JP6679516B2 - Control device and control method - Google Patents

Description

  The present invention relates to a control device and a control method.

  In a network environment composed of various network devices (hereinafter referred to as “NW devices”) such as routers, switches, and gateways, various gateway security products are used to implement security measures (Non-Patent Document 1). . As such a gateway security product, for example, WAF (Web Application Firewall), FW (Firewall), IPS (Intrusion Prevention System), etc. are used (Non-patent Document 2). Further, UTM (Unified Threat Management) appliances in which various functions such as WAF, FW, and IPS are comprehensively implemented are also known.

  In WAF, FW, IPS, etc., by detecting and blocking communication (hereinafter referred to as “abnormal communication”) that may adversely affect IT equipment (eg, a terminal such as a PC) in the network, We are trying to ensure security. Hereinafter, devices such as WAF, FW, and IPS that detect and block abnormal communication will be referred to as “abnormal communication blocking device”. It should be noted that the abnormal communication includes not only communication for the purpose of cyber attack but also communication that occurs when an IT device or the like fails.

  In addition, an NW device having a function of detecting and blocking abnormal communication (hereinafter referred to as “NW device with abnormality detection function”) is also known (Non-patent document 3, Non-patent document 4). Such NW devices with an abnormality detection function include, for example, a switch with a security function added and a UTM appliance with a network function added.

  Here, in a large-scale network such as a communication carrier, as shown in FIG. 1, a network environment is often constructed using a plurality of NW devices 10 with an abnormality detection function. Each NW device 10 with an abnormality detection function shown in FIG. 1 cuts off abnormal communication and allows non-abnormal communication (that is, normal communication) to pass through.

  Further, as shown in FIG. 2, by combining the NW device 20 and the abnormal communication blocking device 30 one by one, it is possible to construct a network environment for blocking the abnormal communication as in FIG. In the network environment shown in FIG. 2, each NW device 20 transfers communication to the abnormal communication blocking device 30 used by itself. The abnormal communication cutoff device 30 cuts off the abnormal communication among the communication transferred from the NW device 20, and transfers the normal communication to the NW device 20. As a result, abnormal communication can be blocked and normal communication can be passed.

  However, the NW device with an abnormality detection function and the abnormal communication blocking device have a problem that the price is higher than that of a normal NW device. In addition, if there is a bias in the communication volume of abnormal communication between NW devices with anomaly detection functions (or between anomalous communication blocking devices), the resources of the anomaly detection function (or abnormal communication blocking devices) are wasted, resulting in cost performance. There was a problem that it decreased.

  For example, among the three NW devices 10 with an abnormality detection function shown in FIG. 1, one NW device 10 with an abnormality detection function has a smaller amount of abnormal communication traffic than another NW device 10 with an abnormality detection function. And In such a case, in the one NW device 10 with an abnormality detection function, resources of the abnormality detection function are wasted and cost performance is deteriorated, as compared with other NW devices 10 with an abnormality detection function.

For these problems, as shown in FIG. 3, in a single communication abnormality cutoff device 30 several NW device 20 (in the example shown in FIG. 3, two NW device 20 ₁ and the NW 20 ₂₎ Can be used. However, in this case, in order to prevent a decrease in network throughput and latency, each NW device 20 needs to limit the amount of transfer to the abnormal communication blocking device 30 (that is, each NW device 20 is in charge of all communications). Is not transferred, but only a part of the communication is transferred to the abnormal communication blocking device 30). This is because the abnormal communication blocking device 30 has a predetermined communication amount that can be processed per unit time.

"Positioning and classification of gateway security products", [online], Internet <URL: http://www.symantec.com/content/ja/jp/enterprise/brochures/b-gateway_security-ja.pdf> "Differences from WAF, IPS / IDS, F / W (firewall)", [online], Internet <URL: https://www.symantec.com/en/jp/page.jsp?id=waf-ips- ids> "Security switch TiFRONT", [online], Internet <URL: http://it.ampere.co.jp/network/security_switch/> "SG SERIES", [online], Internet <URL: http://www.security-switch.com/>

  However, when a plurality of NW devices 20 use one abnormal communication blocking device 30, each NW device 20 receives the transfer amount of each NW device 20 (transfer amount to the abnormal communication blocking device 30). Unbalanced communication volume of abnormal communication was not taken into consideration.

For example, as illustrated in FIG. 4, when the NW device 20 ₁ receives a large amount of abnormal communication, but the NW device 20 ₂ does not receive the abnormal communication, the NW device 20 ₂ causes the abnormal communication blocking device. There was an unnecessary transfer to 30. In this case, reducing the amount of transfer NW device 20 _2, and, by increasing the transfer amount of the NW device 20 _1, it is possible to increase the amount of communication can be shut off communication abnormality in the entire network.

  In this way, by controlling the transfer amount of each NW device 20 in consideration of the bias of the abnormal communication received by each NW device 20, it is possible to improve the interruption rate of the abnormal communication in the entire network.

  The present invention has been made in view of the above points, and an object thereof is to improve the blocking rate of abnormal communication.

  Therefore, in order to solve the above problems, in a control device connected to a plurality of network devices, the ratio of abnormal communication blocked by a communication blocking device connected to the network device in the communication amount of the network device Based on the cutoff rate, the distribution ratio calculation unit that calculates a distribution ratio indicating a ratio to be allocated to the processing of communication transferred from the network device among the processing capabilities of the communication cutoff device, and the distribution ratio calculation unit. A control unit that controls a transfer amount from the network device to the communication blocking device based on the calculated distribution ratio.

  The cutoff rate of abnormal communication can be improved.

It is a figure explaining the structural example (the 1) of the conventional network environment. It is a figure explaining the structural example (the 2) of the conventional network environment. It is a figure explaining an example in case a plurality of NW devices use an abnormal communication interception device. It is a figure explaining a subject in case a plurality of NW devices use an abnormal communication interception device. It is a figure which shows the structural example of the network environment in embodiment of this invention. It is a figure showing an example of hardware constitutions of a control device in an embodiment of the invention. It is a figure showing an example of functional composition of a control processing part in an embodiment of the invention. 6 is a flowchart showing an example of a transfer amount control process in the embodiment of the present invention. It is a figure explaining an example of distribution of the total processing capacity per unit time of an abnormal communication interception device. It is a figure which shows the other structural example of the network environment in embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<Configuration of network environment N>
First, a configuration example of the network environment N according to the embodiment of the present invention will be described with reference to FIG. FIG. 5 is a diagram showing a configuration example of the network environment N in the embodiment of the present invention.

  As shown in FIG. 5, the network environment N according to the embodiment of the present invention includes a control device 100, a plurality of NW devices 20, and an abnormal communication blocking device 30. The network environment N is, for example, a LAN (Local Area Network) or the like.

  The control device 100 is one or more computers having a control processing unit 110. The control device 100 controls the communication amount (transfer amount) that each NW device 20 transfers to the abnormal communication blocking device 30 by the control processing unit 110.

  The control processing unit 110 receives the status signal from each NW device 20 to acquire the status of the traffic volume of each NW device 20 (that is, the traffic volume of the ingress port and the traffic volume of the exit port). Then, the control processing unit 110 distributes the total processing capacity per unit time of the abnormal communication blocking device 30 to each NW device 20 according to the communication amount of the entrance port and the communication amount of the exit port. The ratio (hereinafter referred to as “distribution ratio”) is calculated. After that, the control processing unit 110 transmits a control signal indicating a transfer amount according to the distribution ratio to each NW device 20. In the NW device 20 that receives the control signal, the transfer amount to the abnormal communication blocking device 30 is set (updated) according to the control signal.

  The entry port is a port that receives communication from another network environment to the network environment N when the NW device 20 is a router, for example. On the other hand, the exit side port is, for example, a port that transmits communication from another network environment into the network environment N when the NW device 20 is a router. In other words, for example, when the NW device 20 is a router, the inlet side port is the LAN side port and the outlet side port is the WAN (Wide Area Network) side port.

  The control processing unit 110 calculates the distribution ratio of each NW device 20 such that the distribution ratio increases as the communication amount of the exit port is smaller than that of the entrance port. That is, the control processing unit 110 increases the distribution ratio as the ratio of the communication amount blocked by the abnormal communication blocking device 30 (hereinafter, referred to as “blocking ratio”) to the communication amount of the entrance port is higher. Calculate the distribution ratio.

  As a result, the control processing unit 110 causes each NW device 20 to have a larger transfer amount to the abnormal communication blocking device 30 as the NW device 20 has a higher ratio of the communication amount of the abnormal communication to the communication amount of the normal communication. Can be controlled.

  Note that abnormal communication is communication that may adversely affect IT equipment (for example, a terminal such as a PC) in the network environment N, as described above. The abnormal communication includes not only communication aimed at cyber attacks and the like, but also communication that occurs when an IT device or the like fails. On the other hand, normal communication is communication other than abnormal communication.

  As described above, the NW device 20 is a device such as a router, a switch, or a gateway. The NW device 20 transfers the set transfer amount of the communication (normal communication or abnormal communication) received at the entrance port to the abnormal communication blocking device 30.

  Further, the NW device 20 transmits the communication (normal communication) received from the abnormal communication blocking device 30 from the exit port. It should be noted that the NW device 20 also transmits from the exit port, among the communications received at the entrance port, the communication that has not been transferred to the abnormal communication blocking device 30.

  As described above, the abnormal communication blocking device 30 is a device such as WAF, FW, IPS (or a device having these functions). The abnormal communication cutoff device 30 cuts off (removes) the abnormal communication out of the communication transferred from the NW device 20, and then transmits it to the NW device 20.

  Note that the network environment N may include a plurality of abnormal communication blocking devices 30. In this case, the network environment N may include, for example, a plurality of control devices 100 that control the transfer amount to each of the plurality of abnormal communication blocking devices 30. However, one control device 100 may control the transfer amount to the plurality of abnormal communication blocking devices 30.

<Hardware configuration of control device 100>
Next, a hardware configuration example of the control device 100 according to the embodiment of the present invention will be described with reference to FIG. FIG. 6 is a diagram showing a hardware configuration example of the control device 100 according to the embodiment of the present invention.

  As shown in FIG. 6, the control device 100 includes an external I / F 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, a CPU (Central Processing Unit) 104, and a communication I / F 105. , And an auxiliary storage device 106. These pieces of hardware are connected to each other via a bus B so that they can communicate with each other.

  The external I / F 101 is an interface with an external device. The external device includes a recording medium 101a and the like. The control device 100 can read and write the recording medium 101a and the like via the external I / F 101.

  The recording medium 101a includes, for example, a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), a USB (Universal Serial Bus) memory card, and the like.

  The RAM 102 is a volatile semiconductor memory that temporarily holds programs and data. The ROM 103 is a non-volatile semiconductor memory that can retain programs and data even when the power is turned off. The ROM 103 stores, for example, OS (Operating System) settings, network settings, and the like.

  The CPU 104 is an arithmetic device that reads programs and data from the ROM 103, the auxiliary storage device 106, and the like onto the RAM 102 and executes processing. The communication I / F 105 is an interface for connecting the control device 100 to the network.

  The auxiliary storage device 106 is, for example, a HDD (Hard Disk Drive) or SSD (Solid State Drive), and is a non-volatile storage device that stores programs and data. The programs and data stored in the auxiliary storage device 106 include, for example, an OS, application software that implements various functions on the OS, a program that implements the control processing unit 110, and the like.

  The control device 100 may include a display device such as a display and an input device such as a keyboard and a mouse, in addition to the above hardware.

  The control device 100 according to the present embodiment can realize various processes described later by having the hardware configuration shown in FIG.

<Functional configuration of control processing unit 110>
Next, a functional configuration example of the control processing unit 110 according to the embodiment of the present invention will be described with reference to FIG. 7. FIG. 7 is a diagram showing a functional configuration example of the control processing unit 110 in the embodiment of the present invention.

  As shown in FIG. 7, the control processing unit 110 includes a communication amount acquisition unit 111, a cutoff rate calculation unit 112, a distribution ratio calculation unit 113, and a transfer amount control unit 114. Each of these functional units is implemented by a process that causes the CPU 104 to execute a program that implements the control processing unit 110.

  The communication amount acquisition unit 111 acquires the communication amount (that is, the communication amount of the inlet side port and the communication amount of the outlet side port of each NW device 20) from the status signal received from each NW device 20.

  The state signal is transmitted from each NW device 20 as a response to the transmission request, for example, when the communication amount acquisition unit 111 transmits a transmission request for the state signal to each NW device 20 at predetermined time intervals. That is, the communication amount acquisition unit 111 acquires the communication amounts of the inlet side port and the outlet side port by monitoring the state of the communication amount of the inlet side port and the outlet side port of each NW device 20.

  However, the present invention is not limited to this, and the status signal may be transmitted from each NW device 20 to the control device 100 at predetermined time intervals, for example. In addition, the communication amount acquisition unit 111 stores the state signal transmitted from each NW device 20 in a predetermined storage area, and then reads the state signal from the storage area at a predetermined time interval, for example. May get.

  The cutoff rate calculation unit 112 calculates the cutoff rate from the communication amount acquired by the communication amount acquisition unit 111 (the communication amount of the inlet side port and the communication amount of the outlet side port of each NW device 20).

  The distribution ratio calculation unit 113 calculates the distribution ratio from the cutoff ratio calculated by the cutoff ratio calculation unit 112.

  The transfer amount control unit 114 transmits a control signal indicating the transfer amount according to the distribution ratio calculated by the distribution ratio calculation unit 113 to each NW device 20.

<Transfer amount control processing>
Next, a process (transfer amount control process) in which the control processing unit 110 of the control device 100 controls the transfer amount of each NW device 20 will be described with reference to FIG. 8. FIG. 8 is a flowchart showing an example of the transfer amount control process according to the embodiment of the present invention. The transfer amount control process shown in FIG. 8 is executed, for example, every predetermined time.

  First, the communication amount acquisition unit 111 acquires the communication amount (the communication amount of the inlet side port and the communication amount of the outlet side port of each NW device 20) from the status signal received from each NW device 20 (step S101). The state signal is transmitted from each NW device 20 as a response to the transmission request, for example, when the communication amount acquisition unit 111 transmits a state signal transmission request to each NW device 20.

Here, hereinafter, it is assumed that the network environment N includes m NW devices 20 (“NW device 20 ₁ ”, “NW device 20 ₂ ”, ..., “NW device 20 _m ”). . At this time, the communication amount of the inlet port of the NW device 20 _i (i = 1, ..., M) is a _i and the communication amount of the outlet port is b _i .

Next, the cutoff rate calculation unit 112 uses the communication amounts a _i and b _i (i = 1, ..., M) acquired by the communication amount acquisition unit 111 to determine the cutoff ratio r _i (i) of each NW device 20. = 1, ..., M) is calculated (step S102). Note that blocking ratio calculating unit 112, the i = 1, ···, m _{to, r i = (a i -b} i) / a i by blocking rate _{r i (i = 1, ···} , m ) Should be calculated.

Next, the distribution ratio calculation unit 113 calculates the distribution ratio S _i (i = 1, ..., M) of each NW device 20 from the blocking ratio r _i calculated by the blocking ratio calculation unit 112 (step S103). ). The distribution ratio S _i (i = 1, ..., M) is given by the following formula 1 when the total processing capacity of the abnormal communication interrupting device 30 per unit time is “1.0”. It is calculated.

なお、上記の数１に示す式においてαは、ハイパーパラメータである。αとしては、例えば、ＮＷ装置２０の最低分配割合（各ＮＷ装置２０の分配割合の下限）とすれば良い。このようなαの値は、例えば、ネットワーク環境Ｎの管理者等により予め設定される。

In addition, in the formula shown in the above Expression 1, α is a hyperparameter. The value α may be, for example, the minimum distribution ratio of the NW devices 20 (the lower limit of the distribution ratio of each NW device 20). Such a value of α is preset by, for example, the administrator of the network environment N.

Next, the transfer amount control unit 114 transmits, to each NW device 20, a control signal indicating the transfer amount according to the distribution ratio S _i (i = 1, ..., M) calculated by the distribution ratio calculation unit 113. (Step S104).

That is, the transfer amount control unit 114 calculates the transfer amount T _i (i = 1, ..., M) according to the distribution ratio S _i (i = 1, ..., M), for example. Then, the transfer amount control unit 114 controls to transfer the control signal indicating the transfer amount T _i (i = 1, ..., M) (that is, the transfer amount of the transfer amount T _i to the abnormal communication blocking device 30). Signal) to each NW device 20 _i .

Upon receiving the control signal from the control device 100, the NW device 20 _i (i = 1, ..., M) updates the setting to the transfer amount T _i indicated by the received control signal. As a result, the NW device 20 _i (i = 1, ..., M) can transfer the communication of the set transfer amount T _i among the communication received by the entrance port to the abnormal communication blocking device 30. it can.

In the transfer amount control process shown in FIG. 8, after the communication amount acquisition unit 111 acquires the communication amounts a _i and b _i from the NW device 20 _i , the cutoff rate calculation unit 112 cuts off the communication amounts a _i and b _i. Although the rate r _i has been calculated, it is not limited to this. For example, the control device 100 may acquire the cutoff rate r _i from each NW device 20 _i (i = 1, ..., M). Alternatively, the control device 100 may acquire either the “cutoff rate r _i ” or the “communication amount a _i and b _i ” from each NW device 20 _i (i = 1, ..., M).

  As described above, the control device 100 in the embodiment of the present invention calculates the distribution ratio according to the cutoff ratio of each NW device 20, for example, every predetermined time. Then, control device 100 in the embodiment of the present invention transmits a control signal indicating the transfer amount according to the calculated distribution ratio to each NW device 20. As a result, the control device 100 according to the embodiment of the present invention can dynamically control the transfer amount of each NW device 20 according to the blocking rate of abnormal communication.

<Distribution of total processing capacity of abnormal communication blocking device 30 per unit time>
Here, a case where the total processing capacity per unit time of the abnormal communication interruption device 30 is distributed from the distribution ratio S _i (i = 1, ..., M) calculated by the distribution ratio calculation unit 113 is shown in FIG. This will be described with reference to FIG. FIG. 9 is a diagram illustrating an example of distribution of the total processing capacity of the abnormal communication blocking device 30 per unit time.

As shown in FIG. 9, of the total processing capacity “1.0” per unit time of the abnormal communication interruption device 30, the first range dynamically assigned to each NW device 20 at every predetermined time is “1”. −mα ”, and the second range“ mα ”to which the minimum distribution ratio of each NW device 20 is assigned. At this time, each distribution ratio S _i (i = 1, ..., M) is divided into “S _i −α” assigned to the first range and “α” assigned to the second range. It is represented by the sum of. Thus, by allocating each distribution ratio S _i (i = 1, ..., M), for example, when the cutoff ratio r _k = 0 for a certain NW device 20 _k , the distribution ratio S _k is set. , The minimum distribution ratio “α” assigned to the second range.

<Other configurations of network environment>
Here, in the embodiment of the present invention, the case where the control device 100 and the abnormal communication blocking device 30 are different devices has been described, but the present invention is not limited to this. In the embodiment of the present invention, for example, as illustrated in FIG. 10, the abnormal communication blocking device 30 may include the control processing unit 110. In this case, the abnormal communication blocking device 30 controls the transfer amount of each NW device 20 by the control processing unit 110. As a result, the number of devices constituting the network environment N can be reduced, and, for example, the cost of the network environment N can be reduced and the maintainability can be improved.

<Summary>
As described above, the control device 100 according to the embodiment of the present invention determines, for each NW device 20, the proportion (blocking rate) blocked by the abnormal communication blocking device 30 in the communication received by the inlet port. , The distribution ratio of each NW device 20 is dynamically updated. Thereby, control device 100 in the embodiment of the present invention can dynamically change the transfer amount of each NW device 20 (transfer amount to abnormal communication blocking device 30).

  Moreover, the control device 100 according to the embodiment of the present invention makes the distribution ratio higher for the NW device 20 having a higher cutoff rate among the NW devices 20. For this reason, the transfer amount to the abnormal communication blocking device 30 may be increased as the NW device 20 (that is, the NW device 20 that has a lot of abnormal communication) has a smaller communication amount at the outlet port than the communication amount at the inlet port. it can. Therefore, according to the control device 100 in the embodiment of the present invention, it is possible to improve the blocking rate of abnormal communication in the entire network environment N.

  Further, since the cutoff rate of abnormal communication is improved, the robustness of the entire network environment N can be improved as compared with the case where the control device 100 according to the embodiment of the present invention is not provided. Furthermore, by using the control device 100 according to the embodiment of the present invention, one abnormal communication blocking device 30 can be used by a plurality of NW devices 20, so that costs such as equipment costs can be reduced. .

  Note that the control device 100 according to the embodiment of the present invention calculates the distribution ratio of each NW device 20 using, for example, a technique such as artificial intelligence (AI: Artificial Intelligence) in addition to the expression shown in the above-mentioned expression 1. You can also do it.

  The present invention is not limited to the above specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

20 NW device 30 Abnormal communication interruption device 100 Control device 110 Control processing unit 111 Communication amount acquisition unit 112 Blocking rate calculation unit 113 Distribution ratio calculation unit 114 Transfer amount control unit

Claims (5)

A control device connected to a plurality of network devices,
Based on a cutoff rate indicating a ratio of abnormal communication cut off by a communication cutoff device connected to the network device out of the communication amount of the network device, a transfer from the network device among the processing capabilities of the communication cutoff device is performed. A distribution ratio calculation unit that calculates a distribution ratio that indicates a ratio to be allocated to the communication processing that is performed,
A control unit that controls a transfer amount from the network device to the communication blocking device based on the distribution ratio calculated by the distribution ratio calculation unit;
A control device comprising: A first communication amount in the first port of the network device, a communication amount acquisition unit that acquires a second communication amount in the second port,
A cutoff rate calculating unit that calculates the cutoff rate based on the first communication volume and the second communication volume acquired by the communication volume acquisition unit;
The distribution ratio calculation unit,
Based on the cutoff rate calculated by the cutoff rate calculation unit, the distribution ratio is calculated ,
The first port is a port for receiving communication from another network environment different from the network environment in which the network device is included, to the network environment,
The said 2nd port is a port which transmits the communication which was not blocked | interrupted by the said communication blocking apparatus among the communication which the said 1st port received to the said network environment, The claim 1 characterized by the above-mentioned. The control device described. The distribution ratio calculation unit,
The control device according to claim 1, wherein the distribution ratio is calculated based on the blocking rate received from each of the plurality of network devices. The control unit is
By calculating a transfer amount according to the distribution ratio and transmitting a control signal for transferring the communication of the calculated transfer amount to the communication blocking device to the network device, the network device transfers to the communication blocking device. The control device according to any one of claims 1 to 3, wherein the control device controls a transfer amount. A control method used for a control device connected to a plurality of network devices, comprising:
Based on a blocking rate that indicates a ratio of abnormal communication blocked by a communication blocking device connected to the network device in the communication amount of the network device, a transfer from the network device among the processing capabilities of the communication blocking device is performed. A distribution ratio calculation procedure for calculating a distribution ratio indicating a ratio to be allocated to the communication processing that is performed,
A control procedure for controlling the transfer amount from the network device to the communication blocking device based on the distribution ratio calculated by the distribution ratio calculation procedure;
A control method comprising:

Images