運用線上訓練以達成軟體定義網路之即時入侵檢測

Achieving Real-Time Intrusion Detection in SDNs by On-Line Training

吳冠霖(Kuan-Lin Wu)

指導教授 ： 莊博任

淡江大學/工學院/電機工程學系碩士班/碩士(2019年)

https://doi.org/10.6846/TKU.2019.00819

摘要

在軟體定義網路（Software-Defined Network，SDN）中容易受到傳統網路中大多數攻擊的影響。因此，將入侵檢測系統（Intrusion Detection System，IDS）融入SDN結構中來應對網絡攻擊提供對策是至關重要。現有SDN異常檢測系統的研究中，他們的分類器皆為採用監督學習的方法去訓練分類器。在IDS實際應用當中，所接收到的數據是不會有標籤存在的，而IDS必須經由舊有的攻擊模式嘗試辨識出未知攻擊。而使用監督學習的方法只會使用標籤樣本進行訓練，無法在應用當中使用線上的數據重新訓練。所以不能使用監督學習的訓練機制應用在應用中異常檢測系統上，因為它無法應用線上數據使系統自行適應新種類攻擊。根據線上訓練的問題，半監督式學習的訓練方法是個達成線上訓練異常檢測系統的分類器的解決辦法。現有半監督式學習法有自我學習(Self-Learning)與自我訓練(Self-Training)等方法。
本文中我們提出使用自我訓練混合主動學習(Active Learning)的機制。對高信心權值的樣本集當中被分類為惡意的樣本以隨機挑選加入訓練集當中。加入主動學習的訓練機制其原因是有主動學習之後能對低信心權值的樣本進行標籤並引入至訓練集當中訓練，使分類器有更高的準確率，不會有錯誤識別為攻擊率(False positive rate, FPR)大量上升的情況發生。為了加快訓練機制，我們使用較快的聚類方法，以降低主動學習部分所需要的運作時間。在重新訓練分類器上，我們採取並行訓練分類器，不停擺正在服役中的分類器，以無縫隙的方式使分類器替換。並且在偵測到攻擊時能即時對應防範。
我們在模擬階段證實此訓練方法能有效的提升未知攻擊的辨識能力。在時間方面，此訓練方法不會占用檢測系統的運作時間，因為訓練部分與檢測系統是屬於並行處理，分類器更換時也不會導致分類器停止運作。在實作階段，我們證實此方法對於實際運作上能有效的對未知攻擊作防範，就算一開始沒辨識出也會依照訓練法更新，學會未知攻擊的辨識並成功防範，達成即時檢測攻擊。

關鍵字

軟體定義網路 ； 入侵檢測系統 ； 流程表 ； 規則生成 ； 機器學習 ； 異常檢測 ； 攻擊檢測 ； 電腦網路安全

並列摘要

Software-defined networks (SDN) are susceptible to most of the attacks found in traditional networks. Therefore, Intrusion Detection System (IDS) integrated into the SDN structure to provide Intrusion countermeasures is important. In the study of existing SDN anomaly detection system, their classifiers all adopt the method of supervised learning to train the classifiers. In the practical application of IDS, there is no tag for the received data, and IDS must try to identify unknown attacks through the old attack mode. However, the method of supervised learning only uses labeled samples for training, and cannot use online data for retraining in application. Therefore, the training mechanism of supervised learning cannot be applied to the practical anomaly detection system, because it cannot apply online data to make the system adapt to new types of attacks. According to the problem of online training, the training method of semi-supervised learning is a solution to achieve the classifier of online training anomaly detection system. The existing semi-supervised Learning methods include self-learning and self-training.
In this paper, we propose the mechanism of using self-training mixed Active Learning. For the samples with high confidence weights were classified as malicious samples, we add them to the training set by random selection. The reason for using the training mechanism of active learning is that after active learning, samples with low confidence weights can be labeled and added to the training set for training, so that the classifier has a higher accuracy rate, and there will not be a large increase in false positive rate(FPR). In order to speed up the training mechanism, we use a faster clustering method to reduce the operation time of the active learning part. On the retraining classifier, we adopt the parallel training classifier, keep the classifier in service, and replace the classifier in an uninterrupted way. And when an attack is detected, it can be immediately defended.
We proved in the simulation stage that this training method can effectively improve the identification ability of unknown attacks. In terms of time, this training method will not occupy the operation time of the detection system, because the training part and the detection system are processed in parallel, and the classifier will not stop when the classifier is replaced. In the implementation stage, we proved that this method can effectively prevent unknown attacks in practical operation. Even if it is not identified at the beginning, it will be updated according to the training method to learn how to identify unknown attacks and successfully prevent them, so as to achieve real-time detection attacks.

並列關鍵字

Software Defined Networks(SDNs) ； Intrusion Detection System(IDS) ； Flow table ； Rule generator ； Machine learning ； Anomaly detection ； Attack detection ； Computer network security

參考文獻

[1] N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, “OpenFlow,” ACM SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, Mar. 2008, p. 69.

[2] 王協源, 鄭力維, 張華婷, “軟體定義網路技術簡介及發展趨勢,” NCP Newsletter, no.57, November .2013.

[3] “ONF White Paper.” [Online]. Available: https://www.opennetworking.org/images/stories/downloads/sdn-resources/white-papers/wp-sdn-newnorm.pdf.

[4] 廖振宇, “以軟體定義網路改善Hadoop叢集之運作效能,” June.2015

[5] “OpenFlow Switch Specification, version 1.3.4.” [Online]. Available: https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-switch-v1.3.4.pdf.