Technique of Analyzing An Information System State

• US 20080159165A1
• Filed: 07/02/2007
• Published: 07/03/2008
• Est. Priority Date: 07/28/2006
• Status: Active Grant

• Current Assignee: Twitter Inc (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Takara, Maho
• Granted Patent: US 7,752,307 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

A system for analyzing an information system connected between a plurality of information processors through a communication line, including: a capturing unit for capturing communication packets sent through the communication line; a first counting unit for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets; a second counting unit for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each source of the communication packets; and a determining unit for determining which of a server function and a client function uses a TCP/UDP port of each of the information processors on the basis of the total attribute value for communication packets addressed to the TCP/UDP port and the total attribute value for communication packets sent from the TCP/UDP port.

Claims

1. A system for analyzing an information system connected between a plurality of information processors through a communication line, comprising:

a capturing unit for capturing communication packets sent through the communication line;

a first counting unit for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets;

a second counting unit for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each source of the communication packets; and

a determining unit for determining which of a server function and a client function uses a communication port of each of the information processors on the basis of the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port.

2. The system according to claim 1, further comprising:

a first calculating unit for determining whether or not the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port satisfy a plurality of conditions regarding characteristics of the server function to calculate a first index value representing the degree to which the communication port has the characteristics of the server function on the basis of the determination result; and

a second calculating unit for determining whether the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port satisfy a plurality of conditions regarding characteristics of the client function to calculate a first index value representing the degree to which the communication port has the characteristics of the client function on the basis of the determination result,

wherein the determining unit determines that the client function uses the communication port if the second index value is larger than the first index value for each communication port and determines that the server function uses the communication port if the first index value is larger than the second index value for each communication port.

3. The system according to claim 2, wherein the first counting unit counts the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each destination of the communication packets,

the second counting unit counts the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each source of the communication packets,

the first calculating unit calculates the first index value as the total number of communication packets where an ACK flag and a SYN flag are both set, among the communication packets sent from each of the communication ports under such conditions that the total number of communication packets is larger than the number of remaining packets, and

under such conditions that the total number of communication packets where an ACK flag and a SYN flag are both set, among the communication packets addressed to each of the communication ports is larger than a reference value, the second calculating unit sets a larger value as the second index value.

4. The system according to claim 2, wherein the first counting unit counts IP addresses of source information processors for each destination of the communication packets,

the second counting unit counts IP addresses of destination information processors for each source of the communication packets,

under such conditions that the total number of destination IP addresses of communication packets sent from each communication port and source IP addresses of communication packets addressed to each communication port is larger than a reference value, the first calculating unit sets a larger value as the first index value, and

under such conditions that the total number of destination IP addresses of communication packets sent from each communication port and source IP addresses of communication packets addressed to each communication port is smaller than a reference value, the first calculating unit sets a larger value as the first index value.

5. The system according to claim 2, wherein the first calculating unit counts the number of source communication ports for each destination of communication packets,

the second calculating unit counts the number of destination communication ports for each source of the communication packets,

under such conditions that the total number of destination communication ports of communication packets sent from each communication port and source communication ports of communication packets addressed to each communication port is larger than a reference value, the first calculating unit sets a larger value as the first index value, and

under such conditions that the total number of destination communication ports of communication packets sent from each communication port and source communication ports of communication packets addressed to each communication port is smaller than a reference value, the second calculating unit sets a larger value as the second index value.

6. The system according to claim 2, wherein under such conditions that a port number of each communication port is smaller than a destination port number for communication packets sent from each communication port or a source port number for communication packets addressed to each communication port, the first calculating unit sets a smaller value as the first index value, and

under such conditions that a port number of each communication port is larger than a destination port number for communication packets sent from each communication port or a source port number for communication packets addressed to each communication port, the second calculating unit sets a larger value as the second index value.

7. The system according to claim 2, wherein the first counting unit measures the total data size of communication packets for each destination of the communication packets,

the second counting unit measures the total data size of communication packets for each source of the communication packets,

under such conditions that the total data size or a size on the basis of an average value of communication packets sent from each communication port is larger than the total data size or a size on the basis of an average value of communication packets addressed to each communication port, the first calculating unit sets a larger value as the first index value, and

under such conditions that the total data size or a size on the basis of an average value of communication packets sent from each communication port is larger than the total data size or a size on the basis of an average value of communication packets addressed to each communication port, the second calculating unit sets a larger value as the second index value.

8. The system according to claim 1, wherein the capturing unit sequentially captures communication packets sent through the communication line,

the system further comprises a sum calculating unit for incrementing a counter representing the number of communication packets, a data size of the communication packets, and the number of communication packets where a preset flag is set,

the first counting unit counts the number of communication packets calculated with the sum calculating units for each destination communication port, and

the second counting unit counts the number of communication packets calculated with the sum calculating units for each source communication port.

9. The system according to claim 1, further comprising:

a selecting unit for selecting, if an information processor is designated, all information processors that send/receive communication packets to/from a communication port that is determined to be used by the server function among communication ports of the designated information processor; and

an outputting unit for outputting information about the selected information processors as information about an influence of the selected information processors if the processors stop operating.

10. The system according to claim 9, wherein the number of selected information processors exceeds a preset reference value.

11. The system according to claim 1, further comprising:

a third counting unit for counting the number of communication packets where a FIN flag is set in accordance with a TCP protocol, and the number of communication packets where an SYN flag is set in accordance with the TCP protocol; and

an alarm unit for displaying an alert message that the information system is being attacked under such conditions that the ratio of the number of communication packets where the FIN flag is set to the number of communication packets where the SYN flag is set is smaller than a preset reference value.

12. A method of analyzing a state of an information system connected between a plurality of information processors through a communication line, comprising the steps of:

capturing communication packets sent through the communication line;

extracting a first attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets;

extracting a second attribute value representing communication attributes from each of the captured communication packets to add attribute values for each source of the communication packets; and

determining which of a server function and a client function uses a communication port of each of the information processors on the basis of the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port.

13. The method of analyzing a state of an information system connected between a plurality of information processors through a communication line according to claim 12, comprising the further step of determining whether the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port satisfy a plurality of conditions regarding characteristics of the client function to calculate a first index value representing the degree to which the communication port has the characteristics of the client function on the basis of the determination result.

14. The method of analyzing a state of an information system connected between a plurality of information processors through a communication line according to claim 13, wherein the determining step determines that the client function uses the communication port if the second index value is larger than the first index value for each communication port and determines that the server function uses the communication port if the first index value is larger than the second index value for each communication port.

15. The method of analyzing a state of an information system connected between a plurality of information processors through a communication line according to claim 12, wherein extracting a first attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets comprises counting the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each destination of the communication packets, and

extracting a second attribute value representing communication attributes from each of the captured communication packets to add attribute values for each source of the communication packets comprises counting the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each source of the communication packets.

16. A program product stored on a computer readable medium that causes a computer to function as a system analyzing a state of an information system connected between a plurality of information processors through a communication line, the program product comprising:

a means for capturing communication packets sent through the communication line;

a first counting means for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets;

a second counting means for extracting an attribute value representing communication attributes from each of the captured communication packets to add attribute values for each source of the communication packets; and

a determining means for determining which of a server function and a client function uses a communication port of each of the information processors on the basis of the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port.

17. The program product stored on a computer readable medium that causes a computer to function as a system analyzing a state of an information system connected between a plurality of information processors through a communication line of claim 16, wherein said determining means determines whether the total attribute value for communication packets addressed to the communication port and the total attribute value for communication packets sent from the communication port satisfy a plurality of conditions regarding characteristics of the client function to calculate a first index value representing the degree to which the communication port has the characteristics of the client function on the basis of the determination result.

18. The program product stored on a computer readable medium that causes a computer to function as a system analyzing a state of an information system connected between a plurality of information processors through a communication line of claim 17, wherein the determining means further determines that the client function uses the communication port if the second index value is larger than the first index value for each communication port and determines that the server function uses the communication port if the first index value is larger than the second index value for each communication port.

19. The program product stored on a computer readable medium that causes a computer to function as a system analyzing a state of an information system connected between a plurality of information processors through a communication line of claim 16, wherein said first counting means extracts a first attribute value representing communication attributes from each of the captured communication packets to add attribute values for each destination of the communication packets comprises counting the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each destination of the communication packets.

20. The program product stored on a computer readable medium that causes a computer to function as a system analyzing a state of an information system connected between a plurality of information processors through a communication line of claim 16, wherein said second counting means comprises counting the number of communication packets where an ACK flag and a SYN flag are both set in accordance with a TCP protocol for each source of the communication packets.