JP4161989B2 - Network monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network monitoring system capable of discovering unknown illegal program activity in its early stages. <P>SOLUTION: An application specifying part 221 specifies a transmission application about a packet extracted by an interface 210, a header analysis extracting part 222 analyzes header information and a band analyzing part 223 further analyzes a communication band in accordance with these analysis results. The analysis results are stored in a database 230 and statistically processed by an output processing part 240. Since analysis can be performed for each application, illegal activity that is performed by an unknown or existing illegal program by using the existing application can be discovered in its early stages. <P>COPYRIGHT: (C)2007,JPO&amp;INPIT

Description

  The present invention relates to a system that monitors the state of a network and detects malicious program activities such as worms and DDoS attacks (Distributed Denial of Service attacks).

  In communication networks such as the Internet, failures may occur due to unauthorized activities of computer programs. As computer programs that perform unauthorized activities, for example, worms and DDoS attack programs are known.

  Worms are malicious programs that perform computer destruction while repeating self-replication, and are classified as computer viruses in a broad sense. The worm attempts to send a copy of the worm to a number of other computers using e-mail software on the infected computer. For this reason, the worm not only destroys a large number of computers but also may cause a network congestion failure.

  The DDoS attack is an attack in which a large amount of data is sent to a specific target computer by simultaneously operating a DDoS attack program on a large number of computers. A DDoS attack may not only cause a failure in a targeted computer but also cause a network congestion failure.

  As techniques for protecting computers and networks from such malicious program activities, for example, Internet fixed point observation systems, defense systems using application identification techniques, defense systems using firewalls, and the like are known.

  As a document disclosing the Internet fixed point observation system, for example, the following non-patent document 1 is known. An Internet fixed point observation system is a system that monitors and analyzes traffic using network devices connected to the Internet. In this system, it is possible to detect the occurrence of a network failure due to malicious program activity by visually monitoring the traffic state.

  As a defense system using an application identification technique, for example, Non-Patent Document 2 below is known. The system identifies the application used to transmit the packet from the received packet. And a computer can be defended by filtering the packet transmitted using the known malicious program.

As a document disclosing a defense system using a firewall, for example, the following Patent Document 1 is known. In the technique of Patent Document 1, a firewall is provided at a connection portion between a server to be managed and a network, and a filter device is provided at a border portion between the network and another network. And when a firewall receives an attack packet, while filtering the attack packet, it notifies the information of the attack packet to each filter apparatus. As a result, the attack packet cannot enter the network, so that it is possible to prevent the occurrence of a congestion failure in the network.
Hideki Koike, two others, “Proposal and Implementation of Visualization Techniques for Wide Area Network Monitoring”, [online], Proceedings of the 21st Annual Meeting of the Japan Society for Software Science and Technology (2004), [May 19, 2005 Search], Internet <URL: http://www.vogue.is.uec.ac.jp/~koike/ipmatrix/jssst2004.pdf> Net Agent, “One Point Wall” [online], Net Agent Corporation, [Search May 19, 2005], Internet <URL: http://www.netagent.co.jp/onepoint/> JP 2005-130190 A

  In these systems, for known malicious program activities, damage can be prevented or reduced by setting a filter or a black hole router in advance in cooperation between Internet service providers. Also, when the IP address of a computer that is a target of a DDoS attack is known, it can be dealt with by rewriting the domain name server in advance and changing the IP address.

  However, it is difficult to detect the occurrence of malicious program activities early because unknown malicious program activities can only be dealt with by analyzing the amount of traffic on the network and the number of accesses to specific ports. .

  An object of the present invention is to provide a network monitoring system that can detect an unknown malicious program activity at an early stage.

The network monitoring system according to the present invention includes an interface unit that sequentially extracts packets from network traffic at a monitoring point, and one or more packets extracted by the interface unit for analyzing illegal or legitimate communication. Depending on the application identification unit that identifies the type of application, the header analysis extraction unit that extracts and analyzes the header information of the packet extracted by the interface unit, and the analysis result of the application identification unit or the header analysis extraction unit A bandwidth analysis unit that classifies communications and analyzes the bandwidth used for each classification; a storage unit that stores monitoring data including the identification result of the application identification unit, the analysis result of the header analysis extraction unit, and the analysis result of the bandwidth analysis unit; The monitoring data stored in the storage unit is statistically processed. By, and an output processing unit for the application specific unit generates statistical data of a plurality of types for each type of identified application, and an abnormality detection section for detecting malware activities using statistical data.

According to the network monitoring system of the present invention, analysis of header information and communication bandwidth can be performed for each type of illegal application or legitimate application used for packet communication. regardless of the known, it can be found at an early stage an unauthorized program activity.

  Embodiments of the present invention will be described below with reference to the drawings. In the drawings, the size, shape, and arrangement relationship of each component are shown only schematically to the extent that the present invention can be understood, and the numerical conditions described below are merely examples. .

First Embodiment A network monitoring system according to a first embodiment of the present invention will be described with reference to FIGS.

  FIG. 1 is a conceptual diagram showing the configuration of a network according to this embodiment. As shown in FIG. 1, the network 110 to be monitored includes a plurality of routers 111, 112, 113 and a firewall 114. The routers 111 to 113 and the firewall 114 serve as monitoring points for the network monitoring system (not shown in FIG. 1) according to this embodiment. The external network 120 includes a router 121. The router 111 and the router 121 are connected by a communication line 130. In the following description, the communication direction from the network 110 side to the network 120 side is referred to as “outbound”, and the communication direction from the network 120 side to the network 110 side is referred to as “inbound”. The network monitoring system according to this embodiment is installed in a router 111 that connects the networks 110 and 120, for example.

  FIG. 2 is a block diagram schematically showing the configuration of the network monitoring system 200 according to this embodiment. As illustrated in FIG. 2, the network monitoring system 200 includes an interface 210, an analysis unit 220, a database 230, and an output processing unit 240. The analysis unit 220 includes an application specifying unit 221, a header analysis extraction unit 222, and a band analysis unit 223.

  The interface 210 sequentially extracts packets from the network traffic of the monitoring point (here, the router 111). Further, the interface 210 can filter a specific packet (blocking a packet by applying a patch when the monitoring point is a firewall) based on the operation of the administrator.

  The application specifying unit 221 analyzes the packets extracted by the interface 210 and specifies an application used for transmitting those packets. The applications specified in this embodiment include not only illegal applications such as worms and DDoS attack programs, but also legitimate communication applications such as e-mail software and file exchange software. An application may be identified from only one packet, or may be identified using a plurality of packets. It is desirable to specify the application by using, for example, the characteristics of information read from the payload part (portion for storing communication data) of the packet and the characteristics of the communication protocol. For example, in the case of a worm that uses operating system vulnerabilities, it may be possible to identify the worm by malicious code that uses the vulnerabilities. Further, in the case of software for exchanging files using a unique peer-to-peer communication method, the software may be identified from the characteristics of communication data based on the uniqueness. According to such a specifying method, the specific accuracy can be improved as compared with the method of specifying using only the header information and the transmission / reception port number. This is because the header information may be falsified by an unauthorized program, and the port number may be changed depending on the application. Feature information for specifying an application is created in advance and stored in the application specifying unit 221. This feature information is preferably updated each time a new application is learned. As software for specifying an application, for example, the software disclosed in Non-Patent Document 2 described above is known.

  The header analysis extraction unit 222 extracts and analyzes predetermined header information from the packet extracted by the interface 210. When an application is specified from a plurality of packets, the header analysis extraction unit 222 processes these packets in a batch. In this embodiment, a transmission source address, a destination address, a used protocol, a transmission port number of TCP / UDP (Transmission Control Protocol / User datagram Protocol), and a destination port number are extracted as header information. Further, the header analysis extraction unit 222 uses the extracted transmission source address and destination address and IP address information (not shown) of the network 110 to be monitored, and the address in the network 110 and the network 110. Analyzes outside addresses and communication direction (inbound / outbound). Then, the header analysis extraction unit 222 outputs the use protocol, the transmission source port number, the destination port number, the address in the network 110, the address outside the network 110, and the communication direction as analysis results. The type of header information extracted and analyzed by the header analysis extraction unit 222 is not particularly limited, and can be arbitrarily determined by the manufacturer or user of the network monitoring system 200. For example, a source address or a destination address may be used as they are instead of an address in the network 110 and an address outside the network 110.

  The band analysis unit 223 analyzes the communication band based on the analysis results of the application specifying unit and the header information analysis extraction unit. For example, the bandwidth analyzing unit 223 may analyze the used bandwidth for each application specified by the application specifying unit 221, or the source address / port number and the destination address / port number analyzed by the header analysis extracting unit 222 may be analyzed. The bandwidth used may be analyzed for each communication that matches both. In this embodiment, the bandwidth analysis unit 223 is made to analyze the used bandwidth for each communication in which the source address / port number and the destination address / port number match. On the other hand, the bandwidth used for each application is calculated by the output processing unit 240 by arithmetic processing using the analysis results of the application specifying unit 221, the header analysis extraction unit 222, and the band analysis unit 223 (described later).

  The database 230 is built in a storage device such as a hard disk, and stores monitoring data including analysis results of the application specifying unit 221, the header analysis extraction unit 222, and the bandwidth analysis unit 223 (see FIG. 3 described later).

  The output processing unit 240 reads out monitoring data from the database 230 and applies statistical processing and visual processing to the monitoring data to display on the display device for the supervisor. As will be described later, in this embodiment, as statistical processing performed by the output processing unit 240, the used bandwidth and bandwidth occupancy for each application, the number of communication hosts for each application, the used bandwidth and bandwidth occupancy for each application in inbound communication Adopting the bandwidth and bandwidth occupancy rate for each application in outbound communication, the bandwidth and bandwidth occupancy rate for each communication with the same address and port number, and the time variation of these bandwidth and bandwidth occupancy rates I will decide. Further, as visual processing, the time change of each used band and band occupation rate is graphed (see FIGS. 4 to 6 described later).

  Next, the operation of the network monitoring system 200 shown in FIG. 2 will be described with reference to FIGS.

  First, as described above, the interface 210 extracts a packet from the router 111. The extracted packet is sent to the analysis unit 220.

  The application specifying unit 221 in the analyzing unit 220 analyzes the communication packet as described above, and specifies an application used for the packet communication. As described above, the application may be specified from only one packet, or may be specified using a plurality of packets. When specifying from a plurality of packets, the application specifying unit 221 specifies an application by determining a related packet from packet header information (for example, transmission source address, destination address, port number, sequence number, etc.). Subsequently, the header analysis extraction unit 222 extracts and analyzes the source address, the destination address, the protocol type, the source port number, and the destination port number from these packets. Further, the bandwidth analysis unit 223 analyzes the used bandwidth for each packet in which the application, the source address / port number, and the destination address / port number all match. These analysis results are sent to the database 230 as monitoring data.

  In this embodiment, the header analysis extraction unit 222 and the bandwidth analysis unit 223 do not analyze the packet for which the application identification unit 221 cannot identify the application. However, as described above, the features in the application identification unit 221 By updating the information as needed, the types of applications that can be identified can be increased.

  The database 230 stores monitoring data as a table. The table configuration in the database 230 is shown in FIG. As shown in FIG. 3, items in the network 230 are stored in the database 230, such as an address in the network 110, an address outside the network 110, a used protocol, a source port number, a destination port number, a used band, a used application, and a communication direction The

  The output processing unit 240 reads each monitoring data from the database 230, performs the following statistical processing / visual processing, and displays them on the display device.

  FIG. 4A shows an example in which the used bandwidth and bandwidth occupancy for each application are calculated and displayed by statistical processing. The used bandwidth for each application can be obtained by using the monitoring data (see FIG. 3) and adding the used bandwidth corresponding to the same application. Further, the bandwidth occupancy can be obtained by dividing the used bandwidth calculated in this way by the line capacity.

  FIG. 4B is an example of graphing changes in usage bandwidth and bandwidth occupancy rate for each application by visual processing. Such a graph makes it easy to visually grasp such fluctuations in the used bandwidth and bandwidth occupancy rate. When the bandwidth used for a specific application increases rapidly, there is a high possibility that malicious program activity using that application is being performed. Further, when the bandwidth occupancy rate of a specific application increases rapidly, there is a high possibility that a congestion failure will occur in the network 110 due to unauthorized program activity.

  FIG. 5A shows an example in which the number of communication hosts for each application is calculated and displayed by statistical processing. Here, the number of communication hosts is the number of server computers that provide services using the application. The number of communication hosts is determined by determining the transmission source address from the address in the network 110, the address outside the network 110 and the communication direction for each monitoring data (see FIG. 3), and counting the number of different transmission addresses. Can be calculated.

  FIG. 5B is an example in which the temporal change in the number of communication hosts for each application is graphed by visual processing. When the number of communication hosts rapidly increases in a short time, there is a high possibility that the application that performs the communication transmits a copy of itself to many other computers, and therefore there is a high possibility that the application is a malicious program such as a worm.

  FIG. 6A shows an example in which, for a specific application, a used band and a band occupation ratio in outbound communication and a used band and a band occupation ratio in inbound communication are calculated by statistical processing. These bandwidths can be calculated by using monitoring data (see FIG. 3) and adding bandwidths corresponding to the same application and having the same communication direction. These bandwidth occupancy rates can be calculated by dividing the used bandwidth calculated in this way by the outbound or inbound line capacity. If the outbound / inbound ratio of the used bandwidth or bandwidth occupancy rate is changing rapidly, there is a possibility that a DDoS attack using the application is being performed. Note that the time change of the statistical processing result shown in FIG. 6A may be displayed as a graph in the same manner as in FIGS. 4B and 5B.

  FIG. 6B is an example in which the used bandwidth and bandwidth occupancy rate for inbound communication are calculated and displayed for each address in the network 110 for a specific application. When such a use band and a band occupation rate increase rapidly in a short time, there is a possibility that a computer corresponding to the address is subjected to a DDoS attack using the application. The time change of the statistical processing result shown in FIG. 6B may be displayed as a graph in the same manner as in FIGS. 4B and 5B.

  When an administrator of the network 110 finds an abnormality from the statistical processing information as shown in FIGS. 4 to 6, the administrator of the network 110 relates to the unauthorized program activity by setting the filter of the monitoring point (here, the router 111, see FIG. 1). Block communication packets. Thereby, the network 110 can be protected from such malicious program activity. In addition, when an abnormality is found in the routers 112 and 113, the firewall 114, etc., filtering is performed in other routers (especially routers close to connection points with the other networks 120, etc.) in the same manner as in Patent Document 1. The occurrence of a failure in the entire network may be prevented. Furthermore, when malicious program activity is performed using an application that is not fraudulent (for example, general software for e-mail, etc.), in order to prevent the normal communication from being lost due to filtering, the application is used. It is also possible to limit the bandwidth of communication using.

  As described above, according to the network monitoring system 200 according to this embodiment, the traffic state can be monitored for each application. Therefore, according to this embodiment, the occurrence of malicious program activity can be detected at an early stage, and the damage status of the network 110 due to the malicious program activity can be grasped quickly and in detail.

  In addition, according to the network monitoring system 200 according to this embodiment, not only a malicious program but also a legitimate application is specified, so an unknown or known malicious program seems to be performing an illegal activity using a legal application. Even in such a case, it is possible to detect such an illegal activity at an early stage, and it is possible to quickly and in detail know the damage status of the network 110 due to the illegal activity.

  Also, even when a network congestion failure actually occurs, specifying an application makes it easy to distinguish between congestion caused by malicious program activity and congestion caused by other factors that occur at the same time. Is possible.

Second Embodiment Next, a network monitoring system according to a second embodiment of the present invention will be described with reference to FIG.

  Since the network configuration according to this embodiment is the same as the network configuration (see FIG. 1) of the first embodiment, description thereof is omitted.

  FIG. 7 is a block diagram schematically showing the configuration of the network monitoring system 700 according to this embodiment. In FIG. 7, components denoted by the same reference numerals as those in FIG. 2 are the same as those in FIG. 2.

  In FIG. 7, the output processing unit 710 reads monitoring data from the database 230 as well as the output processing unit 240 according to the first embodiment, and performs statistical processing and visual processing on the monitoring data to display for the supervisor. It is displayed on the device (see FIGS. 4 to 6). In addition, the output processing unit 710 outputs the statistical processing result in response to a request from the abnormality detection unit 720.

  The abnormality detection unit 720 detects malicious program activity using the statistical processing result received from the output processing unit 710. For example, the abnormality detection unit 720 can determine that the malicious program activity is being performed when the time change of the number of transmission addresses or the number of destination addresses corresponding to the same application exceeds a predetermined value. Further, when the time change of the bandwidth usage by the same application exceeds a predetermined value, it can be determined that the illegal program activity is being performed.

  When the abnormality detection unit 720 detects a malicious program activity, the defense execution unit 730 controls the interface 210 to apply a filtering setting or a patch to block a packet related to the malicious program activity.

  Next, the operation of the network monitoring system 700 shown in FIG. 7 will be described.

  As in the first embodiment, the interface 210 extracts a packet from the router 111. The application specifying unit 221 in the analysis unit 220 specifies an application used for communication of a received packet, as in the first embodiment. Subsequently, the header analysis extraction unit 222 extracts and analyzes the same header information as those in the first embodiment from these packets. Further, the bandwidth analysis unit 223 analyzes the used bandwidth for each communication in which the transmission source address / port number and the destination address / port number match. These analysis results are sent to the database 230 as monitoring data. The database 230 stores monitoring data as a table.

  The output processing unit 710 reads each monitoring data from the database 230, performs statistical processing / visual processing similar to those of the first embodiment, and displays them on the display device. In addition, when receiving the request signal from the abnormality detection unit 720, the output processing unit 710 transmits a predetermined statistical processing result to the abnormality detection unit 720.

  As described above, the abnormality detection unit 720 determines the occurrence / non-occurrence of malicious program activity from the received statistical processing result. When a malicious program activity is detected, a signal indicating the detection result is sent to the defense execution unit 730.

  The defense execution unit 730 controls the interface 210 to perform filtering setting or patch application when a malicious program activity is detected by the abnormality detection unit 720. Thereby, the packet related to the malicious program activity can be blocked by the router or the firewall.

  In addition to this, the administrator of the network 110 may be able to artificially set a filter based on the display of the output processing unit 710.

  Further, when an abnormality is found in the routers 112, 113, etc., the network is also filtered in the other routers (particularly routers close to the connection points with the other networks 120, etc.) in the same manner as in Patent Document 1. It is good also as preventing generation | occurrence | production of the failure in the whole. This defense process may be automatically performed by the defense execution unit 730 or may be performed by an administrator.

  In addition, if unauthorized program activity is being performed using a non-fraudable application (for example, general e-mail software), defense execution is performed to prevent the normal communication from being lost due to filtering. The unit 730 or the administrator may limit the bandwidth of communication using the application.

  According to this embodiment, for the same reason as in the first embodiment, regardless of whether the malicious program is unknown or known, early detection of the malicious program activity, quick and detailed understanding of the damage status, accurate cause of the damage Analysis is possible.

  In addition, according to this embodiment, since abnormality detection and countermeasures can be automatically performed, it is possible to reduce human costs for management and human errors.

Third Embodiment Next, a network monitoring system according to a third embodiment of the present invention will be described with reference to FIGS.

  FIG. 8 is a conceptual diagram showing a network configuration according to this embodiment. As shown in FIG. 8, the network 800 to be monitored includes routers 811, 812, 813 and a firewall 814. The routers 811, 812, 813 and the firewall 814 include network monitoring devices 821, 822, 823, and 824. In addition, the network 800 includes an overall monitoring center 830.

  FIG. 9 is a block diagram showing the internal configuration of the network monitoring devices 821 to 824. In FIG. 9, the components given the same reference numerals as those in FIG. 2 are the same as those in FIG.

  Similar to the output processing unit 240 according to the first embodiment, the output processing unit 910 reads monitoring data from the database 230 and performs statistical processing and visual processing on the monitoring data so as to be displayed on the display device for the supervisor. (See FIGS. 4 to 6). In addition, the output processing unit 910 outputs monitoring data read from the database 230 (that is, data before statistical / visual processing) in response to a request from the overall monitoring center 830.

  FIG. 10 is a block diagram showing the internal configuration of the overall monitoring center 830. As shown in FIG. 10, the overall monitoring center 830 includes an interface 1010, an input processing unit 1020, an overall database 1030, and an overall output processing unit 1040.

  The interface 1010 sends the request signal received from the input processing unit 1020 to the network monitoring devices 821 to 824 and sends the monitoring data received from the network monitoring devices 821 to 824 to the input processing unit 1020.

  The input processing unit 1020 generates a request signal and sends it to the interface 1010, and stores the monitoring data received from the interface 1010 in the overall database 1030.

  The overall database 1030 adds information for identifying the network monitoring devices 821 to 824 to the monitoring data (see FIG. 3) received from the input processing unit 1020, stores the information in a table.

  The overall output processing unit 1040 reads monitoring data from the overall database 1030 and performs statistical processing and visual processing on the monitoring data. By this processing, statistical processing data for the entire network 800 is generated. For example, the number of communication hosts for each application and the change over time (see FIG. 5) can be statistically processed for the entire network 800, not for each of the network monitoring devices 821 to 824. Then, the overall output processing unit 1040 displays this processing data on a display device (not shown) of the overall monitoring center 830.

  Next, the operation of the network monitoring system according to this embodiment will be described.

  As in the first embodiment, the interface 210 of the network monitoring devices 821 to 824 extracts a packet from the router 111. The application specifying unit 221 in the analysis unit 220 specifies an application used for communication of a received packet, as in the first embodiment. Subsequently, the header analysis extraction unit 222 extracts and analyzes the same header information as those in the first embodiment from these packets. Further, the bandwidth analysis unit 223 analyzes the used bandwidth for each packet in which the source address / port number and the destination address / port number match. These analysis results are sent to the database 230 as monitoring data. The database 230 tabulates and stores monitoring data. The output processing unit 910 performs statistical processing and visualization processing similar to those of the first embodiment, and displays statistical data.

  The input processing unit 1020 of the overall monitoring center 830 generates a request signal as appropriate. This request signal is transmitted to the corresponding network monitoring apparatuses 821 to 824 via the interface 1010. The output processing unit 910 of the network monitoring devices 821 to 824 reads and transmits monitoring data from the database 230 in response to a request signal from the overall monitoring center 830. The transmitted monitoring data is received by the input processing unit 1020 via the interface 1010. The input processing unit 1020 stores this monitoring data in the database 1030.

  As described above, the overall output processing unit 1040 reads the monitoring data from the overall database 1030, and performs statistical processing and visual processing on the monitoring data to display on the display device for the supervisor.

  According to this embodiment, for the same reason as in the first embodiment, regardless of whether the malicious program is unknown or known, early detection of the malicious program activity, quick and detailed understanding of the damage status, accurate cause of the damage Analysis is possible.

  In addition, according to this embodiment, each router and firewall in the network can be comprehensively monitored. For this reason, according to this embodiment, in addition to being able to grasp and analyze the spread of damage quickly and in detail, it becomes easy to find local abnormalities caused by artificial setting errors and the like.

  It should be noted that the network monitoring devices 821 to 824 of the network monitoring system according to this embodiment are provided with an abnormality detection unit and a defense execution unit (see FIG. 7) similar to those of the second embodiment to generate and prevent illegal program activity. It is good also as making it perform automatically.

Fourth Embodiment Next, a network monitoring system according to a fourth embodiment of the present invention will be described with reference to FIG.

  The overall configuration of the network and the configuration of each network monitoring device according to this embodiment are the same as in the case of the third embodiment (see FIGS. 8 and 9), and a description thereof will be omitted.

  FIG. 11 is a block diagram showing the internal configuration of the overall monitoring center according to this embodiment. As shown in FIG. 11, the overall monitoring center 1100 is different from the third embodiment in that an overall defense execution unit 1110 is provided.

  When the administrator of the overall monitoring center detects unauthorized program activity, the overall defense execution unit 1110 controls the interface 210 of each network monitoring device in an integrated manner by the operation of the administrator, and performs filtering settings and patch settings. Apply. As a result, the packet related to the malicious program activity can be blocked or bandwidth limited by the router or firewall. In addition, when an abnormality is found in some routers or the like, the integrated defense execution unit 1110 is operated by an administrator to operate other routers (especially routers close to connection points with other networks 120 or the like). It is possible to prevent the occurrence of a failure in the entire network by blocking or band limiting.

  According to this embodiment, for the same reason as in the first embodiment, regardless of whether the malicious program is unknown or known, early detection of the malicious program activity, quick and detailed understanding of the damage status, accurate cause of the damage Analysis is possible.

  Moreover, according to this embodiment, it becomes easy to find a local abnormality caused by an artificial setting error or the like for the same reason as in the third embodiment.

  In addition, according to this embodiment, the overall monitoring center 1100 can collectively perform packet blocking and bandwidth limitation at the interface of each network monitoring device. And it can be performed effectively.

1 is a conceptual diagram illustrating a network configuration according to a first embodiment. 1 is a block diagram schematically showing the configuration of a network monitoring system according to a first embodiment. It is a conceptual diagram which shows the structure of the monitoring data stored in the database which concerns on 1st Embodiment. It is a conceptual diagram for demonstrating operation | movement of the output process part which concerns on 1st Embodiment. It is a conceptual diagram for demonstrating operation | movement of the output process part which concerns on 1st Embodiment. It is a conceptual diagram for demonstrating operation | movement of the output process part which concerns on 1st Embodiment. It is a block diagram which shows roughly the structure of the network monitoring system which concerns on 2nd Embodiment. It is a block diagram which shows roughly the structure of the network monitoring system which concerns on 3rd Embodiment. It is a block diagram which shows roughly the structure of the network monitoring apparatus which concerns on 3rd Embodiment. It is a block diagram which shows the internal structure of the comprehensive monitoring center which concerns on 3rd Embodiment. It is a block diagram which shows the internal structure of the comprehensive monitoring center which concerns on 4th Embodiment.

Explanation of symbols

110, 120 Network 111, 112, 113, 121 Router 114 Firewall 130 Communication line 200 Network monitoring system 210 Interface 220 Analysis unit 221 Application identification unit 222 Header analysis extraction unit 223 Bandwidth analysis unit 230 Database 240 Output processing unit

Claims (6)

An interface unit that sequentially extracts packets from the network traffic of the monitoring point;
An application identifying unit that identifies one or more illegal or legitimate application types that communicated the packet by analyzing the one or more packets extracted by the interface unit;
A header analysis extraction unit that extracts and analyzes header information of the packet extracted by the interface unit;
Classifying communication according to the identification result of the application identification unit or the analysis result of the header analysis extraction unit, a band analysis unit for analyzing the used bandwidth for each classification,
A storage unit for storing monitoring data including the identification result of the application identification unit, the analysis result of the header analysis extraction unit, and the analysis result of the band analysis unit;
By statistically processing the monitoring data stored in the storage unit, and an output processing unit that generates a plurality of types of statistical data for each type of the said application that the application identification unit has identified,
An anomaly detector that detects malicious program activity using the statistical data; and
A network monitoring system comprising: The network monitoring according to claim 1 , wherein the abnormality detection unit determines that the malicious program activity is being performed when a time change in the number of addresses corresponding to the same application exceeds a predetermined value. system. The network according to claim 1 , wherein the abnormality detection unit determines that the malicious program activity is being performed when a time change in bandwidth usage by the same application exceeds a predetermined value. Monitoring system. The apparatus according to claim 1 , further comprising a defense executing unit that causes the interface unit to block or limit a bandwidth of a packet related to the malicious program activity when the malicious program activity is detected by the abnormality detection unit. The network monitoring system according to any one of the above. A central storage unit that centrally stores a plurality of the monitoring data generated corresponding to a plurality of the monitoring points;
An overall output processing unit that generates overall statistical data by statistically processing the monitoring data stored in the overall storage unit;
The network monitoring system according to claim 1 , further comprising a general monitoring device having The overall monitoring apparatus, according to claim 5, further comprising an overall protection execution unit to cut off or bandwidth limitation packets according to said non malware activities to the interface portion of each corresponding to the plurality of monitoring points Network monitoring system.