JP7038165B2 - Information processing equipment, information processing methods and information processing programs - Google Patents

Description

The present invention relates to an information processing apparatus, an information processing method and an information processing program.

Conventionally, various technologies for ensuring network security from all cyber attacks such as DoS (Denial of Service attack) attacks, BOF (Buffer Overflow) attacks, brute force attacks, information theft or falsification have been used. Are known. For example, SIEM (Security Information and Event Management) allows access from IP addresses that may threaten the security of the network (hereinafter also referred to as threat IP addresses), such as IP addresses that are the source of attacks such as cyber attacks. Techniques for blocking and detecting are known.

Japanese Unexamined Patent Publication No. 2016-152594

However, the above-mentioned prior art does not always make it possible to appropriately evaluate the security of IP addresses managed by ISPs (Internet Service Providers). For example, the above-mentioned prior art merely blocks and detects access from threat IP addresses, and does not always make it possible to appropriately evaluate the security of IP addresses managed by ISPs.

The present application has been made in view of the above, and is an information processing device, an information processing method, and an information processing program capable of appropriately evaluating the security of an IP address managed by an ISP (Internet Service Provider). To propose.

The information processing apparatus according to the present application inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in a list of threat IP addresses, and also inquires of the ISP. In the IP block information inquired by the inquiry unit, the IP address that matches the threat IP address included in the list of threat IP addresses and the inquiry unit that inquires about the IP block information indicating the range of IP addresses managed by the inquiry unit. When present in, the ISP that manages the threat IP address is provided with a specific unit that identifies the ISP corresponding to the inquired IP block information.

According to one aspect of the embodiment, there is an effect that the security of the IP address managed by the ISP (Internet Service Provider) can be appropriately evaluated.

FIG. 1 is a diagram showing a configuration example of an information processing system according to an embodiment. FIG. 2 is a diagram showing a configuration example of the information processing apparatus according to the embodiment. FIG. 3 is a diagram showing an example of a CIDR cache storage unit according to an embodiment. FIG. 4 is a flowchart showing an information processing procedure according to the embodiment. FIG. 5 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing device.

Hereinafter, an information processing apparatus, an information processing method, and an embodiment for implementing an information processing program (hereinafter referred to as “embodiments”) according to the present application will be described in detail with reference to the drawings. Note that this embodiment does not limit the information processing apparatus, information processing method, and information processing program according to the present application. Further, in each of the following embodiments, the same parts are designated by the same reference numerals, and duplicate description is omitted.

[1. Introduction]
As one of the indexes to evaluate the security of the network managed by the ISP (Internet Service Provider), the number of threat IP addresses managed by the ISP is the number of threat IP addresses managed by other ISPs. There is an indicator of how much (or less) it is compared to. For example, if an ISP can know how many (or few) threat IP addresses it has for threat IP addresses detected all over the world, how much it can take measures against threat IP addresses. It will be easier to decide if you should devote your budget and time.

Generally, information on a threat IP address can be obtained by purchasing from a threat IP address information provider such as a security vendor (Security Vender), which is a security countermeasure business operator. However, it may be difficult to obtain information that can identify the ISP that manages the threat IP address from the threat IP address information provider. Therefore, in order to identify the ISP that manages the threat IP address, it is necessary to inquire the RADB (Routing Assets Database) for the ISP information that manages the threat IP address. However, since the number of threat IP addresses acquired from the threat IP address information provider is enormous, if the ISP information of all threat IPs is inquired to RADB, the inquiry itself becomes a DoS attack against RADB.

Therefore, the information processing apparatus 100 according to the present invention inquires of RADB for ISP information indicating an ISP that manages a predetermined threat IP address included in the list of threat IP addresses, and at the same time, the IP address managed by the ISP. Inquire about the IP block information indicating the range of. Further, when the IP address matching the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry unit 134, the information processing apparatus 100 manages the threat IP address in the ISP. Is identified as the ISP corresponding to the inquired IP block information.

By repeating this, the information processing apparatus 100 can reduce the number of inquiries about the ISP information of the threat IP address to RADB. That is, since the information processing apparatus 100 can reduce the number of inquiries to RADB and the time required for inquiries, the ISP information of the threat IP address can be specified more efficiently than in the past. That is, the information processing apparatus 100 helps the ISP to know how many (or few) threat IP addresses of the company are for the threat IP addresses detected all over the world. Therefore, the information processing apparatus 100 makes it possible to appropriately evaluate the security of the IP address managed by the ISP.

[2. Information processing system configuration]
Next, the configuration of the information processing system according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram showing a configuration example of an information processing system according to an embodiment. As shown in FIG. 1, the information processing system 1 includes an SV server 10, RADB 20, and an information processing device 100. The SV server 10, the RADB 20, and the information processing apparatus 100 are connected to each other via a predetermined network N so as to be communicable by wire or wirelessly. The information processing system 1 shown in FIG. 1 may include an arbitrary number of SV servers 10, an arbitrary number of RADB 20, and an arbitrary number of information processing devices 100.

The SV server 10 is a server device managed by a threat IP address information provider such as a security vendor. The SV server 10 provides network security threat information to the ISP. For example, the SV server 10 permits the information processing apparatus 100 to request information regarding a threat IP address.

RADB20 is a database in which IPR (Internet Routing Registry) information is registered. For example, IP block information indicating the range of IP addresses managed by the ISP is registered in RADB 20.

The information processing device 100 is a server device managed by an ISP (Internet Service Provider). The information processing apparatus 100 acquires threat IP address information from the SV server 10. The information processing apparatus 100 creates a list of unique threat IP addresses based on the information about the threat IP addresses acquired from the SV server 10.

Further, the information processing apparatus 100 inquires of RADB for ISP information indicating an ISP that manages a predetermined threat IP address included in the list of threat IP addresses, and indicates the range of IP addresses managed by the ISP. Inquire about IP block information. The information processing apparatus 100 stores the inquired IP block information in the storage unit. Further, when the IP address matching the threat IP address included in the list of threat IP addresses exists in the inquired IP block information, the information processing apparatus 100 has already inquired about the ISP that manages the threat IP address. Identify as the ISP corresponding to the IP block information.

[3. Information processing device configuration]
Next, the configuration of the information processing apparatus 100 according to the embodiment will be described with reference to FIG. FIG. 2 is a diagram showing a configuration example of the information processing apparatus 100 according to the embodiment. As shown in FIG. 2, the information processing apparatus 100 includes a communication unit 110, a storage unit 120, and a control unit 130. The information processing device 100 includes an input unit (for example, a keyboard, a mouse, etc.) that receives various operations from the administrator of the information processing device 100, and a display unit (for example, a liquid crystal display, etc.) for displaying various information. You may have.

(Communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. Then, the communication unit 110 is connected to the network by wire or wirelessly, and transmits / receives information to / from, for example, the SV server 10 or RADB 20.

(Memory unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk. As shown in FIG. 2, the storage unit 120 has a threat IP list storage unit 121 and a CIDR cache storage unit 122.

(Threat IP list storage unit 121)
The threat IP list storage unit 121 stores various information related to the threat IP address. Specifically, the threat IP list storage unit 121 stores information regarding the list of threat IP addresses generated by the generation unit 131. For example, the threat IP list storage unit 121 stores information regarding a unique list of threat IP addresses that eliminates duplication.

(CIDR cache storage unit 122)
The CIDR cache storage unit 122 stores IP block information (hereinafter, also referred to as CIDR cache information) that has been inquired to RADB by the inquiry unit 134. Here, an example of the information stored in the CIDR cache storage unit 122 will be described with reference to FIG. FIG. 3 is a diagram showing an example of the CIDR cache storage unit 122. As shown in FIG. 3, the CIDR cache storage unit 122 has items such as “ISP name” and “IP block”.

"ISP name" indicates the name of the ISP. The "IP block" indicates information in the IP block (CIDR) indicating the range of IP addresses managed by the ISP.

In the example shown in FIG. 3, the ISP name "Company A" indicates that the name of the ISP is "Company A". Further, it is shown that a plurality of IP blocks such as "IP block # 11", "IP block # 12", ..., Etc. exist in the IP block (CIDR) managed by the ISP name "Company A". More specifically, the IP block "IP block # 11" indicates information of a certain IP block managed by the company A. For example, the IP block "IP block # 11" is information indicating a block of IP addresses in the range of "192.168.1.1" to "192.168.1.100".

(Control unit 130)
Returning to the description of FIG. 2, the control unit 130 is a controller, and is stored in a storage device inside the information processing device 100 by, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). Various programs (corresponding to an example of an information processing program) are realized by executing the RAM as a work area. Further, the control unit 130 is a controller, and is realized by, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

As shown in FIG. 2, the control unit 130 includes a generation unit 131, a determination unit 132, a specific unit 133, an inquiry unit 134, and an update unit 135, and realizes the information processing operation described below. Or execute. The internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 2, and may be any other configuration as long as it is configured to perform information processing described later.

(Generation unit 131)
The generation unit 131 acquires the threat IP address information from the SV server 10 managed by the threat IP address information provider. Subsequently, the generation unit 131 generates a unique list of threat IP addresses by eliminating duplication of threat IP addresses included in the threat IP address information based on the acquired threat IP address information. When the generation unit 131 generates a list of threat IP addresses, the generation unit 131 stores information about the generated list of threat IP addresses in the threat IP list storage unit 121.

(Judgment unit 132)
The determination unit 132 determines whether or not an IP address matching the threat IP address included in the list of threat IP addresses exists in the IP block information queried by the inquiry unit 134. Specifically, the determination unit 132 refers to the threat IP list storage unit 121 and acquires a predetermined threat address from the list of threat IP addresses. For example, the determination unit 132 acquires the threat address indicated by "192.168.1.1" from the list of threat IP addresses.

Subsequently, the determination unit 132 refers to the CIDR cache storage unit 122, and the IP block (CIDR) in the range including the predetermined threat address is included in the IP block information (CIDR cache information) inquired by the inquiry unit 134. Determine if it exists. For example, the determination unit 132 determines whether or not the IP block in the range including the threat address indicated by "192.168.1.1" exists in the CIDR cache information.

(Specific part 133)
The specific unit 133 manages the threat IP address when the IP block (CIDR) in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information queried by the inquiry unit 134. Identify the ISP as the ISP that corresponds to the IP block information that has been queried. For example, the specific unit 133 determines that the IP block in the range including the threat address indicated by "192.168.1.10" by the determination unit 132 exists in the IP block information (CIDR cache information) inquired by the inquiry unit 134. If so, the ISP that manages the threat address indicated by "192.168.1.10" is specified as "Company A" of the ISP corresponding to the threat address information indicated by "192.168.1.10".

(Inquiry unit 134)
The inquiry unit 134 inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in the list of threat IP addresses, and is managed by the ISP. Inquire about IP block information indicating the range of IP addresses that exist. For example, the inquiry unit 134 inquires the RADB of the ISP information indicating the ISP that manages the threat address indicated by "192.168.1.1" included in the list of threat IP addresses. As a result of the inquiry, the inquiry unit 134 acquires the ISP information that the name of the ISP that manages the threat address indicated by "192.168.1.1" is "Company A" from RADB.

Subsequently, when the inquiry unit 134 acquires the ISP information of the threat address, it inquires about the IP block (CIDR) indicating the range of the IP address managed by the ISP indicated by "Company A". As a result of the inquiry, the inquiry unit 134 indicates from RADB that the IP block of "Company A" is a block of IP addresses in the range of "192.168.1.1 to 192.168.1.100", IP block # 11, "192.168.1.101 to 192.168". Acquires IP block information such as IP block # 12, which indicates a block of IP addresses in the range of ".1.300". Subsequently, the inquiry unit 134 has IP blocks # 11 and "192.168.1.101 to 192.168.1.300" indicating a block of IP addresses in the range of "Company A" and "192.168.1.1 to 192.168.1.100", which are the acquired ISP information. The IP block # 12, which indicates the block of the IP address in the range of "", is stored in the CIDR cache storage unit 122 in association with the IP block # 12, .... Further, the inquiry unit 134 deletes the duplication of the IP block (CIDR) and stores it in the CIDR cache storage unit 122. For example, the inquiry unit 134 acquires three IP block information of "192.168.0.0/12", "192.168.1.0/24", and "192.168.2.0/24" as a result of the inquiry. In this case, the query unit 134 has only the IP block information of "192.168.0.0/12" because "192.168.1.0/24" and "192.168.2.0/24" are included in the range of "192.168.0.0/12". Is stored in the CIDR cache storage unit 122. As described above, when the inquiry unit 134 acquires the predetermined IP block and the IP block in the range including the predetermined IP block as a result of the inquiry, CIDR only the IP block information in the range including the predetermined IP block. It is stored in the cache storage unit 122.

Further, the inquiry unit 134 determines that the IP block (CIDR) in the range including the threat IP address included in the list of threat IP addresses does not exist in the IP block information queried by the inquiry unit 134. If so, the RADB is inquired about the ISP information indicating the ISP that manages the threat IP address, and the IP block information indicating the range of the IP address managed by the ISP is inquired. For example, in the inquiry unit 134, the IP block (CIDR) in the range including the threat address indicated by "192.168.1.10" by the determination unit 132 exists in the IP block information (CIDR cache information) inquired by the inquiry unit 134. If it is determined not to do so, inquire the RADB for ISP information indicating the ISP that manages the threat address indicated by "192.168.1.10", and IP block information indicating the range of IP addresses managed by the ISP. Inquire.

(Update part 135)
The update unit 135 updates the CIDR cache storage unit that stores the ISP information and the IP block information in association with each other based on the inquiry result by the inquiry unit 134. Specifically, the update unit 135 associates the ISP information of the acquired threat address with the IP block information for each IP block each time the inquiry unit 134 acquires new inquiry information from RADB, and the CIDR cache storage unit. Write to.

[4. Information processing flow]
Next, the procedure of information processing according to the embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing an information processing procedure according to the embodiment. In the example shown in FIG. 4, the generation unit 131 generates a list of threat IP addresses based on the threat IP address information acquired from the threat IP address information provider (step S101).

In the determination unit 132, the IP block (CIDR) in the range including the threat IP address included in the list of threat IP addresses generated by the generation unit 131 exists in the IP block information (CIDR cache) inquired by the inquiry unit 134. It is determined whether or not to do so (step S102). When the determination unit 132 determines that the IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry unit 134 (step S102; Yes), the ISP that manages the threat IP address is identified as the ISP that corresponds to the inquired IP block information (step S103).

On the other hand, when the determination unit 132 determines that the IP block in the range including the threat IP address included in the list of threat IP addresses does not exist in the IP block information inquired by the inquiry unit 134 (the inquiry unit 134). Step S102; No), the RADB is inquired about the ISP information indicating the ISP that manages the threat IP address (step S104).

When the ISP that manages the threat IP address is not specified as a result of the inquiry (step S105; No), the inquiry unit 134 creates a UNKOWN cache to which the threat IP address related to the inquiry is added (step S106).

On the other hand, when the ISP that manages the threat IP address is specified as a result of the inquiry (step S105; Yes), the inquiry unit 134 indicates to RADB the range of the IP address managed by the specified ISP. Inquire about the IP block information (step S107).

The update unit 135 updates the CIDR cache storage unit by adding information in which the ISP information corresponding to the inquiry result and the IP block information are associated with each other to the CIDR cache storage unit based on the inquiry result by the inquiry unit 134. (Step S108).

[5. effect〕
As described above, the information processing apparatus 100 according to the embodiment includes an inquiry unit 134 and a specific unit 133. The inquiry unit 134 inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in the list of threat IP addresses, and is managed by the ISP. Inquire about IP block information indicating the range of IP addresses that exist. If the IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information queried by the inquiry unit 134, the specific unit 133 inquires about the ISP that manages the threat IP address. Identify the ISP corresponding to the completed IP block information.

As a result, the information processing apparatus 100 can reduce the number of inquiries about the ISP information of the threat IP address to RADB. That is, since the information processing apparatus 100 can reduce the number of inquiries to RADB and the time required for inquiries, the ISP information of the threat IP address can be specified more efficiently than in the past. That is, the information processing apparatus 100 helps the ISP to know how many (or few) threat IP addresses of the company are for the threat IP addresses detected all over the world. Therefore, the information processing apparatus 100 makes it possible to appropriately evaluate the security of the IP address managed by the ISP.

Further, when the IP block in the range including the threat IP address included in the list of threat IP addresses does not exist in the IP block information queried by the inquiry unit 134, the inquiry unit 134 refers to the threat IP to RADB. Inquires about the ISP information indicating the ISP that manages the address, and also inquires about the IP block information indicating the range of the IP address managed by the ISP.

As a result, the information processing apparatus 100 can reduce the number of inquiries about the ISP information of the threat IP address to RADB. Further, the information processing apparatus 100 can specify an IP block including a threat IP address.

Further, the information processing apparatus 100 further includes a CIDR cache storage unit that stores ISP information and IP block information in association with each other based on the inquiry result by the inquiry unit 134. When the inquiry unit 134 acquires a predetermined IP block and an IP block in a range including the predetermined IP block as a result of the inquiry, the CIDR cache storage unit 122 stores only the IP block information in the range including the predetermined IP block. Remember in.

As a result, the information processing apparatus 100 can eliminate duplication of the IP block information stored in the CIDR cache storage unit 122, so that the IP block information can be stored more efficiently.

Further, the information processing apparatus 100 further includes a determination unit 132. The determination unit 132 determines whether or not the IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry unit 134.

Thereby, the information processing apparatus 100 can determine whether or not to inquire the ISP information of the threat IP address to RADB based on the determination result.

Further, the information processing apparatus 100 further includes an update unit 135. The update unit 135 updates the CIDR cache storage unit that stores the ISP information and the IP block information in association with each other based on the inquiry result by the inquiry unit 134.

As a result, the information processing apparatus 100 can reduce the number of inquiries about the ISP information of the threat IP address to RADB.

Further, the information processing apparatus 100 further includes a generation unit 131. The generation unit 131 generates a list of threat IP addresses based on the threat IP address information acquired from the SV server managed by the threat IP address information provider. Specifically, the generation unit 131 generates a list of unique threat IP addresses by eliminating duplication of threat IP addresses included in the threat IP address information.

As a result, the information processing apparatus 100 can further reduce the number of inquiries about the ISP information of the threat IP address to RADB.

[6. Hardware configuration]
Further, the information processing apparatus 100 according to the above-described embodiment is realized by, for example, a computer 1000 having a configuration as shown in FIG. FIG. 5 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing apparatus 100. The computer 1000 includes a CPU 1100, a RAM 1200, a ROM 1300, an HDD 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F) 1700.

The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400, and controls each part. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started, a program depending on the hardware of the computer 1000, and the like.

The HDD 1400 stores a program executed by the CPU 1100, data used by such a program, and the like. The communication interface 1500 receives data from another device via a predetermined communication network and sends the data to the CPU 1100, and transmits the data generated by the CPU 1100 to the other device via the predetermined communication network.

The CPU 1100 controls an output device such as a display or a printer, and an input device such as a keyboard or a mouse via the input / output interface 1600. The CPU 1100 acquires data from the input device via the input / output interface 1600. Further, the CPU 1100 outputs the generated data to the output device via the input / output interface 1600.

The media interface 1700 reads a program or data stored in the recording medium 1800 and provides the program or data to the CPU 1100 via the RAM 1200. The CPU 1100 loads the program from the recording medium 1800 onto the RAM 1200 via the media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or PD (Phase change rewritable Disk), a magneto-optical recording medium such as MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. And so on.

For example, when the computer 1000 functions as the information processing apparatus 100 according to the embodiment, the CPU 1100 of the computer 1000 realizes the function of the control unit 130 by executing the program loaded on the RAM 1200. The CPU 1100 of the computer 1000 reads and executes these programs from the recording medium 1800, but as another example, these programs may be acquired from another device via a predetermined communication network.

Although some of the embodiments of the present application have been described in detail with reference to the drawings, these are examples, and various modifications are made based on the knowledge of those skilled in the art, including the embodiments described in the disclosure column of the invention. It is possible to carry out the present invention in other modified forms.

[7. others〕
Further, among the processes described in the above-described embodiments and modifications, all or part of the processes described as being automatically performed can be manually performed, or are described as being manually performed. It is also possible to automatically perform all or part of the processed processing by a known method. In addition, information including processing procedures, specific names, various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the information shown in the figure.

Further, each component of each of the illustrated devices is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of them may be functionally or physically distributed / physically in any unit according to various loads and usage conditions. Can be integrated and configured.

Further, the above-described embodiments and modifications can be appropriately combined as long as the processing contents do not contradict each other.

Further, the above-mentioned "section, module, unit" can be read as "means" or "circuit". For example, the determination unit can be read as a determination means or a determination circuit.

1 Information processing system 10 SV server 20 RADB
100 Information processing device 110 Communication unit 120 Storage unit 121 Threat IP list storage unit 122 CIDR cache storage unit 130 Control unit 131 Generation unit 132 Judgment unit 133 Specific unit 134 Query unit 135 Update unit

Claims (8)

Inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in the list of threat IP addresses, and of the IP address managed by the ISP. An inquiry unit that inquires about IP block information indicating the range,
If an IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information queried by the query unit, the ISP that manages the threat IP address has been queried. A specific part that identifies the ISP corresponding to the IP block information,
An information processing device characterized by being equipped with. The inquiry part is
If the IP block in the range including the threat IP address included in the list of threat IP addresses does not exist in the IP block information queried by the query unit, the threat IP address is managed for the RADB. Inquire about the ISP information indicating the ISP, and also inquire about the IP block information indicating the range of the IP address managed by the ISP.
The information processing apparatus according to claim 1. A CIDR cache storage unit that stores the ISP information and the IP block information in association with each other based on the inquiry result by the inquiry unit is further provided.
The inquiry part is
When the predetermined IP block and the IP block in the range including the predetermined IP block are acquired as a result of the inquiry, only the IP block information in the range including the predetermined IP block is stored in the CIDR cache storage unit. ,
The information processing apparatus according to claim 1 or 2. A determination unit for determining whether or not an IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry unit.
The information processing apparatus according to any one of claims 1 to 3, further comprising. An update unit that updates the CIDR cache storage unit that stores the ISP information and the IP block information in association with each other based on the inquiry result by the inquiry unit.
The information processing apparatus according to any one of claims 1 to 4, further comprising. Further equipped with a generator that generates a list of the threat IP addresses based on the threat IP address information acquired from the SV server managed by the threat IP address information provider.
The generator is
By eliminating duplication of threat IP addresses included in the threat IP address information, a list of unique threat IP addresses is generated.
The information processing apparatus according to any one of claims 1 to 5. It is an information processing method executed by a computer.
Inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in the list of threat IP addresses, and of the IP address managed by the ISP. The inquiry process for inquiring IP block information indicating the range, and
If an IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry process, the ISP that manages the threat IP address has been inquired. A specific process that identifies the ISP corresponding to the IP block information,
An information processing method characterized by including. Inquires of RADB (Routing Assets Database) for ISP information indicating an ISP (Internet Service Provider) that manages a predetermined threat IP address included in the list of threat IP addresses, and of the IP address managed by the ISP. Inquiry procedure for inquiring IP block information indicating the range, and
If an IP block in the range including the threat IP address included in the list of threat IP addresses exists in the IP block information inquired by the inquiry procedure, the ISP that manages the threat IP address has been inquired. A specific procedure to identify the ISP corresponding to the IP block information,
An information processing program characterized by having a computer execute.

Images