Control device, border router, control method, and control program

A border router that connects networks and that changes a setting in accordance with a command from a control device, a notification of an occurrence of an attack due to concentration of reply packets of a predetermined service and information on a target of the attack being received from the control device, comprising:

• processing circuitry configured to,
• upon reception of a reply packet of the predetermined service, addressed to the target of the attack, add a transmission-source IP address of the reply packet to a black list;
• upon reception of a first type of packet, which is any of a reply packet of the predetermined service, addressed to the target of the attack, and a fragmented packet, addressed to the target of the attack, with an IP address described in the black list as a transmission source, discard the first type of packet;
• and
• after the attack is detected by the control device, when information on a request packet of the predetermined service, transmitted from the target of the attack, observed by the control device, is received from the control device, the processing circuitry sets an exception rule to exclude a second type of packet, which is any of a reply packet of the predetermined service and a fragmented packet, whose transmission-source IP address is a destination IP address of the request packet, from the discarding.

A control method, implemented by a control device, for giving a command to each of border routers, connecting networks, so as to control transfer of packets, comprising:

• receiving a concentration of reply packets of a predetermined service;
• detecting an attack in response to the concentration of reply packets of the predetermined service, and performing
• a step of acquiring at least some of reply packets of a predetermined service, addressed to a target of the attack and received by the border router;
• a step of adding a transmission-source IP address of the acquired reply packet to a black list of the border router;
• a step of, receiving a first type of packet, which is any of a reply packet of the predetermined service, addressed to the target of the attack, and a fragmented packet, addressed to the target of the attack, with an IP address described in the black list as a transmission source, and giving a command to the border router so as to discard the first type of packet;
• and
• after the attack is detected, upon reception of a request packet of the predetermined service from the IP address of the target of the attack, giving a command to each of the border routers so as to set an exception rule to exclude a second type of packet, which is any of a reply packet of the predetermined service and a fragmented packet, whose transmission-source IP address is a destination IP address of the received request packet, from the discarding.

A control method for a border router, connecting networks, to control transfer of packets, comprising:

• a step of receiving, from a control device, a notification of an occurrence of an attack due to concentration of reply packets of a predetermined service and information on a target of the attack and, subsequently, upon reception of a reply packet of the predetermined service, addressed to the target of the attack, adding a transmission-source IP address of the reply packet to a black list;
• a step of receiving a first type of packet, which is any of a reply packet of the predetermined service, addressed to the target of the attack, and a fragmented packet, addressed to the target of the attack, with an IP address described in the black list as a transmission source, and discarding the first type of packet;
• and
• after the attack is detected by the control device, when information on a request packet of the predetermined service, transmitted from the target of the attack, observed by the control device, is received from the control device, setting an exception rule to exclude a second type of packet, which is any of a reply packet of the predetermined service and a fragmented packet, whose transmission-source IP address is a destination IP address of the request packet, from the discarding.

A non-transitory computer readable storage medium having stored therein a control program for a computer to execute a process comprising:

• receiving a concentration of reply packets of a predetermined service;
• detecting an attack in response to the concentration of reply packets of the predetermined service, and performing
• a step of acquiring at least some of reply packets of the predetermined service, addressed to a target of the attack and received by a border router;
• a step of adding a transmission-source IP address of the acquired reply packets to a black list of the border router;
• a step of receiving a first type of packet, which is any of a reply packet of the predetermined service, addressed to the target of the attack, and a fragmented packet, addressed to the target of the attack, with an IP address described in the black list as a transmission source, and giving a command to the border router so as to discard the first type of packet;
• and
• after the attack is detected, upon reception of a request packet of the predetermined service from the IP address of the target of the attack, giving a command to each of the border routers so as to set an exception rule to exclude a second type of packet, which is any of a reply packet of the predetermined service and a fragmented packet, whose transmission-source IP address is a destination IP address of the received request packet, from the discarding.