資安日誌管理暨惡意程式分析平台系統建置－以學校系所為例

Building a Platform System for Information Security Log Management and Malware Analysis-an Example at the School Departments

楊慶裕(Ching-Yu Yang) ； 郭家祥(Jia-Siang Guo) ； 吳信德(Hsin-Te Wu)

《資訊安全通訊》 25卷4期 (2019/11) Pp. 17-28

摘要

隨著科技時代進步，網路也提供人們許多便利性，不僅讓眾多企業帶來商機，也導致被用於犯罪的工具，使得電腦網路犯罪問題逐年累增，例如：竊取公司機密、阻斷服務攻擊、被植入惡意程式等犯罪事件發生，因此現在公司需增加一套完善的系統在犯罪事件發生後立即有效處理電腦鑑識的流程，一但犯罪事件發生，需要有追蹤犯罪電腦之作業程序的能力及技術，可以在最短的時間有效及快速地找到公司內部來源端電腦及犯罪者。本文提出的系統是由三種不同軟體所組成，先將犯罪者的電腦系統備份，並對備份完成的系統進行蒐集、分析Log、索引查詢，簡化過去繁鎖且沒效率的調查工作，並透過Cuckoo Sandbox沙盒分析，了解程式執行動向進而產生文件報表。

關鍵字

資訊安全 ； 網路安全 ； 惡意程式分析 ； Docker平台 ； ELK套件

並列摘要

With the advances in the technology era, the Internet has provided tremendous convenience. Apart from bringing business opportunities for enterprises, the Internet has also become a criminal tool for unscrupulous people, which has increased the problem of cybercrime year by year, such as stealing confidential information, denial-of-service (DoS) attacks, malware implantation, and relevant crimes. Therefore, enterprises are suggested to install a comprehensive system that could implement the process of digital forensics effectively and immediately right after encountering a cybercrime. Once a cybercrime happened, it requires a processing system with sufficient capability and techniques to track the computers that involve in the crime, which enables the company to find the source computer internally and the criminal efficiently and effectively in the shortest time. The system this study offers consists of three different kinds of software, it back the computer system of the criminal up and conduct investigation processes of searching, analyzing logs, and index scanning; the system simplifies the old cumbersome and inefficient investigation process to understand the execution tendencies of the software and produce reports through Cuckoo Sandbox Analysis.

並列關鍵字

Information Security ； Network Security ； Malware Analysis ； Docker Platform ； ELK Stack

參考文獻

Borkar, A. Donode and A. Kumari, “A survey on Intrusion Detection System (IDS) and Internal Intrusion Detection and protection system (IIDPS)”, 2017 International Conference on Inventive Computing and Informatics (ICICI), 2017.

J. V. A. Sukumar, I. Pranav, M.M. Neetish and J. Narayanan, “Network Intrusion Detection Using Improved Genetic k-means Algorithm”, 2018 International Conference on Advances in Computing, Communications and Informatics (ICACCI), 2018.

Y. Gong, S. Mabu, C. Chen, Y. Wang and K. Hirasawa, “Intrusion detection system combining misuse detection and anomaly detection using Genetic Network Programming”, 2009 ICCAS-SICE, 2009.

W. Li, Y. Meng, and L.-F. Kwok, “Enhancing Trust Evaluation Using Intrusion Sensitivity in Collaborative Intrusion Detection Networks: Feasibility and Challenges”, 2013 Ninth International Conference on Computational Intelligence and Security, 2013.

R. Lupu, R. Badea and I. C. Mihai, “Agent-based IDMEF alerting infrastructure for distributed intrusion detection and prevention systems: Design and validation”, 2016 International Conference on Communications (COMM), 2016.