Patent Application
20100107261
The present invention relates to a communication management technique, and particularly to a communication management system and a communication management method for managing inappropriate communication.
Due to improved Internet infrastructures and the widespread of communication terminals, such as cellular phone terminals, personal computers, and VoIP (Voice over Internet Protocol) phone sets, the number of Internet users is now exploding. Under such circumstances, security problems such as computer viruses, hacking and spam mails have become apparent, requiring appropriate techniques for communication control. Also, since improved communication environments have enormously increased communication traffic, there are required communication control apparatuses that enable high-speed processing of a large volume of data.
[Patent Document 1] Japanese Patent Application Laid-open No. 4-180425.
In recent years, there have been found malicious programs (malware) that are primarily intended to infect computers to damage them or to use such computers as zombie computers for sending spam mails or performing DDoS attacks, and such programs are regarded as a serious issue. These malicious programs are called “bots”, and since a bot operates according to external instructions, an infected computer can be manipulated from the outside through a bot. Moreover, if a number of computers are infected by the same bot, such computers can be operated simultaneously under a single instruction, which may cause severe damage.
It is difficult to rely on antivirus software or the like to detect a bot, because new bot variants are created constantly. In addition, attackers are able to use their own protocols to give instructions for operating bots, thereby making the detection of bots more difficult.
The present invention has been made in view of such a situation, and a general purpose thereof is to provide a technique for managing inappropriate communication.
One aspect of the present invention relates to a communication management system. The communication management system comprises: a normal signature list which stores a list of signatures of normal communication; a first search unit which acquires communication data and searches the normal signature list storing signatures of normal communication to check if the signature of the communication data appears in the list; and a warning unit which issues a warning when there is detected communication data of which the signature does not match any signature of normal communication stored in the normal signature list.
The communication management system may further comprise: a determination result acquisition unit which acquires a determination result indicating whether or not communication data against which a warning has been issued is normal; and a normal signature list update unit which, when the determination result acquisition unit acquires a determination result that communication data against which a warning has been issued is found to be normal, adds the signature of the communication data to the normal signature list.
The communication management system may further comprise: an abnormal signature list which stores a list of signatures of communication to be blocked; a second search unit which acquires communication data and searches the abnormal signature list storing signatures of communication to be blocked to check if the signature of the communication data appears in the list; and a blocking unit which, when there is detected communication data of which the signature matches a signature of communication to be blocked stored in the abnormal signature list, blocks the communication data.
The determination result acquisition unit may further acquire a determination result indicating whether or not communication data against which a warning has been issued should be blocked. The communication management system may further comprise an abnormal signature list update unit which, when the determination result acquisition unit acquires a determination result that communication data against which a warning has been issued should be blocked, adds the signature of the communication data to the abnormal signature list.
The communication management system may further comprise: a rule database which stores a rule for extracting communication data required to be analyzed among acquired communication data; a third search unit which acquires communication data and searches the rule database to check if the communication data complies with a rule stored in the database; and an extraction unit which, when there is detected communication data complying with a rule stored in the rule database, extracts the communication data.
The communication management system may further comprise a rule database update unit which adds, to the rule database, a rule for extracting communication data associated with communication data against which a warning has been issued.
At least two of the first search unit, the second search unit and the third search unit may be configured with FPGAs (Field Programmable Gate Array) or wired logic circuits. Also, at least two of the first search unit, the second search unit and the third search unit may perform searches simultaneously in parallel.
Another aspect of the present invention relates to a communication management method. The communication management method comprises: searching, upon acquisition of communication data, a normal signature list storing a list of signatures of normal communication so as to check if the signature of the communication data appears in the list; and issuing a warning when there is detected communication data of which the signature does not match any signature of normal communication stored in the normal signature list.
Optional combinations of the aforementioned constituting elements, and implementations of the invention in the form of methods, apparatuses, systems, recording mediums and computer programs may also be practiced as additional modes of the present invention.
The present invention provides a technique for managing inappropriate communication.
First, as a base technology, a communication control system that has no CPU or OS and performs a packet filtering function using a dedicated hardware circuit will be described. Thereafter, there will be described as an embodiment a technique for managing communication in a botnet using the communication control system of the base technology.
(Base Technology)
The communication control system 100 of the base technology includes multiple communication control apparatuses 10a, 10b, 10c, etc. and operates them functioning as one communication control apparatus 10. Hereinafter, each of the communication control apparatuses 10a, 10b, 10c, etc. and their collective body will be both referred to as a communication control apparatus 10 with no distinction.
In the communication control system 100 of the base technology, each communication control apparatus 10 stores the respective shares of at least part of databases necessary for packet processing; there are provided as many as the number of communication control apparatuses 10 required to share and store such databases, and at least one more apparatus is provided extra. For example, when the number of pieces of data is 300,000 or above but less than 400,000, the number of communication control apparatuses required for operation is four. However, one or more communication control apparatuses 10 should be further provided as standby units in case any of the communication control apparatuses 10 in operation fails or in case a database in any of the communication control apparatuses 10 is updated. Accordingly, at least five communication control apparatuses 10 are provided in total. Conventionally, the entire system has needed to be duplexed considering fault tolerance. According to the technique of the base technology, in contrast, a divided unit of the communication control apparatus 10 may be only provided extra, thereby enabling cost reduction. The operating state of the multiple communication control apparatuses 10a, 10b, 10c, etc. is managed by an operation monitoring server 110. The operation monitoring server 110 of the base technology has a management table for managing the operating state of the communication control apparatuses.
The peripheral apparatuses include the operation monitoring server 110, a connection management server 120, a message output server 130, a log management server 140 and a database server 150. The connection management server 120 manages connection to the communication control apparatus 10. When the communication control apparatus 10 processes a packet transmitted from a cellular phone terminal, for example, the connection management server 120 authenticates the user as a user entitled to enjoy the service of the communication control system 100, based on information included in the packet, which uniquely identifies the cellular phone terminal. Once the user is authenticated, packets transmitted from the IP address, which is temporarily provided for the cellular phone terminal, will be transmitted to the communication control apparatus 10 and processed therein, without being authenticated by the connection management server 120 during a certain period. The message output server 130 outputs a message to the destination or the source of packet transmission, according to whether the communication control apparatus 10 has permitted the packet communication. The log management server 140 manages the operating history of the communication control apparatus 10. The database server 150 acquires the latest database from an external source and provides the database to the communication control apparatus 10. To update the database without halting the operation of the communication control apparatus 10, the apparatus may possess a backup database. The operation monitoring server 110 monitors the operating state of the communication control apparatus 10 and its peripheral apparatuses including the connection management server 120, message output server 130, log management server 140 and database server 150. The operation monitoring server 110 has the highest priority in the communication control system 100 and performs supervisory control of the communication control apparatus 10 and all the peripheral apparatuses. Although the communication control apparatus 10 is configured with a dedicated hardware circuit, as will be described later, the operation monitoring server 110 can monitor the operating state even while the communication control apparatus 10 is in operation, by inputting to or outputting from the communication control apparatus 10 the data for monitoring by means of a boundary-scan circuit based on the technique described in Japanese Patent No. 3041340 filed by the present applicant or other techniques.
In the communication control system 100 of the base technology, as will be described below, the communication control apparatus 10, configured with a dedicated hardware circuit for faster operation, is controlled by using a group of peripheral servers connected thereto and having various functions. Accordingly, by suitably replacing the software of the group of servers, a wide variety of functions can be achieved with a similar configuration. Thus, the base technology provides such communication control system having high flexibility.
The packet processing unit 3 of the conventional communication control apparatus 1 is implemented by software, using a general-purpose processor, or CPU, and an OS running on the CPU. With such configuration, however, the performance of the communication control apparatus 1 depends on the performance of the CPU, hampering the creation of a communication control apparatus capable of high-speed processing of a large volume of packets. For example, a 64-bit CPU can process only up to 64 bits at a time, and hence, there has existed no communication control apparatus having a higher performance than this. In addition, since the conventional communication control apparatus is predicated on the presence of an OS with versatile functionality, the possibility of security holes cannot be eliminated completely, requiring maintenance work including OS upgrades.
For example, a case will be considered here in which search is conducted in packet filtering or the like to check if the data in a packet includes reference data, which serves as criteria for filtering. When a CPU is used to compare the communication data with the reference data, there occurs a problem in that, since only 64-bit data can be compared at a time, the processing speed cannot be improved beyond such CPU performance. Since the CPU needs to repeat the process of loading 64 bits of communication data into a memory and comparing it with the reference data, the memory load time becomes a bottleneck that limits the processing speed.
In the base technology, by contrast, a dedicated hardware circuit configured with a wired logic circuit is provided to compare communication data with reference data. This circuit includes multiple comparators arranged in parallel, so as to enable the comparison of data having a length greater than 64 bits, such as 1024 bits. By providing dedicated hardware in such manner, bit matching can be simultaneously performed on a large number of bits in parallel. Since 1024-bit data can be processed at a time, while the conventional communication control apparatus 1 using a CPU processes only 64 bits, the processing speed can be improved remarkably. Increasing the number of comparators will improve the throughput, but also increase the cost and size of the apparatus. Accordingly, an optimal hardware circuit may be designed in accordance with the desired performance, cost or size.
Since the communication control apparatus 10 of the base technology is configured with dedicated hardware employing a wired logic circuit, it does not require any OS (Operating System). This can eliminate the need for the installation, bug fixes, or version upgrades of an OS, thereby reducing the cost and man-hours required for administration and maintenance. Also, unlike CPUs requiring versatile functionality, the communication control apparatus 10 does not include any unnecessary functions or use needless resources, and hence, reduced cost, a smaller circuit area or improved processing speed can be expected. Furthermore, again unlike conventional OS-based communication control apparatuses, the absence of unnecessary functions decreases the possibility of security holes and thus enhances the tolerance against attacks from malicious third parties over a network.
The conventional communication control apparatus 1 processes packets using software predicated on a CPU and an OS. Therefore, all packet data needs to be received before protocol processing is performed, and then the data is passed to an application. In contrast, since packet processing is performed by a dedicated hardware circuit in the communication control apparatus 10 of the base technology, all packet data need not be received before starting the processing; upon reception of necessary data, the processing can be started at any given point in time without waiting for the reception of subsequent data. For example, position detection processing in a position detection circuit, which will be described later, may be started at the time when position identification data for identifying the position of comparison target data is received. Thus, various types of processing can be performed in parallel without waiting for the reception of all data, reducing the time required to process packet data.
The search circuit 30 includes: a position detection circuit 32 for detecting the position of comparison target data, which is to be compared with reference data, in communication data; an index circuit 34 which serves as an example of a determination circuit that determines which range the comparison target data belongs to among three or more ranges, into which the reference data stored in the first database 50 is divided; and a binary search circuit 36 for searching the determined range for the reference data that matches the comparison target data. The reference data may be searched for the comparison target data using any search technique, and a binary search method is used in the base technology. Since an improved binary search method is employed, as will be discussed later, three first databases 50 are provided in the base technology. The first databases 50A, 50B and 50C store the same reference data.
The base technology will be described by way of example for explaining the operation of the communication control apparatus 10, in which a character string “No. ###” in communication data is detected, the number “###” included in the character string is then compared with reference data, and if the number matches the reference data, the packet will be allowed to pass, while, if they do not match, the packet will be discarded.
In the example of
When the same processing is performed by a CPU, since the comparison process needs to be serially performed one by one from the top, such as comparing character strings “01N” and “No.” before comparing “1No” and “No.”, no improvement of detection speed can be expected. In the communication control apparatus 10 of the base technology, in contrast, providing the multiple comparison circuits 33a-33f in parallel enables simultaneous parallel comparison processing, which could not have been performed with a CPU, improving the processing speed significantly. Providing more comparison circuits will improve the detection speed, as more characters can be compared simultaneously. In consideration of cost or size, a sufficient number of comparison circuits may be provided to achieve a desired detection speed.
Aside from detecting position identification data, the position detection circuit 32 may also be used as a circuit for detecting character strings for various purposes. Moreover, the position detection circuit 32 may be configured to detect position identification data in units of bits, not just as a character string.
The index circuit 34 determines which range comparison target data belongs to among three or more ranges, such as 52a-52d, into which reference data stored in the first database 50 is divided. In the example of
The pieces of reference data at the borders to be input to the comparison circuits 35a-35c of the index circuit 34 may be set by an apparatus provided outside the communication control apparatus 10. Alternatively, reference data at predetermined positions in the first database 50 may be set in advance to be automatically input as such. In the latter case, even when the first database 50 is updated, the reference data at the predetermined positions in the first database 50 are automatically input to the comparison circuits 35a-35c. Therefore, the communication control processing can be performed immediately without initialization or the like.
As mentioned previously, CPU-based binary search cannot make multiple comparisons at the same time. In the communication control apparatus 10 of the base technology, in contrast, providing the multiple comparison circuits 35a-35c in parallel enables simultaneous parallel comparison processing, with a significant improvement in the search speed.
After the index circuit 34 determines the relevant range, the binary search circuit 36 performs search using a binary search method. The binary search circuit 36 divides the range determined by the index circuit 34 further into 2n and subsequently compares the pieces of reference data lying at the borders with the comparison target data, thereby determining which range the comparison target data belongs to. The binary search circuit 36 includes multiple comparators for comparing, bit by bit, reference data with comparison target data. For example, in the base technology are provided 1024 comparators to perform bit matching on 1024 bits simultaneously. When the range to which the comparison target data belongs is determined among the 2n split ranges, the determined range is further divided into 2n. Then, the pieces of reference data lying at the borders are read out to be compared with the comparison target data. Thereafter, this processing is repeated to narrow the range further until reference data that matches the comparison target data is eventually found.
The operation will now be described in more detail in conjunction with the foregoing example. Each of the comparison circuits 35a-35c of the index circuit 34 receives “361” as comparison target data. As for reference data, the comparison circuit 35a receives “378”, which lies at the border of the ranges 52a and 52b. Similarly, the comparison circuit 35b receives reference data “704” lying at the border of the ranges 52b and 52c, and the comparison circuit 35c receives reference data “937” lying at the border of the ranges 52c and 52d. The comparison circuits 35a-35c then perform comparisons simultaneously, determining that the comparison target data “361” belongs to the range 52a. Subsequently, the binary search circuit 36 searches the reference data for the comparison target data “361”.
In CPU-based software processing, the first database 50 stores pieces of reference data in ascending order, from the first data position therein. In the rest of data positions will be stored a maximum value or the like, and in such case, the skip of comparison processing as described above cannot be made during binary search. The comparison technique described above can be implemented by configuring the search circuit 30 with a dedicated hardware circuit.
In a conventional binary search method, a piece of data lying at the one-half position in the search range of a database, in which pieces of data are aligned in ascending or descending order, is read out to be compared with comparison target data in the first search. When the pieces of data are aligned in ascending order and if the comparison target data is smaller than the read out data, it means that the comparison target data might exist within the first half of the search range. Accordingly, in the second search, the search range is newly set to the first half and a piece of data lying at the one-half position in the range, i.e. at the one-quarter position in the original search range, is read out to be compared with the comparison target data. Conversely, if the comparison target data is greater than the read out data, it means that the comparison target data might exist within the second half of the search range. Accordingly, the new search range is set to the second half and a piece of data lying at the one-half position in the range, i.e. at the three-quarter position in the original search range, is read out to be compared with the comparison target data in the second search. In this way, the search range is narrowed by half repeatedly until the target data is reached.
In the base technology, in contrast, three comparison circuits are provided for binary search, so that when the data at the one-half position in the search range is compared with comparison target data for the first search, the comparison for the second search between the comparison target data and each of the pieces of data at the one-quarter and three-quarter positions in the search range can be simultaneously performed in parallel. Thus, the first and second searches can be performed at the same time, thereby reducing the time required to load the data from the database. Also, by operating three comparison circuits in parallel, the number of comparisons can be reduced by half, thereby reducing the search time.
In the example of
There are provided the three first databases 50 in the base technology: the first database 50A is connected to the comparison circuit 36A and supplies thereto a piece of data at the one-quarter position in the search range; the first database 50B is connected to the comparison circuit 36B and supplies thereto a piece of data at the two-quarter position in the search range; and the first database 50C is connected to the comparison circuit 36C and supplies thereto a piece of data at the three-quarter position in the search range. Therefore, pieces of data can be loaded simultaneously into the comparison circuits in parallel, thereby further reducing the time for data loading and enabling high-speed binary search.
Providing more comparison circuits will improve the search speed. In consideration of cost or size of the system, a sufficient number of comparison circuits may be provided to achieve a desired search speed. Also, although it is desirable that first databases as many as comparison circuits are provided, some comparison circuits may share a database in consideration of cost or size of the system.
The first database and the second database are configured to be rewritable from the outside. By replacing these databases, various types of data processing and communication control can be achieved using the same communication control apparatus 10. Also, multistage search processing may be performed by providing two or more databases that store reference data to be searched. In such instance, more complicated conditional branching may be performed by providing two or more databases that store search results and processing contents related to each other. When multiple databases are thus provided to conduct multistage search, a plurality of the position detection circuits 32, the index circuits 34, the binary search circuits 36, etc. may also be provided.
The data intended for the foregoing comparison may be compressed by the same compression logic. If both the source data and the target data to be compared are compressed by the same method, the comparison can be performed in the same manner as usual, thus reducing the amount of data to be loaded for comparison. The smaller amount of data to be loaded can reduce the time required to read out the data from the memory, thereby reducing the overall processing time. Moreover, the number of comparators can be also reduced, which contributes to the miniaturization, weight saving, and cost reduction of the apparatus. The data intended for comparison may be stored in a compressed form, or may be read out from the memory and compressed before comparison.
The switch control unit 14 may provide control such that: either one of the communication control units 12 processes inbound packets and the other processes outbound packets; both the units process inbound packets; or both the units process outbound packets. Consequently, the directions of communications to control can be changed depending on, for example, the traffic status or intended purpose.
The switch control unit 14 may acquire the operating state of the respective communication control units 12 and may switch the direction of communication control according thereto. For example, when one of the communication control units 12 is in a standby state and the other communication control unit 12 is in operation, the unit on standby may be activated as a substitute upon detection of the unit in operation stopping due to a failure or other reasons. This can improve the fault tolerance of the communication control apparatus 10. Also when one of the communication control units 12 needs maintenance such as a database update, the other communication control unit 12 may be operated as a substitute. Thus, appropriate maintenance can be performed without halting the operation of the communication control apparatus 10.
The communication control apparatus 10 may be provided with three or more communication control units 12. The switch control unit 14 may, for example, acquire the traffic status to control the direction of communications in the respective communication control units 12 so that more communication control units 12 are allocated for communication control processing in a direction handling higher traffic. This minimizes a drop in the communication speed, even when the traffic increases in one direction.
The operation monitoring server 110 monitors the operating state of multiple communication control apparatuses 10. When detecting any of the communication control apparatuses 10 being inoperable because of some trouble, the operation monitoring server 110 stores, in the communication control apparatus 10 on standby, the same data as stored in the inoperable apparatus, and places the standby communication control apparatus 10 in operation. For example, when the communication control apparatus 10 with the apparatus ID “2” halts the operation because of a failure, as shown in
Next, the procedure for updating databases stored in the communication control apparatuses 10 will be described. The database server 150 acquires the latest database from an external database at a certain time and retains it therein. In order to reflect, in a communication control apparatus 10, the latest database retained in the database server 150, the operation monitoring server 110 transfers the data from the database server 150 and stores it in the communication control apparatus 10 at a certain time.
In this way, data stored in each of the communication control apparatuses 10 is not fixed in the base technology, and hence, the communication control apparatus 10 that stores certain data changes with time. If, before a packet is sent to each of the communication control apparatuses 10, the process of determining which communication control apparatus 10 stores the data of the user is performed, the time for the process will be additionally required. Accordingly, in the present embodiment, a received packet is provided to all the communication control apparatuses 10, and each of the apparatuses then processes the packet. In the following, a technique for providing such mechanism will be described.
If a packet is converted to a broadcast packet so as to be transmitted to the multiple communication control apparatuses 10a, 10b and 10c, additional process such as adding a time stamp to the header will be required, which reduces the processing speed. Therefore, a packet is not converted but split by the optical splitter 220 so as to be transmitted as a unicast packet to the multiple communication control apparatuses 10a, 10b and 10c. This method will be called “parallelcast” in the present specification.
Each of the communication control apparatuses is not set to a mode in which an apparatus receives only packets directed to the MAC address of the apparatus, but set to promiscuous mode in which an apparatus receives all packets regardless of the destination MAC addresses. When receiving a packet sent via parallelcast from the optical splitter 220, each of the communication control apparatuses omits MAC address matching and acquires every packet to process it.
If a packet needs to be returned to the transmission source because, for example, the communication thereof has been prohibited, the communication control apparatus 10c will transmit a response packet to the switch 210 bypassing the optical splitter 220. If the communication control apparatus 10c processes the packet and the communication thereof is permitted, the communication control apparatus 10c will transmit the packet to a network. Between the communication control apparatuses 10 and the upstream communication line, there is provided the switch 230 by which packets transmitted from the multiple communication control apparatuses 10a, 10b and 10c are aggregated. The communication control apparatus 10c will practically transmit the packet to the switch 230, which transmits the packet to the upstream communication line.
When the switch 230 receives a return packet transmitted from the destination of packet transmission and if the return packet need not be processed by the communication control apparatuses 10, the packet will be transmitted from the port 232 of the switch 230 to the port 212 of the switch 210, and then transmitted therefrom to the transmission source. On the Internet, the transmission path is generally recorded in the packet to ensure the return path through which a response packet sent in return for the packet can be certainly delivered to the transmission source. In the present embodiment, however, since the return path is already provided within the communication path control apparatus 200, communication can be performed between apparatuses without recording the path or processing the packet. Consequently, unnecessary process can be eliminated, thereby improving the processing speed.
The example in
In such way, by sending a packet via parallelcast to all the communication control apparatuses, the packet can be appropriately processed by the proper communication control apparatus among the multiple communication control apparatuses, without the need to specify, in advance, a communication control apparatus by which the packet is to be processed.
Since these communication control apparatuses receive all packets sent via parallelcast from the communication path control apparatus 200 to process or discard them, as stated previously, the apparatuses need not be provided with IP addresses, which uniquely identify apparatuses on the Internet. If the packet processing as discussed above is performed by server apparatuses or the likes, it will be necessary to consider attacks to the server apparatuses. However, since the communication control apparatuses of the present embodiment cannot be directly attacked by malicious third parties via the Internet, communication control can be performed securely.
As discussed previously, a bot infects and damages a user terminal 310. A user terminal infected by a bot (hereinafter, referred to as “bot 320”) is operated at the attacker's discretion and behaves as the attacker's own terminal. Therefore, it is desired to detect and block communication for operating a bot 320 or communication through which a bot 320 attacks another user terminal 310.
However, since new subspecies appear constantly based on a bot of which the source code has become available, it is difficult to certainly detect every inappropriate communication data transmitted from or to a bot 320 or a botnet 322, which consists of multiple bots 320.
For such an occasion, the present embodiment proposes a technique, with the perspective reversed, in which a signature list of normal communication is created so as to permit normal communication; at the same time, every abnormal communication is reported to be analyzed, and both the signature list of normal communication and the signature list of abnormal communication are updated as needed. This technique is expected to reduce damage caused by botnets, so that the social contribution of the present invention may be considered remarkable.
In the communication management system 300, the communication control apparatus 10 is provided between a user terminal 310 and the Internet 390 to control communication data transmitted via the Internet 390. When detecting abnormal communication data, the communication control apparatus 10 notifies an operator terminal 340 thereof. The operator terminal 340 then analyzes such communication data to determine if the communication data is normal. The signature of communication data found to be normal is reflected in the communication control apparatus 10 and, thereafter, the transmission of the same kind of communication data will be permitted. The signature of communication data found to be abnormal is also reflected in the communication control apparatus 10 and, thereafter, the transmission of the same kind of communication data will be forbidden and blocked. In this way, the communication control apparatus 10 detects and blocks communication between a bot 320 and a botnet 322 or communication for operating a bot 320 via the Internet 390.
The communication control apparatus 10 of the present embodiment comprises, as the first database 50, a normal signature list 332, an abnormal signature list 334 and a rule database 336. The normal signature list 332 contains a list of signatures of communication data of which the transmission is considered to be normal and should be permitted. The abnormal signature list 334 contains a list of signatures of communication data of which the transmission is considered to be abnormal and should be blocked. The rule database 336 stores a rule for extracting communication data required to be analyzed.
Since the three first databases 50 are provided, there are also provided three search circuits 30: a search circuit 30A functions as a first search unit, which searches the normal signature list 332 storing signatures of normal communication to check if the signature of acquired communication data appears in the list; a search circuit 30B functions as a second search unit, which searches the abnormal signature list 334 storing signatures of abnormal communication to check if the signature of acquired communication data appears in the list; and a search circuit 30C functions as a third search unit, which searches the rule database 336 to check if acquired communication data complies with a rule stored in the database. At least two, or preferably all, of these search circuits 30 perform searches simultaneously in parallel. This enables fast detection of normal communication, abnormal communication, and communication to be extracted, without reducing throughput. In order to provide communication data to the three search circuits 30 concurrently, the technique shown in
The second database 60 stores a processing content of issuing a warning for the case where there is detected communication data of which the signature does not match any signature of normal communication stored in the normal signature list 332. In such case, the process execution circuit 40 functions as a warning unit that, when the search circuit 30A detects communication data of which the signature does not match any signature stored in the normal signature list 332, issues a warning to notify the operator terminal 340 thereof.
The second database 60 also stores a processing content of blocking communication data for the case where there is detected communication data of which the signature matches a signature of communication to be blocked stored in the abnormal signature list 334. In such case, the process execution circuit 40 functions as a blocking unit that, when the search circuit 30B detects communication data of which the signature matches a signature stored in the abnormal signature list 334, discards and blocks the communication data.
In the operator terminal 340, when acquiring a warning from the communication control apparatus 10, a warning acquisition unit 342 notifies the operator thereof through a display output or an audio output. In the meantime, a communication data acquisition unit 344 acquires from the communication control apparatus 10 the communication data against which the warning has been issued. An analysis unit 346 analyzes communication data against which a warning has been issued and of which the signature does not match any signature of normal communication so as to determine if the communication is normal, and then transmits the result to a determination result acquisition unit 348. The determination result acquisition unit 348 may acquire the determination result from the operator who has analyzed the communication data. Alternatively, the determination result acquisition unit 348 may acquire the determination result from a security vendor or the like specified by the operator.
When acquiring a determination result that communication data against which a warning has been issued is found to be normal, the determination result acquisition unit 348 instructs a normal signature list update unit 352 to add the signature of the communication data to a normal signature list 362. The normal signature list update unit 352 then adds to the normal signature list 362 the signature of the communication data found to be normal.
When acquiring a determination result that communication data against which a warning has been issued should be blocked, the determination result acquisition unit 348 instructs an abnormal signature list update unit 354 to add the signature of the communication data to an abnormal signature list 364. The abnormal signature list update unit 354 then adds to the abnormal signature list 364 the signature of the communication data to be blocked.
The normal signature list 362 and abnormal signature list 364 thus updated are reflected, at a certain time, in the normal signature list 332 and abnormal signature list 334 of the communication control apparatus 10 by the database server 150. Updating of a database may be performed according to the procedure described in the base technology. Alternatively, the normal signature list update unit 352 and abnormal signature list update unit 354 may directly access and update the normal signature list 332 and abnormal signature list 334. When multiple communication control apparatuses 10 are provided, the database server 150 creates the normal signature list 362 that collectively contains determination results of communication data against which warnings have been issued by the respective communication control apparatuses 10, so as to reflect the collective normal signature list 362 in the normal signature lists 332 of the respective communication control apparatuses 10.
In this way, instead of only extracting the signature of abnormal communication to block the communication, the signature of normal communication alone is extracted to permit the communication; the other communication is analyzed and determined if it is normal, and the determination result is reflected thereafter. Accordingly, even though inappropriate communication is conducted using a new communication protocol in the botnet 322 or the like, the communication is not considered to be normal and can be detected certainly. Also, once communication data to be blocked is detected, the signature thereof is registered in the abnormal signature list 334 so that the communication data can be appropriately blocked thereafter. Although the number of signatures included in the normal signature list 332 and abnormal signature list 334 becomes considerably large, communication can be managed appropriately without reducing throughput, because the communication control apparatus 10 of the present embodiment is configured with dedicated hardware, and hence, high-speed search processing can be achieved, as described in the base technology.
The second database 60 further stores a processing content of replicating communication data and outputting it for the case where there is detected communication data that complies with a rule stored in the rule database 336. In such case, the process execution circuit 40 functions as an extraction unit that, when the search circuit 30C detects communication data that complies with a rule stored in the rule database 336, outputs a replica of the communication data from an output port to the operator terminal 340.
For example, when determining whether communication data against which a warning has been issued is normal or to be blocked, it may be necessary, for the analysis, to refer to other communication data transmitted from the same source or other communication data transmitted to the same destination. For such an occasion, if the IP address of the transmission source or transmission destination of the communication data against which a warning has been issued, or the content of the payload of such communication data is registered as one of the rules in the rule database 336, communication data that complies with the rule can be collected and used for the analysis. As described in the base technology, since the communication control apparatus 10 of the present embodiment can detect not only information stored in a header field, such as the IP address of a transmission source or a transmission destination, but also information stored in a payload field, the rules can be set in more detail.
If the operator decides that communication data against which a warning has been issued should be analyzed with reference to other communication data, the operator may add a rule for extracting relevant communication data to a rule database 366 via a rule database update unit 356. The updated rule database 366 is reflected in the rule database 336 of the communication control apparatus 10 by the database server 150. This enables a packet capture apparatus that can modify a signature as needed.
The present invention has been described with reference to the embodiment. The embodiment is intended to be illustrative only and it will be obvious to those skilled in the art that various modifications to constituting elements or processes could be developed and that such modifications are also within the scope of the present invention.
Although the normal signature list 332, abnormal signature list 334, rule database 336, and the search circuits 30A, 30B and 30C, which search such lists and database for communication data, are provided in a single communication control apparatus 10 in the present embodiment, these may be provided in different communication control apparatuses 10.
The present invention is applicable to a communication management system that manages inappropriate communication.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/JP2006/316648 | 8/24/2006 | WO | 00 | 12/16/2009 |
