JP4987019B2 - Attack traffic detection method and attack traffic detection apparatus - Google Patents

Description

  The present invention relates to an attack traffic detection method and an attack traffic detection apparatus, and more particularly to an attack detection technique on an IP network.

In detecting abnormal traffic such as attacks and intrusions on an IP network, a technique for statistically detecting a value that deviates from normal traffic fluctuation as abnormal is known.
As statistical anomaly detection, the amount of traffic such as the number of packets and the number of bytes as disclosed in Non-Patent Document 1 below, or the variation in traffic as disclosed in Non-Patent Document 2 below is shown. A method for a time series of values obtained by measuring traffic characteristics such as entropy at regular intervals has been proposed. These methods detect an attack when a time series value exceeds a dynamic or static threshold.
Although these methods assume that fluctuations in normal traffic are relatively small and fluctuations are random, on the Internet, fluctuations are large even for normal traffic, and time correlation is large. In the following non-patent document 3, when statistical anomaly detection is performed for such traffic, there are many cases in which outliers that occur stochastically in normal traffic are erroneously detected as attacks. It has been shown.
In view of such problems, Non-Patent Document 3 does not use a measurement value at a single monitoring interval, but uses a measurement value at a plurality of monitoring intervals. We propose a method to detect this.

P. Barford, J. Kline, D. Plonka, and A. Ron, “A signal analysis of netWork traffic anomalies,” Proc. 2nd ACM SIGCOMM Workshop in Internet Measurement (IMW2002), Marseille, France, October 2002. A. Lakhina, M. Crovella and C. Diot, “Characterization of Network-Wide Anomalies in Traffic Flows,” Proc. 4th ACM SIGCOMM Conference on Internet Measurement (IMC 2004), Taormina, Italy, October 2004. L. Zhang, Z. Zhu, K. Jeffay, J.S. Marron, and F.D. Smith, “MultiResolution Anomaly Detection for the Internet”, Proceedings of IEEE INFOCOM Workshop on Automated Network Management, Phoenix, AZ, April 18, 2008. A. Hubert, and R. van Mook, “Measures for making DNS more resilient against forged answers,” draft-ietf-dnsext-forgery-resilience-09.txt, November 18,2008.

In attack detection, it is required that false detection is minimized, a warning can be promptly generated when an attack occurs, and an attack over a long period of time is not overlooked. However, the attack patterns that can occur are frequently used at low rates for a long period of time, such as pulse types, and it is not easy to satisfy this condition at a single monitoring interval.
Also, depending on the attack method, the attack success probability is determined by the total number of attack packets sent regardless of the attack packet transmission rate and attack time. In such cases, an attack that transmits high-rate traffic for a short time. And it is necessary to be able to detect both attacks that transmit low rate traffic for a long time.
However, when monitoring at long intervals, there is a problem that it takes time to detect short-term attacks. On the other hand, when monitoring at short intervals, low-rate attacks are missed for a long time or false detection occurs. To do.
The latter is a problem that a low rate attack is missed for a long time when the threshold is set high. However, for long-term low-rate attacks, there is no information on whether or not the attack observed at that monitoring interval will continue thereafter only by monitoring at a short interval. Assuming that the rate continues for a long time after that, the threshold needs to be set below the rate at which the attack can succeed.
However, normal traffic may also exceed the threshold sporadically due to fluctuations. In such a case, false detection occurs.

Therefore, it is effective to simultaneously monitor attacks at a plurality of monitoring intervals. However, in the method proposed in Non-Patent Document 3, the attack probability based on the number of attack packets is not considered, and only a deviation from the normal traffic distribution is used. Since an anomaly has been detected in this case, an effective threshold cannot be set, and there is a possibility that an oversight may occur when the attack traffic is at a low rate that does not deviate from the normal traffic distribution.
The present invention has been made to solve the problems of the prior art, and an object of the present invention is to monitor an attack at a plurality of monitoring intervals and set a threshold value for each monitoring interval based on the probability of success or failure of the attack. Accordingly, it is an object of the present invention to provide a technique capable of reducing false detection and oversight of attack traffic.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
(1) An attack traffic detection method that counts the traffic volume of a monitoring target network at every monitoring interval and detects an occurrence of an attack when the traffic volume within the monitoring interval exceeds a threshold, and holds a plurality of monitoring intervals; The monitoring interval is set to T ₁ , T ₂ ,..., T _n in the short order, and the attack success probability is given by F (R, T) with respect to the attack packet rate number R and the attack duration T. , a _i, but predetermined safety factor, when e _i is the probability that a predetermined, for each monitoring interval Ti, the division to rate the number of R _i the number of acquired packets monitoring interval T _i The attack success probability F (R _i , T _{i + 1} × a _i ) based on the rate number R _i is calculated, and the calculated attack success probability is F ( _{R i, T i + 1 ×} a i) < It is detected as an attack traffic at the time that do not meet the _i.
(2) An attack traffic detection method that counts the traffic volume of the monitored network at every monitoring interval and detects as an attack occurrence when the traffic volume within the monitoring interval exceeds a threshold, and holds a plurality of monitoring intervals; When the monitoring interval is set to T ₁ , T ₂ ,..., T _n in the short order, the attack success probability is given by F (R, T) with respect to the attack packet rate number R and the attack duration T. , as the threshold _{r i} for the monitoring interval _{T i,} for a predetermined probability _{e i} and the safety factor _{a i} to a _{predetermined, F} a _{(r i, T i + 1} × a i) < meet _{e i r i} together is set, calculates the rate number R _i by dividing the number of acquired packets at the monitoring interval T _i, in any of the monitoring interval of the plurality of monitoring interval, rate number R _i in the monitoring interval threshold r Attack when _i is exceeded Detect as traffic.

(3) An attack traffic detection device that counts the traffic volume of the monitoring target network at every monitoring interval and detects as an attack occurrence when the traffic volume within the monitoring interval exceeds a threshold, and monitors at every monitoring interval A traffic acquisition unit for acquiring the target traffic, and a plurality of monitoring intervals are held, and the monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} ascending order, and the attack packet rate number R and attack duration T are set. On the other hand, when the attack success probability is given by F (R, T), a _i , is a predetermined safety factor, and e _i is a predetermined probability , for each monitoring interval Ti, The attack success probability calculation unit that calculates the rate number R _i by dividing the acquired number of packets by the monitoring interval T _i and calculates the attack success probability F (R _i , T _{i + 1} × a _i ) based on the rate number R _i. And multiple monitoring intervals The attack detection unit detects the attack traffic when the calculated attack success probability does not satisfy F (R _i , T _{i + 1} × a _i ) <e _i .
(4) An attack traffic detection device that counts the traffic volume of the monitored network at every monitoring interval and detects as an attack occurrence when the traffic volume within the monitoring interval exceeds a threshold, and monitors at every monitoring interval Successful attack with respect to a traffic acquisition unit for acquiring the target traffic and the plurality of monitoring intervals in the shortest order T ₁ , T ₂ ,..., T _n with respect to the attack packet rate number R and the attack duration T When the probability is given by F (R, T), as a threshold r _i for the monitoring interval T _i , F (r _i , T) for a predetermined safety factor a _i and a predetermined probability e _{i i + 1} × a _i) with setting the r _i that satisfies <e _i, wherein each monitoring interval, acquired packet number division to rate the number of attack success probability calculation for calculating the R _i in the monitoring interval T _i Part and multiple In any of the monitoring interval of the monitoring interval, and an attack detection section for detecting as an attack traffic when the rate number R _i in the monitoring interval exceeds the threshold value r _i.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the present invention, it is possible to monitor attacks at a plurality of monitoring intervals and to set a threshold value for each monitoring interval according to the probability of success or failure of the attack, thereby reducing false detection and oversight of attack traffic.

It is a block diagram which shows schematic structure of the attack traffic detection apparatus of the Example of this invention. It is a graph which shows an example of the calculation example of the attack success probability with respect to several attack rates in a cache pollution attack.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
FIG. 1 is a block diagram showing a schematic configuration of an attack traffic detection apparatus according to an embodiment of the present invention. The attack traffic detection apparatus according to the present embodiment includes a traffic acquisition unit 10, an attack success probability calculation unit 11, and an attack detection unit 12.
The traffic acquisition unit 10 acquires traffic to be monitored. Here, traffic unrelated to the attack may be filtered.
In this embodiment, when a plurality of monitoring intervals are held, and the monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} order of shortness, the attack success probability calculation unit 11 performs every monitoring interval T _i . Then, the rate number R _i is calculated by dividing the acquired number of packets by the monitoring interval T _i , and the attack success probability F (R _i , T _{i + 1} × a _i ) based on the rate number R _i is calculated. However, 1 ≦ i ≦ n−1.
Here, as the attack duration, T _{i + 1} is used instead of the monitoring interval T _i . This is because it is only necessary to detect an attack with a rate that is successful before a longer monitoring interval T _{i + 1} at a certain monitoring interval T _{i. For} a sufficiently small probability e _i , F (R _i , T _{i + 1} × a _i This is because it is only necessary to detect attacks with the number of rates satisfying <e _i . A _i is a safety factor.

As a typical attack in which the attack success probability is obtained by the attack packet rate number R and the attack duration time T, there is a DNS cache poisoning attack.
The success probability F (R, T) of this attack is described in the aforementioned Non-Patent Document 4, and is given by the following equation (1).
In Equation (1), W is the round trip time between the cache server and the authoritative server, P is the number of port numbers used by the cache server, I is the space size of the transaction ID, O is the cache timeout time in the conventional attack, and Kaminsky type W for attack.

FIG. 2 shows an example of calculation examples of attack success probabilities for a plurality of attack rates in a cache pollution attack. In FIG. 2, A has an attack rate of 100 pps and B has an attack rate of 10,000 pps.
As can be seen from FIG. 2, a high rate attack that is established before a long time interval can be detected by monitoring at a short time interval (for example, several seconds or less), and a low rate long time attack is detected at a long time interval (for example, It can be detected by monitoring several minutes).
The attack detection unit 12 checks whether the rate number R _i satisfies the above equation (1) at any one of a plurality of monitoring intervals. If the above equation (1) is not satisfied, the attack detection unit 12 judge.
In the present embodiment, the attack success probability calculation unit 11, for each monitoring interval T _i, and calculate a rate number R _i by dividing the number of acquired packets at the monitoring interval T _i, to the rate number R _i Instead of calculating the attack success probability F (R _i , T _{i + 1} × a _i ) based on the attack success probability calculation unit 11, F (r _i , T _{i + 1} × a _{i) with} respect to a sufficiently small probability e _{i in} advance. ) <together keep calculating the threshold r _i which satisfies e _i, for each monitoring interval T _i, and calculate a rate number R _i by dividing the number of acquired packets at the monitoring interval T _i, attack detection section 12 , It is checked whether at any one of the plurality of monitoring intervals T _i , the rate number R _i is equal to or greater than the threshold value r _i satisfying the above-described equation (1). You may make it do.

As described above, in the present embodiment, the number of rates (or the threshold r _i ) considered as an attack is changed in each of a plurality of monitoring times (T ₁ , T ₂ ,..., T _n ), Detect attacks.
For example, in monitoring at a short time interval (for example, 1 minute), a high-rate attack (for example, the monitoring interval is 1 minute and the attack success probability is 5% within 1 hour) before the long time interval is established. In the case of monitoring over a long time interval (for example, 1 hour), a low rate long-term attack (for example, a monitoring interval) that is overlooked by such a high-rate attack threshold is not detected. Is an attack with an attack success probability exceeding 5% within one day). As a result, it is possible to reduce false detection and oversight of attack traffic.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

10 Traffic acquisition unit 11 Attack success probability calculation unit 12 Attack detection unit

Claims (4)

An attack traffic detection method that counts the traffic volume of a monitored network at every monitoring interval and detects an attack when the traffic volume within the monitoring interval exceeds a threshold,
A plurality of monitoring intervals are held, and the monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} ascending order, and the attack success probability is F (R, T), and when a _i is a predetermined safety factor and e _i is a predetermined probability , the number of acquired packets is divided by the monitoring interval T _i for each monitoring interval Ti. Then, the rate number R _i is calculated, and the attack success probability F (R _i , T _{i + 1} × a _i ) based on the rate number R _i is calculated,
An attack characterized in that it is detected as attack traffic when the calculated attack success probability does not satisfy F (R _i , T _{i + 1} × a _i ) <e _i at any one of a plurality of monitoring intervals. Traffic detection method. An attack traffic detection method that counts the traffic volume of a monitored network at every monitoring interval and detects an attack when the traffic volume within the monitoring interval exceeds a threshold,
A plurality of monitoring intervals are held, and the monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} ascending order, and the attack success probability is F (R, when given by T), as the threshold _{r i} for the monitoring interval _{T i,} with respect to the probability _{e i} a predetermined safe coefficient _{a i} a _{predetermined, F (r i, T i} + 1 × a i) < with setting the r _i that satisfies e _i, to calculate the rate number R _i by dividing the number of acquired packets at the monitoring interval T _i,
An attack traffic detection method comprising: detecting an attack traffic when a rate number R _i within a monitoring interval exceeds a threshold r _i in any one of a plurality of monitoring intervals. An attack traffic detection device that counts the traffic volume of a monitored network at every monitoring interval and detects an attack occurrence when the traffic volume within the monitoring interval exceeds a threshold,
A traffic acquisition unit that acquires traffic to be monitored at a plurality of monitoring intervals;
A plurality of monitoring intervals are held, and the monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} ascending order, and the attack success probability is F (R, T), and when a _i is a predetermined safety factor and e _i is a predetermined probability , the number of acquired packets is divided by the monitoring interval T _i for each monitoring interval Ti. An attack success probability calculation unit that calculates a rate number R _i and calculates an attack success probability F (R _i , T _{i + 1} × a _i ) based on the rate number R _i ;
An attack detection unit for detecting as attack traffic when the calculated attack success probability does not satisfy F (R _i , T _{i + 1} × a _i ) <e _i at any one of a plurality of monitoring intervals. An attack traffic detection apparatus characterized by the above. An attack traffic detection device that counts the traffic volume of a monitored network at every monitoring interval and detects an attack occurrence when the traffic volume within the monitoring interval exceeds a threshold,
A traffic acquisition unit that acquires traffic to be monitored at a plurality of monitoring intervals;
The plurality of monitoring intervals are set to T ₁ , T ₂ ,..., T _{n in} ascending order, and the attack success probability is given by F (R, T) with respect to the attack packet rate number R and the attack duration T. when, as the threshold _{r i} for the monitoring interval _{T i,} satisfying the relative probability _{e i} a predetermined safe coefficient _{a i} a _{predetermined, F (r i, T i} + 1 × a i) <e i r with setting the _i, and the each monitoring interval, acquired attack success probability calculation unit that the number of packets is divided by monitoring interval T _i to calculate the rate number R _i,
An attack traffic detection apparatus comprising: an attack detection unit configured to detect as attack traffic when the number of rates R _i in the monitoring interval exceeds a threshold r _i at any one of a plurality of monitoring intervals.

Images