JP4135094B2 - Packet path tracking system - Google Patents

Description

  The present invention relates to a packet path tracking system for tracking a propagation path of a packet propagating through a network, and in particular, a packet propagation path in which a source IP (Internet Protocol) address is spoofed even in communication via an application server. The present invention relates to a packet path tracking system capable of tracking.

  Prior art documents related to a packet path tracking system that records a packet propagating through a conventional network and tracks the packet propagation path include the following.

JP 2003-264553 A JP 2003-298648 A JP 2003-298651 A Japanese Patent Laid-Open No. 2003-298652

  FIG. 10 is a block diagram showing the configuration of an example of such a conventional packet path tracking system. In FIG. 10, 1 is an attacking terminal operated by an attacker, 2 and 3 are application servers that provide application services, 4 is a target terminal to be attacked, and 5 is packet information of an acquired IP (Internet Protocol) packet. A packet route tracking means for tracking the path of the attack packet based on the above, and an application route tracking means for tracking the route based on the session information of the application.

  The attacking terminal 1 is connected to the application server 2 via the network, and the target terminal 4 is also connected to the application server 3 via the network. The application servers 2 and 3 operate in cooperation with each other in order to provide application services via the network.

  The packet path tracking unit 5 tracks the path of the IP packet between the application server 3 and the target terminal 4, and the application path tracking unit 6 performs the path tracking between the application servers 2 and 3.

  First, a procedure for transmitting an attack packet from the attacking terminal 1 will be described. The attacking terminal 1 misrepresents the IP address of the transmission source by causing the application server 2 such as “PK01” or “PK02” in FIG. Send.

  The application server 2 that has received the packets indicated by “PK01” and “PK02” in FIG. 10 requests the application server 3 to transmit an attack packet as indicated by “SE01” in FIG.

  Then, the application server 3 that has received the request for transmission of the attack packet transmits an attack packet as indicated by “PK03” in FIG.

  Here, the operation of the conventional example in the case of such an attack will be described with reference to FIGS. 11, 12, 13, and 14. FIG. FIG. 11 is a flowchart for explaining the packet path tracking procedure, and FIGS. 12, 13 and 14 are diagrams for explaining the flow of information and the like.

  In “S001” in FIG. 11, the target-side terminal 4 determines whether or not an attack packet as indicated by “PK03” in FIG. 10 has been received, and if an attack packet is received, “S002” in FIG. In FIG. 12, the packet path tracking unit 5 acquires the received attack packet as indicated by “GP11” in FIG. 12, and tracks the propagation path of the attack packet based on the acquired attack packet.

  A specific example of such a propagation path tracking method based on an IP packet is described in “Japanese Patent Application No. 2002-367422” according to the application of the present applicant.

  That is, a packet log recording device that records packets propagating through a plurality of observation points of the network is arranged, and when an attack packet is received from a server that has become a stepping stone, the packet log recording device is searched to attack Identify the packet propagation path and extract the original packet dependency from the detected attack packet to estimate the format of the original packet and then search the packet logging device to identify the estimated propagation path of the original packet. By doing so, it is possible to trace the propagation path even for an IP packet in which the source IP address is spoofed.

  Then, in “S003” in FIG. 11, the packet path tracking unit 5 determines whether or not the application server 3 that is the transmission source that has transmitted the attack packet is identified, as indicated by “TB11” in FIG.

  However, since it is the transmission source application server 3 itself that actually transmitted the attack packet as shown by “PK03” in FIG. 10, a packet that can trace the route of the IP packet in which the source IP address is spoofed. Even the route tracking means 5 cannot further track the route.

  Therefore, if it is determined that the transmission source (application server 3) is specified in “S003” in FIG. 11, the application route tracking means 6 in “S004” in FIG. Session information of the application possessed by the target terminal 4 is acquired.

  Then, in “S005” in FIG. 11, the application path tracking means 6 identifies the application server 2 that is the request source of the attack packet transmission, as indicated by “TB21” in FIG. 13, based on the acquired session information.

  However, in the conventional example as shown in FIG. 10, although the route can be traced to the application server 2 that is the request source of the attack packet, the original attack source as shown in “TB31” in FIG. There was a problem that the route to a certain attacking terminal 1 could not be specified.

This is because the IP address of the transmission source is spoofed in the packets as indicated by “PK01” and “PK02” in FIG. 14 transmitted from the attacking terminal 1 to the application server 2. This is because the above route tracking cannot be performed.
Therefore, the problem to be solved by the present invention is to realize a packet path tracking system capable of tracking a propagation path of a packet whose source IP address is spoofed even through communication via an application server.

In order to achieve such a problem, the invention according to claim 1 of the present invention is:
In a packet path tracking system that tracks the propagation path of a packet propagating through a network,
Application path tracking means for identifying the application server that is the transmission request source of the attack packet based on the session information provided from the target terminal that received the attack packet, and packet information recorded in the application server that is the transmission request source By providing the packet path tracking means for tracking the propagation path of the cause packet based on this, it is possible to trace the propagation path of the packet whose source IP address is spoofed even in communication via the application server.

The invention according to claim 2
In the packet path tracking system according to claim 1,
The application server is
When the cause packet is received and a session is executed in response to the received cause packet, the session information to be executed is recorded as the session information, and the received cause packet information is also recorded as the packet information. This makes it possible to trace the propagation path of a packet in which the source IP address is spoofed even in communication via the application server.

The invention described in claim 3
In the packet path tracking system according to claim 1,
The application route tracking means is
When receiving the session information from the target side terminal, the application server of the attack packet transmission request source is identified by tracking the route of the application based on the received session information, and the specified attack packet Propagation of packets in which the IP address of the sender is spoofed even by communication through the application server by providing the packet path tracking means with the packet information recorded for the application server of the transmission request source The route can be traced.

The invention according to claim 4
In the packet path tracking system according to claim 1,
The packet path tracking means comprises:
When receiving the packet information from the application server that is the transmission request source of the attack packet, the propagation path of the cause packet is traced based on the received packet information and the attack side terminal and the propagation path of the cause packet By identifying the attacking terminal and the cause packet propagation path to the application server or the target terminal, the source IP address is spoofed even through communication via the application server. Packet propagation path can be traced.

The invention according to claim 5
In the packet path tracking system according to any one of claims 1 to 4,
The packet information is
By using the cause packet itself, it is possible to trace the propagation path of the packet in which the source IP address is spoofed even in communication via the application server.

The invention described in claim 6
In the packet path tracking system according to any one of claims 1 to 4,
The packet information is
By using the hash value of the cause packet, it is possible to trace the propagation path of the packet in which the source IP address is spoofed even in communication via the application server. In addition, the amount of information recorded by the application server can be reduced.

The invention described in claim 7
In the packet path tracking system according to any one of claims 1 to 4,
The packet information is
By being a part of the cause packet, it is possible to trace the propagation path of the packet in which the IP address of the sender is spoofed even in communication via the application server. In addition, the amount of information recorded by the application server can be reduced.

The invention described in claim 8
In the packet path tracking system according to any one of claims 1 to 7,
The packet path tracking means comprises:
A packet log recording device that records the cause packet propagating through a plurality of observation points of the network is arranged, the packet log recording device is searched to identify a propagation path of the cause packet, and the detected cause It is a communication through an application server by extracting the original packet dependent part from the packet and estimating the original packet format and searching the packet log recording device to identify the estimated propagation path of the original packet. In addition, it becomes possible to trace the propagation path of a packet whose source IP address is spoofed.

The invention according to claim 9
In the packet path tracking system according to any one of claims 1 to 7,
A router that exists in the propagation path of the cause packet of the network adds a mark that identifies the passage location to the cause packet itself, records the marked packet with the application server, and the packet path tracking means includes: By analyzing the added mark, the propagation path of the cause packet can be specified, and the propagation path of the packet whose source IP address is spoofed can be traced even through communication via the application server. become.

The invention according to claim 10 is:
In the packet path tracking system according to any one of claims 1 to 7,
A router present in the propagation path of the cause packet of the network generates a new packet with a mark for specifying a passage location, records the marked packet with the application server, and the packet path tracking means By analyzing the added mark, by identifying the propagation path of the cause packet, it is possible to trace the propagation path of the packet whose source IP address is spoofed even in communication via the application server. It becomes possible.

The present invention has the following effects.
According to the first, second, third, fourth, fifth, sixth, seventh, eighth, ninth, and tenth inventions, the application server that requested the transmission of the attack packet is identified by the application route tracking means based on the session information. The packet path tracking unit tracks the propagation path of the cause packet based on the packet information corresponding to the session information recorded in the application server, so that the IP address of the source can be determined even in communication via the application server. It is possible to trace the propagation path of a spoofed packet.

  Further, according to the inventions of claims 6 and 7, by making the packet information a hash value of the cause packet or a part of the data of the cause packet, the amount of information recorded by the application server can be reduced. Become.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of an embodiment of a packet path tracking system according to the present invention. In FIG. 1, 1 and 4 are assigned the same reference numerals as in the conventional example shown in FIG. 10, 7 and 8 are application servers that provide application services, and 9 is an application route tracking means for tracking routes based on application session information. Reference numeral 10 denotes a packet path tracking unit that traces the path of an attack packet based on packet information of an acquired IP (Internet Protocol) packet.

  The attacking terminal 1 is connected to the application server 7 via the network, and the target terminal 4 is also connected to the application server 8 via the network. The application servers 7 and 8 operate in cooperation with each other in order to provide application services via the network.

  The application route tracking means 9 performs route tracking between the application servers 7 and 8, and the packet route tracking means 10 performs route tracking of the IP packet between the application server 7 and the attacking terminal 1.

  First, the operation of the application server 7 when an attack packet is transmitted from the attacking terminal 1 will be described with reference to FIGS. FIG. 2 is a flowchart for explaining the operation of the application server 7, and FIG. 3 is an explanatory diagram showing an example of information captured at the time of session execution.

  The attacking terminal 1 misrepresents a packet that causes the attacking packet to be transmitted to the target terminal 4 by causing the application server 7 such as “PK41” or “PK42” in FIG. Send.

  As shown in “S101” in FIG. 2, the application server 7 determines whether or not the packets as shown in “PK41” and “PK42” in FIG. 1 have been received. It is determined whether or not to execute a session corresponding to the packet received in “S102” in FIG.

  If it is determined that the session is to be executed in “S102” in FIG. 2, the application server 7 in “S103” in FIG. 2 performs information on the session to be executed (session information) and information on the received packet (packet information). And also record.

  For example, the application server 7 records session information and packet information as indicated by “RE41” in FIG. 1, and requests the application server 8 to transmit an attack packet as indicated by “SE41” in FIG.

  Specifically, as shown in FIG. 3, when executing a session with session information such as “SE41” in FIG. 1 and packet information such as “PK41” and “PK42” in FIG. 1 corresponding to this session information. Record sequentially.

  Then, the application server 8 that has received the request for transmitting the attack packet transmits an attack packet as indicated by “PK43” in FIG.

  1 will be described with reference to FIGS. 4, 5, 6, 7, 8, and 9. FIG. 4 is a flowchart for explaining the operation of the target-side terminal 4, FIGS. 5, 7 and 9 are explanatory diagrams for explaining the flow of information and the like, and FIG. 6 is a flowchart for explaining the operation of the application route tracking means 9. FIG. 8 is a flowchart for explaining the operation of the packet path tracking means 10.

  In “S201” in FIG. 4, the target-side terminal 4 determines whether or not an attack packet has been received. If it is determined that an attack packet has been received, the target-side terminal 4 in “S202” in FIG. Provides the application path tracking means 9 with the application session information.

  For example, the target terminal 4 that has received an attack packet as indicated by “PK43” in FIG. 5 provides application session information to the application path tracking means 9 as indicated by “SI51” in FIG.

  Then, in “S301” in FIG. 6, the application route tracking means 9 determines whether or not the session information is provided from the target side terminal 4. If it is determined that the session information is provided, In step S302, the application route tracking unit 9 traces the route of the application based on the provided session information and identifies the request source of the attack packet transmission.

  For example, if the application path tracking means 9 determines that the session information has been received from the target terminal 4 as indicated by “SI51” in FIG. 7, the received session information as indicated by “TB51” in FIG. Based on the above, the application path 7 is traced to identify the application server 7 that is the request source of the attack packet transmission.

  Finally, in “S303” in FIG. 6, the application path tracking unit 9 provides the packet information recorded to the request source (for example, the application server 7) of the identified attack packet transmission to the packet path tracking unit 10. Let

For example, as indicated by “PI 51” in FIG. 7, the application path tracking means 9 sends packet information as shown in FIG. 3 recorded in the application server 9 which is the transmission request source of the attack packet to the packet path tracking means 10. Make it available.

  Specifically, the packet that causes the session indicated by “SE41” in FIG. 7 of the application server 7 that is the transmission request source of the attack packet (hereinafter referred to as the cause packet) is shown in FIG. Since the packet is indicated by “PK41” and “PK42”, the application server 7 provides the packet path tracking means 10 with information on the cause packet indicated by “PK41” and “PK42” as packet information.

  In “S401” in FIG. 8, the packet path tracking unit 10 determines whether or not the packet information is provided from the transmission request source of the attack packet (for example, the application server 9), and if the packet information is provided. When the determination is made, the packet path tracking means 10 traces the propagation path of the cause packet based on the acquired cause packet in “S402” in FIG. 8, and the attacking terminal 1 and the cause packet in “S403” in FIG. Identify the propagation path.

  For example, when packet information is acquired as indicated by “PI51” in FIG. 9, the packet path tracking means 10 causes the cause packets (“PK41” and “PK42” as indicated by “TB61” in FIG. 9 based on the acquired packet information. The propagation path of “)” is traced and the propagation path of the attacking terminal 1 and the cause packet is specified.

  A specific example of such a propagation path tracking method based on an IP packet is described in “Japanese Patent Application No. 2002-367422” according to the application of the present applicant.

  That is, a packet log recording device that records packets propagating through a plurality of observation points of the network is arranged, and when an attack packet is received from a server that has become a stepping stone, the packet log recording device is searched to attack Identify the packet propagation path and extract the original packet dependency from the detected attack packet to estimate the format of the original packet and then search the packet logging device to identify the estimated propagation path of the original packet. By doing so, it is possible to trace the propagation path even for an IP packet in which the source IP address is spoofed.

  Then, in “S404” in FIG. 8, the packet path tracking means 10 notifies the application server or the target terminal of the last identified attacking terminal 1 and the propagation path of the cause packet.

  As a result, the application server that requested the transmission of the attack packet is identified by the application route tracking means 9 based on the session information, and the packet route tracking means 10 causes the packet information corresponding to the session information recorded in the application server. By tracking the propagation path of a packet, it is possible to trace the propagation path of a packet in which the source IP address is spoofed even in communication via an application server.

  Note that the session information and the packet information are illustrated as information captured when the session shown in FIG. 3 is performed, but the packet information includes not only the cause packet data itself but also the cause packet hash value and a part of the cause packet data. It does not matter. In this case, the amount of information recorded by the application server can be reduced.

  In the embodiment shown in FIG. 1, a packet log recording device for recording a packet propagating through a plurality of observation points of the network is arranged, and when an attack packet is received, the packet log recording device is searched for an attack. The packet path tracking means 10 for specifying the packet propagation path is used. A router existing in the cause packet propagation path adds a mark for specifying the passage location to the cause packet itself, and the marked packet is applied to the application server. The propagation path of the cause packet may be identified by analyzing the added mark and analyzing the added mark.

  In the embodiment shown in FIG. 1, a packet log recording device for recording a packet propagating through a plurality of observation points of the network is arranged, and when an attack packet is received, the packet log recording device is searched for an attack. The packet path tracking means 10 for identifying the packet propagation path is used, but a router existing in the cause packet propagation path generates a new packet with a mark for identifying the passage location, and the marked packet is generated. May be recorded by the application server, and the propagation path of the cause packet may be specified by analyzing the added mark.

1 is a configuration block diagram showing an embodiment of a packet path tracking system according to the present invention. It is a flowchart explaining operation | movement of an application server. It is explanatory drawing which shows an example of the information taken in at the time of session execution. It is a flowchart explaining operation | movement of a target side terminal. It is explanatory drawing explaining the flow of information etc. It is a flowchart explaining operation | movement of an application path | route tracking means. It is explanatory drawing explaining the flow of information etc. It is a flowchart explaining operation | movement of a packet path | route tracking means. It is explanatory drawing explaining the flow of information etc. It is a block diagram showing an example of a conventional packet path tracking system. It is a flowchart explaining the tracking procedure of a packet path | route. It is explanatory drawing explaining the flow of information etc. It is explanatory drawing explaining the flow of information etc. It is explanatory drawing explaining the flow of information etc.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Attack side terminal 2,3,7,8 Application server 4 Target side terminal 5,10 Packet path tracking means 6,9 Application path tracking means

Claims (10)

In a packet path tracking system that tracks the propagation path of a packet propagating through a network,
Application path tracking means for identifying the application server that requested the transmission of the attack packet based on the session information provided from the target terminal that received the attack packet;
A packet path tracking system comprising: a packet path tracking unit that tracks a propagation path of a cause packet based on packet information recorded in the application server that is the transmission request source. The application server is
When the cause packet is received and a session is executed in response to the received cause packet, the session information to be executed is recorded as the session information, and the received cause packet information is also recorded as the packet information. The packet path tracking system according to claim 1, wherein: The application route tracking means is
When receiving the provision of the session information from the target terminal, identify the application server of the attack packet transmission request source by tracking the route of the application based on the received session information,
2. The packet path tracking system according to claim 1, wherein the packet path tracking unit is provided with packet information recorded for the application server that is the transmission request source of the identified attack packet. The packet path tracking means comprises:
When receiving the packet information from the application server that is the transmission request source of the attack packet, the propagation path of the cause packet is traced based on the received packet information and the attack side terminal and the propagation path of the cause packet Identify
2. The packet path tracking system according to claim 1, wherein the identified attacking terminal and the propagation path of the cause packet are notified to the application server or the target terminal. The packet information is
5. The packet path tracking system according to claim 1, wherein the packet is the cause packet itself. The packet information is
5. The packet path tracking system according to claim 1, wherein the packet path tracking system is a hash value of the cause packet. The packet information is
5. The packet path tracking system according to claim 1, wherein the packet path tracking system is a part of the cause packet. The packet path tracking means comprises:
A packet log recording device for recording the cause packet propagating through a plurality of observation points of the network;
The packet log recording device is identified by searching the packet log recording device to identify the propagation path of the cause packet, or by extracting the original packet dependent portion from the detected cause packet and estimating the format of the original packet The packet path tracking system according to claim 1, wherein a propagation path of the original packet estimated by searching is identified. A router that exists in the propagation path of the cause packet of the network adds a mark identifying the passage location to the cause packet itself, and records the marked packet with the application server,
8. The packet path tracking system according to claim 1, wherein the packet path tracking unit identifies the propagation path of the cause packet by analyzing the added mark. Generate a new packet with a mark identifying the passage location of the router present in the propagation path of the cause packet of the network, and record the marked packet with the application server,
8. The packet path tracking system according to claim 1, wherein the packet path tracking unit identifies the propagation path of the cause packet by analyzing the added mark.

Images