JP2003178024A - Unauthorized access tracking method, its program, and recording medium on which the program is recorded - Google Patents

Abstract

(57) [Summary] [Problem] To provide an unauthorized access tracking method capable of acquiring a MAC address of a computer of a criminal who has made unauthorized access by misrepresenting an IP address. SOLUTION: In a monitoring server 2, an MIB monitoring agent 13 manages a management information base (MIB) 31 to be monitored.
And updates the monitoring log 133 of the monitoring agent 13 by associating the pair of the IP address and the MAC address recorded in the update with the update time.
The MAC address tracking agent 12 inputs the time of the unauthorized access and the IP address used for the unauthorized access when tracking the unauthorized access.
Moves to the monitoring server 2, and the tracking agent
From the monitoring log 133, the MAC address associated with the updated time before the time of the unauthorized access and the last recorded update time and the IP address is acquired, and the acquired MA is acquired.
The C address is recorded, and the MAC address tracking agent 12 moves to the console 4 and outputs the MAC address.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for locating a computer of a criminal who has made unauthorized access in an in-house network or the like, and more particularly, to obtain a MAC address of a computer of a criminal who has illegally accessed by misrepresenting an IP address. The present invention relates to an unauthorized access tracking method, a program thereof, and a recording medium on which the program is recorded.

[0002]

2. Description of the Related Art In recent years, the number of unauthorized access to a server has increased rapidly, and the importance of tracing the criminal has increased. The tracking of the criminal is to identify the computer used by the criminal, and the term tracking is used for convenience.

Conventionally, it has been possible to identify the IP address used for unauthorized access from various logs and assign the computer having the IP address to the criminal.

[0004]

However, since the IP address is easily misrepresented, the actual access source computer cannot always be identified from the found IP address. In other words, the IP address assigned by the DHCP server or the administrator is usually legitimate, but it is easy to misrepresent it by changing the computer settings. There is no inconvenience. Moreover, since the computer cannot be specified from the IP address, it is convenient for the criminal of unauthorized access.

As a countermeasure against IP address spoofing, a hub with a security function is used. IP to this hub
If a set of an address and a MAC address is set for each computer, it is possible to perform filtering by rejecting an access request from a computer that is out of this set.

However, in an organization such as a company, computers are often replaced due to the change of employees, and in this case, the security of the hub needs to be reset, but since the work is complicated, it is not set. There are many. Therefore, countermeasures against unauthorized access using a spoofed IP address are not always perfect.

If the MAC address of the criminal's computer can be obtained from the spoofed IP address,
Not only can the problem of the hub be solved, but it is usually impossible to change the MAC address of the computer, so it cannot be ruled out, and therefore the merit is very large.

Therefore, the present invention has been made in view of the above-mentioned conventional problems, and the purpose thereof is to
It is an object of the present invention to provide an unauthorized access tracking method capable of acquiring the MAC address of a computer of a criminal who illegally accessed by misrepresenting the address.

[0009]

In order to solve the above-mentioned conventional problems, the present invention according to claim 1 uses the IP address used for the unauthorized access from the MA of the access source computer.
A method for tracing unauthorized access to obtain a C address,
On the monitoring server, the monitoring agent detects an update of the management information base to be monitored and, at the same time, detects the IP address and MAC address pair recorded in the update,
The tracking agent is recorded in the monitoring log of the monitoring agent in association with the update time, and when tracing the unauthorized access, the tracking agent that inputs the time of the unauthorized access and the IP address used for the unauthorized access is stored in the monitoring server. The tracking agent moves, acquires from the monitoring log of the monitoring agent a MAC address associated with the update time and the last recorded update time before the time of the unauthorized access and the acquired MAC address. MA
The C-address is recorded in the trace log of the trace agent, and the trace agent moves to a predetermined computer and outputs the trace log in which the MAC address is recorded. Use it as a means.

According to the first aspect of the present invention, in order to obtain the MAC address of the access source computer from the IP address used for the unauthorized access, the monitoring agent in the monitoring server stores the management information base of the monitoring target. The update is detected and the I recorded in the update is detected.
A pair of the P address and the MAC address is recorded in the monitoring log of the monitoring agent in association with the update time, and the time of the unauthorized access and the IP address used for the unauthorized access are input when tracing the unauthorized access. The traced agent moved to the monitoring server, and the traced agent was associated with the update time recorded before the time of the unauthorized access and finally recorded from the monitor log of the monitoring agent and the IP address. Since the MAC address is acquired, the acquired MAC address is recorded in the tracking log of the tracking agent, and the tracking agent moves to a predetermined computer and outputs the tracking log recorded with the MAC address, MAC of the computer of the criminal who made an unauthorized access by spoofing the IP address It is possible to get a dress.

According to the second aspect of the present invention, the M of the computer that is the access source is determined from the IP address used for the unauthorized access.
An unauthorized access tracking method for obtaining an AC address, wherein a monitoring agent in each of a plurality of monitoring servers detects an update of a management information base to be monitored, and an IP address and M recorded in the update.
A tracking agent that records a pair of AC addresses in the monitoring log of the monitoring agent in association with the update time and inputs the time of the unauthorized access and the IP address used for the unauthorized access when tracing the unauthorized access. Corresponds to the address of the segment including the IP address used for the unauthorized access from the table in which the IP addresses of the plurality of monitoring servers are associated with the addresses of the network segments assigned to the respective monitoring servers. Obtain the IP address of the monitoring server, the tracking agent moves to the monitoring server having the obtained IP address, and is recorded from the monitoring log of the monitoring agent in the monitoring server before the time of the unauthorized access and at the end. Corresponding to the update time and the IP address That the acquired MAC address is acquired, the acquired MAC address is recorded in the tracking log of the tracking agent, the tracking agent moves to a predetermined computer, and the tracking log in which the MAC address is recorded is output. The characteristic means of tracing unauthorized access will be the solution.

According to the second aspect of the present invention, in order to obtain the MAC address of the access source computer from the IP address used for the unauthorized access, the monitoring agent in each of the plurality of monitoring servers is a monitoring target. When an update of the management information base is detected, the pair of the IP address and the MAC address recorded in the update is recorded in the monitoring log of the monitoring agent in association with the update time. Time of access and IP used for the unauthorized access
The tracing agent, which has input the address, selects the IP address used for the unauthorized access from the table in which the IP addresses of the plurality of monitoring servers are associated with the addresses of the network segments assigned to the respective monitoring servers. The IP address of the monitoring server corresponding to the address of the containing segment is obtained, the tracking agent moves to the monitoring server having the obtained IP address, and from the monitoring log of the monitoring agent in the monitoring server, before the time of the unauthorized access. The MAC address associated with the last recorded update time and the IP address is acquired, the acquired MAC address is recorded in the tracking log of the tracking agent, and the tracking agent is predetermined. Move to the computer and Since outputs the recorded tracking logs can acquire the MAC address of the computer of the criminal who unauthorized access spoofed IP address.

A third aspect of the present invention provides a solution means by an unauthorized access tracking program which is a program for operating the monitoring agent or the tracking agent on a computer.

A fourth aspect of the present invention provides a solving means using a recording medium in which an unauthorized access tracking program, which is a program for operating the monitoring agent or the tracking agent on a computer, is recorded.

According to the present invention of claim 3 or 4, an unauthorized access tracking program, which is a program for operating a monitoring agent or a tracking agent on a computer, is stored in a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, a magnetic tape or the like. It is recorded on a computer-readable recording medium or transmitted via a communication network such as the Internet so that it can be widely distributed.

[0016]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing an example of the configuration of a network for implementing the unauthorized access tracking method of the present invention. As shown in FIG. 1, for example, in an intranet of a company, a web server 1, a monitoring server 2 used for monitoring purposes, a router 3, and a console 4 which is a computer of a network administrator are connected by a LAN line, etc. Has been done. Also, the computer 5 of the criminal used to attack the server is connected to the network. It should be noted that it does not matter which segment the computer 5 belongs to. The web server 1, for example, provides information to employees and is an attack target for criminals. Computers other than the criminal computer 5 are omitted in the drawing.

Each router 3 and web server 1 respectively
It has a MIB (Management Information Base) 31. Each of these routers 3 and the like receives the I packet when the IP packet arrives.
A pair of a P address and a MAC address (physical address) (hereinafter referred to as an address pair or a pair) is defined as M
Write to IB31. When a pair including the written IP address arrives, the pair including the written IP address is overwritten and updated.

The monitoring server 2 and the console 4 each operate an agent acceptor 11 which is a platform (basic program) for operating an agent.

In the monitoring server 2, the agent acceptor 11 operates the MIB monitoring agent 13. The MIB monitoring agent 13 monitors the MIB 31 assigned as a monitoring target, and when an address pair is updated, the MIB monitoring agent 13 acquires the pair, records it in the monitoring log in association with the update time. ing. As in the MIB monitoring agent 13 on the left side of FIG. 1, the monitoring target may be a plurality of MIBs 31. In addition, a plurality of M
The IB monitoring agent 13 may monitor one MIB 31.

In the console 4, the agent acceptor 11 is the MAC address tracing agent 12
Is waiting. The MAC address tracing agent 12 can move between the monitoring server 2 and the console 4 on which the agent acceptor 11 operates, and M
When the time of the unauthorized access and the IP address used are input, the AC address tracking agent 12 moves to the monitoring server 2, obtains the MAC address of the criminal's computer, and returns the MAC address to the console 4. It is supposed to be reported from.

FIG. 2 is a diagram showing the configurations of the monitoring server 2 and the console 4.

The monitoring server 2 includes an agent acceptor 1
1 and the MIB monitoring agent 13 are operating. MI
The B monitoring agent 13 includes a MIB monitoring function 131, an address pair recording function 132, and a monitoring log 133. The MIB monitoring function 131 is a function of monitoring the update of the MIB 31 to be monitored and acquiring a pair newly recorded in the update. The address pair recording function 132 is a function of recording the acquired pair in the monitoring log 133 in association with the update time.

On the console 4, the agent acceptor 1
1 is running and MAC address tracking agent 1
Two are waiting. MAC address tracking agent 1
2 is an information input function 121 and a table search function 122.
A server move function 123, a MAC address search function 124, a tracking log output function 125, and a tracking log 126.
It has and.

The information input function 121 inputs the time of the unauthorized access and the IP address used to trace the log 126.
It is a function to record in. The table search function 122 is a function of searching the IP address of the monitoring server 2 from the monitoring agent management table 41 described later. The server moving function 123 is a function for the agent itself to move between the console 4 and the monitoring server 2. The MAC address search function 124 uses the monitoring log 13 in the monitoring server 2 of the moving destination.
It is a function of searching the MAC address from 3 and recording it in the tracking log 126. The tracking log output function 125 is a function of displaying the tracking log 126 on the display device or the like of the console 4.

Further, the console 4 has a monitoring agent management table 4 in which the addresses of the respective monitoring servers 2 are recorded.
1 is provided.

FIG. 3 shows the monitoring agent management table 4
It is a figure which shows 1. Monitoring agent management table 41
Is the network address N of the network segment
A and the IP address of the monitoring server 2 to which the network segment is assigned are recorded in association with each other.
The network address NA is actually represented by a subnet address and a subnet mask.

Next, the operation of this embodiment will be described. FIG. 4 is a sequence diagram showing a state of unauthorized access and acquisition of a MAC address in this embodiment. FIG. 5 is a diagram showing how the MIB 31 is updated in the course of unauthorized access. FIG. 6 is a diagram showing the contents recorded in the monitoring log 133. Here, the MAC address of the criminal's computer 5 is "XX: XX: XX: XX: XX: 01", and the legitimate IP address is "192.168.11.1".
01 ”. In the network configuration of FIG. 1, the computer 5 accesses the web server 1 through the two routers 3, but the router 3 on the right side of FIG. 1 in charge of the network segment to which the computer 5 belongs is described as an example. To do. The time is illustrated for convenience.

First, when the criminal uses the regular IP address "192.168.11.101" from the computer 5 to access the web server 1 at 10 o'clock (step S1), the router 3 causes the router 3 to operate as shown in FIG. As shown in a), the pair of the regular IP address and the MAC address “XX: XX: XX: XX: XX: 01” of the computer 5 is recorded in its own MIB31 (hereinafter simply referred to as MIB31) (step). S3). Then, the M running on the monitoring server 2 on the right side of FIG. 1 (hereinafter simply referred to as the monitoring server 2)
As shown in FIG. 6, the IB monitoring agent 13 (hereinafter, simply referred to as the MIB monitoring agent 13) acquires this address pair from the MIB 31 by the MIB monitoring function 131 and uses the address pair recording function 132 to acquire the address pair.
The data is recorded in the monitoring log 133 in association with the update time "10 o'clock" (step S5). The update time can be substituted with the acquisition time of the address pair if the delay time of the network can be ignored, and the same applies to the following.

Then, in the computer 5, the legitimate IP address is an illegal IP address "192.168.68."
11.104 ”(step S7), 11
When the web server 1 is sometimes accessed (step S9), the router 3 causes an illegal IP address and MAC address "XX: XX: XX:" as shown in FIG. 5B.
The pair including the regular IP address is updated with the pair “XX: XX: 01” (step S11). Then MIB
As shown in FIG. 6, the monitoring agent 13 acquires the updated address pair and records it in the monitoring log 133 in association with the update time “11:00” (step S1).
3).

Note that the router 3 does not update the MIB 31 in the case of unauthorized access thereafter. Therefore MI
The content of B31 remains as it is in FIG.

Then, in the computer 5, the illegal IP address is the legitimate IP address "192.168.68."
11.101 ”(step S15), and 1
When the web server 1 is accessed at 2 o'clock (step S17), the router 3 is
The pair including the illegal IP address is updated with the pair including the legitimate IP address (step S19). Then, the MIB monitoring agent 13 acquires the updated address pair and records it in the monitoring log 133 in association with the update time "12:00" as shown in FIG. 6 (step S21).

Here, steps S9 to S17
In the meantime, it is assumed that the web server 1 is damaged by the unauthorized access from the criminal's computer 5. Then, as a result of performing the predetermined tracking processing, the IP address “192.168.1” used for the unauthorized access is obtained.
1.104 ”and the unauthorized access time“ 11:10 ”are obtained and are input to the MAC address tracing agent 12 from the console 4 (step S3).
1).

The MAC address tracking agent 12 is
The information input function 121 records this IP address and the time of unauthorized access in the tracking log 126, and then the table search function 122 searches the monitoring agent management table 41 to find the IP address of the monitoring server 2 that is the migration destination. Obtained (step S33). That is, referring to the monitoring agent management table 41, the IP address “1
The network address of the network segment including “192.168.11.104” is obtained, and the IP address of the corresponding monitoring server 2 is obtained.

Then, the MAC address tracing agent 12 moves to the monitoring server 2 by the server moving function 123 (step S35). Subsequently, the MAC address tracking agent 12 uses the MAC address search function 12
4, the MAC address of the criminal computer 5 is searched by referring to the monitoring log 133 (step S3).
7). That is, the MAC address tracking agent 12
First, from the monitoring log 133, the update time recorded before the unauthorized access time “11:10” and finally recorded is obtained. Here, the update time "11 o'clock" is obtained.
Then, the update time and the IP used for the unauthorized access
The MAC address "XX: XX: XX: associated with the address, that is," 192.168.11.104 "
XX: XX: 01 ”is acquired, and the obtained MAC address is recorded in the tracking log 126.

MAC address tracing agent 1
2 returns to the console 4 (step S39), and finally, the illegal IP address “192.168.11.10.
4 ”, time of unauthorized access“ 11:10 ”and MAC
The tracking log 126 including the address "XX: XX: XX: XX: XX: 01" is output to the display device or the like (step S41). If the monitoring server 2 or the agent acceptor 11 is not operating due to a failure, for example, the MAC
The address is not available, but the MA
The C address trace agent 12 outputs a trace log 126 indicating that the trace is impossible.

In the above embodiment, the input illegal I
Although it has been described that one IP address of the monitoring server 2 is obtained for the P address, when a plurality of MIBs 31 are monitored as in the MIB monitoring agent 13 on the left of FIG. Since the generated address pair and the time of the unauthorized access are recorded in one monitoring log 133, even in the case of the unauthorized access in which the unauthorized record remains in only one MIB 31, the monitoring generated from the other MIB 31. The MAC address of the criminal's computer can be obtained from the log 133.

Further, a plurality of MIB monitoring agents 13
When monitoring one MIB 31, a method of obtaining a MAC address different from the above can be implemented.
The differences will be described below.

First, the MAC address tracing agent 1
2 can circulate the monitoring server 2 including the plurality of MIB monitoring agents 13. In other words, in the search process of step S33, the IP addresses of the plurality of monitoring servers 2 are obtained. Therefore, if the monitoring servers 2 perform the search while searching for the MAC address as in step S37, and finally return to the console 4. Good.

It is also possible to operate a plurality of MAC address tracking agents 12 on the console 4 so that each MAC address tracking agent 12 moves to each of the plurality of monitoring servers 2 to obtain a MAC address. According to this processing, even if one of the MAC address tracking agents 12 becomes unprocessable in the middle of the network, another MAC address tracking agent 12 that can be processed can obtain the MAC address of the criminal's computer. .

In the above embodiment, the MAC address tracing agent 12 is set to return to the console 4. However, if another computer is set as a return place and the MAC address is acquired, the computer returns to the computer and reports it. May be performed.

As described above, according to the unauthorized access tracking method of this embodiment, the IP used for unauthorized access is
In order to obtain the MAC address of the access source computer from the address, M of each of the plurality of monitoring servers
The IB monitoring agent 13 detects the update of the management information base (MIB) to be monitored, and associates the pair of the IP address and the MAC address recorded in the update with the update time to monitor the monitoring log of the monitoring agent. Please record in the
Time of unauthorized access and I used for the unauthorized access
The tracking agent, which has input the P address, uses the monitoring agent management table 41 in which the IP addresses of the plurality of monitoring servers are associated with the addresses of the network segments assigned to the respective monitoring servers.
The IP address of the monitoring server corresponding to the address of the segment including the IP address used for the unauthorized access is obtained, the tracking agent moves to the monitoring server having the obtained IP address, and the monitoring agent of the monitoring server From the monitoring log, the MAC address associated with the update time last recorded before the time of the unauthorized access and the relevant IP address is acquired, and the acquired MAC address is recorded in the tracking log of the tracking agent. , The tracking agent moves to a predetermined console 4 and outputs a tracking log in which the MAC address is recorded, so that the MAC address of the computer of the criminal who illegally accessed by misrepresenting the IP address can be acquired. .

The agent acceptor 1 described above is used.
1. A program for operating the MAC address tracking agent 12 and the MIB monitoring agent 13 on a computer is recorded on a computer-readable recording medium such as a semiconductor memory, a magnetic disk, an optical disk, a magneto-optical disk, a magnetic tape, or the Internet. It can be widely distributed by being transmitted via a communication network such as.

Further, in the above embodiment, the target of unauthorized access is one web server, and the number of servers for this server is three.
The explanation has been given by taking an example of access once, but the FTP server or TEL
Even if another type of server such as a NET server is the target of unauthorized access, or the target of each access is different, the same effect can be obtained.

[0044]

As described above, according to the present invention,
Since the MAC address can be obtained from the IP address, it is possible to identify the computer of the criminal who illegally accessed by misrepresenting the IP address.

[Brief description of drawings]

FIG. 1 is a diagram showing an example of a network configuration for implementing an unauthorized access tracking method of the present invention.

FIG. 2 is a diagram showing a configuration of a monitoring server 2 and a console 4.

FIG. 3 is a diagram showing a monitoring agent management table 41.

FIG. 4 is a sequence diagram showing a state of unauthorized access and acquisition of a MAC address.

FIG. 5 is a diagram showing how the MIB 31 is updated in the course of unauthorized access.

FIG. 6 is a diagram showing contents recorded in a monitoring log 133.

[Explanation of symbols]

1 Web server 2 monitoring server 3 routers 4 Administrator's computer 5 Criminal's computer 11 Agent Receptor 12 MAC address tracking agent 13 MIB monitoring agent

Claims (4)

[Claims] 1. A method for tracing an unauthorized access, which obtains a MAC address of an access source computer from an IP address used for unauthorized access, wherein a monitoring agent in a monitoring server detects an update of a management information base to be monitored. In addition, the pair of IP address and MAC address recorded in the update is
It is recorded in the monitoring log of the monitoring agent in association with the update time, and when tracing unauthorized access, the time of the unauthorized access and the I used for the unauthorized access are recorded.
The tracking agent that has entered the P address moves to the monitoring server, and the tracking agent displays the update time and the last recorded IP address before the time of the unauthorized access from the monitoring log of the monitoring agent. The MAC address associated with is acquired, the acquired MAC address is recorded in the tracking log of the tracking agent, and the tracking agent moves to a predetermined computer and the tracking log in which the MAC address is recorded. An unauthorized access tracking method characterized by outputting. 2. A method for tracing an unauthorized access, wherein a MAC address of a computer as an access source is obtained from an IP address used for unauthorized access, wherein a monitoring agent in each of a plurality of monitoring servers is a management information base to be monitored. Detected the update, and the IP address and MAC recorded in the update
The address pair is recorded in the monitoring log of the monitoring agent in association with the update time. When tracing unauthorized access, the unauthorized access time and the I used for the unauthorized access are recorded.
The IP address used for the unauthorized access from the table in which the tracing agent that has input the P address associates the IP addresses of the plurality of monitoring servers with the addresses of the network segments assigned to the respective monitoring servers. The IP address of the monitoring server corresponding to the address of the segment that contains is detected, the tracking agent moves to the monitoring server with the calculated IP address, and the unauthorized access time is displayed from the monitoring log of the monitoring agent on the monitoring server. The MAC address associated with the previous and last recorded update time and the IP address is acquired, and the acquired MAC address is recorded in the tracking log of the tracking agent. Computer and move to the MAC Unauthorized access tracking method and outputting the recorded tracking logs less. 3. An unauthorized access tracking program, which is a program for operating the monitoring agent or the tracking agent on a computer. 4. A recording medium on which an unauthorized access tracking program, which is a program for operating the monitoring agent or the tracking agent on a computer, is recorded.