JP4330066B2 - Intrusion detection system, intrusion detection method, and recording medium - Google Patents

Description

The present invention relates to an intrusion detection system, an intrusion detection method, and a recording medium that prevent unauthorized access from an external network.

  FIG. 5 is a diagram illustrating a conventional lower intrusion detection device 500.

  A conventional lower intrusion detection device 500 includes an external network 10 constructed on the Internet or outside, an intrusion detection device 70, and an internal network 80 to be monitored.

  The intrusion detection device 70 is installed at a position where it is possible to monitor communication from the external network 10 to the internal network 80, communication from the internal network 80 to the external network 10, and communication between the internal networks 80. It is.

  In the conventional intrusion detection system 500, the intrusion detection device 70 is installed as a single unit between the external network 10 and the internal network 80 to be monitored, and the administrator detects any unauthorized attacks from the outside. Based on the past experience of the administrator or the like, it is determined whether it is a false detection or an unauthorized access (for example, see Patent Document 1).

  Furthermore, the intrusion detection device 70 monitors whether or not the access is unauthorized by comparing the attack pattern called the signature with the packets flowing on the internal network 80 that is the monitoring target network one by one.

  In other words, in the conventional intrusion detection system 500, the intrusion detection device 70 analyzes a signature (an attack pattern obtained by analyzing a past crime on the network and extracting an element that can be regarded as an attack or unauthorized access), and a monitoring target. The communication packet flowing on the network to be checked is checked to determine whether the communication is illegal.

The intrusion detection device 70 has a plurality of signatures on a database in the intrusion detection device 70. The intrusion detection apparatus 70 compares the signature in the signature database with each communication packet in order, and if the communication packet matches one of the signatures in the database, the communication packet that has flowed on the network. Is considered illegal communication.
JP 2002-328896 A

  In the above conventional example, when the internal network 80 connected to the intrusion detection device 70 is attacked, an attack that causes secondary damage may be made from the internal network 80 to the outside. There is a problem that the intrusion detection device 70 does not have a protection means from the inside to the outside.

  That is, the above conventional example has a problem that it receives secondary damage in a network that monitors unauthorized communication from an external network.

It is an object of the present invention to provide an intrusion detection system, an intrusion detection method, and a recording medium that are not subject to secondary damage in a network that monitors unauthorized communication from an external network.

The present invention is an intrusion detection system that is connected to a network composed of an upper network and a plurality of lower networks, and monitors unauthorized communication from the external network, and is provided between the external network and the upper network. And a plurality of lower intrusion detection devices provided between the upper network and each lower network. The lower intrusion detection device uses a plurality of signatures used for intrusion detection. When a lower-level intrusion detection device detects an attack on the lower-level intrusion detection device itself due to illegal storage and storage means for storing a part of the signatures divided between the lower-level intrusion detection devices, A device having transfer means for transferring the stored signature and warning content to the upper intrusion detection device. The upper intrusion detection device stores the signature transferred from the lower intrusion detection device in a database and uses the database to detect intrusion on behalf of the lower intrusion detection device. An intrusion detection system that is separated from the upper network.

According to the present invention, there is an effect that secondary damage is not caused in a network that monitors unauthorized communication from an external network.

  The best mode for carrying out the invention is the following examples.

  FIG. 1 is a diagram illustrating an intrusion detection system 100 that is Embodiment 1 of the present invention.

  The intrusion detection system 100 includes an external network 10, an upper intrusion detection device 20, an upper network 30, lower intrusion detection devices 41, 42, 43, and lower networks (monitored networks) 51, 52, 53.

  The upper intrusion detection device 20 is an upper intrusion detection device provided between the external network 10 and the upper network 30, and a predetermined lower intrusion detection device (for example, the lower intrusion detection device 42) has failed. In this case, the lower intrusion detection devices 41 and 43 other than the lower intrusion detection device 42 are notified of the occurrence of the failure.

  The lower intrusion detection devices 41, 42, and 43 are intrusion detection devices provided between the upper network 20 and the lower networks 51, 52, and 53. 43 is an intrusion detection device that detects that a failure due to a failure or an attack has occurred and notifies the host intrusion detection device 20 that a failure has occurred due to the failure or the attack.

  The lower networks 51, 52, and 53 are lower networks that are monitored by the lower intrusion detection devices 41, 42, and 43, respectively.

  FIG. 2 is a diagram for explaining the behavior of the lower intrusion detection devices 41, 42, 43, 44, 45 in the intrusion detection system 100.

  FIG. 3 is a diagram showing data describing a material for detecting an attack called a signature.

  If there are 50 signatures in total, the lower intrusion detection devices 41, 42, 43, 44, and 45 have databases DB1, DB2, DB3, DB4, and DB5, respectively.

  In the intrusion detection system 100, 50 signatures are divided and stored in databases DB1, DB2, DB3, DB4, and DB5 provided in the lower intrusion detection devices 41, 42, 43, 44, and 45, respectively. .

  In the intrusion detection system 100, ten signatures are stored in each of the five lower intrusion detection devices 41 to 45. The database 21 provided in the upper intrusion detection device 20 existing on the upper network of the lower intrusion detection devices 41 to 45 performs an intrusion detection proxy in accordance with an instruction from the lower intrusion detection devices 41 to 45.

  For example, when the lower intrusion detection device 42 storing the signatures SG11 to SG20 is attacked, the lower intrusion detection device 42 is separated from the network from the attacked effect.

  FIG. 4 is a flowchart illustrating an operation in which the lower intrusion detection device 42 makes a supplement request to the upper intrusion detection device 20 in the first embodiment.

  At this time, the lower intrusion detection device 42 makes a supplement request to the upper intrusion detection device 20 by the operation shown in FIG. In the supplement request, the data describing the reason for disconnecting from the network and the stored signature are transferred to the upper intrusion detection device 20 via the network. Upon receiving the supplement request, the upper intrusion detection device 20 takes that the lower intrusion detection device 42 is in an unusable state as the log database 22, and simultaneously stores the signatures SG11 to SG20 in the database 21 and stores the database 21 in the database 21. Intrusion detection on behalf of using.

  By the above-described operation, it is possible to prevent the same attack not only on the lower intrusion detection device 42 but also on the lower intrusion detection devices 41, 43,.

As described above, the purpose of the system 100 is to prevent secondary damage against attacks in the shortest time.

  When the lower intrusion detection devices 41 to 45 are further connected in the monitoring target network using the mechanism of the first embodiment and the lower intrusion detection device 42 is the upper network, the lower intrusion detection device 42 is the upper intrusion detection device. 2, the signatures SG 11 to SG 20 in FIG. 2 are divided and arranged, and the lower intrusion detection devices 41 to 45 function as the lower intrusion detection device 42.

  In the above embodiment, in a computer-readable recording medium that records an intrusion detection program for monitoring unauthorized communication from an external network, a lower intrusion detection device provided between an upper network and a lower network includes: A failure detection procedure for detecting that a failure or an attack has occurred due to unauthorized communication, and a first failure occurrence notification that the lower intrusion detection device informs the upper intrusion detection device that the failure has occurred A procedure and a second intrusion detection device that notifies the lower intrusion detection device other than the predetermined lower intrusion detection device that the failure has occurred when the predetermined lower intrusion detection device fails. This is an example of a program that causes a computer to execute the failure occurrence notification procedure.

You may make it record the said program on recording media, such as FD, CD, DVD, HD, and a semiconductor memory.

It is a figure which shows the intrusion detection system 100 which is Example 1 of this invention. FIG. 3 is a diagram illustrating behavior of lower intrusion detection devices 41, 42, 43, 44, and 45 in the intrusion detection system 100. It is a figure which shows the data which described the material for detecting the attack called a signature. 6 is a flowchart illustrating an operation in which the lower intrusion detection device 42 makes a supplement request to the upper intrusion detection device 20 in the first embodiment. It is a figure which shows the conventional lower intrusion detection apparatus 500. FIG.

Explanation of symbols

100 ... Intrusion detection system,
10 ... External network,
20 ... upper intrusion detection device,
21 ... Database,
22 ... Log database,
30 ... Upper network,
41-45 ... Lower intrusion detection device,
51-53 ... Monitoring target network (lower network),
DB1-DB5 ... database,
SG11 to SG50: Signature.

Claims (1)

An intrusion detection system that is connected to a network composed of an upper network and a plurality of lower networks, and monitors unauthorized communication from an external network,
An upper intrusion detection device provided between the external network and the upper network, and a plurality of lower intrusion detection devices provided between the upper network and the respective lower networks,
The lower intrusion detection device is
Storing means for dividing a signature used for intrusion detection among the plurality of lower intrusion detection devices and storing a part of the signatures ;
Transfer means for transferring the signature and the warning content stored in the lower intrusion detection device to the upper intrusion detection device when an attack on the lower intrusion detection device itself by unauthorized communication is detected ;
A device having
The upper intrusion detection device stores a signature that is transferred from the upper Symbol subordinate intrusion detection device to the database, a device for intrusion detection on behalf using the database,
An intrusion detection system, characterized in that a lower intrusion detection device in which a failure has occurred is separated from the upper network.

Images