JP2005012606A - Network cutoff system, and network cutoff judging apparatus and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve the security against the attack from the outside to a management target network and a computer on the management target network. <P>SOLUTION: When an attacking source computer 75 which performs an attack or an attacking source network 70 to which the attacking source computer 75 is connected is detected by network monitoring apparatuses 300, 400 installed on the networks 50, 60 other than the management target networks 10, 20, a network cutoff judging apparatus 500 cuts off the communications between the management target networks 10, 20 and the attacking source computer 75 or communications between the management target networks 10, 20 and the attacking source network 70 even if the attacks to the management target networks 10, 20 are not performed. Besides, when the network monitoring apparatuses 300, 400 detect the attacking source computer 75 or the attacking source network 70, the network cutoff judging apparatus 500 reports its network address to the managers of the management target networks 10, 20. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a management target network and a technology for improving the security of a computer on the management target network against an attack from an external network.
[0002]
[Prior art]
In recent business, the use of the Internet has become indispensable, and many companies and organizations connect their computers to an in-house or organization network, and then connect the network to the Internet. We are promoting efficiency.
[0003]
On the other hand, since anyone can connect to the Internet relatively easily, the occurrence of accidents such as unauthorized intrusion, information leakage, and data tampering is increasing, and when connecting a company or organization network to the Internet, Conventionally, various measures have been taken (for example, see Patent Documents 1 and 2).
[0004]
In the technology described in Patent Document 1, when a victim host computer detects an unauthorized access packet, the victim host computer detects an unauthorized access packet to a boundary relay device in the same independent system as the victim host computer, and the unauthorized access packet is detected. By transferring filtering information for discarding access packets, unauthorized access packets are blocked in the boundary area.
[0005]
In the technique described in Patent Document 2, an external attack monitoring board and an internal attack monitoring board for detecting illegal packets on the main communication path connecting the internal network and the external network, an external attack monitoring board, and an internal attack monitoring board If an illegal packet is detected by the network, the packet is discarded, and if not, a network defense device with a main board that relays the packet is arranged to increase resistance against overload attacks. Yes.
[0006]
[Patent Document 1]
JP 2002-185539 A
[Patent Document 2]
Japanese Patent Laid-Open No. 2002-199025
[0007]
[Problems to be solved by the invention]
However, each of the conventional techniques described in Patent Documents 1 and 2 has a problem that the countermeasure may be delayed because the attack is detected when the attack is performed on the management target network. there were.
[0008]
Accordingly, an object of the present invention is to provide an attack-source computer or a network to which an attack-source computer that is likely to launch an attack before the attack is performed on the managed network and the computers in the managed network. Is to ensure that appropriate precautions can be taken before actual attack.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, a first network shutoff system according to the present invention provides:
A network monitoring device that is installed in a network other than a managed network and detects an attack source computer that is attacking a network other than the managed network, or an attack source network to which the attack source computer is connected;
Network blocking determination for blocking communication between the attack source computer detected by the network monitoring device and the managed network, or communication between the attack source network and the managed network detected by the network monitoring device And an apparatus.
[0010]
In addition, the second network shutoff system according to the present invention prevents an attack from the managed network to the outside.
In the first network shutdown system,
The network shutoff determination device is
When the attack source computer or the attack source network detected by the network monitoring apparatus exists in the managed network, the communication between the managed network and the external network is blocked.
[0011]
In addition, the third network cutoff system according to the present invention is:
To be able to notify the administrator of the managed network of the attack source computer or attack source network,
In the first network shutdown system,
The network shutoff determination device is
The network monitoring apparatus has a configuration in which the network address of the attack source computer detected by the network monitoring apparatus or the network address of the attack source network is notified to an administrator of the management target network.
[0012]
More specifically, the fourth network cutoff system according to the present invention is:
Each time an attack source computer connected to a network other than the managed network and attacking a network other than the managed network or an attack source network connected to the attack source computer is detected, the attack source A computer or a network monitoring device for recording the network address of the attack source network;
A network cutoff system including a network cutoff judgment device,
The network shutoff determination device is
An attack information collection unit for collecting the network address of the attack source computer or the attack source network from the network monitoring device;
A designated network blocking processing unit that detects an attack source computer or attack source network that has made an attack more than a predetermined number of times based on the network address of the attack source computer or attack source network collected by the attack information collection unit;
Blocks communication between the attack source computer detected by the designated network blocking processor and the managed network, or communication between the attack source network detected by the specified network blocking processor and the managed network. And a network relay device interface unit.
[0013]
The fifth network shutoff system according to the present invention is
In the fourth network shut-off system,
When the designated network blocking processor detects an attack source computer or attack source network that has made an attack more than a predetermined number of times, does the detected attack source computer or attack source network exist in the managed network? Having a configuration for determining whether or not
When the network relay device interface unit determines that the attack source computer or attack source network that has made an attack more than a predetermined number of times in the designated network blocking processing unit exists in the managed network, the managed network and When it is determined that the communication with the external network is interrupted and does not exist in the managed network, the communication between the attack source computer and the managed network or the attack source network and the managed network It has the structure which interrupts | blocks communication between these.
[0014]
The sixth network shut-off system according to the present invention is
In the fourth network shut-off system,
A network manager notifying unit for notifying an administrator of the managed network of a network address of the attack source computer or the attack source network detected by the designated network blocking processing unit.
[0015]
[Action]
When an attack source computer that is attacking a network other than the managed network or an attack source network connected to the attack source computer is detected by a network monitoring device installed in a network other than the managed network, Even if there is no attack on the managed network, the network blockage judgment device blocks communication between the managed network and the attack source computer or between the managed network and the attack source network. In addition, the security of the computers on the managed network can be made extremely high.
[0016]
In addition, when the attack source computer or the attack source network detected by the network monitoring device exists in the managed network, communication between the managed network and the external network is blocked, so the managed network becomes the attack source. Can be prevented.
[0017]
Further, since the network address of the attack source computer detected by the network monitoring device or the network address of the attack source network is notified to the administrator of the managed network, it is possible to take preventive measures against the attack.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described in detail with reference to the drawings.
[0019]
[Configuration of Example]
FIG. 1 is a block diagram of an embodiment of a network interruption system according to the present invention. Referring to the figure, the network blocking system of this embodiment includes network relay devices 100 and 200, network monitoring devices 300 and 400, administrator terminals 15 and 25, network blocking determination device 500, and attack source computer 75. And managed networks 10 and 20, networks 30, 40, 50, 60 and 70, and a network group 80.
[0020]
The managed networks 10 and 20 are networks such as an intranet that protects against attacks or manages them so as not to cause attacks. The network group 80 is a network composed of a plurality of networks such as the Internet. The networks 30, 40, 50, 60, and 70 are networks such as an intranet connected to the network group 80. The network relay devices 100 and 200 connect the networks 30 and 40 and the management target networks 10 and 20, respectively, and are generally configured by a router, a firewall, or the like.
[0021]
The network monitoring devices 300 and 400 are connected to the network switches of the networks 50 and 60, respectively, and monitor network packets flowing through the networks to detect attacks. Usually, an intrusion detection system (Intrusion Detection System) is used. Called.
[0022]
The network interruption determination device 500 reads attack detection information related to the attack detected by the network monitoring devices 300 and 400, and if the attack from the network 70 to which the attack source computer 75 is connected exceeds a certain number of times, the network interruption determination device 500 By changing the settings of the devices 100 and 200, the relay of data from the network 70 to which the attack source computer 75 is connected to the managed networks 10 and 20 is blocked. In addition, when it is determined that the network should be blocked or when the network is blocked, the network blocking determination apparatus 500 transmits an e-mail notifying the administrator terminals 15 and 25 to that effect. The attack source computer 75 is a computer that performs an attack via the network 70.
[0023]
Referring to FIG. 2, the network cutoff determination device 500 includes a network monitoring device interface unit 501, an attack information collection unit 502, an attack information processing unit 503, a managed network cutoff processing unit 504, and a designated network cutoff processing unit 505. A network relay device interface unit 506, a network manager notification unit 507, an attack detection information reading area 510, a network monitoring device management table 520, an attack status management table 530, and a managed network management table 540. Has been. The network interruption determination device 500 is realized by, for example, a computer. The computer reads a program recorded on a recording medium such as a disk or a semiconductor memory (not shown), and executes the program. Network monitoring device interface unit 501, attack information collection unit 502, attack information processing unit 503, managed network blocking processing unit 504, designated network blocking processing unit 505, network relay device interface unit 506, network manager notification unit on its own computer 507, an attack detection information reading area 510, a network monitoring device management table 520, an attack status management table 530, and a managed network management table 540 are realized.
[0024]
The network monitoring device management table 520 is a table that holds information regarding the network monitoring devices 300 and 400 that are the collection destinations of attack detection information. Referring to FIG. 3, the network monitoring device management table 520 includes rows for the number of installed network monitoring devices 300 and 400 (two rows in this embodiment), and each row has a network monitoring device name area 521. The network monitoring device address area 522. In the network monitoring device identification name area 521, a name for identifying the network monitoring devices 300 and 400 is stored. The network monitoring device address area 522 stores the network addresses of the network monitoring devices 300 and 400 that communicate to collect attack detection information. For example, the network address of the network monitoring device 300 is stored in the first row of the network monitoring device management table 520, and the network address of the network monitoring device 400 is stored in the second row.
[0025]
The attack information collection unit 502 has a function of referring to the network monitoring device management table 520 and instructing the network monitoring device interface unit 501 of the network addresses of the network monitoring devices 300 and 400 that are the collection destinations of the attack detection information. .
[0026]
The network monitoring device interface unit 501 has a function of collecting attack detection information from the network monitoring devices 300 and 400 based on the network address instructed from the attack information collection unit 502 and storing it in the attack detection information reading area 510.
[0027]
Referring to FIG. 4, the attack detection information reading area 510 includes a plurality of attack source network address areas 511, a plurality of attack pattern identification information areas 512, and a plurality of attack source network address areas 513. . The network address area 511 of the attack source network stores the network address of the network 70 to which the attack source computer 75 is connected. The attack pattern identification information area 512 stores a name for identifying the attack pattern of the attack detected by the network monitoring apparatuses 300 and 400. The attack source address area 513 stores the network address of the attack source computer 75.
[0028]
The attack information processing unit 503 has a function of updating the contents of the attack status management table 530 based on the attack detection information stored in the attack detection information reading area 510 by the network monitoring device interface unit 501.
[0029]
The attack status management table 530 classifies the attack detection information stored in the attack detection information reading area 510 by the network monitoring device interface unit 501 according to the combination of the network address of the network 70 to which the attack source computer 75 is connected and the attack pattern. This is a table for storing the number of cases. Referring to FIG. 5, the attack status management table 530 includes a plurality of rows, and each row includes a network address area 531 of the attack source network, an attack pattern identification information area 532, and an attack detection frequency area 533. . The network address area 531 and attack pattern identification information area 532 of the attack source network are copied from the network address area 511 and attack pattern identification information area 512 of the attack source network in the attack detection information reading area 510, respectively. The attack detection count area 533 stores the number of detections of a combination of the network address and attack pattern of the same attack source network within a certain time (for example, 5 minutes). In the present embodiment, as shown in FIG. 5, the number of attack detections is managed for each combination of the network address of the attack source network and the attack pattern identification information, but for each network address of the attack source network, The number of attack detections may be managed. In this case, the attack pattern identification information area 532 is not necessary.
[0030]
The managed network cutoff processing unit 504 has a function of sequentially passing information on the managed networks 10 and 20 stored in the managed network management table 540 to the designated network cutoff processing unit 505.
[0031]
Referring to FIG. 6, the managed network management table 540 is composed of as many lines as the number of monitored networks 10 and 20 (two lines in this embodiment), and each line includes a managed network identification name region 541 and Network relay device address area 542, network relay device type area 543, network administrator e-mail address area 544, blocking threshold area 545, blocking permission / inhibition designation area 546, and subnetwork address area 547 in the managed network It consists of.
[0032]
In the managed network identification name area 541, a name for identifying the managed networks 10 and 20 is stored. The network relay device address area 542 stores the network addresses of the network relay devices 100 and 200 connected to the management target networks 10 and 20. The network relay device type area 543 stores information for identifying the types of the network relay devices 10 and 20. The network administrator e-mail address area 544 stores the e-mail address of the network administrator of the network. In the blocking threshold area 545, blocking or notifying the network administrator of the number of occurrences within the predetermined time (for example, 5 minutes) of the same attack source network address and attack pattern set for the network. The threshold value is stored. The blockability designation area 546 stores a distinction between whether to block or only notify the network administrator without blocking when an attack exceeding the block threshold is detected. The In the subnet address area 547 in the management target network, addresses of one or a plurality of sub-networks constituting the network are stored.
[0033]
The designated network blocking processing unit 505 is configured to manage the managed network based on the information about each managed network 10 and 20 passed from the managed network blocking processing unit 504 and the contents of the attack status management table 530. 10 and 20, a function for determining whether to shut down the network or notifying the administrator, a function for instructing the network relay device interface unit 506 to shut down the network when it is determined that the network is to be shut down, When it is determined to notify the administrator, the network administrator notification unit 507 has a function of instructing notification to the administrator.
[0034]
The network relay device interface unit 506 changes the configuration of the network relay devices 100 and 200 in accordance with an instruction from the designated network blocking processing unit 505 to block communication between the attack source network 70 and the managed networks 10 and 20. Alternatively, it has a function of blocking communication between the managed network 10 or the subnetwork in the managed network 20 and the outside of the managed network.
[0035]
The network manager notification unit 507 has a function of sending an e-mail to the manager of the managed networks 10 and 20 in accordance with an instruction from the designated network blocking processing unit 505.
[0036]
[Description of operation of embodiment]
Next, the overall operation of this embodiment will be described in detail with reference to the drawings.
[0037]
Now, for example, it is assumed that the attack source computer 75 is attacking the network 50 via the network 70.
[0038]
Each time the network monitoring device 300 installed in the network 50 detects an attack (FIG. 7, A71 and A72 are yes), it records the attack detection information as log information in a log file (A73). This attack detection information includes the network address of the attack source computer 75, the network address of the network 70 to which the attack source computer 75 is connected, and attack pattern identification information.
[0039]
On the other hand, the attack information collection unit 502 in the network interruption determination apparatus 500 performs the processing shown in the flowchart of FIG.
[0040]
As shown in the flowchart of FIG. 8, the attack information collection unit 502 sequentially sets each row of the network monitoring device management table 520 as a processing target (A80, A86), and the network monitoring device address area 522 in the row to be processed. The network monitoring device interface unit 501 is called by designating the address set in (A83). Thereafter, the attack information collection unit 502 waits for a return from the network monitoring device interface unit 501.
[0041]
The network monitoring device interface unit 501 communicates with the network monitoring device at the address specified by the attack information collection unit 502, and reads the attack detection information stored in the log file of the network monitoring device after the previous reading. Then, the attack detection information read this time is stored in the attack detection information reading area 510 (A91 in FIG. 9). If there is no attack detection information stored in the log file since the previous reading, nothing is stored in the attack detection information reading area 510. Thereafter, the network monitoring device interface unit 501 returns to the attack information collection unit 502. By this processing, the network address, attack pattern identification information, and attack source network address of the network 70 connected to the attack source computer 75 recorded in the log file of the network monitoring device 300 are the attack source network in the attack detection information reading area 510. Network address area 511, attack pattern identification information area 512, and attack source network address area 513.
[0042]
When the control is returned from the network monitoring device interface unit 501, the attack information collection unit 502 checks whether or not the attack detection information is stored in the attack detection information reading area 510 (A84 in FIG. 8). If attack detection information is stored, for each stored attack detection information, a set of the network address of the attack source network 70 and attack pattern identification information included therein is obtained, and all of the obtained The attack information processing unit 503 is called by designating a set of. Further, all the information stored in the areas 511 to 513 of the attack detection information reading area 510 is deleted, and a return from the attack information processing unit 503 is waited (A85). On the other hand, when attack detection information is not stored, the next row of the network monitoring device management table 520 is set as a processing target (A86). If there is no next line (A81 is yes), the first (first line) of the network monitoring apparatus management table 520 is handled (A82).
[0043]
When called from the attack information collection unit 502, the attack information processing unit 503 compares the current time with the time of the previous call, and if a certain time or more has elapsed since the previous call, the attack status management All the rows in the table 530 are deleted (A101 in FIG. 10 is no, A102). On the other hand, if it is within a predetermined time from the previous call, the pair of the attack source network 70 instructed by the attack information collection unit 502 and the attack pattern identification information is registered in the attack status management table 530. Judgment is made (A101 is yes, A103).
[0044]
If the combination of the network address of the attack source network 70 and the attack pattern identification information has already been registered in the attack status management table 530, 1 is added to the number of attacks detected in the corresponding row (A103 is yes, A104). If not registered, it is newly registered and the attack detection count is set to 1 (A103 is no, A105). This process is performed for all pairs designated by the attack information collection unit 502.
[0045]
Thereafter, the attack information processing unit 503 calls the managed network blocking processing unit 504 and waits for a return from the managed network blocking processing unit 504 (A106).
[0046]
When called from the attack information processing unit 503, the managed network blocking processing unit 504 extracts information on the managed network registered in the first row of the managed network management table 540 (A110 and A112 in FIG. 11). Then, the designated network cutoff processing unit 505 is called by designating the extracted information (A113). The above information includes the managed network identifier, network relay device address, network relay device type, network administrator e-mail address, blocking threshold, blocking availability designation, and subnetwork address in the managed network. (See FIG. 6). Thereafter, the managed network cutoff processing unit 504 waits for a return from the designated network cutoff processing unit 505. When control is returned from the designated network cutoff processing unit 505, the next row (next management target network) of the management target network management table 540 is set as a processing target (step A114), and the same processing is performed. When there is no unprocessed line (A111 is yes), the process returns to the attack information processing unit 503.
[0047]
When the designated network blocking processing unit 505 is called from the managed network blocking processing unit 504, the blocking threshold in the information specified by the managed network blocking processing unit 504 and each attack detection in the attack status management table 530 are detected. The number of attack detections registered in the number of times area 533 is respectively compared (A121 in FIG. 12), and if there is no exceeding the blocking threshold (A121 is no), the managed network is blocked without doing anything. The process returns to the processing unit 504.
[0048]
On the other hand, when there is an attack detection frequency area 533 in which the number of attack detections exceeding the blocking threshold is registered (A121 is yes), the network address area 531 of the attack source network in the same row as the area 533 is present. By checking whether the network address registered in the subnetwork address in the managed network designated by the managed network blocking processing unit 504 is included in the attack source network, It is determined whether it is in the managed network (network specified by the managed network identification name in the information specified by the managed network cutoff processing unit 504) (A122)
[0049]
If the network address of the network 70 to which the attack source computer 75 is connected is not included in the managed network that is currently being processed (A122 is yes), then the managed network blocking processing unit 504 specifies the network address. The blocking information in the information is checked (A123). If blocking is possible, the blocking of communication between the network 70 connected to the attack source computer 75 and the managed network currently being processed is specified. Then, the network relay device interface unit 506 is called (A124). Thereafter, the network manager notifying unit 507 is called to instruct the administrator of the managed network currently being processed to notify that the attack has been executed because the attack has been detected and the network address of the blocked network. (A125). Thereafter, when control is returned from the network relay device interface unit 506 and the network manager notification unit 507, the process returns to the caller-managed network cutoff processing unit 504.
[0050]
When it is designated that blocking is not possible (A123 is no), the network manager notifying unit 507 is called, and an attack is detected with respect to the manager of the management target network currently being processed, and the attack source network 70 When the network administrator notification unit 507 returns control, the process returns to the caller management target network blocking processing unit 504.
[0051]
If the network address of the network 70 to which the attack source computer 75 is connected is included in the managed network (A122 is no), then the blocking in the information specified by the managed network blocking processing unit 504 is performed. The permission designation is checked (A127), and when the blocking is possible, the blocking of communication between the attack source network (the management target network currently being processed) and the outside of the management target network is specified, and the network relay device interface unit 506 (A128). After that, the network administrator notification unit 507 is called to instruct the administrator of the managed network currently being processed to notify that the blocking has been executed and that the blocking cause is an attack from the managed network. (A129). Thereafter, when control is returned from the network relay device interface unit 506 and the network manager notification unit 507, the process returns to the caller-managed network cutoff processing unit 504.
[0052]
When it is designated that blocking is not possible (A127 is no), the network manager notification unit 507 is called, and an attack from the managed network is detected against the manager of the managed network currently being processed. Is notified (A130), and when the control is returned from the network manager notification unit 507, the process returns to the caller-managed network cutoff processing unit 504.
[0053]
When the network relay device interface unit 506 is called from the designated network blocking processing unit 505, the communication between the attack source network 70 designated by the designated network blocking processing unit 505 and the managed network currently being processed is blocked. As described above, the setting of the network relay apparatus that is directly connected to the management target network that is the current processing target is changed by a method according to the type, and then the process returns to the designated network cutoff processing unit 505 that is the call source. (A131 in FIG. 13). For example, if the type of the network relay device is a router, the contents of the routing table are changed, and if the type is a firewall, the contents of the definition table are changed. The network address and type of the network relay device can be obtained by referring to the network relay device address area 542 and the network relay apparatus type area 543 of the management target network management table 540.
[0054]
When called from the designated network blocking processing unit 505, the network manager notifying unit 507 transmits an e-mail to the manager of the management target network in accordance with an instruction from the designated network blocking processing unit 505 (A141 in FIG. 14). The administrator e-mail address can be obtained by referring to the network administrator e-mail address area 544 of the management target network management table 540.
[0055]
Other Embodiments of the Invention
[0056]
Another embodiment of the present invention will be described with reference to FIG. In this embodiment, the network relay devices 100 and 200 do not block communication with the network 70 to which the attack source computer 75 is connected, but block communication with the attack source computer 75.
[0057]
Next, the operation of this embodiment will be described with reference to FIG. 10, FIG. 12, and FIG. Here, only differences from the above-described embodiment will be described.
[0058]
The attack information processing unit 503 manages the number of attack detections using the network address and attack pattern pair of the attack source computer 75 instead of the network address and attack pattern pair of the attack source network 70 (A103 in FIG. 10). -A105).
[0059]
The designated network blocking processing unit 505 determines whether or not the attack source computer 75 is included in the subnet of the managed network by using the network address of the attack source computer 75 instead of the network address of the attack source network 70 (FIG. 12 A122). In steps A124 and A128, not the attack source network 70 but the attack source computer 75 is designated.
[0060]
The network relay device interface unit 506 uses the network address of the attack source computer 75 instead of the network address of the attack source network 70 to change the configuration of the corresponding network relay device (A131 in FIG. 13).
[0061]
In each of the above-described embodiments, the number of network monitoring devices is two, but the number of network monitoring devices may be any number. Further, although the number of networks to be monitored is “2”, the number of networks is not limited to this. In each of the embodiments described above, the network monitoring device is not installed in the management target network, but the network monitoring device may be installed in the management target network. Although not described in each of the above-described embodiments, the operator of the network interruption determination apparatus 500 may charge the administrator of the management target networks 10 and 20 for a fee. At that time, charge a fee according to the number of times the communication between the managed network and the attack source network or the attack source computer is blocked, charge a fee according to the number of outgoing emails, or charge a fixed amount every month be able to.
[0062]
【The invention's effect】
As described above, according to the present invention, an attack source computer or an attack source computer that is attacking a network other than the managed network is connected by a network monitoring device installed in a network other than the managed network. If an attack source network is detected, the network blockage judgment device communicates between the managed network and the attack source computer or between the managed network and the attack source network, even if no attack is being performed on the managed network. Therefore, the safety of the managed network and the computers on the managed network can be made extremely high.
[0063]
Further, the present invention blocks communication between the managed network and the external network when the attack source computer or the attack source network detected by the network monitoring device exists in the managed network. It can be prevented from becoming an attack source.
[0064]
In addition, the present invention notifies the administrator of the network to be managed of the network address of the attack source computer or the network address of the attack source network detected by the network monitoring device, so that it is possible to take preventive measures against the attack.
[Brief description of the drawings]
FIG. 1 is a block diagram of an embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration example of a network cutoff determination device 500. FIG.
FIG. 3 is a diagram showing a configuration example of a network monitoring device management table 520. FIG.
FIG. 4 is a diagram illustrating a configuration example of an attack detection information reading area 510;
FIG. 5 is a diagram showing a configuration example of an attack status management table 530;
6 is a diagram showing a configuration example of a management target network management table 540. FIG.
FIG. 7 is a flowchart illustrating a processing example of the network monitoring devices 300 and 400;
FIG. 8 is a flowchart illustrating a processing example of an attack information collection unit 502;
FIG. 9 is a flowchart illustrating a processing example of the network monitoring apparatus interface unit 501;
FIG. 10 is a flowchart illustrating a processing example of an attack information processing unit 503;
FIG. 11 is a flowchart illustrating a processing example of a management target network cutoff processing unit 504;
12 is a flowchart showing a processing example of a designated network cutoff processing unit 505. FIG.
FIG. 13 is a flowchart illustrating a processing example of the network relay device interface unit 506;
14 is a flowchart showing a processing example of a network manager notification unit 507. FIG.
[Explanation of symbols]
10, 20 ... Managed network
30, 40, 50, 60, 70 ... network
75 ... Attack source computer
80: Network group
100, 200 ... Network relay device
300, 400 ... Network monitoring device
500 ... Network cutoff judgment device
501... Network monitoring device interface unit
502 ... Attack information collection unit
503 ... Attack information processing section
504 ... Managed network blocking processor
505 ... Designated network cutoff processing unit
506: Network relay device interface section
507 ... Network administrator notification section
510 ... Attack detection information reading area
520 ... Network monitoring device management table
530 ... Attack status management table
540 ... Managed network management table

Claims (8)

A network monitoring device that is installed in a network other than the managed network and detects an attack source computer that is performing an attack on the network other than the managed network, or an attack source network to which the attack source computer is connected;
Network blocking determination for blocking communication between the attack source computer detected by the network monitoring device and the managed network, or communication between the attack source network and the managed network detected by the network monitoring device A network shut-off system comprising the device. The network shut-off system according to claim 1,
The network shutoff determination device is
A network having a configuration for blocking communication between the managed network and an external network when an attack source computer or an attack source network detected by the network monitoring apparatus exists in the managed network Shut-off system. The network shut-off system according to claim 1,
The network shutoff determination device is
A network blocking system comprising: a network address of an attack source computer detected by the network monitoring device or a network address of the attack source network is notified to an administrator of the managed network. Each time an attack source computer connected to a network other than the managed network and attacking a network other than the managed network or an attack source network connected to the attack source computer is detected, the attack source A computer or a network monitoring device for recording the network address of the attack source network;
A network cutoff system including a network cutoff judgment device,
The network shutoff determination device is
An attack information collection unit for collecting the network address of the attack source computer or the attack source network from the network monitoring device;
A designated network blocking processing unit that detects an attack source computer or attack source network that has made an attack more than a predetermined number of times based on the network address of the attack source computer or attack source network collected by the attack information collection unit;
Blocks communication between the attack source computer detected by the designated network blocking processor and the managed network, or communication between the attack source network detected by the specified network blocking processor and the managed network. A network interruption system comprising a network relay device interface unit. The network shut-off system according to claim 4,
When the designated network blocking processor detects an attack source computer or attack source network that has made an attack more than a predetermined number of times, does the detected attack source computer or attack source network exist in the managed network? Having a configuration for determining whether or not
The network relay device interface unit,
When it is determined that an attack source computer or attack source network that has made an attack more than a predetermined number of times in the designated network blocking processing unit exists in the managed network, communication between the managed network and the external network is performed. If it is determined that it does not exist in the managed network, the communication between the attack source computer and the managed network or the communication between the attack source network and the managed network is blocked. A network shut-off system characterized by having a configuration. The network shut-off system according to claim 4,
A network blocking system comprising a network manager notifying unit for notifying an administrator of the managed network of a network address of an attack source computer or an attack source network detected by the designated network blocking processing unit. Detected by a network monitoring device that is installed in a network other than the managed network and detects an attack source computer that is attacking the network other than the managed network or the attack source network to which the attack source computer is connected. The communication between the attack source computer and the managed network or the communication between the attack source network detected by the network monitoring device and the managed network is blocked. Network interruption judgment device. Computer
Detected by a network monitoring device that is installed in a network other than the managed network and detects an attack source computer that is attacking the network other than the managed network, or an attack source network to which the attack source computer is connected. In order to function as a network interruption determination device that blocks communication between the attack source computer and the managed network or communication between the attack source network and the managed network detected by the network monitoring device. Program.

Images