摘要
電腦科技應用的普及與網際網路技術的蓬勃發展，越來越多的使用者透過網路來傳遞或儲存重要的資料。隨著使用者的增加，駭客攻擊、竊取個資的事件頻傳，攻擊的手法也不斷地更新，入侵偵測系統（Intrusion Detection System，IDS）為最常被用來保護系統的安全。本論文是以虛擬機器監控層的具擴展性的入侵偵測與防禦系統（Virtual Machine Monitor based Extensible Intrusion Prevention System，VMM-EIPS）為基礎，我們擴展它的模組化架構，讓此系統同時具備誤用偵測與異常偵測功能的架構。我們亦設計與實作新的功能元件，可以偵測IDS Evasion攻擊與非偽裝IP的TCP SYN Flood攻擊的功能元件，我們將所實作的系統重新命名為EIPS^+。此外，我們也增加了檢測封包後的回應機制，使得EIPS^+系統的防禦與回應功能變得更加完善。我們的EIPS^+系統是實作成Linux核心模組，掛載在Linux Kernel的網路封包過濾子系統Net- Filter的PREROUTING掛勾點上，可以檢測所有進入系統的網路封包，檢測完成後再根據檢測的結果給予相對應的回應。實驗結果顯示我們所新增的檢測IDS Evasion技術的功能元件可以有效地偵測到相關的IDS Evasion的攻擊，且新增的檢測TCP SYN Flood攻擊的功能元件，亦可以有效地檢測出非偽裝IP的阻斷服務（Denial-of-Service，DoS）攻擊。在效能評估方面，與著名的開放原始碼的IDS-Snort相比，EIPS^+對系統效能只降低了0.9%~3.9%，而Snort則是降低了6.8%~20.6%，結果證明運作於核心層級的EIPS^+因為不需要在不同的Protection Domain中轉換，以及減少了封包複製的動作，所以對系統效能影響較小。
並列摘要
As the popularity of computer applications and the rapid development of Internet technology, more and more users transmit or store important information through the internet. However, with the increase in the users, accompanied by hacker attacks, hacking techniques are diverse and constantly updated. Intrusion Detection System (IDS) is most commonly used to protect the system security. This paper is based on the research, the Virtual Machine Monitor Based Extensible Intrusion Prevention System (VMM-EIPS), we have expanded its modularized architecture to enable misuse detection and abnormal detection. We have also designed and implemented new functional components for the detection of IDS evasion attacks and TCP SYN flood attack with non-forged IPs. The system is then renamed to EIPS^+. Besides, we have also added reaction mechanisms into EIPS^+ to make its intrusion prevention and responding to attacks more complete. Our EIPS+ is implemented as a Linux kernel module which is registered and mounted at the PREROUTING hook of Netfilter, i.e. Linux kernel's network subsystem for packet filtering and processing. It can examine all network packets incoming to the system. The experimental results show that our newly developed detecting components can effectively detect the associated IDS evasion attacks, and detect whether the system is under TCP SYN flood attack with non-forged IPs. Compared with the well-known open-source IDS - Snort, the system performance with EIPS^+ degrades only 0.9%~3.9%, whereas, because EIPS^+ does not need to switch protection domains and reduces the packet copy operation, so it obtains better performance. With Snort system performance degrades 6.8%~20.6%.
延伸閱讀
- Chen, M. J. (2015). 網際網路服務之多層入侵防禦系統架構設計 [doctoral dissertation, National Chung Cheng University]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0033-2110201614033384
- Liu, C. Y. (2015). 高安全性控制與網路系統之異質性 模型化基礎平台開發 [master's thesis, National Taipei Uinversity]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0023-1005201615095327
- 陳孟志（2013）。平行化比對之網路入侵偵測防禦系統〔碩士論文，國立中正大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0033-2110201613562516
- 伊遠正（2020）。模組化核心層級入侵偵測與防禦系統以及使用RPS/RFS機制提升效能的研究〔碩士論文，國立暨南國際大學〕。華藝線上圖書館。https://doi.org/10.6837/ncnu202000019
- 黃國睿（2007）。基於多核心處理器之網路入侵防禦系統之設計〔碩士論文，國立清華大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0016-1411200715162370