JP2006243878A - Unauthorized access detection system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an unauthorized access detection system capable of early providing or executing, after detection of an unauthorized access, an appropriate processing method according to the content of the unauthorized access. <P>SOLUTION: A signature-with-handling method providing server 101 forms signatures in which attack patterns showing characteristics of unauthorized access are paired with appropriate handling methods after finding out unauthorized accesses, and provides them to end equipment or a router 102. The signatures are formed by an expert who operates the signature-with-handling method providing server 101. In the end equipment or the router 102, an unauthorized access detection/coping part 104 inspects data to be transmitted and received, and detects, upon finding out a packet matched to the signatures, it as unauthorized access. Further, an unauthorized access handling part 107 provides a handling method corresponding to this unauthorized access to an equipment application 108 to execute the handling method. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an illegal access detection system technology, and particularly to a signature creation method for detecting unauthorized access, an attack pattern indicating the characteristics of unauthorized access in the signature and an appropriate countermeasure when an unauthorized access is detected. By recording it in pairs and providing a countermeasure to the administrator when an unauthorized access is actually detected, the administrator can make a decision every time an unauthorized access is detected and take subsequent measures. The present invention relates to an unauthorized access detection system that can be omitted and can quickly cope with unauthorized access.

  In recent years, with the spread of networks such as the Internet, the introduction of an always-on Internet connection environment has become popular in companies and homes. Conventionally, when a LAN environment is configured internally in a company or home (hereinafter referred to as an internal network), a line (hereinafter referred to as an external network) connectable to the outside such as the Internet is connected to the internal network. In general, a gateway or a router is used for relaying, and NAT (Network Address Translation) is set to restrict direct communication from an external network to a device in the internal network. However, in recent years, with the proliferation of IPv6 (Internet Protocol version 6) and peer-to-peer connections, electrical appliances that can be connected to personal computers and networks (hereinafter referred to as end devices) without direct gateway or router settings are directly communicating. The forms that meet each other are also becoming popular.

  However, since the home network is always connected to the outside network, a device connected to the home network may receive unauthorized access from the outside network. The unauthorized access in this case is an unauthorized attack performed from an external network, such as an unauthorized intrusion, a DDoS (Distributed Denial of Service) attack, an attack aimed at system vulnerability. In addition, there is a possibility that an end device connected to the home network receives unauthorized access from the external network and is illegally intruded, thereby making unauthorized access to the external network. Unauthorized access in this case refers to an end device connected to the internal network becoming a stepping stone when it is infected with a virus, for example, and attacking the outside. And a case where a DDoS attack is performed.

  Therefore, there are an intrusion detection system (Intrusion Detection System), an intrusion detection and prevention system (Intrusion Detection and Prevention), and the like for unauthorized access performed from the outside network to the home network. The former is a system for detecting unauthorized access by monitoring system and network resources and activities. The latter is a system that blocks unauthorized access in addition to the former. These systems are widely deployed mainly in gateways.

  As a method of detecting unauthorized access by an intrusion detection system and intrusion detection / protection system, a signature type that detects unauthorized access using a signature is generally used. A signature is an attack pattern that exists in a packet used for unauthorized access. In the signature type, a pattern of attacks discovered as unauthorized access in the past is stored as a signature, and each time a packet is received, it is judged whether it is unauthorized access by comparing the packet with the signature. It is. As processing after detecting unauthorized access, in the case of an intrusion detection system, since only unauthorized access is detected, measures such as blocking unauthorized access are taken by the administrator. Many intrusion detection / prevention systems automatically block only unauthorized access and do not block other normal communications.

As a document that prescribes how to perform processing after detecting unauthorized access, there is a technique disclosed in the publication of Patent Document 1. According to the method disclosed in this publication, based on the header information of the IP packet received by the device, the preset IP packet header information and the setting rule indicating the relationship between the attack are referred to, and the IP packet that becomes the attack The filter is set to allow other IP packets to pass. Furthermore, based on the payload information of the IP packet that has passed through the filter, it is possible to block the attacking IP packet and allow other IP packets to pass, thereby preventing the attacking IP packet from being accepted.
JP 2003-99339 A

  As processing after detecting unauthorized access, it is necessary to implement appropriate countermeasures at an early stage in order not to increase the damage caused by unauthorized access. However, since the intrusion detection system only detects unauthorized access, the processing after unauthorized access detection must be performed by the administrator after examining the countermeasures appropriate for the unauthorized access. May not be possible.

  In addition, the intrusion detection / prevention system and the conventional configuration always block only unauthorized access after detecting unauthorized access. However, depending on the type of unauthorized access, blocking may affect other communications. It is hard to say that it is an appropriate coping method. An example of unauthorized access that affects other communications by blocking is ACK SCAN, which is one of DoS attacks. Normally, a service provided by the system is protected by setting packet filtering so that it is not accessed from an external network. However, the administrator may not have set the packet filtering correctly or may have been set incorrectly due to incorrect settings. Therefore, the attacker can search the ports that are not set for filtering among the ports that are serviced by the system by sending a large amount of TCP ACK packets to the target terminal. If an attacker obtains information about a port for which filtering is not set, there is a possibility that the attacker may attempt to use the service illegally using that port. However, if an ACK SCAN is detected and only the TCP ACK packet is blocked, normal TCP communication establishes a connection by exchanging the TCP ACK packet. Will also stop other communications, affecting other communications. In addition, if only unauthorized access is blocked, every time a service that requires communication with an external network is activated, the administrator can analyze all blocked unauthorized access and communicate correctly. It is necessary to investigate whether or not. For example, when the ACK SCAN is cut off, even if an attempt is made to start the operation of a new service, the TCP ACK is discarded and communication cannot be performed, which is useless.

  In addition, all of the above systems monitor and detect packets flowing from the external network to the internal network, but conversely, the end device becomes a stepping stone when it is infected with a virus. It cannot be detected when unauthorized access such as a DDoS attack is made to an external network.

  The present invention solves the above-described conventional problems by comparing an attack pattern existing in a packet used for unauthorized access when creating a signature and an appropriate countermeasure after the unauthorized access is detected. When an unauthorized access is detected, an appropriate processing method corresponding to the content of unauthorized access is provided to the administrator and implemented. For example, the following measures for dealing with unauthorized access are defined in the signature.

  With regard to unauthorized access that does not affect other normal communications even if it is blocked, the administrator issues a request to block only that type of packet when detected, and the administrator Or block only that type of packet after a certain period of time.

  Regarding the type of unauthorized access that causes significant damage when infected and affects other communications when blocked, the administrator is requested to stop the system at the time of detection, and the administrator stops or stops after a certain time.

  When unauthorized access is detected, a countermeasure is also provided to deal with unauthorized access, so there is no need for the administrator to make a decision after each unauthorized access is detected, and early countermeasures can be taken against unauthorized access. It is. In addition, since the blocking method is changed according to unauthorized access, it is possible to protect against unauthorized access without affecting normal communication as much as possible. There is no need to analyze the contents of unauthorized access.

  Furthermore, regardless of the direction of the packet flow, the packet is investigated and unauthorized access is detected. As a result, the end device is exposed to unauthorized access, which serves as a stepping stone and performs unauthorized access such as DDoS attacks on external networks. Since it is possible to detect such a case, it is possible to prevent a case where the user who uses the end device is stepped on without knowing it and causes trouble to the external network.

  In order to solve the conventional problem, an invention according to claim 1 of the present application is an unauthorized access detection system that detects unauthorized access from a packet flowing through a network based on a signature indicating an attack pattern that is characteristic of unauthorized access. And an appropriate handling method after an unauthorized access is detected, and a signature providing server with a countermeasure that creates a signature with a countermeasure by associating the signatures with each other, and an unauthorized access detection and countermeasure section. Monitoring a packet flowing through the network, and a signature correcting / managing unit with a countermeasure for correcting and managing the signature with a countermeasure provided from the signature providing server with a countermeasure as required by the system, The signature with the countermeasure managed by the signature correction / management unit with the countermeasure Comparing and detecting an unauthorized access with an unauthorized access detection unit, and when an unauthorized access is detected, a countermeasure corresponding to the unauthorized access is extracted from the signature with the countermeasure and provided to the device application And an unauthorized access countermeasure unit.

  The invention according to claim 2 of the present application, when receiving the signature with a countermeasure from the signature providing server with a countermeasure, inquires about whether or not the device application needs to be corrected, and It has a signature management unit with a countermeasure that corrects and manages based on the request of the device application if necessary based on the judgment of the application.

  In addition, the invention according to claim 3 of the present application provides a coping method corresponding to the unauthorized access from the signature with the coping method to the device application when an unauthorized access is detected. When the coping method is not executed in the device application, the device application includes an unauthorized access countermeasure unit that executes the coping method.

  The invention according to claim 4 of the present application detects a coping method that causes a problem in starting the new service from unauthorized access that has already been dealt with when starting a new service. When a certain coping method is applied, a coping method list is provided to the device application, and an illegal access countermeasure unit for canceling the coping method that causes the problem according to circumstances is provided.

  In addition, in the invention according to claim 5 of the present application, in the state where some unauthorized access has already been detected and the countermeasure is applied, is the countermeasure corresponding to the unauthorized access appropriate every certain time? In this case, the information processing apparatus includes an unauthorized access countermeasure unit that transmits contents of the unauthorized access and a symptom to the signature providing server with a countermeasure when it is not appropriate.

  Further, the invention according to claim 6 of the present application is an unauthorized access detection system for detecting unauthorized access from a packet flowing through a network based on a signature indicating an attack pattern that is a characteristic of unauthorized access. The unit creates an appropriate coping method after the unauthorized access is detected, associates the signatures with each other, creates a coping method with a coping method, and a coping method with the coping method The provided signature with countermeasures is modified and managed according to the needs of the system, and the signature correction / management unit with countermeasures is monitored, and the packet flowing through the network is monitored. Compare with the managed signature with the countermeasure, and determine whether it is unauthorized access And illegal access detection section that, when the unauthorized access is detected, the extracts Action corresponding to the unauthorized access from Solution with signatures, characterized in that it comprises a countermeasures against unauthorized access unit for providing to the device application.

  In the present invention, the attack pattern used for unauthorized access in the signature and the appropriate countermeasure after the unauthorized access is detected are recorded in pairs, and the countermeasure is provided to the administrator when unauthorized access is detected. By doing so, it is not necessary for the administrator to make a determination after each unauthorized access is detected, and it is possible to take early measures against unauthorized access. In addition, by appropriately changing the blocking method according to unauthorized access, it is possible to protect against unauthorized access without affecting normal communication as much as possible, and when a service that an administrator wants to communicate newly occurs Therefore, it is not necessary to analyze the contents of unauthorized access being blocked, and the administrator's trouble can be saved.

  Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
FIG. 1 is a block diagram showing a schematic configuration of an unauthorized access detection countermeasure system according to Embodiment 1 of the present invention.

  In FIG. 1, a signature providing server 101 with a countermeasure, an end device, a router 102, and the like are connected to a network such as the Internet. The signature providing server 101 with a countermeasure creates an appropriate countermeasure for each unauthorized access after the unauthorized access is discovered, and pairs the countermeasure with a signature indicating an attack pattern indicating the characteristics of the unauthorized access. Create a legal signature. Hereinafter, data that enumerates pairs of attack patterns indicating the characteristics of unauthorized access and countermeasures after the unauthorized access is detected is referred to as a signature with countermeasures. The signature with a countermeasure is mainly created by an expert who operates the signature providing server 101 with a countermeasure, and the gateway, router, or end device used in a network such as a company or a home by the signature providing server 101 with a countermeasure. Provided to. The end device or router 102 transmits data from the end device or router 102 to the network, the data transmitting / receiving unit 103 for the end device or router 102 to receive data from the network, detecting unauthorized access, The unauthorized access detection / countermeasure unit 104 and the device application 108 are provided and implemented to the application 108. The unauthorized access detection / countermeasure unit 104 manages a signature with a countermeasure provided from the signature providing server 101 with a countermeasure, and corrects and manages the signature with a countermeasure that can be customized to a format suitable for the system as necessary. An unauthorized access detection unit 106 that extracts a packet flowing through the data transmission / reception unit 103 and inspects whether the access is unauthorized using the signature with a countermeasure managed by the signature correction / management unit 105 with a countermeasure; When unauthorized access is detected, a countermeasure method corresponding to unauthorized access is provided to the device application 108 based on the content of the signature with the countermeasure, and the countermeasure method is implemented upon receiving a request for the countermeasure from the device application 108 The unauthorized access countermeasure unit 107 is configured.

  FIG. 2 shows an example of a signature with a countermeasure created by the signature providing server with a countermeasure 101. The unauthorized access name indicates the name of unauthorized access. The unauthorized access pattern is an attack pattern indicating the characteristics of unauthorized access. The damage at the time of receiving is the degree of damage when the system receives unauthorized access, and the lower the damage, the lower the value, and the higher the value. The effect of blocking is the degree of influence on other communications when only unauthorized access is blocked.If only unauthorized access is blocked, the value will be low if other communications can continue without any change. If the unauthorized access is blocked and other communications cannot be continued, the value is high. The necessity of notification to the center indicates whether it is necessary to notify the signature providing server 101 with a countermeasure or the provider. In the case of serious unauthorized access, or in the case of unauthorized access that cannot be handled by the end device or the router 104 itself, notification to the center is considered necessary. The guidance to the honeypot indicates whether or not it is necessary to analyze unauthorized access in detail by guiding unauthorized access to a decoy server (honeypot). For example, if you want to collect evidence when appealing to an intruder by recording the identity of the intruder who gained unauthorized access, recording the behavior, etc., or researching intrusion methods and attack methods, It is considered necessary to guide to the honeypot. The unauthorized access on the first line in FIG. 2 is named “ABC Attack” and includes a packet including a character string “eeee.exe”. The damage upon receiving this unauthorized access is “4”, the effect of blocking is “6”, and the total score is 10. An example of the relationship between the total score and the coping method is shown in FIG. Notification to the center is necessary, and guidance to the honeypot is also necessary.

  FIG. 3 is an example showing a specific countermeasure to which each signature with a countermeasure in FIG. 2 corresponds. The total score corresponds to the total score in FIG. The coping method varies depending on the total score. In the case of “ABC Attack”, which is an unauthorized access on the first line in FIG. 2, the total score is 10, so that the system needs to be stopped as a countermeasure. In the case of “DDD Overflow”, which is unauthorized access on the second line in FIG. 2, since the total number is 5, it is only necessary to block (partially block) only unauthorized access. However, the method of extracting the coping method of FIG. 3 from the total score is an example, and the total score is not necessarily required. If it is desired to determine a countermeasure method based only on the damage received when the system is operated, the countermeasure method may be determined by applying the value shown for the damage when the damage is received to the total score shown in FIG.

  FIG. 4 is a flowchart illustrating a flow from when the end device or the router 102 receives a signature with a countermeasure from the signature providing server 101 with a countermeasure to being managed by the signature correction / management unit 105 with a countermeasure. The signature providing server 101 with the handling method transmits the signature with the handling method to the signature correcting / managing unit 105 with the handling method of each end device or the router 102 (S401). The signature correcting / managing unit 105 with the handling method notifies the device application 108 that the signature with the handling method has been received (S402). Upon receiving the notification, the device application 108 makes an inquiry to the signature correction / management unit 105 with a countermeasure and determines whether or not the signature with a countermeasure needs to be corrected (S403). If correction is necessary due to the circumstances of the system or the like, the device application 108 notifies the correction / management unit 105 with the corrective signature with corrective action and the correction portion of the corrective signature with the corrective action (S404, 405). The attached signature correction / management unit 105 corrects and saves the signature with the countermeasure (S406). If there is no need for correction, the device application 108 notifies the signature correction / management unit 105 with countermeasures that correction is not required (S404, 407), and the signature correction / management unit 105 with countermeasures includes a countermeasure. The signature is saved (S408).

  FIG. 5 is a flowchart showing processing when the unauthorized access detection unit 106 inspects packets received by the data transmission / reception unit 103 from the Internet or from other end devices or routers (not shown). The unauthorized access detection unit 106 inspects the packet flowing through the data transmission / reception unit 103 (S501). At this time, if a packet that matches the signature with the countermeasure is not detected, it is regarded as a normal packet, and the packet passes (S502). When detected, the unauthorized access countermeasure unit 107 is notified, and the unauthorized access countermeasure unit 107 extracts a countermeasure method corresponding to the unauthorized access described in the signature with the countermeasure method, and provides the countermeasure method to the device application 108. (S503, 504). The unauthorized access countermeasure unit 107 executes the coping method when requested by the device application 108 to implement the coping method (S505, 506). If no request has been made, it is checked whether or not the request has been made until a predetermined time elapses (S507), and if the predetermined time has passed, the countermeasure is automatically executed by the unauthorized access countermeasure unit 107 (S507, 508).

  FIG. 6 shows an example of the blocking status list. The blocking status list is a list that shows a list of unauthorized access that has been actually detected and that has been implemented with countermeasures, and the actual detected unauthorized access, the total number of points shown in FIG. 3, and the actual countermeasures implemented. It consists of methods. In the case of unauthorized access in the first line, it indicates that an unauthorized access “DDD Overflow” has actually been detected, and the total score is 5, so that only this unauthorized access is blocked (partially shown in FIG. 3). It is in a state of being blocked.

  FIG. 7 is a flowchart showing a case where the device application 108 wants to start a new service. The device application 108 makes an inquiry to the unauthorized access countermeasure unit 107 (S701), and searches whether the unauthorized access countermeasure unit 107 has already been detected from the blocked status list when an unauthorized access that is harmful is already detected (S702). . When there is no harmful unauthorized access, the unauthorized access countermeasure unit 107 notifies the device application 108 that no unauthorized unauthorized access has been detected, and the device application 108 starts a service (S703, 704). In the case where an illegal access that is harmful is already detected, the unauthorized access countermeasure unit 107 provides a block status list to the device application 108 (S703, 705). The device application 108 examines whether or not to start the service from the blocking status list (S706). If the service is not started, the device application 108 ends without doing anything (S707 and 708). When starting the service, the device application 108 issues a notification permitting the start of the service to the unauthorized access countermeasure unit 107 (S707, 709). The unauthorized access countermeasure unit 107 cancels the countermeasure for the harmful unauthorized access (S710), and then the device application 108 starts the service (S711). In the case of the example shown in FIG. 6, “HOE Scan” has already been detected, and the method of dealing with total blocking is applied. However, even if a new service is started due to the total blocking, communication is possible. It will not be possible. Therefore, “HOE Scan” is an unauthorized access that is a harmful effect. However, not only full blocking, but also unauthorized access to which other countermeasures are applied may be regarded as harmful access. For example, depending on the content of the service to be started, it is possible to communicate using a type of blocked packet by partially blocking. In this case, even unauthorized access that is partially blocked is regarded as harmful access that is harmful.

  FIG. 8 is a flowchart for checking whether or not unauthorized access that has already been detected is appropriately dealt with based on the content of the blocking status list. Confirmation is performed at regular intervals. The unauthorized access countermeasure unit 107 searches whether there is no problem in the countermeasures implemented for the unauthorized access at the head of the blocking status list (S801). The unauthorized access countermeasure unit 107 checks whether or not there is a problem. If there is no problem, the unauthorized access countermeasure unit 107 checks whether or not the next line exists in the blocking status list. A row is an inspection target (S802, 803, 804). If the next line does not exist, the process ends (S803). If there is a problem with the coping method, the contents and symptoms of unauthorized access are provided to the signature providing server with coping method 101 or a server such as a provider (S802, 805). For example, when the unauthorized access shown in FIG. 6 has already been detected, “PQR Attack” does not suffer a great deal of damage even if the end device or router is attacked. It has been subjected. However, if the end device or router 102 suffers significant damage due to the occurrence of this unauthorized access variant, the countermeasure must be changed. It is provided to a server such as a signature providing server 101 or a provider. The signature providing server 101 with a countermeasure can also create a new signature with a countermeasure.

(Embodiment 2)
FIG. 9 is a block diagram showing a schematic configuration of the unauthorized access detection countermeasure system according to Embodiment 2 of the present invention.

  In FIG. 9, an end device and a router 901 are connected to a network such as the Internet. The end device or router 901 transmits data from the end device or router 901 to the network, the data transmission / reception unit 902 for the end device or router 901 to receive data from the network, detects unauthorized access, and the countermeasures thereafter An unauthorized access detection / countermeasure unit 903 and a device application 908 are provided and implemented to the application 908. The unauthorized access detection / countermeasure unit 903 creates an appropriate countermeasure for each unauthorized access after the unauthorized access is discovered, and creates a signature with a countermeasure that is paired with a signature indicating an attack pattern indicating the characteristics of unauthorized access. A signature creation unit 904 with a countermeasure to be created and a signature modification with a countermeasure that manages the signature with a countermeasure created by the signature creation unit 904 with a countermeasure and can be customized to a format suitable for the system as necessary. A management unit 905 and an unauthorized access detection unit 906 that extracts packets flowing through the data transmission / reception unit 902 and inspects whether or not unauthorized access is performed using a signature with a countermeasure managed by the signature correction / management unit 905. And measures to respond to unauthorized access based on the signature contents when unauthorized access is detected Providing to the device application 908, and a countermeasures against unauthorized access unit 907 to implement countermeasures.

  In the second embodiment, in the first embodiment of FIG. 1, a signature with a countermeasure performed by the signature providing server with a countermeasure 101 is created with a countermeasure in the unauthorized access detection / countermeasure unit 903 of each end device or router 901. This is what the signature creation unit 904 performs. The signature with a countermeasure created by the signature creation section with a countermeasure 904 is managed by a signature correction / management section 905 with a countermeasure. Thereafter, all operations in the second embodiment are the same as those described in the first embodiment by replacing the signature providing server 101 with a countermeasure in the first embodiment with a signature creation unit 904 with a countermeasure.

  The unauthorized access detection system of the present invention records an attack pattern used for unauthorized access and an appropriate countermeasure after the unauthorized access is detected as a signature, and provides a countermeasure to the administrator when unauthorized access is detected. By doing so, it is possible to respond to unauthorized access promptly without the need for the administrator to determine and take subsequent measures each time unauthorized access is detected, such as when the administrator is a general user at home, etc. It can be used when there is a lack of knowledge about network security, or when it is necessary to deal with unauthorized access quickly without the need for an administrator.

1 is a block diagram showing a schematic configuration of an unauthorized access detection system according to Embodiment 1 of the present invention. Diagram showing an example of a signature with a countermeasure Diagram showing an example of how to deal with Flowchart showing processing when a signature with countermeasure is received from the signature management server with countermeasure and the signature correction / management unit with countermeasure corrects and manages the signature. Flow chart showing processing when the data transmitting / receiving unit receives a packet from the Internet or from an end device or router A diagram showing an example of the blocking status list Flowchart showing when a device application wants to start a new service Flowchart for confirming whether or not unauthorized access that has already been detected is being dealt with appropriately The block diagram which shows schematic structure of the unauthorized access detection system which concerns on Embodiment 2 of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Signature providing server with countermeasure 102 End device and router 103 Data transmission / reception unit 104 Unauthorized access detection / measurement unit 105 Signature correction / management unit with countermeasure 106 Unauthorized access detection unit 107 Unauthorized access countermeasure unit 108 Device application 901 End device and router 902 Data transmission / reception unit 903 Unauthorized access detection / countermeasure unit 904 Signature creation unit with countermeasure 905 Signature modification / management unit with countermeasure 906 Unauthorized access detection unit 907 Unauthorized access countermeasure unit 908 Device application

Claims (6)

An unauthorized access detection system that detects unauthorized access from a packet flowing through a network based on a signature indicating an attack pattern that is characteristic of unauthorized access,
An appropriate coping method after an unauthorized access is detected, a signature providing server with a coping method for creating a coping scheme with a countermeasure by associating the signatures with each other,
The unauthorized access detection and countermeasure department
A signature correcting / managing unit with a countermeasure for correcting and managing the signature with a countermeasure provided from the signature providing server with a countermeasure according to the needs of the system;
An unauthorized access detection unit that monitors packets flowing through the network, compares the signature with a countermeasure managed by the signature correction / management unit with a countermeasure, and determines whether the access is unauthorized;
An unauthorized access detection system comprising: an unauthorized access countermeasure unit that extracts a countermeasure corresponding to the unauthorized access from the signature with the countermeasure and detects the unauthorized access and provides the device application with the countermeasure. When the signature with the countermeasure is received from the signature providing server with the countermeasure, the device application is inquired about whether or not the correction is necessary. The unauthorized access detection system according to claim 1, further comprising: a signature correction / management unit with a countermeasure for correcting and managing based on a request. When an unauthorized access is detected, a response method corresponding to the unauthorized access is provided from the signature with the countermeasure to the device application, and the device application is requested to execute the countermeasure after a certain period of time. The unauthorized access detection system according to claim 1, further comprising an unauthorized access countermeasure unit that executes the countermeasure when it does not exist. When a new service is started, a countermeasure that causes a problem in starting the new service is detected from unauthorized access that has already been dealt with. If a problematic countermeasure is taken, The unauthorized access detection system according to claim 1, further comprising an unauthorized access countermeasure unit that provides a device list to a device application and cancels a countermeasure that causes the problem in some cases. In a state where some unauthorized access has already been detected and countermeasures are being taken, it is checked at regular intervals whether or not the countermeasures corresponding to the unauthorized access are appropriate. The unauthorized access detection system according to claim 1, further comprising an unauthorized access countermeasure unit that transmits contents and symptoms of the unauthorized access to the signature providing server with a countermeasure. An unauthorized access detection system that detects unauthorized access from a packet flowing through a network based on a signature indicating an attack pattern that is characteristic of unauthorized access,
The unauthorized access detection and countermeasure department
An appropriate coping method after unauthorized access is detected, a signature creating unit with a coping method for creating a coping method with a countermeasure by associating the signatures with each other,
A signature correction / management unit with a countermeasure for correcting and managing the signature with a countermeasure provided from the signature creation unit with a countermeasure according to the needs of the system;
An unauthorized access detection unit that monitors packets flowing through the network, compares the signature with a countermeasure managed by the signature correction / management unit with a countermeasure, and determines whether the access is unauthorized;
An unauthorized access detection system comprising: an unauthorized access countermeasure unit that extracts a countermeasure corresponding to the unauthorized access from the signature with the countermeasure and detects the unauthorized access and provides the device application with the countermeasure.

Images