JP3889701B2 - Packet path tracking system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a packet path tracking system that records a packet propagating through a network and tracks the packet propagation path, and more particularly to a packet path tracking system that can track the propagation path of a replay attack packet.
[0002]
[Prior art]
Prior art documents related to a packet path tracking system that records a packet propagating through a conventional network and tracks the packet propagation path include the following.
[0003]
[Patent Document 1]
JP-A-10-164064
[Patent Document 2]
JP 2000-341315 A
[0004]
On the conventional Internet, a DoS attack (Denial of Service attack: hereinafter simply referred to as DoS) is a problem in which packets are continuously transmitted to a target to stop a service provided by the target. Yes.
[0005]
In particular, a DDoS attack (Distributed DoS: hereinafter simply referred to as a DDoS attack) in which a DoS attack is performed on a single target simultaneously from a plurality of points has become a serious problem.
[0006]
For this reason, in order to prevent such a DDoS attack or the like, a packet path tracking system that identifies the source of an illegal packet has been devised.
[0007]
FIG. 9 is a block diagram showing the configuration of an example of such a conventional packet path tracking system. In FIG. 9, 1 is a terminal operated by an attacker (attacker), 2 is a target server for DDoS attacks and the like, 3 and 4 are ISPs (Internet Service Providers: hereinafter simply referred to as ISPs), Reference numerals 5, 6, 7 and 8 denote routers. Reference numerals 9, 10 and 11 denote packet log recording devices for recording information of packets to propagate.
[0008]
The terminal 1 is connected to the ISP 3 via the router 5, and the ISP 3 is connected to the ISP 4 via the router 6 and the router 7. The server 2 is connected to the ISP 4 via the router 8.
[0009]
Further, a packet log recording device 9 is connected to the line between the terminal 1 and the router 5, a packet log recording device 10 is connected to the line between the router 6 and the router 7, and the server 2 and the router 8 The packet log recording device 11 is connected to the line between the two.
[0010]
Here, the operation of the conventional packet path tracking system shown in FIG. 9 will be described with reference to FIGS. FIG. 10 is an explanatory diagram illustrating an attack path of an attacker (attacker), and FIG. 11 is an explanatory diagram illustrating a packet recording state.
[0011]
As shown by “AT01” in FIG. 10, an attacker (attacker) performs a DoS attack or the like from the terminal 1 to the target server 2 via the ISP 3 and ISP 4.
[0012]
On the other hand, the packet log recording devices 9, 10 and 11 acquire packets propagating through the connected lines and sequentially record them in the storage means.
[0013]
For example, as shown by “LG11”, “LG12”, and “LG13” in FIG. 11, the packet log recording devices 9, 10, and 11 acquire illegal packets that propagate due to a DoS attack and sequentially record them in the storage means. .
[0014]
Then, the illegal packet received by the server 2 subjected to the DoS attack or the like is compared with the packets recorded in the packet log recording devices 9, 10, and 11, respectively, and the path through which the illegal packet propagated is specified.
[0015]
For example, since the illegal packet used in the DoS attack or the like shown in FIG. 10 is recorded in the packet log recording devices 9, 10, and 11, the propagation path of the illegal packet as indicated by “AT01” in FIG. 10 is specified. It becomes possible to do.
[0016]
However, in order to sequentially record all information of packets propagated to the monitored line, the storage means requires a huge storage capacity, and therefore a method for efficiently holding packet information has been devised. .
[0017]
FIG. 12 is a block diagram showing a specific example of such a packet log recording apparatus. Reference numeral 12 denotes an arithmetic control unit, and 13 denotes a storage unit.
[0018]
The input from the line that is the observation point is connected to the calculation control means 12, and the output of the calculation control means 12 is connected to the storage means 13.
[0019]
Here, the operation of the packet log recording apparatus shown in FIG. 12 will be described with reference to FIG. FIG. 13 is an explanatory diagram for explaining a method of recording the acquired packet.
[0020]
As shown by “LG21” in FIG. 12, a packet input from a line as an observation point is taken into the arithmetic control means 12, and a portion that is invariant during propagation is extracted from an IP (Internet Protocol) packet.
[0021]
Then, the arithmetic control means 12 converts the extracted information into a hash value using a hash function, regards this hash value as the address of the storage means 13, and sets a specific packet such as setting a bit at the corresponding address. Records that has been propagated.
[0022]
Here, the hash function is a function that generates a fixed-length pseudo-random number (hash value) from the original text, and since this hash function includes an irreversible one-way function, the original text is generated from the generated hash value. It cannot be reproduced. Also, it is extremely difficult to create different data with the same hash value.
[0023]
For example, the arithmetic control unit 12 applies a hash function to a portion that is invariant during propagation extracted from the acquired packet as indicated by “PI31” in FIG. 13, and as indicated by “HV31” in FIG. 13. Assume that a hash value (for example, XXXXH: 16-bit hexadecimal representation) is obtained.
[0024]
In this case, the arithmetic control unit 12 regards the obtained hash value (XXXXH) as the address of the storage unit 13 and writes data to the address “XXXXH” as indicated by “WD31” in FIG.
[0025]
For example, it is recorded that a specific packet has been propagated by changing the data writing method from “00000000B (8-bit data)” to “00000001B” or the like (setting a bit).
[0026]
If a bit is set in the address of the storage means 13 corresponding to the hash value obtained by applying the hash function to an illegal packet received by a server that has received a DoS attack or the like, the illegal packet is recorded in the packet log. This means that the device has propagated through the connected line.
[0027]
As a result, the packet log recording apparatus shown in FIG. 12 does not record all the packet information in the storage means, but records it at the address of the storage means corresponding to the hash value obtained by applying the hash function to a part of the packet. By doing (setting a bit), the storage capacity of the storage means may be small, and packet information can be efficiently held.
[0028]
[Problems to be solved by the invention]
However, in the packet path tracking system using the packet log recording device shown in FIG. 9, if the attack is caused by a reflection attack packet against the target server 2 or the like, the packet propagation path cannot be traced. There was a problem I said.
[0029]
Here, a replay attack packet is an inquiry packet in which the source address is forged to the server serving as a platform, and a response packet is transmitted to the target terminal of the source address for which the platform server is forged. As a result, a DoS attack or the like is substantially performed on the target terminal.
[0030]
FIG. 14 is a configuration block diagram showing an example of a conventional packet path tracking system for explaining such a replay attack. In FIG. 14, 14 is an attack side terminal, 15 is a server serving as a platform, 16 is a target side terminal that is a propagation path analysis device, and 17 and 18 are packet log recording devices that record information of packets to be propagated.
[0031]
The attacking side terminal 14 is connected to the server 15 via a network or the like, and the target side terminal 16 is also connected to the server 15 via a network or the like. A packet log recording device 17 is connected to the line between the attacking side terminal 14 and the server 15, and a packet log recording device 18 is connected to the line between the server 15 and the target side terminal 16.
[0032]
The basic configuration of the packet log recording devices 17 and 18 is the same as that of the conventional packet log recording device shown in FIG.
[0033]
Here, the operation of the conventional packet path tracking system shown in FIG. 14 will be described with reference to FIGS. FIG. 15 is an explanatory diagram showing an attack path of an attacker (attacker) in a replay attack, and FIG.
[0034]
The attacking terminal 14 replaces its source address (source IP address) with the IP address of the target terminal 16 (forged) as shown in “PC 41” in FIG. Send.
[0035]
At this time, the packet whose source address indicated by “PC 41” in FIG. 15 is forged is recorded in the packet log recording device 17 as well.
[0036]
On the other hand, the server 15 that has received the inquiry packet indicated by “PC 41” in FIG. 15 attempts to generate a reply packet to the inquiry and transmit it to the attacking terminal 14 that is the transmission source.
[0037]
However, since the source address is forged in the inquiry packet indicated by “PC41” in FIG. 15, the server 15 that does not recognize the forgery is described in the inquiry packet indicated by “PC41” in FIG. An answer packet such as “PC42” in FIG. 15 is transmitted to the target terminal 16 having the source address.
[0038]
At this time, the reply packet indicated by “PC 42” in FIG. 15 is recorded in the packet log recording device 18 as a matter of course.
[0039]
Then, the target side terminal 16 which is the propagation path analyzing device that has received the illegal packet as shown by “PC42” in FIG. 15 receives the received illegal packet and the packet recorded in the packet log recording devices 17 and 18, respectively. The route through which the illegal packet is propagated is identified by comparison.
[0040]
For example, since an illegal packet used for the DoS attack indicated by “PC42” in FIG. 15 is recorded in the packet log recording device 18, the illegal packet propagation path as indicated by “TR51” in FIG. Can be identified.
[0041]
However, the packet log recording device 17 does not record the illegal packet received by the target terminal 16 and used for the DoS attack indicated by “PC 42” in FIG. 15 (the packet indicated by “PC 41” in FIG. 15). Therefore, it is impossible to specify an illegal packet propagation path as indicated by “TR52” in FIG.
[0042]
  That is, in the replay attack, the server that is used as a platform can be reached by tracing the propagation path of the received illegal packet, but the propagation path to the attacking terminal cannot be traced.
Therefore, the problem to be solved by the present invention isBased on the response packet, it is possible to trace not only the route to the server that became the stepping stone but also the propagation route to the attacking terminalIt is to realize a packet path tracking system.
[0043]
[Means for Solving the Problems]
  In order to achieve such a problem, the invention according to claim 1 of the present invention is:
  In a packet path tracking system that records packets propagating through a network and tracks packet propagation paths,
  When there are a plurality of packet log recording devices that record packets propagating through a plurality of observation points of the network and a propagation path tracking request from a target side terminal that has received an illegal reply packet, the plurality of packet log recording devices are searched. And specifying the propagation path of the reply packet,A query packet dependent portion is extracted from the detected reply packet to estimate the format of the query packet, and then a plurality of packet log recording devices are searched to identify the estimated propagation path of the query packet.By having a propagation path analysis device,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0045]
  The invention according to claim 2
  In a packet path tracking system that records packets propagating through a network and tracks packet propagation paths,
  When a plurality of packet log recording devices that record packets propagating through a plurality of observation points of the network and an illegal answer packet are received, the plurality of packet log recording devices are searched to identify the propagation path of the answer packet In addition, a query packet dependent portion is extracted from the detected response packet to estimate the format of the query packet, and then a plurality of packet log recording devices are searched to identify a propagation path of the estimated query packet. With route analyzerBy havingBased on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0047]
  The invention described in claim 3
  Invention of Claim 1 or Claim 2In the packet path tracking system,
  The packet log recording device comprises:
  A storage unit that records information of the inquiry packet or the reply packet; and the inquiry packet or the reply packet that propagates through one of the plurality of observation points is captured and all information is written to the storage unit, and the propagation path analyzer By being configured with arithmetic control means for tracing the propagation path of the inquiry packet or the reply packet by control,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0048]
  The invention described in claim 4
  Invention of Claim 3In the packet path tracking system,
  The propagation path analyzer is
If the inquiry packet dependence part matches among the information recorded in the storage means of the packet log recording device, it is determined that the estimated inquiry packet is recorded in the packet log recording device. ByBased on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0049]
  The invention according to claim 5
  Invention of Claim 1 or Claim 2In the packet path tracking system,
  The packet log recording device comprises:
  Storage means for recording information of the inquiry packet or the answer packet; and taking the inquiry packet or the answer packet propagating through one of the plurality of observation points; From the arithmetic control means which regards the obtained hash value as the address of the storage means and writes data as the information to the address and traces the propagation path of the inquiry packet or the reply packet under the control of the propagation path analyzer By being configured,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0050]
  The invention described in claim 6
  Invention of Claim 5In the packet path tracking system,
  The propagation path analyzer is
  By determining that the estimated original packet is recorded in the packet log recording device if there is a record at the address of the storage means corresponding to the hash value obtained by applying a hash function to the inquiry packet dependent part ,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0051]
  The invention described in claim 7
  The invention according to any one of claims 1 to 6In the packet path tracking system,
  The inquiry packet or the answer packet is
  By being a packet used in ICMP,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0052]
  The invention described in claim 8
  Invention of Claim 7In the packet path tracking system,
  The inquiry packet or the answer packet is
  By being a packet of the ping command implemented using the ICMP echo command,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0053]
  The invention according to claim 9
  The invention according to any one of claims 1 to 6In the packet path tracking system,
  The inquiry packet or the answer packet is
  By being a packet used in UDP,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0054]
  The invention according to claim 10 is:
  The invention according to any one of claims 1 to 6In the packet path tracking system,
  The inquiry packet or the answer packet is
  By being a packet used in TCP,Based on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[0055]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of a packet path tracking system according to the present invention. In FIG. 1, reference numerals 14, 16, 17 and 18 are assigned the same reference numerals as those in FIG.
[0056]
The attacking terminal 14 is connected to the server 19 via a network or the like, and the target terminal 16 is also connected to the server 19 via a network or the like. A packet log recording device 17 is connected to the line between the attack side terminal 14 and the server 19, and a packet log recording device 18 is connected to the line between the server 19 and the target side terminal 16.
[0057]
Here, the operation of the embodiment shown in FIG. 1 will be described with reference to FIGS. 2, 3, 4, 5, 6, 7 and 8.
[0058]
FIG. 2 is an explanatory diagram showing an attack path of an attacker (attacker) of a replay attack, FIG. 3 is a flow diagram for explaining the operation of tracing a propagation path of a replay attack packet by the server 19, and FIGS. FIG. 6 is an explanatory diagram illustrating an example of a configuration of a reflection attack packet, and FIG. 7 is an explanatory diagram illustrating a relationship between the reflection attack packet and the original packet. .
[0059]
The attacking terminal 14 replaces (forges) its own source address (source IP address) as shown by “PC 61” in FIG. 2 with the IP address of the target terminal 16 (hereinafter referred to as the original packet). .) Is transmitted to the server 19 as a springboard.
[0060]
At this time, the original packet indicated by “PC 61” in FIG. 2 is recorded in the packet log recording device 17 as a matter of course.
[0061]
On the other hand, the server 19 that has received the original packet indicated by “PC 61” in FIG. 2 attempts to generate a reply packet to the inquiry and transmit it to the attacking terminal 14 that is the transmission source.
[0062]
However, since the source address is forged in the original packet indicated by “PC 61” in FIG. 2, the server 19 that does not recognize the forgery has the source address described in the original packet indicated by “PC 61” in FIG. An answer packet (hereinafter referred to as a replay attack packet) as shown by “PC 62” in FIG.
[0063]
At this time, the replay attack packet indicated by “PC 62” in FIG. 2 is recorded in the packet log recording device 18 as a matter of course.
[0064]
Then, the target terminal 16 that has received the illegal replay attack packet as indicated by “PC 62” in FIG. 2 records the replay attack packet received as described in the conventional example and the packet log recording devices 17 and 18, respectively. The route that the reflection attack packet propagated is identified by comparing the received packets.
[0065]
For example, since the replay attack packet indicated by “PC 62” in FIG. 2 is recorded in the packet log recording device 18, the target side terminal 16 can specify the propagation path of the replay attack packet to the server 19 that has been stepped on. .
[0066]
However, since the target side terminal 16 cannot specify the propagation path of the reflection attack packet any more, it requests the server 19 placed on the platform to track the propagation path of the reflection attack packet.
[0067]
In “S001” in FIG. 3, the server 19 determines whether or not there is a request for tracking the propagation path of the reflection attack packet from the target side terminal 16 as described above, and if there is such a request, “S002” in FIG. The packet log recording devices 17 and 18 are searched.
[0068]
For example, the server 19 searches the recorded contents of the packet log recording devices 17 and 18 as indicated by “SR71” and “SR72” in FIG. 4 using the reflection attack packet.
[0069]
Then, in “S003” in FIG. 3, the server 19 determines whether or not a reflection attack packet is recorded in the packet log recording device.
[0070]
For example, it is determined whether or not a replay attack packet is recorded in the packet log recording device 18 as indicated by “RP81” in FIG.
[0071]
If a replay attack packet is recorded in “S003” in FIG. 3, in other words, if a replay attack packet is detected, the server 19 is clearly attacking the target terminal 16 itself. 3 "S004", the server 19 specifies the propagation path of the reflection attack packet.
[0072]
Then, in “S005” in FIG. 3, the server 19 extracts the original packet dependence portion from the detected replay attack packet and estimates the format of the original packet.
[0073]
For example, “PC91” in FIG. 6 is realized by using the Internet Control Message Protocol (ICMP) echo command, which is the most basic command used to check whether or not an IP packet reaches the communication destination in the network. This is an example of a reply packet (corresponding to a reflection attack packet) transmitted in the “ping command” that is performed.
[0074]
Such packets are classified into parts such as “IP header”, “ICMP header”, and “ICMP data” shown in “IPH91”, “ICH91” and “ICD91” in FIG. 6, and each part has a destination address. And various information necessary for executing a “ping command” such as a transmission source address.
[0075]
Each information in such a reply packet (corresponding to a reflection attack packet) is determined depending on information of an inquiry packet (corresponding to an original packet) (hereinafter referred to as dependency information) and an inquiry packet ( Information (hereinafter referred to as non-dependent information) determined completely independently of the original packet).
[0076]
For example, “PC61” and “PC62” in FIG. 7 show examples of the original packet and the replay attack packet in FIG. 2, respectively, and “IPH101” and “IPH102” in FIG. "ICH101" and "ICH102" in FIG. 7 are "ICMP headers" of the original packet and reflection attack packet, and "ICCD101" and "IC102" in FIG. 7 are "ICMP data" of the original packet and reflection attack packet, respectively. Show.
[0077]
In FIG. 7, “FD101”, “FD102”, “FD103”, and “FD104”, which are each information in the replay attack packet, are dependency information, and the other portions are independent information.
[0078]
That is, the dependency information shown in “FD101”, “FD102”, “FD103”, and “FD104” in FIG. 7 is “FD105”, “FD106”, “FD107”, and “FD” in FIG. Information is determined based on the FD 108 ″.
[0079]
In other words, only the dependency information in the replay attack packet indicated by “FD101”, “FD102”, “FD103”, and “FD104” in FIG. 7 is the only information common to the original packet.
[0080]
For this reason, the part of the dependency information shown in “FD101”, “FD102”, “FD103”, and “FD104” in FIG. 7 is estimated to be the same as the original packet, and the part of the nondependent information is masked to form a new packet. Thus, the original packet dependent portion is extracted from the reflection attack packet, and the format of the original packet can be estimated.
[0081]
Specifically, for example, in the “IP header”, dependency information such as “Version”, “IHL”, “Total Length”, “Protocol” is used as it is as the original packet, and “Source Address” and “Destination Address” The dependency information such as "" is used as an original packet by exchanging with each other.
[0082]
Similarly, for example, in the “ICMP header”, dependency information such as “Code”, “Identifier”, and “Sequence Number” is used as it is as the original packet, and dependency information such as “ICMP data” is also used as it is in the original packet. Used as
[0083]
Then, in “S006” in FIG. 3, the server 19 searches the packet log recording devices 17 and 18, and in “S007” in FIG. 3, the server 19 stores the original packet in the estimated format in the packet log recording device. Determine whether it is recorded.
[0084]
For example, the server 19 searches the recorded contents of the packet log recording devices 17 and 18 as indicated by “SR71” and “SR72” in FIG. 4 using the original packet of the estimated format, and displays “SP111” in FIG. As shown, it is determined whether or not the original packet of the estimated format is recorded in the packet log recording device 17.
[0085]
That is, in the information recorded in the packet log recording device, even if the estimated original packet non-dependence information does not match, the estimated original packet is recorded in the packet log recording device if the dependency information matches. Judge that it has been.
[0086]
On the other hand, when information is recorded in the packet log recording device by a method of recording (setting a bit) at the address of the storage unit corresponding to the hash value, a hash function is added to the dependency information in the estimated original packet. If there is a record at the address of the storage means corresponding to the hash value obtained by application (if a bit is set), it is determined that the estimated original packet is recorded in the packet log recording device.
[0087]
If the original packet of the format estimated in “S007” in FIG. 3 is recorded, in other words, if the original packet of the estimated format is detected, the server 19 in “S008” in FIG. Identify the propagation path.
[0088]
As a result, when there is a propagation path tracking request from the target terminal 16, the server 19 that has become a stepping stone searches the packet log recording device to identify the propagation path of the replay attack packet (answer packet) and is detected. The original packet (inquiry packet) estimated by searching the packet log recorder after extracting the original packet (inquiry packet) dependent part from the replay attack packet (answer packet) and estimating the format of the original packet (inquiry packet) By specifying the propagation path, it is possible to trace the propagation path of the replay attack packet.
[0089]
In the description of the embodiment shown in FIG. 1, the packet log recording apparatus corresponds to the hash value obtained by extracting the packet dependency information and applying the hash function in order to reduce the storage capacity of the storage means. There is a need to record (set a bit) at the address of the storage means.
[0090]
However, when all the packet information propagated by the packet log recording device is recorded in the storage means, there is no need to extract the dependency information in the packet as described above.
[0091]
Further, in the description of the embodiment shown in FIG. 1, the target terminal 16 requests the tracking of the propagation path of the replay attack packet by using the server 19 that has been used as a step when the propagation path of the replay attack packet cannot be specified. Of course, since the possibility of a replay attack can be estimated when the propagation path of the replay attack packet cannot be specified, the target side terminal 16 itself can be estimated from the replay attack packet detected as the propagation path analysis device. The packet dependence part may be extracted to estimate the format of the original packet, and the packet log recording device may be searched to identify the propagation path of the original packet.
[0092]
Further, in the description of the embodiment shown in FIG. 1, a packet of a “ping command” realized by using the ICMP (Internet Control Message Protocol) echo command is illustrated, but of course, it is not limited to this. Even if it is another packet used in ICMP (Destination Unreachable Message, Time Exceeded Message, Parameter Problem Message, Source Quench Message, Redirect Message, etc.), the dependent information part is assumed to be the same as the original packet and is not dependent By masking the information portion to obtain a new packet, the original packet dependent portion is extracted from the replay attack packet, and the format of the original packet can be estimated.
[0093]
Furthermore, even for packets used in TCP (Transmission Control Protocol), packets used in UDP (User Datagram Protocol), etc., the dependency information part is estimated to be the same as the original packet, and the non-dependent information part is masked. By using the new packet, the original packet dependent portion is extracted from the replay attack packet, and the format of the original packet can be estimated.
[0094]
【The invention's effect】
  As is apparent from the above description, the present invention has the following effects.
  According to the inventions of claims 1, 2, 3, 4, 5, 6, 7, 8, 9 and claim 10,When there is a propagation path tracking request from the target side terminal, the server that became the step or the target side terminal searches the packet log recording device, and the reflection attack packet(Answer packet)Redirect attack packets detected along with the propagation path of(Answer packet)The original packet (inquiry packet) dependent part is extracted from the original packet (inquiry packet), the format of the original packet (inquiry packet) is estimated, the packet log recording device is searched, and the propagation path of the estimated original packet (inquiry packet) is specified. ByBased on the response packet, it is possible to trace not only the route to the server that has become a stepping stone but also the propagation route to the attacking terminal.
[Brief description of the drawings]
FIG. 1 is a configuration block diagram showing an embodiment of a packet path tracking system according to the present invention.
FIG. 2 is an explanatory diagram showing an attack path of an attacker (attacker) in a replay attack.
FIG. 3 is a flowchart for explaining a tracking operation of a propagation path of a reflection attack packet of a server.
FIG. 4 is an explanatory diagram for explaining a tracking operation of a propagation path of a reflection attack packet of a server.
FIG. 5 is an explanatory diagram for explaining a tracing operation of a propagation path of a reflection attack packet of a server.
FIG. 6 is an explanatory diagram showing an example of a configuration of a reflection attack packet.
FIG. 7 is an explanatory diagram illustrating a relationship between a reflection attack packet and an original packet.
FIG. 8 is an explanatory diagram for explaining a tracking operation of a propagation path of a reflection attack packet of a server.
FIG. 9 is a configuration block diagram showing an example of a conventional packet path tracking system.
FIG. 10 is an explanatory diagram showing an attack path of an attacker (attacker).
FIG. 11 is an explanatory diagram for explaining a packet recording state;
FIG. 12 is a configuration block diagram showing a specific example of a packet log recording apparatus.
FIG. 13 is an explanatory diagram illustrating a method for recording acquired packets.
FIG. 14 is a configuration block diagram showing an example of a conventional packet path tracking system for explaining a replay attack.
FIG. 15 is an explanatory diagram showing an attack path of an attacker (attacker) in a replay attack.
FIG. 16 is an explanatory diagram for explaining a tracking situation of a packet propagation path;
[Explanation of symbols]
1 terminal
2,15,19 servers
3,4 ISP
5, 6, 7, 8 routers
9, 10, 11, 17, 18 Packet log recording device
12 Calculation control means
13 Storage means
14 Attacking terminal
16 Target terminal

Claims (10)

In a packet path tracking system that records packets propagating through a network and tracks packet propagation paths,
A plurality of packet log recording devices for recording packets propagating through a plurality of observation points of the network;
When there is a propagation path tracking request from the target terminal that has received the illegal reply packet, the plurality of packet log recording devices are searched to identify the propagation path of the reply packet, and an inquiry is made from the detected reply packet. And a propagation path analysis device that searches a plurality of the packet log recording devices after extracting a packet-dependent portion to estimate the format of the inquiry packet and identifies the estimated propagation route of the inquiry packet. And packet path tracking system. In a packet path tracking system that records packets propagating through a network and tracks packet propagation paths,
A plurality of packet log recording devices for recording packets propagating through a plurality of observation points of the network;
When an illegal answer packet is received, a plurality of the packet log recording devices are searched to identify a propagation path of the answer packet, and an inquiry packet dependent portion is extracted from the detected answer packet to obtain a format of the inquiry packet A propagation path analysis device for identifying a propagation path of the inquiry packet estimated by searching a plurality of the packet log recording devices after estimating
A packet path tracking system comprising: The packet log recording device comprises:
Storage means for recording information of the inquiry packet or the reply packet;
The inquiry packet or the answer packet propagating through one of the plurality of observation points is captured and all information is written in the storage means, and the propagation path of the inquiry packet or the answer packet is traced under the control of the propagation path analyzer. Arithmetic control means
It is composed of
The packet path tracking system according to claim 1 or 2. The propagation path analyzer is
If the inquiry packet dependent portion of the information recorded in the storage means of the packet log recording device matches, it is determined that the estimated inquiry packet is recorded in the packet log recording device. It is characterized by
The packet path tracking system according to claim 3. The packet log recording device comprises:
Storage means for recording information of the inquiry packet or the reply packet;
The query packet or the answer packet propagating through one of the observation points is extracted, a query packet dependent part is extracted, a hash function is applied, and the obtained hash value is regarded as the address of the storage means, Arithmetic control means for writing data as the information and tracing the propagation path of the inquiry packet or the reply packet under the control of the propagation path analyzer;
It is composed of
The packet path tracking system according to claim 1 or 2. The propagation path analyzer is
Corresponds to the hash value obtained by applying a hash function to the query packet dependent part If there is a record at the address of the storage means, it is determined that the estimated original packet is recorded in the packet log recording device
The packet path tracking system according to claim 5. The inquiry packet or the answer packet is
It is a packet used in ICMP
The packet path tracking system according to any one of claims 1 to 6. The inquiry packet or the answer packet is
It is a packet of a ping command implemented using the ICMP echo command.
The packet path tracking system according to claim 7. The inquiry packet or the answer packet is
It is a packet used in UDP
The packet path tracking system according to any one of claims 1 to 6. The inquiry packet or the answer packet is
It is a packet used in TCP
The packet path tracking system according to any one of claims 1 to 6 .

Images