JP7563227B2 - Network monitoring and control system, monitoring and control device, analysis and monitoring server, and network monitoring and control method - Google Patents

Description

This disclosure relates to security technology that ensures network safety in IoT-enabled networks.

IoT devices such as sensors are becoming more widespread and are being applied to a variety of industries. One of the challenges facing IoT devices is security measures. Due to the lack of security, IoT devices are prone to becoming targets of cyber attacks, and cyber attacks targeting IoT devices are showing an increasing trend year by year around the world.

In 2016, a cyber attack using malware called "Mirai" occurred. The situation of the cyber attack is shown in Figure 1. In Figure 1, 50 is an IoT device, 51 is a network, and 70 is the target of the attack. Under normal circumstances, the IoT device 50 transmits sensing information, etc. to the IoT server 52 via the network 51.

When an IoT device 50 is infected with malware by an attacker, it downloads a bot from a C&C (command and control) server (not shown) and begins to search for the next target for infection. The bot waits for instructions from the C&C server, and the infected IoT device 50 takes part in a DoS attack, such as a distributed denial of service (DDoS) attack, in which a large number of HTTP requests and UDP packets are sent to the target 70 via the network 51. When the number of infected IoT devices 50 becomes large, the service of the site that becomes the target 70 of the attack can easily go down.

To defend against such cyber attacks, a security system for IoT devices using a whitelist has been proposed (see, for example, Non-Patent Document 1). In this security system, the IoT gateway is provided with a whitelist, which is a list of connection destinations that are permitted to connect using the IP address or MAC address of the communication terminal.

The IoT gateway is installed between the IoT device and the IoT server, and constantly monitors the communication between the IoT device and the IoT server. During monitoring, it detects access from external devices and access from new devices, and blocks communication from devices that are not on the whitelist.

However, since the IoT gateway performs communication analysis based on the IP address and MAC address of the communication terminal, it is necessary to deploy a large number of computing resources in the IoT gateway. This inevitably requires a high-performance IoT gateway. Also, in addition to the communication of communication data between the IoT server and IoT device, new communication for controlling the same amount of traffic is generated between the IoT server and IoT device. This causes the problem of excessive load on the network.

Nomura, Kouki, Nagabuchi, Yukio, Tanigawa, Maki, "Proposal of a method for providing a provisional whitelist during the machine learning period of the whitelist for IoT-GW," Proceedings of the 80th National Conference of the Information Processing Society of Japan, 2E-03, pp. 3-449-3-450, March 2018.

This disclosure has been made in light of the above circumstances, and the network monitoring and control system and network monitoring and control method disclosed herein aim to reduce the computing resources required to monitor and control the traffic volume of communication terminals, thereby reducing the load on the network.

The monitoring and control device disclosed herein aims to reduce the computing resources required to monitor and control the traffic volume of communication terminals, thereby reducing the load on the network.

The analysis and monitoring server disclosed herein aims to reduce the computing resources required to monitor and control the traffic volume of communication terminals.

The network monitoring and control system of the present disclosure comprises:
A monitoring control device and an analysis monitoring server are provided,
The monitoring and control device includes:
Mirroring communication from communication terminals,
For each communication terminal, the traffic volume of the mirrored communication is converted into binary bitmap data.
Transmitting the bitmap structure data to the analysis and monitoring server;
When cut-off information for cutting off communication from a communication terminal is received from the analysis monitoring server, the communication from the corresponding communication terminal is cut off;
The analysis and monitoring server includes:
receiving the bitmap structure data from the monitoring and control device;
storing the received bitmap structure data for each communication terminal;
comparing the stored bitmap structure data of the communication terminal with past bitmap structure data of the communication terminal, and when determining that an abnormality exists, transmitting cutoff information for cutting off communication from the communication terminal to the monitoring control device;
It is characterized by:

The monitoring control device of the present disclosure includes:
Mirroring communication from communication terminals,
For each communication terminal, the traffic volume of the mirrored communication is converted into binary bitmap data.
Transmitting the bitmap structure data;
The present invention is characterized in that when cut-off information for cutting off communication from a communication terminal is received, the communication from the relevant communication terminal is cut off.

The analysis and monitoring server of the present disclosure includes:
receiving bitmap data representing the amount of traffic of the mirrored communication for each communication terminal in binary;
storing the received bitmap structure data for each communication terminal;
The bitmap structure data stored for the communication terminal is compared with past bitmap structure data stored for the communication terminal, and when it is determined that there is an abnormality, blocking information for blocking communication from the communication terminal is transmitted.

The network monitoring and control method of the present disclosure includes:
A network monitoring control method using a monitoring control device and an analysis monitoring server,
The monitoring and control device includes:
Mirroring communication from communication terminals,
For each communication terminal, the traffic volume of the mirrored communication is converted into binary bitmap data.
Transmitting the bitmap structure data to the analysis and monitoring server;
The analysis and monitoring server includes:
receiving the bitmap structure data from the monitoring and control device;
storing the received bitmap structure data for each communication terminal;
comparing the stored bitmap structure data of the communication terminal with past bitmap structure data of the communication terminal, and when determining that an abnormality exists, transmitting cutoff information for cutting off communication from the communication terminal to the monitoring control device;
The monitoring and control device includes:
When the blocking information is received from the analysis and monitoring server, communication from the corresponding communication terminal is blocked.

The network monitoring and control system and network monitoring and control method disclosed herein can reduce the computing resources required to monitor and control the traffic volume of communication terminals, thereby reducing the load on the network.

The monitoring and control device disclosed herein can reduce the computing resources required to monitor and control the traffic volume of communication terminals, thereby reducing the load on the network.

The analysis and monitoring server disclosed herein can reduce the computing resources required to monitor and control the traffic volume of communication terminals.

1 shows an example of a conventional network configuration. 1 illustrates an example of a configuration of a network monitoring and control system according to the present disclosure. 2 illustrates an example of a configuration of a monitoring control device according to the present disclosure. 1 shows an example of the operation of the monitoring and control device of the present disclosure.

The following describes in detail the embodiments of the present disclosure with reference to the drawings. Note that the present disclosure is not limited to the embodiments shown below. These implementation examples are merely illustrative, and the present disclosure can be implemented in various forms with various modifications and improvements based on the knowledge of those skilled in the art. Note that components with the same reference numerals in this specification and drawings are considered to be identical to each other.

An example of the configuration of the network monitoring and control system of this embodiment is shown in FIG. 2. In FIG. 2, 10 is a monitoring and control device, 20 is an analysis and monitoring server, 50 is an IoT device serving as a communication terminal, 51 is a network, and 52 is an IoT server. A plurality of IoT devices 50 are connected to an IoT server 52 via the network 51. When the IoT device 50 is, for example, a sensor device, the IoT device 50 transmits collected sensing information to the IoT server 52 via the network 51. The IoT server 52 processes the collected sensing information.

The network monitoring and control system of this embodiment includes a monitoring and control device 10 between an IoT device 50 and a network 51, and an analysis and monitoring server 20 connected to the monitoring and control device 10 via the network. The monitoring and control device 10 and the analysis and monitoring server 20 work together to monitor and control the IoT device 50.

The monitoring control device 10 may accommodate multiple IoT devices 50. The monitoring control device 10 mirrors communications from the IoT devices 50, converts the traffic volume of the mirrored communications into bitmap structure data represented in binary, and transmits the bitmap structure data for each IoT device to the analysis monitoring server 20. Transmission from the monitoring control device 10 to the analysis monitoring server 20 may be via the same network as transmission to the IoT devices 50, or via a different network.

The monitoring control device 10 does not copy and transmit the communication from the IoT device 50 itself, but converts the communication traffic volume into binary bitmap structure data and transmits it, thereby reducing the load on the network. In addition, the bitmap structure data represented in binary can reduce the computing resources of the analysis monitoring server 20.

The analysis monitoring server 20 receives and stores bitmap structure data for each IoT device from multiple monitoring control devices 10. The analysis monitoring server 20 stores the bitmap structure data for each IoT device for a long period of time. For each IoT device, the analysis monitoring server 20 compares the stored bitmap structure data with past data, and if it determines that the newly stored bitmap structure data for an IoT device is abnormal, it transmits blocking information to the monitoring control device 10 to block communication with that IoT device.

As an example of comparing stored bitmap structure data with past data and determining that newly stored bitmap structure data of an IoT device is abnormal, when the number of bits per hour in the stored bitmap structure data of a communication terminal is greater than the maximum number of bits per hour in past bitmap structure data stored for the communication terminal, it can be determined that communication from that communication terminal is abnormal.

If the number of bits per hour is higher than the highest value in the past, there is a high possibility that the amount of traffic from IoT devices is abnormal.

As another example, when the number of bits per time in the stored bitmap structure data of a communication terminal is greater than a predetermined multiple of the average number of bits per time in the stored past bitmap structure data of the communication terminal, the communication from that communication terminal is determined to be abnormal.

If the number of bits per hour is more than a certain multiple of the past average value, there is a high possibility that the traffic volume from the IoT device is abnormal. The certain multiple can be set to any value in advance.

For example, if the number of bits per hour is greater than the highest value in the past or a specified multiple of the average number of bits per hour, it is determined that the communication from the communication terminal is abnormal. In addition to the number of bits per hour, the number of bits per month, the number of bits per week, the number of bits per day, etc. may also be used. Shortening the unit time allows for a quick response, but also makes errors more likely to occur. Examples of the specified multiple of the average value include 2 or more times the average value, or 10 or more times the average value.

These determination methods are easy to analyze, so the analysis and monitoring server 20 can easily make a determination without performing advanced processing.

The analysis monitoring server 20 centrally processes bitmap data from multiple monitoring control devices 10, reducing the burden on the monitoring control devices 10. In addition, when analyzing communication anomalies, the communication itself is not analyzed, but rather the bitmap data is analyzed, eliminating the need for advanced processing. As a result, the computing resources required for analysis can be reduced.

When the monitoring control device 10 receives the blocking information from the analysis monitoring server 20, it blocks communication from the corresponding IoT device 50. As a result, it is possible to prevent DDoS attacks and the like against the target of the attack.

The configuration of the monitoring control device 10 is shown in Figure 3. 10 is the monitoring control device, 11 is a monitoring unit, 12 is a collection unit, 13 is an analysis and conversion unit, 14 is a communication unit, and 15 is a control unit. The monitoring unit 11 transparently handles communication from an IoT device (not shown) as a communication terminal to an IoT server (not shown). At the same time, it mirrors the communication and outputs it to the collection unit 12 as a mirroring signal. The collection unit 12 records a portion of the mirroring signal from the monitoring unit 11 and periodically outputs the mirroring signal to the analysis and conversion unit 13. The analysis and conversion unit 13 analyzes the traffic volume of the mirroring signal and converts it into bitmap structure data represented in binary. The bitmap structure data has a significantly reduced data volume compared to the mirroring signal.

An example of bitmap structure data converted by the analysis and conversion unit 13 is bitmap structure data in which the presence or absence of mirrored communication within a specified time is expressed in binary. For example, if there is communication within a specified time, it is represented as "1", and if there is no communication, it is represented as "0". Since the presence or absence of communication is simply represented in binary, computer resources can be reduced.

Another example is bitmap data that represents the result of threshold-determining the amount of traffic of mirrored communication within a specified time period using a predetermined threshold in binary. For example, the traffic volume of communication within a specified time period is threshold-determined using a predetermined threshold, and if it exceeds the threshold, it is set to "1", and if it does not exceed the threshold, it is set to "0". Since the result of threshold-determining the amount of traffic of communication using a predetermined threshold is expressed in binary, computer resources can be reduced. Furthermore, by changing the setting of the predetermined value, the threshold can be changed according to fluctuations in the amount of traffic.

The analysis and conversion unit 13 can easily analyze traffic volume and convert it into bitmap structure data without sophisticated processing.

Figure 4 shows an example of the traffic volume of the mirroring signal input to the analysis and conversion unit 13 converted into binary bitmap structure data. In Figure 4, the horizontal axis represents hourly units from midnight to midnight, weekday units from Monday to Sunday, month units from January to December, and day units from the 1st to 365th. The vertical axis ranks the destination IP addresses with the most accesses in order from 1st to 100th place.

The mirroring signal is a communication signal itself, so it is a huge amount of data. The analysis and conversion unit 13 converts the communication traffic volume into bitmap structure data represented in binary.

In this way, the monitoring and control device 10 converts the results of a threshold determination of the presence or absence of communication or the amount of traffic using a predetermined threshold into binary bitmap structure data, which can significantly reduce the amount of information compared to the communication itself.

The communication unit 14 transmits bitmap data to the analysis monitoring server. It also receives blocking information from the analysis monitoring server. The control unit 15 normally controls the monitoring unit 11 to transparently handle communication from an IoT device (not shown) to an IoT server (not shown). When blocking information is input from the communication unit 14, the control unit 15 causes the monitoring unit 11 to block communication from the IoT device (not shown).

As described above, the network monitoring and control system and network monitoring and control method disclosed herein do not copy and transmit the communication itself from the IoT device 50, but convert the communication traffic volume into bitmap structure data represented in binary and transmit it, and monitor and control the communication of the IoT device 50 based on the bitmap structure data. This reduces the load on the network between the monitoring control device and the analysis and monitoring server, reducing the computer resources of the analysis and monitoring server, while preventing the IoT device 50 from launching DDoS attacks on the target of attack, etc.

The monitoring control device and analysis monitoring server of the present invention can also be realized by a computer and a program. The program can be recorded on a recording medium or provided via a network.

This disclosure can be applied to the information and communications industry.

10: Monitoring and control device 11: Monitoring unit 12: Collection unit 13: Analysis and conversion unit 14: Communication unit 15: Control unit 20: Analysis and monitoring server 50: IoT device 51: Network 52: IoT server

Claims (8)

A monitoring control device and an analysis monitoring server are provided,
The monitoring and control device includes:
Mirroring communication from communication terminals,
For each communication terminal, the traffic volume of the mirrored communication is converted into binary bitmap data.
Transmitting the bitmap structure data to the analysis and monitoring server;
When cut-off information for cutting off communication from a communication terminal is received from the analysis monitoring server, the communication from the corresponding communication terminal is cut off;
The analysis and monitoring server includes:
receiving the bitmap structure data from the monitoring and control device;
storing the received bitmap structure data for each communication terminal;
comparing the stored bitmap structure data of the communication terminal with past bitmap structure data of the communication terminal, and when determining that an abnormality exists, transmitting cutoff information for cutting off communication from the communication terminal to the monitoring control device;
A network monitoring and control system comprising: The network monitoring and control system according to claim 1, characterized in that the monitoring and control device converts the presence or absence of the mirrored communication within a predetermined period of time into binary data with a bitmap structure. The network monitoring and control system according to claim 1, characterized in that the monitoring and control device converts the result of threshold determination of the traffic volume of the mirrored communication within a specified time period using a predetermined threshold into binary data with a bitmap structure. The network monitoring and control system according to any one of claims 1 to 3, wherein the analysis and monitoring server determines that communication from a communication terminal is abnormal when the number of bits per hour in the bitmap structure data of the stored communication terminal is greater than the maximum number of bits per hour in the past bitmap structure data of the stored communication terminal. The network monitoring and control system according to any one of claims 1 to 3, wherein the analysis and monitoring server determines that communication from a communication terminal is abnormal when the number of bits per hour in the bitmap structure data of the stored communication terminal is greater than a predetermined multiple of the average number of bits per hour in the past bitmap structure data of the stored communication terminal. Mirroring communication from communication terminals,
For each communication terminal, converting the presence or absence of mirrored communication within a predetermined period of time into binary bitmap data;
Transmitting the bitmap structure data;
A monitoring and control device characterized in that, when cut-off information for cutting off communication from a communication terminal is received, the monitoring and control device cuts off communication from the corresponding communication terminal. receiving bitmap data representing the amount of traffic of the mirrored communication for each communication terminal in binary;
storing the received bitmap structure data for each communication terminal;
An analysis and monitoring server characterized by comparing the stored bitmap structure data of a communication terminal with past bitmap structure data of the stored communication terminal, and when it determines that there is an abnormality, sending blocking information to block communication from the communication terminal. A network monitoring control method using a monitoring control device and an analysis monitoring server,
The monitoring and control device includes:
Mirroring communication from communication terminals,
For each communication terminal, the traffic volume of the mirrored communication is converted into binary bitmap data.
Transmitting the bitmap structure data to the analysis monitoring server;
The analysis and monitoring server includes:
receiving the bitmap structure data from the monitoring and control device;
storing the received bitmap structure data for each communication terminal;
comparing the stored bitmap structure data of the communication terminal with past bitmap structure data of the communication terminal, and when determining that an abnormality exists, transmitting cutoff information for cutting off communication from the communication terminal to the monitoring control device;
The monitoring and control device includes:
A network monitoring control method, comprising the steps of: upon receiving the blocking information from the analysis and monitoring server, blocking communication from the corresponding communication terminal.

Images