JP5600626B2 - Traffic passing route analysis method, program, and apparatus - Google Patents

Description

The present invention relates to traffic passing path analysis, in particular, on the basis of the normal features available in generic firewall device, traffic passing path analysis method capable grasp the traffic flow to the labor-saving and high accuracy, a program, and apparatus.

  A firewall device is a type of router installed at a connection point between a managed network and an external network. In order to increase the safety of the managed network, the firewall device allows only necessary packets to pass based on the traffic communication policy (security policy, hereinafter referred to as “policy information”) for each organization and blocks dangerous packets. . Therefore, the configuration information (rule information) of the firewall device needs to be appropriately set based on the policy information. The firewall device may be arranged between the segment networks in the managed network (for example, between the intranet of department a and the intranet of department b).

  In general, a network administrator receives an “order sheet (request form)” for requesting setting of a firewall device from each department (for example, an administrator of each intranet). The network manager creates “policy information” based on the order sheet and the basic policy of the organization. The policy information is composed of a permutation of a plurality of “policy elements”. The firewall management device creates “rule information” for each firewall device based on the policy information. The rule information is also configured by a permutation of a plurality of “rule elements”. Then, the firewall management device transmits rule information for each firewall device.

  In some cases, it may be necessary to evaluate and diagnose whether or not the traffic communication status of the firewall or router is as designed for the network that has already been constructed. There is an issue of analyzing the current state of traffic flow. The traffic flow is, for example, information on a route through which traffic from the computer A0 to the computer B0 passes through the firewalls FW1 and FW2. Such information analysis can also be realized by personal work in a network that is operated only by small and static route setting. Today, however, network configurations typically have more than 10 firewalls and routers and use dynamic routing. In such an environment, it is impossible to perform analysis promptly and without error by personal work.

  In relation to such circumstances, the following conventional technologies (NetFlow, Non-Patent Document 1, Non-Patent Document 2) add a new function or additional device to a general-purpose firewall device, and traffic flow on the firewall. Can be analyzed.

Cisco, “Introduction to Cisco IOS NetFlow-A Technical Overview”, [online], [searched February 21, 2011], Internet <URL: http://www.cisco.com/en/US/prod/collateral /iosswrel/ps6537/ps6555/ps6601/prod_white_paper0900aecd80406232.html> Cisco, “IETF RFC 3954: Cisco Systems NetFlow Services Export Version 9,” [online], [searched February 21, 2011], Internet <URL: http://www.ietf.org/rfc/rfc3954.txt >

However, the above-described prior art cannot be used with conventional general-purpose devices, the load on the firewall device is increased, and the introduction / installation effort / cost of additional devices become practical problems.

  The purpose of the present invention is to solve the above-mentioned problems of the prior art, and does not necessarily use a technique that is not necessarily widely used (for example, a technique that loads a firewall device such as dynamic route information or NetFlow). It is an object of the present invention to provide a traffic passage route analysis method, program, and apparatus that can grasp a network traffic flow with reduced labor and high accuracy on the basis of functions normally available in a firewall apparatus.

  In order to solve the above-described problems of the prior art, the present invention is a traffic passage route analysis method, and the arrival date and time of each traffic in each firewall device and the firewall device to which the traffic has arrived from a plurality of predetermined firewall devices, , Obtaining the individual traffic information by associating the information of the transmission source and destination of the traffic with each other, and the individual traffic constituting the individual traffic information with the match of the transmission source and the destination and the arrival date and time Grouping based on proximity within a predetermined standard to obtain aggregated traffic information, and for each aggregated traffic constituting the aggregated traffic information, each individual traffic belonging to the aggregated traffic in the order of arrival date and time Find the permutation of the firewall devices that the traffic has arrived at Characterized in that it comprises the step of estimating the said population about traffic from a common source as the passing path of the entire traffic flow leading to the destination.

  In addition, the present invention is a traffic passage program, which causes a computer to function as a traffic passage analysis device by causing the computer to execute the traffic analysis method.

  Further, the present invention is a traffic passage analysis device, and from a plurality of predetermined firewall devices, the arrival date and time of each traffic in each firewall device, the firewall device that the traffic has reached, the transmission source and destination of the traffic, The individual traffic information creating unit that creates the individual traffic information by associating and acquiring the information, and the individual traffic constituting the individual traffic information within the predetermined criteria of the coincidence of the transmission source and the destination and the arrival date and time An aggregated traffic information creating unit that creates aggregated traffic information by grouping on the basis of proximity of each other, and for each aggregated traffic constituting the aggregated traffic information, in order of arrival date and time of each individual traffic belonging to the aggregated traffic, Order of firewall devices that individual traffic arrived The calculated, characterized by comprising a passage path estimation unit for estimating a that order column as the passing path of the entire traffic flow leading to the destination from the aggregate traffic to a common source.

  Further, the individual traffic information is obtained by referring to a traffic log recorded by each firewall device.

  ADVANTAGE OF THE INVENTION According to this invention, the passage route of a traffic flow can be estimated based on the individual traffic information which consists of various items normally acquirable in a general-purpose firewall apparatus. In particular, by creating individual traffic information with reference to a traffic log in a general-purpose firewall device, it is possible to estimate a passage route while avoiding overload and additional costs.

It is a figure which shows an example of the system which concerns on this invention. It is an example of the traffic flow and traffic log (traffic information) for demonstrating this invention. It is a functional block diagram of the traffic passage analysis device of the present invention. It is a flowchart of the traffic passage route analysis method of the present invention. It is an example which showed individual traffic information in the table form. It is the example which showed aggregated traffic information in the table format. It is a flowchart which estimates a passage route. It is an example of the correspondence information of the passage route information updated with a passage route estimation flow, and aggregated traffic and a passage route.

  Hereinafter, the present invention will be described in detail with reference to the drawings. FIG. 1 is an example of a system according to the present invention, and is a diagram illustrating an example of a relationship between a traffic passage analysis device and a firewall device that is an analysis target of a passing traffic flow.

  The traffic passage analysis device 1 obtains necessary information from a plurality of predetermined firewall devices 20 to be analyzed, and analyzes the traffic flow. The firewall device 20 is disposed between the management target network 50 and an external network 60 that is generally included in the entire Internet 70. The managed network 50 includes a plurality of internal networks 40, and the router 30 is responsible for packet transfer within the network.

  For example, the management target network 50 is a network of a company, and the internal network 40 is an intranet of each department of the company. Although not necessarily shown in such an arrangement in FIG. 1, the firewall device 20 is arranged not only between the managed network 50 and the external network 60 but also between the internal networks 40 in the managed network 50. It may be done.

  In the present invention, it is basically assumed that the firewall device 20 to be analyzed is in the management target network 50 as shown in FIG. The traffic passage analysis device 1 is preferably a device that also manages these firewall devices 20, since the analyzed traffic flow can be effectively used as basic information for management. However, as long as necessary information can be acquired, any firewall device can be added to the analysis target regardless of inside or outside of the management target network 50.

  The firewall device 20 checks which rule element the packet received from the external network 60 (or the internal segment network 40) corresponds to. Based on the action described in the corresponding rule element, whether or not the packet can be transferred is determined.

  The firewall device 20 can record a communication result for each packet as a “traffic log” (or “access log”). The “traffic log” is a record indicating which action is taken by which rule element for which packet. In the present invention, it is assumed that a corresponding traffic log item is recorded in advance so that necessary information can be acquired from the firewall device 20.

  The traffic log is acquired by the firewall device 20 for a predetermined period, and then sent to a log storage server (not shown in FIG. 1) using the Syslog protocol, etc., and the traffic passing path analysis device 1 acquires the stored log. Also good. Alternatively, it may be acquired directly from the firewall device 20. In any case, it can be obtained by any method that does not overload the firewall device 20.

  In the present invention, the information necessary for the traffic passing path analyzing apparatus 1 is described as being acquired from the traffic log, but the present invention is not limited to this. That is, similar information regarding traffic in the firewall device 20 can be acquired, and if the firewall device 20 is not overloaded, it is not always necessary to acquire information via a log. In the present invention, the traffic log is used as an embodiment of information that can be recorded by a general-purpose firewall device 20 by a normal management method and can be acquired relatively easily. At this time, not all types of information that can be recorded in the traffic log are required. In addition, as a convenience for facilitating the explanation of the technical significance of each piece of information, general traffic log terms or abbreviations are appropriately borrowed for explanation.

  FIG. 2 is an example of a traffic flow and a traffic log that are consistently used to describe the present invention (as described above, the traffic log may more generally be traffic information). In the upper part of FIG. 2, firewall devices FW1 to FW5 of a predetermined arrangement and hosts (A), (B), and (C) that are traffic sources or destinations are shown as examples. Of these firewall devices, FW1 and FW2 are defined as analysis targets.

  In FIG. 1, in order to describe the entire system, a series of firewall devices 20 with no particular distinction has been described. However, in the present invention, distinction between firewall devices is necessary. Therefore, when referring to the firewall device in the following description, it is assumed that the FW1 to FW5 are used.

In FIG. 2, the following Tf1, Tf2, and Tf3 are shown as examples of the traffic flow that occurs sequentially.
Tf1 and Tf2: transmission source (src) = (A), destination (dst) = (B), service used (service) = http
Tf3: Source (src) = (A), Destination (dst) = (B), Service used (service) = ssh

  As shown in the upper part of Fig. 2, Tf1 is the traffic flow of the packet of the http service sent from the source (A) to the destination (C), and the firewall devices FW1, FW2 and FW3 are sequentially allowed to pass through and pass through And the destination has been reached. Similarly, Tf2 is a traffic flow of the packet of the http service sent from the transmission source (A) to the destination (C), and reaches the destination that sequentially passes through the firewall devices FW1, FW2, and FW3 on the way. Further, Tf3 is a traffic flow of the packet of the ssh service sent from the transmission source (A) to the destination (C), but the firewall apparatus FW1 refuses to communicate on the way and does not reach the destination.

  As described above, after the traffic flows Tf1 to Tf3 are sequentially permitted or rejected, traffic logs that record the progress remain in the firewall devices FW1 to FW5. The lower part of FIG. 2 shows an example of FW1 and FW2 that are analysis targets, among traffic logs of each firewall device. (T1), (T2) and (T3) are traffic logs corresponding to the traffic flows Tf1, Tf2 and Tf3 recorded in FW1, respectively. (T4) and (T5) are traffic logs corresponding to the traffic flows Tf1 and Tf2 recorded in FW2, respectively. Note that the association between a traffic log (traffic information) and a traffic flow is a feature of the present invention, and details will be described later.

  The content of the items in the traffic log is, for example, as follows in the order of items for (T1), and is a record of the traffic flow Tf1. The format of the log item is an example in NetScreen (registered trademark), which is an example of a general-purpose firewall device, but the present invention can be similarly implemented even in a log of another format. Further, as described above, the present invention can be applied to any firewall device that can acquire the same information without necessarily using a log format.

“FW1” is a traffic log acquired by the firewall device FW1.
“Acl1 policy = 001” The packet of the traffic T1 reaches the physical interface for which the access control list acl1 is set among the physical interfaces of FW1, and the policy with policy ID = 001 in the access control list Applied.
“Src = (A)” The transmission source host of the traffic is (A). (Generally shown as an IP address.)
“Dst = (B)” The destination host of the traffic is (B). (Similar to the sender, it is generally shown as an IP address.)

“Service = http” The service used by the traffic is http. (In addition, there can be various protocol services such as ssh, telnet, ftp, and SMTP.)
“Action = allow” The traffic was received by FW1 and communication was permitted as an operation result. (If rejected, “action = deny”.)
“Start_time = t1” The occurrence date and time of the traffic, that is, the reception date and time at FW1 is t1. The t1 part is generally specified by year, month, day, minute, second, etc. (Note that the reception date and time in FW2 corresponding to the traffic flow is t1 + dt1 slightly delayed from t1. In the present invention, the passage route is obtained from such information as described later.)
“Duaration = 1” The duration of the traffic in FW1 is 1 (the unit is a predetermined arbitrary unit).
“Send = 100” The number of transmitted bytes of the traffic is 100.
“Rcvd = 10” The number of received bytes of the traffic is 10.

  Although not shown in the lower part of FIG. 2, the source port number “SrcPort” and the destination port number “DstPort” may be further specified as the contents of the traffic log items. Various other items may also be used.

  FIG. 3 shows a functional block diagram of the traffic passage analysis device 1 according to the present invention. The traffic passage analysis device 1 includes a log acquisition unit 2 (or traffic information acquisition unit 2), an individual traffic information creation unit 3, an aggregated traffic information creation unit 4, a passage route estimation unit 5, and a display unit 6. Among these, the individual traffic information creation unit 3 further includes a reaching device identification unit 31, an interface identification unit 32, an arrival date acquisition unit 33, a transmission source / destination acquisition unit 34, a port acquisition unit 35, and an attached information acquisition unit 36. The passage route estimation unit 5 includes an accuracy calculation unit 51.

  FIG. 4 shows a flowchart of the traffic passing route analyzing method according to the present invention, and the role of each functional block in FIG. In step S1, the log acquisition unit 2 accesses a predetermined plurality of firewall devices as shown in FIG. 1 or FIG. 2, or accesses a syslog server or the like that stores traffic logs of the plurality of firewall devices. Then, a traffic log is acquired from the predetermined plurality of firewall devices. Alternatively, the traffic information acquisition unit 2 may acquire the traffic information equivalent to the traffic log information by directly or indirectly accessing a predetermined plurality of firewall devices without necessarily passing through the log format.

  In step S2, the individual traffic information creation unit 3 creates individual traffic information using the information acquired in step S1. An example of the individual traffic information is shown in FIG. The example of FIG. 5 represents individual traffic information in the form of a table for the log outputs T1 to T5 of the firewall devices FW1 and FW2 to be analyzed described in FIG. As shown in FIG. 5, the individual traffic information is information obtained by merging the traffic logs acquired from the respective firewall devices in a simple description.

  In order to perform merging, the individual traffic information creation unit 3 first assigns a consistent and unique ID to traffic (T1 to T5) appearing in each traffic log. The ID is represented by T1 to T5 used when the traffic log has already been described. The assigned ID is shown in the traffic ID (TID) column in FIG.

  For each of the traffic thus identified (referred to as individual traffic), the reaching device identification unit 31 through the attached information acquisition unit 36 included in the individual traffic information creation unit 3 respectively from the traffic log as described below. Extract and associate information. In the traffic log, since information on each traffic is generally described for each line, all information on a specific traffic is extracted from the same line.

  The reaching device identification unit 31 associates the information of the firewall device that the individual traffic has reached. For example, the firewall device FW1 is associated with the individual traffic T1. In addition, the interface identification unit 32 acquires a physical interface that the traffic has reached in the firewall device.

  In general, a firewall device can have a plurality of physical interfaces on both the input side and the output side of a packet or the like. The interface identification unit 32 acquires the identification information of the physical interfaces on the input side and the output side when the traffic has arrived (including cases where the traffic has reached, that is, communication permission and communication rejection). If the identification information is obtained from the traffic log, it can be obtained from the name of the access control list (acl) set in each physical interface. For example, the physical interface set in the access control list acl1 in the firewall apparatus FW1 is associated with the individual traffic T1 as the reached interface. If the access control list item cannot be acquired, the configuration information of each firewall device may be read in advance, and information corresponding to the access control list item may be extracted from the log.

  The information acquired by both the reaching device identifying unit 31 and the interface identifying unit 32 is a pair, and is shown in the column of “appeared at” in FIG. For example, “FW1 acl1” is associated with the individual traffic T1.

  The arrival date acquisition unit 33 acquires the date and time when the individual traffic arrived at the firewall device. That is, if it is acquired from the traffic log, the start_time item is acquired and associated with the individual traffic. In FIG. 5, for example, the individual traffic T1 is associated with 2010/09/16 20:29:00 (September 16, 2010, 20: 29: 0).

  The transmission source / destination acquisition unit 34 acquires the transmission destination and destination of the individual traffic. That is, if it is acquired from the traffic log, the src and dst items are acquired as IP addresses and associated with the individual traffic. In FIG. 5, for example, the source IP address 10.0.0.1 and the destination IP address 172.19.76.1 are associated with the individual traffic T1.

  The port acquisition unit 35 acquires the source port number and / or the destination port number of the individual traffic. When the port acquisition unit 35 can acquire the port number, the individual traffic is based on TCP or UDP.

  In addition, various information may be acquired by the attached information acquisition unit 36. For example, as indicated by the items “send” and “rcvd” in FIG. 5, respectively, the number of transmitted bytes and the number of received bytes of the individual traffic may be acquired.

  Further, the attached information acquisition unit 36 may acquire a use protocol, for example. In the example of FIG. 5, the individual traffic T1 to T5 are all TCP protocol. The attached information acquisition unit 36 may further acquire information specific to each protocol. If the TCP protocol is used, the service used may be acquired. In this case, if it is obtained from the traffic log, it is obtained from the service item.

  As described above, when various information is acquired in step S2 and the individual traffic information creation unit 3 creates individual traffic information, in step S3, the aggregated traffic information creation unit 4 creates aggregated traffic information using the individual traffic information. FIG. 6 shows an example of aggregated traffic information. In FIG. 6, as an example of the aggregated traffic information, aggregated traffic information created from the individual traffic information of FIG. 5 is shown in a table format.

  The aggregated traffic information is information that aggregates individual traffic in the individual traffic information, that is, groups them into each aggregated traffic. Each aggregated traffic is aggregated from the individual traffic so as to represent each of the sequentially generated traffic flows (Tf1, Tf2, Tf3, etc.) as described in FIG.

  The aggregated traffic information creation unit 4 obtains each aggregated traffic and assigns an ID. The ID is shown as AT1, AT2, AT3, etc. in the column of ATID (Aggregated Traffic ID), that is, the aggregated traffic ID in FIG. For example, AT1 corresponds to the traffic flow Tf1 in FIG. 2, and is a collection of the individual traffic T1 and T4 in FIG. 6 as shown in the individual traffic column (consists of column) constituting the AT1. . Similarly, AT2 corresponds to traffic flow Tf2, and aggregates individual traffic T2 and T3. AT3 corresponds to the traffic flow Tf3, and as a result of aggregation, the individual configuration traffic is only T3.

  The number of configuration individual traffics is shown in the column of aggregate count (AT1, AT2, AT3, respectively, 2, 2, 1). Note that in FIG. 6, there are two firewall devices to be analyzed, FW1 and FW2, and aggregated traffic consisting of up to two individual traffics is shown as an example, but there are three or more firewall devices to be analyzed Then, aggregated traffic composed of three or more individual traffics can be created.

  Each embodiment in which the aggregated traffic information creation unit 4 creates such aggregated traffic is as follows.

  In one embodiment, the identity of a transmission source and a destination, which is the minimum condition that individual traffic belonging to the same aggregated traffic should satisfy, is used. The transmission source and destination can be referred to in the individual traffic information by acquisition by the transmission source / destination acquisition unit. Furthermore, since not only the transmission source and the destination but also the same port number is used for the same aggregated traffic, the aggregated traffic information creation unit 4 may also use the identity of the port number acquired by the port acquisition unit 35. .

  As shown in FIG. 6, for example, for aggregate traffic AT1, the source IP address (Src IP) and the destination IP address (Dst IP) are 10.0.0.1 and 172.19.76.1, respectively, and the configuration individual traffic T1 and It is the same address as the address in T4. Similarly, the port numbers (source Src Port and destination Dst Port) are the same as the numbers in T1 and T4.

  In general, if the network is operating normally, there is no traffic flow that passes through the same firewall device more than once. Therefore, as an additional embodiment, the aggregated traffic information creating unit 4 creates aggregated traffic information so that the same firewall device acquired by the reaching device identifying unit 31 does not exist in the same aggregated traffic. Also good. For the same reason, the aggregated traffic information may be created so that there is no same thing including the distinction of the physical interface acquired by the interface identifying unit 32 in each firewall device.

  Furthermore, when data of one traffic flow is sequentially relayed by the firewall device, the arrival times are almost the same time. More precisely, the arrival time is obtained as a series of values within a predetermined range. Therefore, as an additional condition for belonging to the same aggregated traffic, it can be used that the arrival dates and times acquired by the arrival date and time acquisition unit 33 fall within a predetermined range.

For example, in AT1, the arrival date and time of individual traffic T1 and T4 is
T1: 2010/09/16 20:29:00 That is (September 16, 2010 20: 29: 0)
T4: 2010/09/16 20:29:01 ie (September 16, 2010 20:29:01)
It is. The difference in arrival date and time between T1 and T4 is 1 second (the 1 second is an example value), and the difference in arrival date and time between T1 or T4 and other individual traffic is 1 minute or more. From this, it can be determined that T1 and T4 belong to the same aggregated traffic AT1, and other traffic belongs to different aggregated traffic. For AT1, arrival date information is represented in the start time column as the first T1 value as 2010/09/16 20: 29: 0. Similarly, it can also be determined that the individual traffic T2 and T5 whose arrival time difference is 1 second belong to the aggregated traffic AT2.

  The embodiment using the arrival time is also essential in the present invention, as is the identity of the transmission source and the destination. In particular, it is essential for obtaining the order in the passage route in step S4 described later.

  In addition, as a premise for determining the aggregated traffic based on the arrival time as described above, in step S1 in FIG. 4, the traffic information and the like are acquired after the timing information in each firewall device is synchronized in advance. . Alternatively, on the assumption that there is an error between the timing information in each firewall device, the arrival time described by the clock of each firewall device in the traffic log acquired by the log acquisition unit 2 is You may make it correct to a clock.

  For example, by correcting the clock of the firewall device FW1 backward by 1 second, it matches the clock of the traffic passage route analysis device 1, and by correcting the clock of the firewall device FW2 backward by 2 seconds, the traffic passage route analysis device 1 The arrival time at FW1 and the arrival time at FW2 are uniformly corrected to the clock information in the traffic path analysis device 1 in advance.

  In addition to the combinations of the embodiments described above, it is possible to create aggregated traffic information using the identity or similarity of each piece of information acquired by the reaching device identification unit 31 to the attached information acquisition unit 36. it can. For example, in FIG. 6, the number of transmitted bytes and the number of received bytes acquired by the attached information acquiring unit 36 are also shown in the send / rcvd column. Such information may also be used additionally.

  As described above, after the aggregated traffic information creating unit 4 creates aggregated traffic information in step S3 of FIG. 4, in step S4, the passing route estimation unit 5 estimates the passing route using the aggregated traffic information. FIG. 7 is a flowchart for estimating the passage route, and is a detailed flow in step S4 of FIG.

  Steps S41 to S43 in FIG. 7 are sequentially executed for each aggregated traffic ATi (i = 1, 2, 3,...) Of the aggregated traffic information, as shown in the step S44 of the repeated determination, and all aggregates are performed. Processing is performed for traffic. In start step S40, the aggregated traffic identification counter i = 1 is set, and the first aggregated traffic AT1 is determined as a processing target, and the process proceeds to step S41.

  In step S41, passage route information is constructed for the i-th aggregated traffic ATi. Passing path information refers to the passage of the firewall device and the physical interface through which the traffic flow corresponding to the aggregated traffic has passed when it reaches the same common destination from the common source for all individual traffic constituting the aggregated traffic. This is information for specifying a route, and is constructed in association with the transmission source and destination. Here, the order of passage of the firewall device and the physical interface refers to the aggregated traffic information (and individual traffic information), in the order of arrival date and time (start time in FIG. 5) of the individual traffic corresponding to the firewall device and the physical interface. Determined.

  In step S42, the entire passage route information created so far is updated based on the passage route constructed from ATi. That is, if the same passage route as the passage route of the ATi exists in the passage route information that has already been created, the addition of new passage route (and ID assignment) is not performed, and conversely, if it does not exist, Add (and give ID) as a new route.

  In step S43, the aggregated traffic ATi is associated with the passage route information. Unlike the step S42, the association is performed regardless of whether or not a passage route constructed from ATi already exists.

  In step S44, as described above, it is determined whether processing has been performed for all aggregate traffic ATi. If not, counter i is incremented by one and steps S41 to S43 are performed for the next aggregate traffic AT (i + 1). Perform the process.

  FIG. 8 shows, in tabular form, an example of passage route information that is sequentially created and updated according to the above flow. (1) of FIG. 8 is an example of the passage route information in step S42, and (2) is an example of correspondence between the aggregated traffic and the passage route in step S43. Each table is blank in step S40 except for the item portion, and is created sequentially from the upper side each time the subsequent steps are followed. In FIG. 8, the rows of P1 and P2 in (1) and the rows of AT1, AT2, and AT3 in (2) are obtained by sequentially processing the aggregated traffic information shown in FIG. Therefore, AT2 and AT3 are common to FIGS.

FIG. 8 (1) shows an example of passage route information. The PID is an ID that is sequentially assigned to the passage routes that constitute the passage route information. Each passage route is associated with a transmission source (Src IP), a firewall device and physical interface (FW / acl name) that arrives halfway, their arrival sequence, and a destination (Dst IP). The passing route P1 with the ID P1 is constructed from the aggregated traffic AT1 of FIG. 6 that is the first processing target, and is sequentially specified as [1] to [4] below.
[1] Send from source (10.0.0.1) → [2] (FW1 acl1) → [3] (FW2 acl2) → [4] Destination (172.19.76.1) The order of [3] is determined in the order of the arrival times of the individual traffics T1 and T4 described above. The aggregated traffic AT1 processed first is associated with the passage route P1 as shown in (2).

The aggregated traffic AT2 to be processed second after AT1 is the same as P1 whose transit route is obtained by AT1, and therefore no new ID is added to the table of (1). Then, as shown in (2), AT2 and P1 are associated with each other. The aggregated traffic AT3 to be processed third is refused to communicate in FW1 as described in FIG. 2, and is composed of only the individual traffic T3 as shown in FIG. Therefore, the passage route of AT3 is
[1] Transmission from source (10.0.0.1) → [2] (FW acl1) is reached and blocked → [3] Destination (172.19.76.1) is not reached and is different from P1, so new Is assigned an ID, and the passage route P2 is associated as shown in (1). Further, as shown in (2), the correspondence between AT3 and P2 is performed. Although not shown in (1), each of the passage route information may additionally include communication permission / rejection information.

  Further, FIG. 8 also shows the result for the aggregated traffic AT4 processed fourth. Since the passing route of AT4 is different in P1 from the destination and the passing physical interface in FW2, and also different from P2, P3 is added as a new passing route.

  In the description of FIG. 7 and FIG. 8, the passage route is specified according to the order of the firewall device and the physical interface that has passed. However, by omitting the specification of the physical interface, more simply, only the firewall device that has passed. You may carry out by order.

  As described above, when the passage route estimation unit 5 estimates the passage route in step S4, in step S5, the accuracy calculation unit 51 calculates the accuracy for each passage route based on the estimated passage route information. . Note that step S5 is optional and may be skipped.

  The accuracy is a numerical value of the “probability” of each passing route, and is calculated based on the following circumstances. Normally, traffic flows between the same ground (source / destination IP pair) should all be associated (associated) with the same passage route. However, there may be a temporary shift in the traffic appearance order due to a failure, a packet order reversal, or an error in the arrival time of the recording due to a delay in log processing in the firewall device. As a result, a plurality of different passage routes appear to be associated with the traffic flow between the same ground, and there is a possibility that the administrator makes a mistake in passage route discrimination. Further, there is a possibility that the traffic flow becomes deny in the middle like T3 (AT3).

  Therefore, it is a passage route between the same ground, but the accuracy is obtained by counting the number of aggregated traffic (appearance frequency) associated with each other for passage routes whose firewall interfaces and physical interfaces that pass in the middle differ as a whole passage permutation. be able to. In general, the appearance frequency can be used as the accuracy on the assumption that the occurrence of a failure or the like is rare compared to the normal state.

For example, with respect to P1 and P2 which are passing routes between the same ground (source IP address = 10.0.0.1, destination IP address = 172.19.76.1) in the state processed from AT1 to AT4 in (2) of Fig. 8 The accuracy f (P) of can be obtained as follows. That is, two AT1 and AT2 are tied to P1, and one AT3 is tied to P2,
f (P1) = 2/3, f (P2) = 1/3
As required.

  That is, in the above example, the accuracy calculation unit 51 calculates the accuracy based on the number of aggregate traffic associated with each passing route for each of the passing routes having the same transmission source and destination and different permutations of passing. It is an example to give.

  As described above, if communication passage permission / rejection information is additionally included in each passage route information, by using the information for accuracy calculation, the accuracy calculated only by the appearance frequency as described above is used. Furthermore, it is possible to obtain a highly accurate accuracy. Alternatively, when the accuracy is calculated only by the appearance frequency and it is desired to check the details, the administrator may check the information of the traffic log as appropriate.

  The processing of each step in FIG. 4 and the corresponding roles of the log acquisition unit 2 to the passage route estimation unit 5 in FIG. 3 have been described above. In the present invention, the display unit 6 can appropriately display the progress and final results in each step, and can be used for the judgment of an administrator or the like. That is, in response to a display request from the administrator, the individual traffic information as shown in FIG. 5, the aggregated traffic information as shown in FIG. 6, the passage information as shown in FIG. 8, and the route between the same ground calculated in step S5 The accuracy between each other can be appropriately displayed using the display unit 6. Various known methods such as GUI (Graphical User Interface) and CLI (Command Line Interface) can be used for the display in response to the request from the administrator.

  Note that the present invention can also be implemented as a traffic passage analysis program that causes a computer to execute the steps of FIG. 4 to cause the computer to function as the traffic passage analysis device illustrated in FIG. The computer functions as a traffic passage analysis device that reads the program and executes the above steps.

  As described above, according to the present invention, it is possible to estimate the passage route of a traffic flow based on individual traffic information including various items that can be normally acquired in a general-purpose firewall device. In particular, by creating individual traffic information with reference to a traffic log in a general-purpose firewall device, it is possible to estimate a passage route while avoiding overload and additional costs.

  DESCRIPTION OF SYMBOLS 1 ... Traffic passage analysis apparatus, 2 ... Log acquisition part (traffic information acquisition part), 3 ... Individual traffic information creation part, 4 ... Aggregation traffic information creation part, 5 ... Passage path estimation part, 6 ... Display part

Claims (9)

Individual traffic information obtained by associating and acquiring information on the arrival date and time of each traffic in each firewall device, the firewall device that the traffic has reached, and the source and destination of the traffic from a plurality of predetermined firewall devices And the stage of
Grouping each individual traffic constituting the individual traffic information into aggregate traffic information by grouping the individual traffic based on the matching of the transmission source and destination and proximity within a predetermined standard of arrival date and time;
For each aggregated traffic that constitutes the aggregated traffic information, a permutation of firewall devices that the individual traffic has reached is obtained in order of arrival date and time of each individual traffic belonging to the aggregated traffic, and the permutation is common to the aggregated traffic. Estimating as a passing route of the entire traffic flow from the source to the destination ,
Further at the step of said aggregated traffic information, traffic passing path analysis method characterized by be Rukoto said aggregated traffic information as dedicated traffic between the firewall device is identical to the dedicated traffic has reached not the same group . Individual traffic information obtained by associating and acquiring information on the arrival date and time of each traffic in each firewall device, the firewall device that the traffic has reached, and the source and destination of the traffic from a plurality of predetermined firewall devices And the stage of
Grouping each individual traffic constituting the individual traffic information into aggregate traffic information by grouping the individual traffic based on the matching of the transmission source and destination and proximity within a predetermined standard of arrival date and time;
For each aggregated traffic that constitutes the aggregated traffic information, a permutation of firewall devices that the individual traffic has reached is obtained in order of arrival date and time of each individual traffic belonging to the aggregated traffic, and the permutation is common to the aggregated traffic. Estimating as a passing route of the entire traffic flow from the source to the destination ,
Further at block to the passage path, traffic passage path analysis, characterized in association Rukoto one passage path throughout the aggregate traffic the permutation, and the common source and destination for each aggregate traffic, is a common Method. In the step of setting the individual traffic information, the port number assigned to each traffic is additionally acquired and associated with the individual traffic information.
3. The traffic passing route analyzing method according to claim 1, wherein the individual traffic is further grouped based on a match of port numbers to obtain the aggregated traffic information at the stage of the aggregated traffic information. Further, in the step of setting the individual traffic information, the individual traffic information is obtained by additionally acquiring and associating the physical interface that the traffic has reached in the firewall device that the traffic has reached,
Further, in the step of estimating as the passage route, in the order of the arrival date and time, a permutation of a pair of a firewall device to which each individual traffic has arrived and a physical interface that has arrived at the firewall device is obtained, and the permutation is determined as the entire traffic. traffic passing path analysis method according to any one of claims 1 to 3, characterized in that estimating the passage path. Any said predetermined plurality of firewall apparatus is a general-purpose firewall device, wherein at the step of the individual traffic information, of claims 1 to 4 recorded traffic log reference to each firewall apparatus for determining the individual traffic information The traffic passage route analysis method according to claim 1. Depending on the display request from the administrator, the dedicated traffic information, according to any one of claims 1 to 5, further comprising the step of displaying at least one of said aggregated traffic information and the passage path Traffic passage route analysis method. A traffic passage analysis program for causing a computer to function as a traffic passage analysis device by causing a computer to execute the traffic passage route analysis method according to any one of claims 1 to 6 . Individual traffic information is obtained by associating and acquiring information on the arrival date and time of each traffic in each firewall device, the firewall device that the traffic has reached, and the source and destination of the traffic from a plurality of predetermined firewall devices. An individual traffic information creation section to be created;
An aggregated traffic information creating unit that creates aggregated traffic information by grouping each individual traffic constituting the individual traffic information based on a match between the transmission source and destination and proximity within a predetermined criterion of arrival date and time;
For each aggregated traffic that constitutes the aggregated traffic information, a permutation of firewall devices that the individual traffic has reached is obtained in order of arrival date and time of each individual traffic belonging to the aggregated traffic, and the permutation is common to the aggregated traffic. A passage route estimation unit that estimates a passage route as a whole traffic flow from the transmission source to the destination,
The aggregated traffic information creation unit in addition, individual traffic between the firewall device is identical to the dedicated traffic reaches the traffic passing path analyzer according to claim to Rukoto said aggregated traffic information not to the same group. Individual traffic information is obtained by associating and acquiring information on the arrival date and time of each traffic in each firewall device, the firewall device that the traffic has reached, and the source and destination of the traffic from a plurality of predetermined firewall devices. An individual traffic information creation section to be created;
An aggregated traffic information creating unit that creates aggregated traffic information by grouping each individual traffic constituting the individual traffic information based on a match between the transmission source and destination and proximity within a predetermined criterion of arrival date and time;
For each aggregated traffic that constitutes the aggregated traffic information, a permutation of firewall devices that the individual traffic has reached is obtained in order of arrival date and time of each individual traffic belonging to the aggregated traffic, and the permutation is common to the aggregated traffic. A passage route estimation unit that estimates a passage route as a whole traffic flow from the transmission source to the destination,
Further in the passage path estimating unit, said permutation and the common source and destination for each aggregate traffic, the traffic passes through path analyzing apparatus according to claim association Rukoto one passage path throughout the aggregate traffic as a common .