Patent Application
20180212982
The present invention relates to setting of information to a network device, and especially relates to a technology to set information for interrupting an attack detected within a network to a network device.
In recent years, targeted cyber attacks to cause unauthorized programs to intrude into companies and organizations through the Internet by exploiting someone's feelings and preying on the vulnerability of information systems. The targeted cyber attacks have been highly developed, sophisticated, and diversified year by year. As means to counter the attacks, behavior detection devices that find out an attack from a behavior of an operation of software or communication on the network have been put into practical use. Among the behavior detection devices, a behavior detection device, which finds out an attack from a behavior of communication on the network, monitors traffic mirrored from a network device, and detects intrusion of suspicious data from an external network, connection from an internal network to an unauthorized website in an external network, suspicious communication and files, and abnormality by statistical analysis or the like, thereby to detect an attack that cannot be detected through matching with pattern files in a virus definition document.
Further, with a view to minimize damage by performing prompt initial response if an unauthorized program intrudes into a company or an organization by a targeted cyber attack, a solution has been proposed, which causes a behavior detection device and a software defined networking (SDN) technology to cooperate with each other to automate interruption/separation of a network by an SDN cooperative adapter, using an event detected by the behavior detection device as a trigger.
Non-Patent Literature 1:
http://jpn.nec.com/sdn/pdf/NEC_SDN_cyber_trendmicro.pdf
The above-described behavior detection device detects suspicious communication, and outputs details of communication such as a destination internet protocol (IP) address, a transmission source IP address, and a protocol type. In a case of performing interruption/separation of communication in cooperation with the behavior detection device, an IP address is specified and an interruption instruction of communication is output to the network side. There is a technology described in JP-10-56451-A as a method of identifying a terminal from a specified IP address. In identification of a terminal based on an address resolution protocol (ARP) table in JP-10-56451-A, only up to a layer 3 switch can be identified in a case where layer 3 switches are included in the network. In a case where the network is a network having a hierarchical structure further including layer 2 switches, even if a layer 3 switch is identified and a filter for interrupting communication is set to the layer 3 switch, an unauthorized program infects another terminal in layer 2 relay between layer 2 switches, and spreading of the damage cannot be prevented.
In a case of a command and control (C & C) server that causes the interruption target IP address notified from the behavior detection device to output an instruction to the unauthorized program, a filter to interrupt communication may just be set to a point of contact with the C & C server, that is, a port of a network device directly in contact with the Internet. By the setting, even if there is a terminal undetected by the behavior detection device although an unauthorized program is hidden by an attack, communication between the terminal and the C & C server can also be interrupted, and the point of contact is the efficient and optimum communication interruption position with a small application number of filters. The port directly connected with the Internet is known from the network configuration, and the optimum communication interruption position for the C & C server can be determined by an administrator in advance.
Meanwhile, in a case of an IP address of a terminal, the IP address being an interruption target IP address notified from the behavior detection device and infected with the unauthorized program, identification of an optimum communication interruption position is not easy. In this case, setting a filter to a port of a layer 2 switch directly connected with the terminal with a local area network (LAN) cable is the efficient and optimum communication interruption position, where communication to another sub net, and layer 2 relayed-communication in the same network device can be interrupted, and the application number of filters is least. However, only the IP address is notified from the behavior detection device. Therefore, in a conventional terminal identification technology, a media access control (MAC) address of the terminal is obtained from address resolve protocol (ARP) information learned by a layer 3 switch, and a port that has learned the MAC address from the filtering database (FDB) information is employed as an application target candidate of the filter. However, there is a problem that, in a network configuration in which a plurality of layer 2 switches is hierarchized, which layer 2 switch is directly connected with the terminal or is a network device with the least number of hops cannot be identified from only the FDB information.
Further, a user of a terminal of which communication has been interrupted cannot distinguish whether the terminal cannot reach a network due to breakdown of a device, or whether the communication has been interrupted due to infection of an unauthorized program.
Further, in a case where the terminal infected with an unauthorized program is connected with a port of another layer 2 switch or the IP address of the terminal is changed because the terminal is carried out or the like, movement of the port or change of the IP address needs to be detected, and the optimum communication interruption position needs to be re-identified.
The present invention has been made for solving the above-described problems, and an objective is to provide a technology to set a filter for interrupting communication of a terminal infected with an unauthorized program to an appropriate position in a network to realize the interruption of communication with a least number of filters.
Further, an objective of the present invention is to enable a user of a terminal of which communication has been interrupted to distinguish whether the terminal cannot reach a network due to breakdown of the device, or whether the communication has been interrupted due to infection of an unauthorized program.
Further, an objective of the present invention is to re-identify a communication interruption position and interrupt communication in a case where a terminal infected with an unauthorized program is connected to another port or in a case where an IP address of the terminal is changed.
To solve the above-described problems, in the present invention, as an example,
To be specific, in a case where the detection result output by the behavior detection unit is an IP address of an attacked terminal device, the network management unit identifies a layer 2 switch having a smallest number of hops from the attacked terminal device, on the basis of information for associating the IP address of the attacked terminal device and the address allocated to a terminal device accommodated in a switch, the learning information of ports of the switches, and the adjacency information of the switches, and sets a filter that interrupts communication of the attacked terminal device to the identified layer 2 switch.
Further, in a case where a state of a terminal device of an interruption target of communication has been changed, the identification of the target switch for which setting for interrupting the attack is to be performed and the setting for interrupting the attack are performed again.
Further, an interruption message notification unit that notifies interruption of communication because the attack has been detected, to the terminal device of which the communication has been interrupted.
According to the present invention, a filter for interrupting communication of a terminal infected with an unauthorized program can be set to an appropriate position in a network, and the interruption of communication can be realized with a least number of filters.
Further, the present invention enables a user of a terminal of which communication has been interrupted to distinguish whether the terminal cannot reach a network due to breakdown of a device, or whether the communication has been interrupted due to infection of an unauthorized program.
Further, interruption of communication at an optimum position in a network can be continued in a case where a terminal infected with an unauthorized program is connected to a port of another device, or in a case where an IP address of the terminal infected with an unauthorized program is changed.
Hereinafter, a form for implementing the present invention will be described, illustrating a plurality of embodiments.
First, a first embodiment will be described in the following order.
The network system in
The layer 3 switch S10 is connected with the Internet through a port P11, with the behavior detection device S60 through a port P12, with the network management server S50 through a port P13, with the layer 2 switch S20 through a port P14, and with the layer 2 switch S40 through a port P15.
The layer 2 switch S20 is connected with the layer 3 switch S10 through a port P21, with the layer 2 switch S30 through a port P22, and with a user terminal U30 through a port P23.
The layer 2 switch S30 is connected with the layer 2 switch S20 through a port P31, with a user terminal U10 through a port P32, and with a user terminal U20 through a port P33.
The layer 2 switch S40 is connected with the layer 3 switch S10 through a port P41, and with a user terminal U40 through a port P42.
The network management server S50 includes a central processing unit (CPU) for carrying out an operation, a memory for storing a program, and a network interface (IF) for being connected with another network device through a line, and these elements are connected with a bus. The memory stores the controller C10 as a program, and realizes functions of the controller C10 when the CPU executes the program stored in the memory.
The controller C10 is configured from a device information collection unit M51 that is a module to collect information of the network devices, a setting instruction reception unit M52 that that is a module to receive an instruction from the behavior detection device, a topology calculation unit M53 that identifies a target network device for which a filter or the like is to be set according to the instruction, a device setting control unit M54 that performs setting to the network device, and ARP information T10, FDB information T20, and link layer discovery protocol (LLDP) information T30 that are tables storing the information of the network devices collected by the device information collection unit M51. Contents of the tables will be described in
Although the layer 2 switches S20 and S40 have a similar configuration in the present embodiment, the layer 2 switch S30 will be described here as an example. Note that the layer 3 switch S10 is different in including a packet relay unit for performing layer 3 relay, in addition to the configuration of the layer 2 switches.
The layer 2 switch S30 includes a plurality of ports (P31, P32, P33, and the like in
Contents of the tables will be described below.
The ARP information will be described using
The FDB information will be described using
The FDB information T20 is generated on the basis of the FDB information collected from the management target network devices by the controller C10, and is configured from a device L21, a MAC address L22, a learning interface L23, and a learning port L24. In the present embodiment, description will be given on the assumption that VLAN10 is configured from the ports P14 and P15 of the layer 3 switch, the ports P21, P22, and P23 of the layer 2 switch S20, the ports P31 and P32 of the layer 2 switch S30, and the ports P41, P42, and P43 of the layer 2 switch S40. MAC-A of the user A terminal U10 learns the port P14 of the layer 3 switch S10, the port P22 of the layer 2 switch S20, and the port P32 of the layer 2 switch S30. As a result, an entry of the device L21 of S10, the MAC address L22 of MAC-A, the learning interface L23 of VLAN10, and the learning port L24 of P14, an entry of the device L21 of S20, the MAC address L22 of MAC-A, the learning interface L23 of VLAN10, and the learning port L24 of P22, and an entry of the device L21 of S30, the MAC address L22 of MAC-A, the learning interface L23 of VLAN10, and the learning port L24 of P32 are stored.
Similarly, as for MAC-C of the user C terminal U30, an entry of the device L21 of S10, the MAC address L22 of MAC-C, the learning interface L23 of VLAN10, and the learning port L24 of P14, and an entry of the device L21 of S20, the MAC address L22 of MAC-C, the learning interface L23 of VLAN10, and the learning port L24 of P23 are stored.
Similarly, as for MAC-D of the user D terminal U40, an entry of the device L21 of S10, the MAC address L22 of MAC-D, the learning interface L23 of VLAN10, and the learning port L24 of P15, and an entry of the device L21 of S40, the MAC address L22 of MAC-D, the learning interface L23 of VLAN10, and the learning port L24 of P42 are stored.
Further, when VLAN20 is configured from the port P14 of the layer 3 switch, the ports P21 and P22 of the layer 2 switch S20, and the port P33 of the layer 2 switch S30, MAC-B of the user B terminal U20 learns the port P14 of the layer 3 switch S10, the port P22 of the layer 2 switch S20, and the port P33 of the layer 2 switch S30. As a result, an entry of the device L21 of S10, the MAC address L22 of MAC-B, the learning interface L23 of VLAN20, and the learning port L24 of P14, an entry of the device L21 of S20, the MAC address L22 of MAC-B, the learning interface L23 of VLAN20, and the learning port L24 of P22, and an entry of the device L21 of S30, the MAC address L22 of MAC-B, the learning interface L23 of VLAN20, and the learning port L24 of P33 are stored.
Next, the LLDP information will be described using
The LLDP information T30 is generated on the basis of LLDP information collected by the controller C10 from the management target network devices, and is configured from a device L31, a reception port L32, a counter device L33, and a connection destination port L34. In the present embodiment, description will be given on the assumption that all the network devices enable the LLDP function, and the network devices transmit an LLDP control frame to adjacent network devices. The layer 3 switch S10 receives the LLDP control frames from the layer 2 switch S20 and the layer 2 switch S40, the layer 2 switch S20 receives the LLDP control frames from the layer 3 switch S10 and the layer 2 switch S30, the layer 2 switch S30 receives the LLDP control frame from the layer 2 switch S20, and the layer 2 switch S40 receives the LLDP control frame from the layer 3 switch S10.
A result of the LLDP information T30 generated by the controller C10 on the basis of LLDP information collected from the management target network devices is illustrated in
For the information tables described in
The unauthorized program having infected the user A terminal U10 performs communication with the C & C server S70 on the Internet for an attack (M10). The layer 2 switch S30 that is a relay point of the communication mirrors the communication to the behavior detection device S60 (M20). In the present embodiment, the behavior detection device S60 is arranged as an external device connected to the network device and thus the communication is mirrored. However, the network device itself may include the behavior detection device and a mount position of the function is not limited. The behavior detection device S60, which has analyzed the mirrored communication and detected infection of the user A terminal U10 with the unauthorized program, outputs an instruction to the controller C10 to interrupt the communication of IP-A that is the IP address of the user A terminal U10 (M30). The controller C10, which has received the communication interruption instruction M30 from the behavior detection device S60, identifies the target network device to which communication interruption setting is to be set, on the basis of the information collected from the network devices (F10).
The controller C10, which has received (F11) the communication interruption instruction M30 of IP-A that is the IP address of the user A terminal U10 from the behavior detection device S60 with the setting instruction reception unit M52, creates an information table for narrowing the network device to which filter setting for communication interruption is to be performed, in a combination of the ARP information table T10 and the FDB information table T20, in the topology calculation unit M53. The filter setting target device narrowing information table T40 in
The filter setting target device narrowing information table T40 in
To solve this problem, the information table is created in combination of not only the ARP information T10 and the FDB information T20 but also the LLDP information T30. The filter setting target device identifying information table T50 in
Note that, in the present embodiment, the information table T50 is created upon reception of the communication interruption instruction from the behavior detection device S60. However, the information table T50 may be created upon update of the information tables T10, T20, and T30.
The filter setting target device identifying information T50 in
Referring back to
As described above, in the network system of the first embodiment, communication interruption of the user terminal infected with an unauthorized program can be realized with a least number of filters. Further, display of the interruption message on the web browser of the user can make the user aware of infection with the unauthorized program early.
Next, a second embodiment will be described.
A network configuration in which a hub is provided between a layer 2 switch and a user terminal, a plurality of user terminals is accommodated in the hub, and the hub is connected to a port of the layer 2 switch, in the network configuration illustrated in
The second embodiment is an embodiment that detects movement and realizes communication interruption in a case where a terminal infected with an unauthorized program is carried out and connected with a port of another layer 2 switch.
In the present embodiment, a technology to detect, by a controller of a network management server, connection of a communication interruption target terminal with a port of another layer 2 switch, and set a filter for interrupting communication to the port at the destination will be described in the following order.
A network management server S51 in
The port movement monitoring information T100 is information for monitoring port movement of a terminal of which communication has been interrupted, and stores a device L101, a MAC address L102, a learning interface L103, and a learning port L104.
The device information collection unit M51 of a controller C11 periodically collects information from management target network devices and updates tables. When the device information collection unit M51 detects linking-down of the port P32 of the layer 2 switch S30, the device information collection unit M51 discards an entry K50 of the device L21 of S30, the MAC address L22 of MAC-A, the learning interface L23 of VLAN10, and the learning port L24 of P32. Further, the device information collection unit M51 detects connection of the user A terminal U10 to the layer 2 switch S40 and up-linking of the port P43, and learns and stores an entry K60 of the device L21 of S40, the MAC address L22 of MAC-A, the learning interface L23 of VLAN10, and the learning port L24 of P43.
A different point from the flowchart (
The port movement detection unit M100 of the controller C11 periodically (F101) confirms whether an entry corresponding to the FDB entry registered in the port movement monitoring information T100 exists in an FDB information table T20 (F102). In a case where an appropriate FDB entry exists in the FDB information table T20, the processing is terminated. In a case where no appropriate FDB entry exists in the FDB information table T20, steps F12 to F15 in
In a case where a user terminal is directly connected with a network device that cannot learn the FDB information, like a network configured from a router instead of the layer 3 switch, down of a port may be used for detection of the movement of a port. Further, the port movement detection processing may be performed at timing determined in advance or upon an instruction of a server administrator, other than the periodic operation.
As described above, in the second embodiment, even if the user terminal infected with an unauthorized program is moved after the communication is interrupted, and is connected with another port of another layer 2 switch to resume the communication, the port movement is detected and the communication interruption setting can be performed again.
Next, a third embodiment will be described.
The third embodiment is an embodiment to realize communication interruption even in a case where an IP address of a terminal infected with an unauthorized program is changed.
As exemplarily described in the second embodiment, in a case where an IP address of a terminal, of which communication is to be interrupted, is set to a filter of a layer 2 switch, communication can be continued if the IP address of the terminal infected with the unauthorized program is changed.
Therefore, in the present embodiment, a configuration in which a controller of a network management server detects change of an IP address of a target terminal, of which communication has been interrupted, and sets communication interruption to the IP address after change will be described in the following order.
The IP change monitoring information T200 in
The IP address of a user A terminal U10 having the IP address IP-A as the IP change monitoring target is changed from IP-A to IP-A′, and the user A terminal U10 starts communication with IP-A′. The IP change detection unit M200 learns an entry K70 of the device L11 of S10, the IP address L12 of IP-A′, the MAC address L13 of MAC-A, and the output destination interface L14 of VLAN10, and stores the entry to the ARP information table.
A different point from the flowchart (
In the present embodiment, as the IP change monitoring information T200, an entry of the IP address L201 of IP-A and the MAC address L202 of MAC-A is registered.
In the present embodiment, as the IP change monitoring information T200, an entry of the IP address L201 of IP-A and the monitoring target device MAC address L202 of MAC-A is registered as monitoring information. When the terminal of the monitoring target MAC address changes the IP address and continues the communication, an entry K80 of the ARP information table T20 is generated. The IP change detection unit M200 detects change of the IP address through the generation of the entry K80. Further, the IP change detection unit M200 can interrupt the communication by performing communication interruption setting again to the IP address after change, after detecting the change of the IP address. Note that the IP address change detection processing may be performed at timing determined in advance or upon an instruction of a server administrator, other than the periodic operation.
As described above, in the controller of the third embodiment, even if the IP address of the user terminal infected with an unauthorized program is changed to another IP address after the communication is interrupted, and the user terminal tries to resume the communication, the change of the IP address is detected and the communication interruption setting can be performed again.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2017-009098 | Jan 2017 | JP | national |
| 2017-103184 | May 2017 | JP | national |
