通過風險評估和流量分析來檢測網絡暴露

本論文深入研究了網路防禦的基本原理，威脅獵捕(Threat Hunting)的概念，涵蓋了主動檢測的幾個案例研究和可用於網路基礎設施內網路暴露的分散式檢測技術。管理風險和暴露量測是大型組織內資訊安全計劃的主要目標。在全國範圍內管理安全風險是任何國家電腦應急響應小組（CERT）或電腦安全事件響應小組（CSIRT）的主要目標。透過這項工作，我們的目標是改進即時偵查網路暴露的過程和提早發現對手的活動。威脅搜尋和主動檢測旨在縮短網路違規與檢測此類漏洞之間的時間。這種方法在對手有意避開傳統安全產品的案例中特別有效。這項工作有助於自動執行主動監控、檢測和威脅搜尋領域中的選定任務。我們設計並實作分散式雲端平台，以處理大量要處理，存儲和分析的數據。並且嘗試了解大型網路風險評估的方法，使用大型網路數據集進行實際實驗。這項工作的主要貢獻是展示如何利用威脅獵捕和大型網路基礎設施偵察的幾種非侵入性方法來衡量分析網路中的風險和網路漏洞風險。

關鍵字

網域名稱生成演算法；風險評估；網路暴露；入侵檢測；惡意軟件；流量分析

並列摘要

This dissertation dives into basic principles of network defense, concepts of threat hunting, covers several case studies of proactive detection and techniques that can be used for a scalable detection of network exposures within network infrastructure. Managing risk and exposure levels is the primary objective of an Information Security Program within a large organization. Managing security risks at a country-wide level is a primary objective of any National Computer Emergency Response Team(CERT) or a Computer Security Incident Response Team (CSIRT). With this work we aim at improving the process of timely detection of network exposures and adversary activities at earlier stages. Threat hunting and proactive detection aims at shortening time between network breach and detection of such breach. This approach is particularly effective in cases when the adversary intentionally evades traditional security products. This work helps to automate selected tasks in the domains of proactive monitoring, detection and threat hunting. A scalable cloudbased platform was designed and implemented in order to cope with massive amount of data to be processed, stored and analyzed. In this study we try to understand methods of a large network risk evaluation and conduct practical experiments using a large network datasets. The main contribution of this work is to demonstrate how threat hunting and several non-intrusive methods of a large network infrastructure reconnaissance could be used to measure risk and network vulnerability exposures within the analyzed network.

並列關鍵字

DGA ； Risk Assessment ； Network Exposures ； Intrusion Detection ； Malware ； Traffic Analysis

參考文獻

[1] A.K. Sood, R. Bansal, and R.J. Enbody, “Cybercrime: Dissecting the state of underground enterprise,”Internet Computing, IEEE, vol. 17, no. 1, pp. 60–68, 2013.