Analysis device, analysis method, and analysis program
An analysis server acquires observation information including a transmission source IP address, a transmission source MAC address, a transmission destination IP address, and a transmission destination MAC address in communication from each of sensing devices. The analysis server estimates a topology of a network on the basis of the acquired observation information. On the basis of the estimated topology, an analysis server creates a monitoring list indicating communication that is a target for transmission of the observation information for each sensing device such that any one sensing device on a path of the communication transmits the observation information of the communication for each piece of communication in the network, and transmits the monitoring list to the sensing device. Thereafter, each sensing device transmits the observation information of the communication to the analysis server on the basis of the monitoring list.
1 . An analysis apparatus comprising: a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
acquiring, from each communication observation device of a plurality of communication observation devices that observe communication in a network, observation information of the communication including a transmission source Internet Protocol (IP) address, a transmission source Media Access Control (MAC) address, a transmission destination IP address, and a transmission destination MAC address in the communication;
estimating a topology of the network on the basis of the acquired observation information;
allocating one communication observation device of the plurality of communication observation devices to observe a path of the network, wherein the one communication observation device is on the path of the communication and transmits:
the observation information of the communication for each piece of communication flowing through the network on the basis of the estimated topology,
an installation position of the one communication observation device on the path of the network, and
the observation information of the communication acquired from the one communication observation device;
creating, based on a result of the allocating operation of the one communication observation device, a monitoring list indicating one or more target communications for observation and for transmission by the allocated one communication observation device; and
transmitting the created monitoring list to respective communication observation devices of the plurality of communication observation devices, thereby preventing transmission of a plurality of pieces of observation information of an instance of communication, wherein
the respective communication observation devices are allocated to transmit the observation information of the communication with the same transmission source IP address and transmission source MAC address.
2 . The analysis apparatus according to claim 1 , wherein
the estimating the topology of the network further comprises estimating the topology of the network including an IP address and a MAC address of an apparatus in the network on the basis of the acquired observation information, and
the process further comprises:
detecting communication performed by an impersonated apparatus, by comparing a pair of an IP address and a MAC address of the apparatus included in the acquired observation information of the communication with a pair of an IP address and a MAC address of the apparatus included in the estimated topology.
3 . The analysis apparatus according to claim 2 , wherein
the process further comprises
detecting whether or not there is a change in the topology of the network by comparing the estimated topology of the network with a past topology of the network.
4 . The analysis apparatus according to claim 3 , wherein
in a case of the detecting that there is a change in the topology of the network,
the creating a monitoring list further comprises recreating a monitoring list for each of the communication observation devices on the basis of the estimated topology and the observation information, and
the transmitting the created monitoring list further comprises transmitting the recreated monitoring list for each of the communication observation devices to each of the communication observation devices.
5 . The analysis apparatus according to claim 2 , wherein
the process further comprises
specifying a monitoring location insufficient for monitoring each piece of communication in the network on the basis of the estimated topology of the network and information regarding an installation location of the communication observation device in the network, and outputting the specified monitoring location.
6 . The analysis apparatus according to claim 1 , wherein
in a case where the plurality of communication observation devices is installed in a same subnet in the network,
the estimating the topology of the network further comprises estimating a topology of an L2 network in the subnet on the basis of a difference between pieces of observation information acquired from the respective communication observation devices.
7 . An analysis method executed by an analysis apparatus, comprising:
acquiring, from each communication observation device of a plurality of communication observation devices that observe communication in a network, observation information of the communication including a transmission source Internet Protocol (IP) address, a transmission source Media Access Control (MAC) address, a transmission destination IP address, and a transmission destination MAC address in the communication;
estimating a topology of the network on the basis of the acquired observation information;
allocating one communication observation device of the plurality of communication observation devices to observe a path of the network, wherein the one communication observation device is on the path of the communication and transmits;
the observation information of the communication for each piece of communication flowing through the network on the basis of the estimated topology,
an installation position of the one communication observation device on the path of the network, and
the observation information of the communication acquired from the communication observation device;
creating, based on a result of the allocating operation of the one communication observation device, a monitoring list indicating one or more target communications for observation and for transmission by the allocated one communication observation device; and
transmitting the created monitoring list to respective communication observation devices of the plurality of communication observation devices, thereby preventing transmission of a plurality of pieces of observation information of an instance of communication, wherein
the respective communication observation devices are allocated to transmit the observation information of the communication with the same transmission source IP address and transmission source MAC address.
8 . A non-transitory computer readable storage medium having stored therein an analysis program that causes a computer to execute a process comprising the steps of:
acquiring, from each communication observation device of a plurality of communication observation devices that observe communication in a network, observation information of the communication including a transmission source Internet Protocol (IP) address, a transmission source Media Access Control (MAC) address, a transmission destination IP address, and a transmission destination MAC address in the communication;
estimating a topology of the network on the basis of the acquired observation information;
allocating one communication observation device of the plurality of communication observation devices to observe a path of the network, wherein the one communication observation device is on the path of the communication and transmits:
the observation information of the communication for each piece of communication flowing through the network on the basis of the estimated topology,
an installation position of the one communication observation device on the path of the network, and
the observation information of the communication acquired from the communication observation device;
creating, based on a result of the allocating operation of the one communication observation device, a monitoring list indicating one or more target communications for observation and for transmission by the allocated one communication observation device; and
transmitting the created monitoring list to respective communication observation devices of the plurality of communication observation devices, thereby preventing transmission of a plurality of pieces of observation information of an instance of communication, wherein
the respective communication observation devices are allocated transmit the observation information of the communication with the same transmission source IP address and transmission source MAC address.