應用虛擬化技術於分散式異常流量偵測系統之設計

A Design of Distributed Abnormal Traffic Detection System by Applying Virtualization Technology

張彥文(Yen-Wen Chang)

指導教授 ： 林錦財

崑山科技大學/資訊科技學院/數位生活科技研究所/碩士(2011年)

https://doi.org/10.6828/KSU.2011.00035

摘要

本論文以Web Service技術來設計與開發動態異常偵測平台，此平台是針對大流量網路架構下之異常流量偵測與分析。本文將每種異常偵測方法定義為一種服務，並以Web Service實作，可使網管人員依情況客製化調整，針對各種新型攻擊，可額外開發並彈性啟用不同的偵測服務。在大流量環境下，本文透過虛擬化技術來管理分散式系統的基礎建設，結合資料庫讀寫分離機制，使偵測平台能對Netflow資料庫資料進行分散式查詢，減輕對單一資料庫存取負擔，以提升整體分析速度效益。

關鍵字

虛擬化 ； Ｗeb服務

並列摘要

This paper uses Web Service technology to design and develop a dynamic detection platform. The platform focuses on the detection and analysis of anomaly traffic for large network flow architecture. This article will define each type of anomaly detection methods as a service that is implemented by Web Service technology. The framework has the flexibility that allows administrators to adjust the resources according to the circumstance variation by enabling or disabling different detection services, and add new services to accommodate a variety of new attacks. To deal with the large network flow environment, we use virtualization technology to manage the traffic database through a distributed system infrastructure. Combined with the library of read/writing splitting mechanism, the system can distribute queries of Netflow data to different agents to share the access burden of a single database and improve the overall analysis speed and efficiency.

並列關鍵字

Virtualization ； Web Service

參考文獻

[15]蔡佳帆，“虛擬化技術之績效測試比較”， 碩士論文，淡江大學資訊管理學系，2008

[30]蔡旭昇、吳億修，“植基於雲端運算架構之即時網路流量監控分析”， Conference on Information Technology and Applications in Outlying Islands, 2010

[6]Paul F. Roberts, “DOJ Indicts Hacker for Hospital Botnet Attack”, http://www.eweek.com/c/a/Security/DOJ-Indicts-Hacker-for-Hospital-Botnet-Attack/

[1]馬培治，“中國駭客攻擊遊戲網站 脅迫配合宣傳”, http://www.zdnet.com.tw/news/web/0,2000085679,20129046,00.htm

[2]Cellopoint，“Cellopoint 2010年電子郵件安全下半年度預測分析”，http://www.ithome.com.tw/itadm/article.php?c=61586