[0013]
For example, as shown by “LG11”, “LG12”, and “LG13” in FIG. 6, the packet log recording devices 9, 10, and 11 acquire illegal packets that propagate due to a DoS attack and sequentially record them in the storage means. .
[0014]
Then, the illegal packet received by the server 2 subjected to the DoS attack or the like is compared with the packets recorded in the packet log recording devices 9, 10, and 11, respectively, and the path through which the illegal packet propagated is specified.
[0015]
For example, since the illegal packet used in the DoS attack shown in FIG. 5 is recorded in the packet log recording devices 9, 10 and 11, the propagation path of the illegal packet as indicated by “AT01” in FIG. 5 is specified. It becomes possible to do.
[0016]
However, in order to sequentially record all information of packets propagated to the monitored line, the storage means requires a huge storage capacity, and therefore a method for efficiently holding packet information has been devised. .
[0017]
FIG. 7 is a block diagram showing a specific example of such a packet log recording apparatus. Reference numeral 12 denotes an arithmetic control unit, and 13 denotes a storage unit.
[0018]
The input from the line that is the observation point is connected to the calculation control means 12, and the output of the calculation control means 12 is connected to the storage means 13.
[0019]
Here, the operation of the packet log recording apparatus shown in FIG. 7 will be described with reference to FIG. FIG. 8 is an explanatory diagram for explaining a method of recording the acquired packet.
[0020]
As shown by “LG21” in FIG. 7, a packet input from a line as an observation point is taken into the arithmetic control means 12, and a portion that is invariant during propagation is extracted from an IP (Internet Protocol) packet.
[0021]
Then, the arithmetic control means 12 converts the extracted information into a hash value using a hash function, regards this hash value as the address of the storage means 13, and sets a specific packet such as setting a bit at the corresponding address. Records that has been propagated.
[0022]
Here, the hash function is a function that generates a fixed-length pseudo-random number (hash value) from the original text, and since this hash function includes an irreversible one-way function, the original text is generated from the generated hash value. It cannot be reproduced. Also, it is extremely difficult to create different data with the same hash value.
[0023]
For example, the arithmetic control unit 12 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as indicated by “PI31” in FIG. 8, and as indicated by “HV31” in FIG. Assume that a hash value (for example, XXXXH: 16-bit hexadecimal representation) is obtained.
[0024]
In this case, the arithmetic control unit 12 regards the obtained hash value (XXXXH) as the address of the storage unit 13 and writes data to the address “XXXXH” as indicated by “WD31” in FIG.
[0025]
For example, it is recorded that a specific packet has been propagated by changing the data writing method from “00000000B (8-bit data)” to “00000001B” or the like (setting a bit).
[0026]
If a bit is set in the address of the storage means 13 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack or the like, the illegal packet is recorded in the packet log. This means that the device has propagated through the connected line.
[0027]
As a result, the packet log recording apparatus shown in FIG. 7 does not record all the packet information in the storage means, but records it at the address of the storage means corresponding to the hash value obtained by applying the hash function to a part of the packet. By doing (setting a bit), the storage capacity of the storage means may be small, and packet information can be efficiently held.
[0028]
[Problems to be solved by the invention]
However, the packet log recording apparatus shown in FIG. 7 extracts a portion that is invariant during propagation in the IP packet, converts it into a hash value using a hash function, and regards this hash value as the address of the storage means. However, there is a slight possibility that the converted hash values will coincide even with completely different IP packets.
[0029]
For this reason, even if a bit is set in the address of the storage means 13 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack or the like, There is a problem that it is impossible to deny the possibility that there is no packet, and it is impossible to determine whether the packet is an illegal packet.
Therefore, the problem to be solved by the present invention is to realize a packet log recording apparatus capable of presenting recorded information and the certainty of the information together.
[0030]
[Means for Solving the Problems]
In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In a packet log recording device that records packets propagating through multiple observation points of the network,
A first storage means for recording the packet information; a second storage means for recording the filling rate of the first storage means; and a packet that propagates through one of the plurality of observation points is captured and unchanged during propagation. Is extracted, the hash function is applied, the obtained hash value is regarded as the address of the first storage means, data is written to a specific bit of this address, and the data of the first storage means By providing the calculation control means for acquiring the filling rate and recording it in the second storage means, it is possible to obtain a probability that the retrieved packet is the same as the packet recorded in the log recording device. .
[0031]
The invention according to claim 2
In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording the packet information and filling rate in a log recording area and a filling rate recording area respectively, and a hash function by extracting a packet that propagates through one of the plurality of observation points and extracting an invariant part during propagation And the obtained hash value is regarded as the address of the log recording area, and data is written to a specific bit of the address, and the filling rate of the data in the log recording area is acquired and stored in the filling rate recording area. By providing the operation control means for recording, it is possible to obtain a probability that the retrieved packet is the same as the packet recorded in the log recording device.
[0032]
The invention described in claim 3
In the packet log recording device according to claim 1,
The arithmetic control means is
By calculating the correct probability from the filling rate and recording it in the second storage means, it is possible to obtain the probability that the retrieved packet is the same as the packet recorded in the log recording device.
[0033]
The invention according to claim 4
In the packet log recording device according to claim 1,
The arithmetic control means is
By obtaining the number of times that the hash value is the same as the already recorded hash value and recording it in the second storage means, it is possible to make a more accurate judgment when simultaneously searching for a series of attack packets. Become a material.
[0034]
The invention according to claim 5
In the packet log recording device according to claim 1,
The arithmetic control means is
Finally, the time when data was recorded at the address corresponding to the specific hash value is acquired and recorded in the second storage means, so that a more accurate judgment can be made when simultaneously searching for a series of attack packets. Become a material.
[0035]
The invention described in claim 6
In the packet log recording device according to claim 1,
The arithmetic control means is
Finally, by acquiring the time when the specific hash value was the same as the already recorded hash value and recording it in the second storage means, it is possible to simultaneously search for a series of possible attack packets. It becomes an accurate judgment material.
[0036]
The invention described in claim 7
In the packet log recording device according to claim 1,
The arithmetic control means is
By acquiring a plurality of recently recorded hash values and recording times retroactively and recording them in the second storage means, it becomes a more accurate judgment material when simultaneously searching for a series of possible attack packets. .
[0037]
The invention described in claim 8
In the packet log recording device according to claim 1,
The arithmetic control means is
By dividing and managing the first storage means into a plurality of areas, it is possible to obtain a probability that the retrieved packet is the same as the packet recorded in the log recording device.
The invention according to claim 9
In the packet log recording device according to claim 2,
The arithmetic control means is
By obtaining a plurality of recently recorded hash values and recording times retroactively and recording them in the filling rate recording area, it becomes a more accurate judgment material when simultaneously searching for a series of attack packets.
The invention according to claim 10 is:
The arithmetic control means is
By dividing and managing the log recording area into a plurality of areas, it is possible to obtain a probability that the retrieved packet is the same as the packet recorded in the log recording apparatus.
[0038]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of a log recording device of a packet path tracking system according to the present invention.
[0039]
In FIG. 1, 13 is assigned the same reference numeral as in FIG. 7, 12a is a calculation control means, and 14 is a storage means for recording the filling rate. The input from the line as the observation point is connected to the calculation control means 12a, and the output of the calculation control means 12a is connected to the storage means 13 and 14, respectively.
[0040]
The operation of the embodiment shown in FIG. 1 will be described with reference to FIGS. FIG. 2 is a flowchart for explaining the operation of the arithmetic control means 12a. FIG. 3 is an explanatory view showing an example of the situation of the storage means 13.
[0041]
Since the probability that the converted hash values coincide even if they are completely different IP packets becomes higher as the data is buried in the storage means 13 for recording the log, the data filling rate in the storage means 13 is determined by the hash value. Is obtained as the probability of coincidence happening and recorded in the storage means.
[0042]
That is, in “S001” in FIG. 2, the arithmetic control unit 12 a searches the status of the storage unit 13 and acquires the number of data recorded in the storage unit 13.
[0043]
For example, from the situation of the storage means 13 shown in FIG. 3, data is stored in the address portions shown in “SD01”, “SD02”, “SD03”, “SD04”, “SD05”, “SD06”, and “SD07” in FIG. Since it is written, the number of data is obtained.
[0044]
Then, in “S002” in FIG. 2, the arithmetic control unit 12a divides the acquired number of data recorded in the storage unit 13 by the maximum recording number of the storage unit 13, and fills the division result in “S003” in FIG. The rate is recorded in the storage means 14.
[0045]
That is, when a bit is set in the address of the storage unit 13 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack or the like, the bit is recorded in the storage unit 14 By referring to the filling rate, it is possible to obtain the probability that the hash values will coincide.
[0046]
As a result, the calculation control unit 12a acquires and records the data filling rate of the storage unit 13 that records the log, thereby obtaining a probability that the hash values coincide with each other. It is possible to obtain a probability that it is the same as the packet recorded in the log recording device.
[0047]
In the embodiment shown in FIG. 1, the storage means 13 for recording the packet log and the storage means 14 for recording the filling rate are described separately for the sake of simplicity. Of course, one storage means is provided. May be divided into two areas such as a log recording area and a filling rate recording area.
[0048]
Further, when the filling rate is “A”, the calculation control means 12a may calculate “(1−A) × 100 [%]” or the like and record it in the storage means 14 as the correct answer probability. Absent.
[0049]
Further, the arithmetic control unit 12a may acquire the number of times the hash values match and record them in the storage unit 14.
[0050]
Alternatively, the time when the arithmetic control unit 12a last recorded data at a specific hash value (address) and the last time when the specific hash value matched may be acquired and recorded in the storage unit 14.
[0051]
Further, the arithmetic control unit 12a may acquire a plurality of hash values (for example, the past ten) that have recently matched hash values and record them in the storage unit 14.
[0052]
In this case, “the number of times the hash value matched”, “the time when data was last recorded at a specific hash value (address)”, “the time when the specific hash value last matched”, and “the latest hash value matched By recording a plurality of hash values retroactively in the past, a more accurate recording time can be obtained. For example, a more accurate determination time can be obtained when simultaneously searching for a series of attack packets.
[0053]
The arithmetic control unit 12a may manage the storage unit 13 by dividing it into a plurality of areas. For example, the arithmetic control means 12a “has the number of times the hash value is matched” for each area, “the time when data is finally recorded at a specific hash value (address)”, and “the time when the specific hash value finally matches” In addition, “a plurality of hash values whose hash values have been matched recently” may be acquired and recorded in the storage unit 14.
[0054]
In the description shown in FIG. 2, it is described that the arithmetic control means 12a is searching for the status of the storage means 13, but the number of times of new recording in the storage means 13 is counted in advance, and the count You may refer to the value.
[0055]
【The invention's effect】
As is apparent from the above description, the present invention has the following effects.
According to the first, second, third, eighth and tenth aspects of the present invention, the calculation control means acquires and records the data filling rate of the storage means for recording the log so that the hash values coincide with each other. It is possible to obtain the probability that the retrieved packet is the same as the packet recorded in the log recording device.
[0056]
According to the inventions of claims 4, 5, 6, 7 and 9, the operation control means records the data to the “number of times the hash values match” and “the last hash value (address)”. By recording “time”, “the time when a specific hash value was last matched” and “a plurality of hash values with the most recent hash value that were matched” in the past, what could be considered as a series of attack packets at the same time It becomes a more accurate judgment material when searching.
[Brief description of the drawings]
FIG. 1 is a configuration block diagram showing an embodiment of a log recording device of a packet path tracking system according to the present invention.
FIG. 2 is a flowchart for explaining the operation of an arithmetic control unit.
FIG. 3 is an explanatory diagram showing an example of the status of storage means.
FIG. 4 is a configuration block diagram showing an example of a conventional packet path tracking system.
FIG. 5 is an explanatory diagram showing an attack path of an attacker (attacker).
FIG. 6 is an explanatory diagram for explaining a packet recording state;
FIG. 7 is a configuration block diagram showing a specific example of a packet log recording apparatus.
FIG. 8 is an explanatory diagram illustrating a method for recording acquired packets.
[Explanation of symbols]
1 Terminal 2 Server 3, 4 ISP
5, 6, 7, 8 Router 9, 10, 11 Packet log recording device 12, 12a Arithmetic control means 13, 14 Storage means

Claims (10)

In a packet log recording device that records packets propagating through multiple observation points of the network,
First storage means for recording information of the packet;
Second storage means for recording the filling rate of the first storage means;
A packet propagating through one of the observation points is taken in, a portion that is invariant during propagation is extracted, a hash function is applied, and the obtained hash value is regarded as the address of the first storage means, A packet log recording apparatus comprising: an operation control unit that writes data to a specific bit and acquires the filling rate of the data in the first storage unit and records the data in the second storage unit. In a packet log recording device that records packets propagating through multiple observation points of the network,
Storage means for recording the packet information and the filling rate in a log recording area and a filling rate recording area, respectively;
A packet propagating through one of the observation points is taken, a portion that is invariant during propagation is extracted and a hash function is applied, and the obtained hash value is regarded as the address of the log recording area and a specific address of this address A packet log recording apparatus comprising: an operation control unit that writes data in bits and acquires the filling rate of data in the log recording area and records the data in the filling rate recording area. The arithmetic control means is
A correct probability is calculated from the filling rate and recorded in the second storage means.
The packet log recording device according to claim 1. The arithmetic control means is
The number of times that the hash value is identical to the hash value already recorded is acquired and recorded in the second storage means
The packet log recording device according to claim 1. The arithmetic control means is
Finally, the time when the data was recorded at the address corresponding to the specific hash value is acquired and recorded in the second storage means.
The packet log recording device according to claim 1. The arithmetic control means is
Finally, the time when the specific hash value is the same as the already recorded hash value is acquired and recorded in the second storage means
The packet log recording device according to claim 1. The arithmetic control means is
A plurality of recently recorded hash values and recording times are acquired retroactively and recorded in the second storage means.
The packet log recording device according to claim 1. The arithmetic control means is
The first storage unit is divided into a plurality of areas for management.
The packet log recording device according to claim 1. The arithmetic control means is
  A plurality of recently recorded hash values and recording times are acquired retroactively and recorded in the filling rate recording area.
The packet log recording device according to claim 2. The arithmetic control means is
  The log recording area is divided into a plurality of areas and managed.
The packet log recording device according to claim 2.

Images