JP4363650B2 - Intrusion detection processing apparatus, intrusion detection processing method, and recording medium - Google Patents

Description

The present invention relates to processing for preventing unauthorized access from an external network, and in particular, an intrusion detection processing device and an intrusion detection processing method for preventing unauthorized access from an external network by using a linkage operation function of the intrusion detection device. And a recording medium.

  FIG. 6 is a diagram showing functional blocks and a processing direction showing a conventional intrusion detection apparatus 500.

  In the conventional intrusion detection apparatus 500, the packet decoder 51 temporarily stores communication packets between the monitoring target network and the external network, and performs packet structure analysis and decoding processing at the data link layer level.

  The preprocessor 52 formats the data so that the detection engine 54 can easily handle it. The preprocessor plug-in 53 sets ON / OFF of processing performed by the preprocessor 52. The detection engine 54 is the heart of an intrusion detection device that collates data shaped by the preprocessor plug-in 53 and a signature rule that is an attack pattern.

  The rule set 55 is a database that records signature rules that are attack patterns.

  The output plug-in 56 performs a behavior when matching performed by the detection engine 54 is matched, determines a behavior described in the signature rule recorded in the rule set 55, and performs a different behavior to each output destination 60. .

  As the output destination 60, a database 61, a local log file 62, a monitoring system 63, and a Syslog 64 can be considered.

  In other words, in the conventional intrusion detection apparatus 500, the input communication packet 58 is analyzed by the packet decoder 51, the preprocessor 52 shapes the data to be easily handled by the detection engine 54, and then the detection engine 54 converts the data into the rule set 55. Check against recorded signature rules.

  FIG. 7 is a flowchart showing the operation at the start-up in the conventional example.

  When the operation of the intrusion detection device starts, in S51, the preprocessor plug-in 53 reads settings relating to the configuration of data read by the detection engine 54. For example, settings such as layering of communication packets and a combination of two communication packets transferred to the detection engine 54 are included.

  In S52, the information is developed in the preprocessor 52 and the communication packet information from the packet decoder 51 is waited. In S53, the signature rule is read from the database of the rule set 55, and the detection engine is detected from the plurality of signature rules recorded in the database. The signature rule that 54 refers to for matching is selected and deployed to the detection engine 54. In S <b> 54, the detection engine 54 that referred to the signature rule waits for communication packet information processed by the preprocessor 52. After completing these operations, a communication packet 58 is input.

  FIG. 8 is a diagram illustrating processing during an intrusion detection operation when an attack packet is input from the communication packet 58 in the above-described conventional example.

  In S61, the packet decoder 51 analyzes and decodes the packet configuration at the data link layer level of the communication packet. In S62, the preprocessor 52 makes the detection engine 54 readable according to the analysis information. Shape the communication packet. In S63, the detection engine 54 performs a matching process with the signature rule. When a matching communication packet is generated, the operation information specified by the signature rule matched by the matching, for example, “the specified detection information is stored in the database”. The operation information “record” is notified to the output plug-in 56. In S64, the output plug-in 56 executes the above-described specifying operation.

By performing the above series of operations, it is monitored whether or not the attack packet is included in the communication packet between the monitored network and the external network. If the attack packet is included, the designated detection operation is performed ( For example, see Patent Document 1).
JP 2002-335246 A

  The conventional intrusion detection apparatus 500 analyzes an attack pattern seen from the past unauthorized access history and detects the attack pattern. That is, unauthorized access is detected by comparing the signature rule and the communication packet one by one.

  If the amount of unauthorized access in the past increases, the increased amount must be detected, and the amount of processing necessary for the detection increases. As a solution to the increase in the processing amount, it is possible to enhance the processing capability of the intrusion detection device. However, the enhancement of the processing capability of the intrusion detection device has a problem that the cost of the intrusion detection device itself is high, and there is a problem that it is necessary to discard the existing intrusion detection device and review the introduction.

The present invention can cope with an increase in the amount of unauthorized access in the past without preparing a plurality of expensive intrusion detection devices with high processing capabilities, that is, even intrusion detection devices without high processing capabilities. It is an object of the present invention to provide an intrusion detection processing device, an intrusion detection processing method, and a recording medium.

The present invention provides a plurality of intrusion detection processing devices arranged between the monitoring target network and an external network in order to monitor and prevent unauthorized communication with respect to each of the monitoring target networks. The signature rule dividing means for dividing the signature rule referred to for detecting that the communication between the monitored network and the external network is unauthorized communication into a plurality of blocks, and the signatures of the divided plurality of blocks Each of the plurality of intrusion detection processing devices is associated with each of the plurality of intrusion detection processing devices, and each of the plurality of intrusion detection processing devices has detection processing execution means for executing processing for detecting the signature rule of the corresponding block. The signature rule dividing means converts the signature rule into the signature rule. When dividing into several blocks, is intrusion detecting device, characterized in that the means for time division processing.

The present invention provides a plurality of intrusion detection processing devices arranged between the monitoring target network and an external network in order to monitor and prevent unauthorized communication with respect to each of the monitoring target networks. In the control method, a signature rule that is referred to in order to detect that communication between the monitored network and the external network is unauthorized communication is divided into a plurality of blocks and stored in a memory. Each of the divided plurality of block signature rules is associated with each of the plurality of intrusion detection processing devices and stored in a memory, and each of the plurality of intrusion detection processing devices detects the signature rule of the corresponding block. And a detection process execution step for executing the process to perform Dividing step, the signature rule, when dividing into the plurality of blocks, a method of controlling the intrusion detecting device, characterized in that the dividing processing step time.

The present invention provides a plurality of intrusion detection processing devices arranged between the monitoring target network and an external network in order to monitor and prevent unauthorized communication with respect to each of the monitoring target networks. A signature rule dividing procedure for dividing a signature rule referred to in order to detect that communication between the monitored network and the external network is unauthorized communication into a plurality of blocks and storing it in a memory Each of the divided plurality of block signature rules is associated with each of the plurality of intrusion detection processing devices and stored in a memory, and each of the plurality of intrusion detection processing devices has a corresponding block signature rule. The detection process execution procedure for executing the detection process A computer-readable recording medium storing a program to be executed, wherein the signature rule dividing procedure is a procedure for time-sharing processing when the signature rule is divided into the plurality of blocks. It is.

According to the present invention, it is possible to cope with an increase in the amount of unauthorized access in the past without preparing a plurality of expensive intrusion detection devices with high processing capabilities, that is, even intrusion detection devices without high processing capabilities. The effect that it can respond is produced.

  The best mode for carrying out the invention is the following examples.

  FIG. 1 is a block diagram showing an intrusion detection system 100 that is Embodiment 1 of the present invention.

  The intrusion detection system 100 includes monitored networks NW11 to NW13, NW21 to NW23, NW31 to NW33, intrusion detection devices D1 to D3, an aggregation device C1, and an external network NW1.

  Each of the intrusion detection devices D1 to D3 includes a plurality of monitoring target networks, and is arranged between the monitoring target network and the external network in order to monitor and prevent unauthorized communication with respect to each of the monitoring target networks. A plurality of intrusion detection processing devices;

  Each of the intrusion detection devices D1 to D3 has an internal network, that is, the monitoring target networks NW11 to NW13 are connected to the first intrusion detection device D1, and the monitoring target is connected to the second intrusion detection device D2. The networks NW21 to NW23 are connected, and the monitoring target networks NW31 to NW33 are connected to the third intrusion detection device D3.

  The intrusion detection devices D1 to D3 are arranged at each entrance of the external network NW1, and the aggregation device C1 is similarly connected to the external network NW1, and all devices are in an environment where communication is possible via the network.

  The reason why the rule area that is processed by the intrusion detection device D1, the area of the processing target rule of the intrusion detection device D2, and the area of the processing target rule of the intrusion detection device D3 are mutually changed is as follows. .

  First, the majority of communications that are attacked are the same subs, except when the attacker can identify what kind of server the attack target is, such as attacking a specific public server. There is a known property of uniformly attacking the network.

  Considering this characteristic, the attack shown in FIG. 1 is an attack on all of the intrusion detection devices D1 to D3, and any one of the intrusion detection devices D1 to D3 detects this series of attacks. If the detection log is left in the aggregation device C1, the attack is detected as a whole.

  Therefore, since it is necessary for the intrusion detection devices D1 to D3 to be integrated so that an attack can be detected, the processing target rules of the intrusion detection devices D1, D2, and D3 are changed from each other.

  The aggregation device C1 is a device that collects detection log information from a plurality of the intrusion detection devices, analyzes the collected detection logs, and returns the analysis result to the plurality of intrusion detection devices.

  FIG. 2 is a diagram illustrating processing inside the intrusion detection devices D1 to D3, that is, signature rule blocking and time division processing in the first embodiment.

  The signature rule R1 is a signature rule recorded in a later-described rule set 16 configured inside the intrusion detection device, and includes signature 1 to signature 7.

  In the first embodiment, the signature rule R1 is divided into a plurality of blocks and divided into a block B1, a block B2, and a block B3. The block B1 is composed of a signature 1 and a signature 2, the block B2 is composed of a signature 3, a signature 4 and a signature 5, and the block B3 is composed of a signature 6 and a signature 7.

  The schedule SK1 is a schedule in which the intrusion detection device D1 detects the plurality of blocks B1, B2, and B3 arranged for each time (arranged at different times). The signatures SY1, SY2, and SY3 are monitored by all of the signature rules R1 (signature 1 to signature 7) without overlapping the intrusion detection devices D1 to D3.

  Through the above operation, at time t of schedule SK1, intrusion detection device D1 executes intrusion detection processing using signature 1 and signature 2 included in block B1, and intrusion detection device D2 is included in block B2. Intrusion detection processing using signature 3, signature 4 and signature 5 is executed, and intrusion detection device D3 performs intrusion detection processing using signature 6 and signature 7 included in block B3. Execute. Also, each intrusion detection device D1 to D3 collects the detection information in the aggregation device C1 via the network NW1, and shares the detection information between the intrusion detection devices D1 to D3.

  FIG. 3 is a block diagram illustrating a configuration example of the intrusion detection device D1.

  The configurations of the intrusion detection devices D2 and D3 are the same as the configuration of the intrusion detection device D1.

  The intrusion detection device D1 includes a packet decoder 11, a preprocessor 12, a preprocessor plug-in 13, a detection engine 14, a time management unit 15, a rule set 16, a rule update unit 17, and an output plug-in 18. .

  The packet decoder 11 switches the signature rule R1 to be checked against the communication packet every time, temporarily stores the communication packets between the monitoring target networks NW11 to NW33 and the external network NW1, and transmits the packet at the data link layer level. Performs configuration analysis and decoding.

  The preprocessor 12 formats the data so that the detection engine 14 can handle it.

  The preprocessor plug-in 13 sets ON / OFF of processing performed by the preprocessor 12.

  The detection engine 14 is the heart of the intrusion detection device D1 that collates the data shaped by the preprocessor plug-in 13 and the signature rule R1 that is an attack pattern.

  The time management unit 15 manages the time of the schedule SK1, and performs notification to change the rule set 16 referred to by the detection engine 14 at a specified time (for example, every 10 minutes).

  The rule set 16 is a database that records a signature rule R1 that is an attack pattern and blocks B1 to B3 that are a group of signature rules R1.

  The rule update unit 17 updates the signature rule R1 and the blocks B1 to B3 in the rule set 16.

  The output plug-in 18 performs a behavior when the matching is matched in the detection engine 14.

  That is, the rule set 16 is an example of a signature rule dividing unit that divides a signature rule referred to in order to detect that communication between the monitoring target network and the external network is unauthorized communication into a plurality of blocks.

  The signature rule dividing means is means for variably controlling the time distribution for the time division processing according to the detection log information.

  The search engine 14 associates each of the divided plurality of block signature rules with each of the plurality of intrusion detection processing devices, and each of the plurality of intrusion detection processing devices detects the signature rule of the corresponding block. It is an example of the detection process execution means which performs the process to perform. That is, the search engine 14 is a means for performing coincidence detection processing on all of the plurality of blocks without omission when performing coincidence detection processing with the plurality of blocks.

  FIG. 4 is a block diagram showing the aggregation device C1.

  The aggregation device C1 includes a detection information input / output unit 21, a database 22, and a database management unit 23.

  The detection information input / output unit 21 detects unauthorized access by the intrusion detection devices D1 to D3, receives the output detection information, and outputs detection information obtained by collecting these pieces of information as aggregate information. The database 22 records detection information.

  The database management unit 23 executes storage processing and organization processing in the database 22, rearranges the collected detection information, and creates aggregated information to be output to the outside via the detection information input / output unit 21. For example, the detection information of the top five detection information up to the previous day is notified to the user using each intrusion detection device D1 to D3. For the notification, a conventional notification method such as e-mail is used. In the above case, in addition to notifying the user of the detection information, the detection information may be reported to an organization for storing statistical information, or the detection information may be notified to the administrator.

  FIG. 5 is a flowchart illustrating an operation of switching the signature rule R1 in the first embodiment.

  First, the time management unit 15 determines whether or not it is the designated time (S1), and when the designated time interval has elapsed, the detection engine 14 issues a block change notification (S2). Upon receiving the block change notification, the detection engine 14 refers to the rule set 16 (S3), and the rule set 16 determines whether there is update information when referring to the detection engine 14 (S4). For example, the rule update unit 15 is inquired, and if there is a change, after changing the block and the signature rule R1, the signature rule R1 in units of blocks is transferred to the detection engine 14 (S5). If there is no update information (S4), the detection engine 14 reads the transferred signature rule R1 again and performs detection processing (S6).

  With the above operation, an intrusion detection system that performs intrusion detection while suppressing the signature rule R1 to a certain amount is realized. That is, a conventional intrusion detection device must see, for example, 100 signatures within a predetermined time, but in the intrusion detection device according to the embodiment within the predetermined time, it is sufficient to see, for example, 50 signatures that are half of the signature. .

Compared to the conventional example in which one intrusion detection device detects all intrusions, the load processed by one intrusion detection device in the above embodiment can be reduced. According to the above embodiment, a high processing capacity can be achieved. It is possible to cope with an intrusion detection device that does not have one, and it is superior to a single intrusion detection device that cannot be dealt with in the event that a detection failure occurs by simply reducing the number of rules, that is, as in the above embodiment. This is a system in which a plurality of intrusion detection devices can detect an attack as a whole, and it is not necessary to prepare a plurality of expensive detection devices with high processing capabilities.

1 is a block diagram illustrating an intrusion detection system 100 that is Embodiment 1 of the present invention. FIG. In Example 1, it is a figure which shows the process inside the intrusion detection apparatuses D1-D3, ie, the block formation of a signature rule, and a time division process. It is a block diagram which shows the structural example of the intrusion detection apparatus D1. It is a block diagram which shows the aggregation apparatus C1. 5 is a flowchart illustrating an operation of switching a signature rule R1 in the first embodiment. It is a figure which shows the functional block which shows the conventional intrusion detection apparatus 500, and the direction of a process. It is a flowchart which shows the operation | movement at the time of starting in the said prior art example. FIG. 10 is a diagram illustrating processing during an intrusion detection operation when an attack packet is input from a communication packet 58 in the conventional example.

Explanation of symbols

100 ... Intrusion detection system,
D1, D2, D3 ... Intrusion detection device,
11 ... Packet decoder,
12 ... Preprocessor,
13: Preprocessor plug-in,
14: Detection engine,
15 ... Time management department,
16 ... ruleset,
17 ... rule update part,
18 ... Output plug-in,
C1 ... aggregation device,
21 ... Detection information input / output unit,
22 ... Database,
23 ... Database management department,
NW1 ... external network,
NW11 to NW33 ... monitored network,
R1 ... Signature rule,
B1, B2, B3 ... Block,
SY1, SY2, SY3 ... signature,
SK1 ... Schedule.

Claims (5)

In a plurality of intrusion detection processing devices arranged between the monitored network and an external network in order to monitor and prevent unauthorized communication to each monitored network, where there are a plurality of monitored networks,
Signature rule dividing means for dividing a signature rule referred to for detecting that communication between the monitored network and the external network is unauthorized communication into a plurality of blocks;
Each of the divided plurality of block signature rules is made to correspond to each of the plurality of intrusion detection processing devices, and each of the plurality of intrusion detection processing devices executes processing for detecting the signature rule of the corresponding block. Detection processing execution means;
And the signature rule dividing means is means for performing time division processing when the signature rule is divided into the plurality of blocks. In claim 1,
The intrusion detection processing apparatus according to claim 1, wherein the signature rule dividing unit is a unit that variably controls time distribution for the time division processing according to detection log information. In claim 1 or claim 2,
An intrusion detection process characterized in that any one of the plurality of intrusion detection processing devices detects a series of attacks on all of the plurality of intrusion detection processing devices and leaves a detection log in the aggregation device. apparatus. In a control method of a plurality of intrusion detection processing devices arranged between the monitored network and an external network in order to monitor and prevent unauthorized communication to each monitored network, where there are a plurality of monitored networks ,
A signature rule dividing step of dividing a signature rule referred to in order to detect that communication between the monitored network and the external network is unauthorized communication into a plurality of blocks and storing it in a memory;
Each of the divided plurality of block signature rules is associated with each of the plurality of intrusion detection processing devices and stored in a memory, and each of the plurality of intrusion detection processing devices detects the signature rule of the corresponding block. A detection processing execution step for executing the processing to be performed;
And the signature rule dividing step is a step of performing time division processing when the signature rule is divided into the plurality of blocks. A program for controlling a plurality of intrusion detection processing devices arranged between the monitored network and an external network in order to monitor and prevent unauthorized communication to each monitored network when there are a plurality of monitored networks In
A signature rule dividing procedure for dividing a signature rule referred to in order to detect that communication between the monitored network and the external network is unauthorized communication into a plurality of blocks and storing it in a memory;
Each of the divided plurality of block signature rules is associated with each of the plurality of intrusion detection processing devices and stored in a memory, and each of the plurality of intrusion detection processing devices detects the signature rule of the corresponding block. A detection process execution procedure for executing the process to be performed;
The signature rule dividing procedure is a procedure for performing time-sharing processing when the signature rule is divided into the plurality of blocks. Program.

Images