JP3986871B2 - Anti-profiling device and anti-profiling program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an anti-profiling apparatus and an anti-profiling program that perform countermeasure processing against information collection for the purpose of unauthorized intrusion in a computer network.
[0002]
[Prior art]
In recent years, network services using the Internet have expanded and various services can be widely provided. Network services can provide a wide variety of resources to users, such as Web pages and files using HTTP (Hyper Text Transfer Protocol) and FTP (File Transfer Protocol), and email using SMTP (Simple Mail Transfer Protocol). Servers that provide information to users are always at risk of being damaged by unauthorized intrusions and attacks. Unauthorized intrusion is often performed through a process of collecting necessary information in advance. This information collection attempts to make unauthorized intrusions after acquiring information on misconfiguration of the server to be intruded and information on vulnerable parts of the software. Many tools for collecting information are available on the Internet. If you use such tools, for example, port scan tools, anyone can access information and services on computers and routers connected to the network. It is possible to easily know information such as the name and version of the application that provides the service, and use it as a clue to unauthorized intrusion.
[0003]
With this information, the vulnerable parts (weaknesses) of the equipment that is the target of information collection can be identified, enabling service disruption and unauthorized intrusion. When using nmap (Network Mapper), which has many functions among port scan tools, in addition to port scan, features of TCP / IP (Transmission Control Protocol / Internet Protocol) stack implementation of devices connected to the network (called fingerprints) Information that is not disclosed to the outside, such as the OS (operating system) and application version. In addition, an application that provides necessary information to an external unspecified number of people such as Web and FTP and must permit the connection correctly responds to all external connection requests. This makes the application information public for both normal communication and malicious communication.
[0004]
Conventionally, as a means to counter the above-mentioned information collection, in the case of a TCP service such as a Web server, the banner response, which is information provided by the application after the connection is established, is invalidated, the banner information is restricted, or false information is displayed. The way to return is taken. In addition, information is prevented from being leaked by removing applications that are not normally used from the settings so that communication is not performed, or blocking by a firewall before a packet reaches a device connected to the network.
[0005]
[Problems to be solved by the invention]
However, as described above, in the conventional method for preventing information leakage, if a tool having an advanced information collection function is used, target information can be easily collected by avoiding this, so that a sufficient effect can be obtained. There was a problem that it could not be raised. In addition, when information is provided for an unspecified number of people, information obtained by an attacker may be used as a clue for unauthorized intrusion. In addition, when blocking and preventing communication to devices connected to a network that does not allow communication by a firewall, this reveals computers and applications that can communicate with the outside, so narrow the target to attackers Sometimes it gives useful information. In addition, there is a problem that the incomplete setting of the firewall itself and the vulnerable part are examined from such information and intruded.
[0006]
The present invention has been made in view of the above points, and its purpose is to analyze received packets to determine the legitimacy of the communication, and to control the information provided in accordance with the degree of reliability for unauthorized intrusion. It is another object of the present invention to provide an anti-profiling apparatus and an anti-profiling program that not only prevent attacks but also provide confusion to attackers by not providing information that provides clues to attacks or providing false information.
[0007]
[Means for Solving the Problems]
In order to solve the above-mentioned problem, management of a side (management side) that receives a packet in communication directed to a device connected to a network and responds to a validity determination method for the received packet and an analysis result of the packet. The validity determination method determining means determined by the determination rule set based on the safety standard established based on the policy, and the validity determination method determined by the validity determination method determining means, the reliability of the packet is determined. The correctness determination means to be obtained, the response method determining means for determining the response method for the packet based on the reliability, and the response information for responding to the packet when the instruction information is input into predetermined filter rules the basis of the limited information response unit generates and provides limited response information is limited by filtering, and instruction information is input wherein And non-change information reply means for replying the response information to the packet, based on the response method in which the response method determination means has determined, in response to the packet, the limited information response means or the non-change information reply means An anti-profiling apparatus comprising: means for selecting any of the above and inputting the instruction information.
[0008]
According to the present invention, in the invention described above, the legitimacy determination method determination unit selects an immediate response process that responds promptly or a careful process that emphasizes safety based on the determination rule , and the selected process. It is characterized in that a legitimacy determination method corresponding to is determined .
[0009]
The present invention, in the invention described above, the validity judging means obtains the reliability based on a black list describing the communication source address of the packet, classifying the packet based on the reliability It is characterized by that.
[0010]
According to the present invention, in the above-described invention, pseudo information response means for generating and providing false information for the packet when the instruction information is input, and responding to the packet when the instruction information is input Non-response means, and the means for inputting, as the response to the packet, based on the response method determined by the response method determination means, the limited information response means or the no-change information response means or Either the pseudo information response means or the non-response means is selected and the instruction information is input.
[0011]
According to the present invention, a management policy on the side (management side) that receives a packet in communication directed to a device connected to a network and returns a validity determination method for the received packet and the analysis result of the packet is received. The reliability of the packet is obtained by a legitimacy determination method determination step determined by a determination rule set based on the originally established safety standard and a legitimacy determination method determined in the legitimacy determination method determination step. Based on a predetermined filter rule, a legitimacy determining step, a response method determining step for determining a response method for the packet based on the reliability, and response information for responding to the packet when instruction information is input and limited information response step generates and provides limited response information is limited by filtering Te, instruction information There the non-change information reply step of replying the response information to the an input packet, based on said response scheme determined by the response type determining step, in response to the packet, the limited information response step Alternatively, an anti-profiling program for executing the step of selecting any one of the non-change information reply steps and inputting the instruction information.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a configuration of an anti-profiling apparatus 10 according to the embodiment. In the figure, reference numeral 14 denotes a packet acquisition processing unit that receives a packet sent to the internal network 70 via the external network 100. Reference numeral 11 denotes a determination rule in which a packet processing method is set for each type of communication, and reference numeral 12 denotes a black list describing a communication source address, a communication source port number, and the like that do not permit communication. The black list 12 is created in three types, short-term, medium-term, and long-term, depending on the acquisition period of information to be described. Reference numeral 13 denotes a processing packet history describing a history of packet acquisition / determination such as which packet is being processed and what packet was processed a while ago.
[0013]
Reference numeral 15 denotes a corresponding method determination processing unit that determines a processing method based on the determination rule 11 in accordance with the type of input received packet. Further, the handling method determination processing unit 15 determines the validity of the received packet by collating the black list 12 and the processing packet history 13 according to each processing method, and obtains the communication reliability. And the response method with respect to a received packet is defined according to the calculated | required communication reliability. The response method is selected from the following four methods. Minimal information provision: Characteristic information and redundant information are deleted from the response content to the communication request and sent, no response: No response to the communication request, etc. No processing: No anti-profiling processing Provision of fake information that responds as usual: Responses to communication requests etc. are added by adding random or unusual forms of characteristic information or redundant information that are different from the correct response. .
[0014]
Reference numeral 16 denotes a packet transfer processing unit that transfers a received packet determined to be correct communication to the internal network 70. Reference numeral 17 denotes a packet reception processing unit that receives a packet sent from the internal network 70, and reference numeral 19 denotes a packet response processing unit that performs transmission processing of the input packet and transmits the packet to the external network 100. Reference numeral 18 denotes a pseudo response generation processing unit that generates false information based on an instruction from the handling method determination processing unit 15 and outputs the false information to the packet response processing unit 19. A minimum information generation processing unit 20 includes a service information acquisition processing unit 21, a packet transmission / reception processing unit 22, a service information filter processing unit 23, and a filter rule 24.
[0015]
The service information acquisition processing unit 21 acquires service information responding from the transmission destination host of the packet connected to the internal network 70 via the packet transmission / reception processing unit 22 based on the instruction of the handling method determination processing unit 15. The filter rule 24 is a rule that describes information that cannot be provided to the outside and information that can be provided, and restricts output information. The service information filter processing unit 23 filters the acquired service information based on the filter rule 24 to generate limited service information.
[0016]
2 and 3 are diagrams illustrating an installation example of the anti-profiling apparatus 10. FIG. 2 shows an arrangement example of the anti-profiling apparatus 10 in the network system. The anti-profiling device 10 is installed in front of the firewall 50 of the internal network before the packet reaches the application, and performs overall processing on all packets received via the Internet 100. In the arrangement example shown in FIG. 3, the anti-profiling device 10 is installed in the terminal 60 and performs processing for all communications that reach the application in the terminal 60. There is no difference in the processing method of the anti-profiling apparatus 10 shown in FIGS.
[0017]
Hereinafter, the operation of the anti-profiling apparatus 10 will be described. FIG. 4 is a diagram illustrating a processing flow of the anti-profiling apparatus 10. This will be described with reference to FIGS. 1 and 4. First, the packet acquisition processing unit 14 receives the transferred packet and outputs it to the handling method determination processing unit 15. The handling method determination processing unit 15 analyzes the input packet and determines whether or not the protocol is abnormal (step S110). If the protocol is abnormal and the determination result is YES, the process proceeds to step S111 and returns to step S112 without returning a response. When the response history is stored (step S112: YES), it is recorded in the response method history 25. On the other hand, if the protocol is normal and NO in step S110, the source IP address is checked against the blacklist 12-1 in step S120. In the case of communication from an IP address that is not permitted, the process proceeds to step S111, and when the response history is stored (step S112: YES), it is recorded in the response method history 25.
[0018]
If it is determined in step S120 that the IP address is permitted (step S120: NO), the process proceeds to step S130 to determine whether or not the response method has been determined. If the response method has already been determined because it is related to the received packet and the determination result is YES, the response method history 25 is referred to in step S131 to perform the process according to the determined response method. In the case of NO in step S130, the process proceeds to step S140, and based on the determination rule set for each port, it is determined whether to perform random processing or routine processing according to the packet connection request.
[0019]
If it is determined in step S140 that the process is random, one of steps S161 to S164 and S181 to S184 is selected at random. Here, a description will be given assuming that step S161 is selected. Step S161 is an information non-providing system that places importance on safety. Next, communication reliability is determined by the validity determination system A. FIG. 5A shows a processing flow of the validity determination method A. First, it is determined whether the address information of the received packet is on the black list by checking with the long-term black list 12-4 (step S201). If the determination result is YES, it is determined that the connection is unauthorized connection A4. On the other hand, if it is not on the black list, the process proceeds to step S202, and it is determined whether or not related communication is described with reference to the processing packet history 13. If the related communication is not described and NO, it is determined that the connection is normal A1. If the determination result in step S202 is YES, it is further determined whether the connection request is a suspicious connection A3 or a suspicious connection A2 by checking the medium term blacklist.
[0020]
When the normality determination method A determines that the connection is normal connection A1 or A3, the process proceeds to step S171, and an instruction is output to the minimum information generation processing unit 20. In step S112, it is determined whether or not the response history is to be saved, and if so, the response history is recorded in the response method history 25. The minimum information generation processing unit 20 receives an instruction from the handling method determination processing unit 15, acquires a response to the received packet from the connection destination host, filters the response information based on the filter rule 24, and obtains the minimum information. Generate. The packet response processing unit 19 transmits this minimum information to the network 100.
[0021]
On the other hand, if it is determined in step S140 that the routine process is performed, it is further determined in step S150 whether to perform an immediate process or a careful process. In the case of quick response processing, one of the methods in steps S161 to S164 is selected depending on whether safety is important or service is important. Step S161 is a method for providing no information with the highest priority on safety, and step S162 is a method for emphasizing regular services with emphasis on services. Step S163 is a fake information provision method that counters unauthorized connections, and step S164 is a minimum information provision method as a standard. In steps S165 to 168 following steps S161 to 164, the above-described correctness determination method A with a simple determination algorithm is used so as not to cause a significant delay in the response.
[0022]
Here, it is assumed that the regular service emphasis method in step S162 is selected. When step S162 is selected, the communication reliability is determined by the validity determination method A. As a result of the determination, in the case of normal connections A1 and A3, the process proceeds to step S170, and a response is transmitted from the packet reception processing unit 17 via the packet return processing unit 19 without anti-profiling processing. If it is determined that the connection A2 is suspicious by the validity determination method A, the process proceeds to step S171. In step S 171, a minimum information generation instruction is issued to the minimum information generation processing unit 20, and the generated minimum information is transmitted via the packet response processing unit 19. If it is determined that the connection is unauthorized connection A4, the process proceeds to step S169, and no response is returned.
[0023]
Next, the case where the careful type process (step S180) is selected in step S150 will be described. In the case of careful processing, one of the methods in steps S181 to S184 is selected depending on whether safety is important or serviceability is important. Step S181 is a minimum information providing method, and step S182 is a regular service-oriented method. Step S183 is a fake information provision method, and step S184 is an information provision careful method that emphasizes safety. Here, description will be made assuming that the minimum information providing method in step S181 is selected. In steps S185 to 188 subsequent to steps S181 to 184, the validity determination method B of the determination algorithm in which safety is more important than response speed is used. FIG. 5B shows the flow of processing in the validity determination method B. Subsequent to step S181, the communication reliability is obtained by the legitimacy determination method B in step S185.
[0024]
In the legitimacy determination method B, first, the address information of the received packet is checked against the long-term black list 12-4 to determine whether it is on the black list (step S301). When the determination result is YES, it is determined that the connection is unauthorized connection B6. If it is not on the long-term blacklist 12-4 (step S301: NO), the process packet history 13 is referred to in step S302 to check whether there is a related communication. In the case of YES, the process proceeds to step S303, and it is determined whether the connection is a suspicious connection B5 or a normal connection B4 by checking with the short-term blacklist 12-2.
[0025]
In the case of NO in step S302, after the determination of about 100 to 1000 ms is suspended, the received packet is checked against the processing packet history 13 (step S305). If the collation result is YES, the process proceeds to step S306, where it is collated with the short-term black list 12-2 to determine whether the connection B3 is suspicious or normal connection B2. If NO in step S305, it is determined as normal connection B1. If it is determined that the normal connection is B1, B2, or B4 by the legitimacy determination in step S185, the process proceeds to step S191, where the minimum information generation instruction is output to the minimum information generation processing unit 20 and is limited by the filter rule 24 Information is sent out. If it is determined that the connection B3, B5 or unauthorized connection B6 is suspicious by the validity determination, the process proceeds to step S189, and no response is returned.
[0026]
FIG. 6 is a diagram illustrating an example of a combination of processing method determination, correctness determination processing, and processing content in the above-described handling method determination processing unit 15. In the figure, processing method determination 1 is the processing of step 140, and processing method determination 2 is the processing of step S150. In the processing method determination 3 (step S160) following the quick response processing of the processing method determination 2, the information non-providing method (step S161), the regular service emphasis method (step S162), the fake information providing method (step S163), and the minimum information One of the providing methods (S164) is selected.
[0027]
In the processing method judgment 3 (step S180) for the cautious type processing, the information provision cautious method (step S184) that emphasizes safety, the regular service emphasis method (step S182), the fake information provision method (step S183), and the minimum information provision method One of the methods in (Step S181) is selected. The communication reliability determination results by the validity determination processing methods A and B are classified into regular (normal connection), unknown (suspicious connection), and illegal (unauthorized connection). Then, according to the determination result, any one of response processing of minimum information provision, no response, no processing, and provision of false information is performed. Note that the configuration of the processing method determination, correctness determination processing, and processing content set in the determination rule 11 is not limited to the configuration shown in FIG. 6, and a configuration that is considered optimal is set by the network administrator's determination. can do.
[0028]
Next, specific processing examples for unauthorized connection by the anti-profiling apparatus 10 are shown in FIGS. FIG. 7 shows a state in which the attacker 110 has performed a port scan using a scanning tool. A correct response is made to the user 120, but the scanning of the attacker 110 confuses information collection by returning false information. As shown in FIG. 8, the attacker 110 generally generates an IP address directly without using DNS or the like, and tries to scan comprehensively. For example, a scanning tool such as nmap is used to scan a large number of IP addresses and ports to obtain information on the weak points of the attack target without manpower. The anti-profiling apparatus 10 counters by returning false information as responses of all IP addresses and port numbers to be scanned.
[0029]
FIG. 9 shows a case where communication occurs to a nonexistent IP address (address B) or a port that is not used, and it can be clearly understood that the purpose of collecting information for unauthorized access is anti-profiling. False information is transmitted from the device 10. FIG. 10 shows a case in which communication is continuously generated for a plurality of IP addresses and port numbers in a short time, and is an easy-to-understand example in which communication is attempted by mechanically generating an IP address. is there. In this case, not only the communication to the nonexistent IP address and port but also the communication to the existing IP address and the port number where the service is performed is a part of the scan, so false information is returned.
[0030]
FIG. 11 shows an example in which the attacker 110 is trying to collect fingerprints using a scanning tool. Four scan patterns are sent from the scan tool, and the OS is discriminated based on the combination of the responses as shown in the fingerprint discrimination table. In this case, the anti-profiling apparatus 10 returns false information that causes a pattern that cannot be analyzed by the tool, and confuses and stops the scanning tool. FIG. 12 shows a case where the anti-profiling apparatus 10 is installed between the firewall 50 and the network 100. By returning false information from the anti-profiling device 10 or not responding to the scan, the setting of the firewall 50 is concealed so that no information is given.
[0031]
【The invention's effect】
As described above, according to the present invention, since the received packet is analyzed and the information provided according to the reliability of the communication is controlled, the leakage of information that is a clue to attacks against unauthorized access is prevented. be able to. It also prevents information collection by returning inaccurate information to maliciously collected information, and confuses the scanning tool's judgment, thereby suppressing the next stage of information collection and providing sufficient protection. Since it can be delayed until it is performed or it can be avoided, the security of the managed network can be greatly increased. In addition, since it is possible to handle the access to the internal network in one place, there is no need to manage the settings for each application or terminal, and it is possible to significantly reduce the operation and management costs of the security system. .
[Brief description of the drawings]
FIG. 1 is a block diagram of an anti-profiling apparatus according to an embodiment of the present invention.
FIG. 2 is a diagram showing an example in which the anti-profiling apparatus of the embodiment is installed in front of a firewall.
FIG. 3 is a diagram showing an example in which the anti-profiling apparatus of the embodiment is installed in a terminal.
FIG. 4 is a diagram showing a processing flow of the anti-profiling apparatus.
FIG. 5 is a flowchart of correctness determination methods A and B;
FIG. 6 is a diagram illustrating a combination of processes of a handling method determination processing unit.
FIG. 7 is a diagram illustrating an example of processing of the anti-profiling apparatus of the present embodiment.
FIG. 8 is a diagram illustrating processing for port scanning of the anti-profiling apparatus of the present embodiment.
FIG. 9 is a diagram illustrating an example of processing of the anti-profiling apparatus of the present embodiment.
FIG. 10 is a diagram showing processing for port scanning of the anti-profiling apparatus of the present embodiment.
FIG. 11 is a diagram illustrating processing for collecting fingerprint prints of the anti-profiling apparatus of the present embodiment.
FIG. 12 is a diagram illustrating firewall concealment processing of the anti-profiling apparatus of the present embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 10 Anti-profiling apparatus 11 Determination rule 12, 12-1-4 Black list 13 Process packet history 14 Packet acquisition process part 15 Corresponding method determination process part 16 Packet transfer process part 17 Packet reception process part 18 Pseudo reply generation process part 19 Packet response Processing unit 20 Minimum information generation processing unit 21 Service information acquisition processing unit 22 Packet transmission / reception processing unit 23 Service information filter processing unit 24 Filter rule 25 Response method history

Claims (5)

Safety standards established based on the management policy of the side (management side) that receives packets in communications directed to devices connected to the network and determines the validity judgment method for the received packets and returns the analysis results of the packets. A legitimacy determination method determination means that is determined by a determination rule set based on
A legitimacy judging means for determining the reliability of the packet by the legitimacy judging system determined by the legitimacy judging system determining means;
Response method determining means for determining a response method for the packet based on the reliability;
Limited information response means for generating and providing limited response information obtained by filtering response information responding to the packet when instruction information is input based on a predetermined filter rule ;
Unchanged information reply means for replying the response information to the packet when instruction information is input;
Based on the response method determined by the response method determination unit, as a response to the packet, selecting either the limited information response unit or the non-change information response unit and inputting the instruction information;
An anti-profiling apparatus comprising: The legitimacy determination method determination means selects an immediate response process that responds promptly or a careful process that emphasizes safety based on the determination rule, and determines a legitimacy determination method that corresponds to the selected process. The anti-profiling apparatus according to claim 1. The said correctness determination means calculates | requires the said reliability based on the black list which described the communication origin address of the said packet, and classifies the said packet based on the said reliability. Anti-profiling device. Pseudo information response means for generating and providing false information for the packet when the instruction information is input;
No-response means that does not respond to the packet when the instruction information is input;
Further comprising
The input means is:
Based on the response method determined by the response method determination unit, the response to the packet is selected from the limited information response unit, the non-change information response unit, the pseudo information response unit, or the no response unit. The anti-profiling apparatus according to claim 1, wherein the instruction information is input. On the computer,
Safety standards established based on the management policy of the side (management side) that receives packets in communications directed to devices connected to the network and determines the validity judgment method for the received packets and returns the analysis results of the packets. A legitimacy determination method determination step determined by a determination rule set based on
A legitimacy determination step for determining the reliability of the packet by the legitimacy determination scheme determined in the legitimacy determination scheme determination step;
A response method determining step for determining a response method for the packet based on the reliability;
A limited information response step of generating and providing limited response information obtained by filtering response information responding to the packet when instruction information is input , based on a predetermined filter rule ;
A non-change information response step of returning the response information to the packet when the instruction information is input;
Based on the response method determined in the response method determination step, as a response to the packet, selecting either the limited information response step or the non-change information response step and inputting the instruction information;
Anti-profiling program for running.

Images