以資料探勘技術改善國軍網路入侵偵測效能之研究

The Study on Improving Intrusion Detection Efficiency of the Military Internet by the Technique of Data Mining

吳文進(Wen-Chin Wu)

《復興崗學報》 92期 (2008/12) Pp. 177-211

https://doi.org/10.29857/FHKAJ.200812.0008

摘要

資訊及通訊科技的快速發展與普及化，已成為生活與工作中不可或缺的重要工具，不論政府機關（構）、企業組織乃至於個人用戶，對電腦與網路的依賴日趨緊密，但相對所引發的資通安全防護問題卻益顯嚴重。因應數位時代的來臨，政府部門自1994年起陸續推展「數位台灣」相關計畫，並於2008年3月首度發表「資通安全政策白皮書」，揭示資通信科技發展與資通安全政策要求應同步與時推移之決心。國軍屬政府機關一環，在資訊化、自動化建軍理念引領下，不容置外於資通安全政策規範，尤其因應戰備任務需求與國軍網路機敏特性，除厲行「實體隔離」政策以實現「資訊邊疆」保護概念之外，更應採行「保護－偵測－反應－復原」四個風險管控策略來有效防堵資通安全防護缺口。
在眾多資通安全防護機制中，入侵偵測系統可以有效偵測入侵滲透及人員濫（誤）用行為，並能提供適切的補償控制措施與建議，符合風險管控保護、偵測及反應之防護策略，可視為國軍落實資通安全政策要求與落實執行之重要機制。為結合現階段國軍需求，發展專用之入侵偵測系統以確保國軍網路安全，本研究深入分析入侵偵測系統運作之架構，從封包偵測效能瓶頸點，尋思結合資料探勘技術與前置封包分類器來改善偵測效能，經實驗證明，利用資料探勘技術實作前置封包表頭分類器的確可以改善封包比對效能不佳與正確率低等問題，而在多種分類器演算法中，又以倒傳遞類神經網路最佳，其正確率92.704%稍低於約略集合理論92.867%，但執行速度可增加約112.95倍，同時還兼具偵測未知攻擊的能力。本研究除能為國軍落實資通安全防護提供更多的選項之外，前置封包分類器的實作亦能使國軍實現資通安全無虞之目標更邁向前一步。

關鍵字

入侵偵測 ； 倒傳遞類神經網路 ； 資料探勘 ； 網路安全 ； 資訊安全

並列摘要

Intrusion detection system can effectively detect intrusion, penetration and the misuse behavior by staff as well as appropriately apply for compensation measure, control measure, and suggestion to fit the protection strategy of risk control and prevention, detection and reaction in the midst of the information and communication security mechanism. Intrusion detection system is an important mechanism to request and perform the information and communication security policy for military. The study is to analyze the operation framework of intrusion detection system for finding the bottleneck of intrusion detection system efficiency in order to help the military build a personalized intrusion detection system to protect military networks. Setting packet classifier and head classifier before using the technique of data mining could improve poor efficiency of compare package and low accuracy through the evidence from experiments.
Back Propagation Neural Network（BPN） is the best one of the multiple classifier algorithm, and its accuracy is up to 92.704% roughly lower than Rough Set Theory (RST) is up to 92.867%; however its executed velocity could increase some 112.95 times and detect the unforeseen the attacking ability. Therefore, the study is not only to apply for more choices to perform information and communication protection but also to help the military to reach the goal about the nest step in the future of not leaking the military information and communication.

並列關鍵字

intrusion detection ； back propagation neural network ； data mining ； internet security ； information security