雲端環境下基於入侵警報關聯性之動態網路鑑識分析系統

為了取得網路犯罪的證據，網路鑑識這門技術逐漸受到重視，現今主要的網路鑑識方法大多是事後人工的分析，此方法尤其在大量網路流量的雲端環境下十分耗時，因此，網路鑑識的自動化是個不可或缺的任務。本論文中，我們提出一個於雲端環境下的動態網路鑑識系統，當遭受攻擊時，此系統會在最短的時間內盡可能地蒐集證據。我們在論文中使用一個基於特徵碼的入侵偵測系統Snort，當作一個監視網路活動的工具。另外，本論文也提出一個兩階段式分析方法，能根據入侵警報分析網路資料。此論文的目標包括動態地蒐集相關證據、嘗試找出基於特徵碼的入侵偵測系統所偵測不到的攻擊，以及減少資料量來節省儲存空間。在實驗中，我們使用知名的數據集來測試系統，並呈現在不同入侵偵測系統的設置下，此系統分析結果的差異。實驗結果顯示我們的分析方法能夠有效率地萃取相關證據，並在跟相關研究的比較之下，更有效的節省空間。

關鍵字

網路鑑識；入侵檢測；警報關聯

並列摘要

In order to confirm network criminals, network forensics techniques have become more and more important. Current network forensic approaches are primarily static and post-mortem investigation which is time-consuming with massive network traffic, especially in cloud environments. Therefore, the automation of network forensics turns into an essential task. In this thesis, we proposed a dynamic network forensics system for cloud environments to gather evidence as soon as possible. We use the popular signature-based Intrusion Detection System (IDS), Snort, as a network forensic tool to monitor network activities. Moreover, we propose a two-phase analysis approach to automatically analyze the network data based on intrusion alerts. In brief, the objectives of our approach include collecting relevant evidence dynamically, trying to discover the attacks missed by the signature-based IDS, and reducing data storage required to keep the evidences. In the experiments with well-known data sets, the performance of our approach under different IDS configuration has also been analyzed and presented in this thesis. The experimental results show that our analysis approach has ability to automatically extract relevant evidence and save more storage space.

並列關鍵字

Network Forensics ； Intrusion Detection ； Alert Correlation

參考文獻

[1] V. Paxson, "Bro: a system for detecting network intruders in real-time," Computer Networks, pp. 2435-2463, 1999.

[5] W. Ren and H. Jin, "Distributed Agent-based Real-time Network Intrusion Forensics System Architecture Design," in Proceedings of the 19th International Conference on Advanced information Networking and Applications, New York, 2005, pp. 177-182.

[7] J. O. Nehinbe, "Log analyzer for network forensics and incident reporting," in 2010 International Conference on Intelligent Systems, Modeling and Simulation, 2010, pp. 356-361.

[8] F. Raynal, Y. Berthier, P. Biondi, and D. Kaminsky, "Honeypot forensics part 1: analyzing the network," IEEE Security & Privacy, vol. 2, pp. 72-78, August 2004.

[9] T. BASS, "Intrusion detection systems and multisensor data fusion," Communications of the ACM, vol. 43, pp. 99-105, April 2000.

國際替代計量

雲端環境下基於入侵警報關聯性之動態網路鑑識分析系統

全文下載

主題瀏覽