- 學位論文
運用軟體定義網路流程表阻擋物聯網環境中之攻擊
Using SDN Flow Tables to Block Attacks in IoT Environments
摘要
物聯網帶來了便利與安全，開啟人們新的世代。諸如智能冰箱、穿戴裝置以及網路監視器…等等，此類商品已經普及的在各個家庭中，因此產生出大量數據。但是隨之而來的缺失愈來愈明顯，隨著物聯網時代的序幕，網路攻擊也愈來愈普遍。此原因能夠歸咎於物聯網設備的密碼安全性不足，因此導致專門針對物聯網環境的惡意軟件能夠使用brute force取得密碼，並且惡意軟件攻擊讓該物聯網設備成為殭屍。所以隨著物聯網設備的增加，DDoS也隨之嚴重且普遍。 目前的論文大多數是採用入侵檢測系統(Intrusion-detection system, IDS)或是防火牆，偵測攻擊流量並且抵禦攻擊。但是此種做法不適用在高速的網路環境中，當面對流量龐大的骨幹網路，IDS會來不及偵測進而使未經檢測的攻擊封包到達目的主機。IDS使用規則辨識攻擊，在面對未知攻擊時不能夠防範，只能等到未知攻擊被專業人員解析，再新增規則至IDS內才能擋掉攻擊。在這之間所需的時間是以天數為單位在計算，攻擊早已經達成目的並且將病毒擴散的更廣。 本論文提出在Openflow switch上架設蜜罐(Honeypot)收集攻擊流量，並且使用機器學習進行異常檢測，透過此種方式能夠在不影響網路速度前提下，找到並防範未知攻擊。透過有效運用Flow table的功能，我們藉由匹配header來抵禦攻擊流量，而不是阻擋攻擊者的所有流量。在物聯網環境之下使用Flow table防範攻擊，不但能夠透過SDN支援更龐大的流量，也能夠減少流量形式的攻擊帶來的網路壅塞。 實驗結果證實，Flow table在面對DDoS的高流量以及短數據包的攻擊，比起IDS擁有更佳的捕獲率。在阻擋攻擊流量方面，能夠辨識出正常流量與攻擊流量的差異，而不用阻擋攻擊者的所有流量。我們提出在Openflow switch上架設Honeypot收集攻擊流量與既有文獻做法相比，可以在不延遲網路的情況下找到未知攻擊並且完成異常檢測。
並列摘要
The Internet of Things brings convenience and security and opens up new generations. Such products as smart refrigerators, wearable devices, and network monitors, etc., have been popularized in various households, thus generating a large amount of data. But the consequent lacks are becoming more and more obvious. With the prelude of the Internet of Things era, cyber attacks are becoming more and more common. This can be attributed to insufficient password security for IoT devices, which results in malware specifically targeting the IoT environment being able to use brute force to obtain passwords and malware attacks make the IoT device a zombie. Therefore, with the increase of IoT devices, DDoS is also serious and widespread. Most of the current theses use an Intrusion-detection system (IDS) or a firewall to detect attack traffic and defend against attacks. However, this method is not suitable for use in a high-speed network environment. When faced with a heavy backbone network, IDS will not be able to detect packets and cause undetected attack packets to reach the destination host. IDS uses rules to identify attacks. It cannot be prevented in the face of unknown attacks. It can only wait until the unknown attack is resolved by the professional, and then add rules to the IDS to block the attack. The time required between these is calculated in units of days, and the attack has already achieved its purpose and spread the virus more widely. This thesis proposes to set up a honeypot on the Openflow switch to collect attack traffic, and use machine learning to identify the abnormality. In this way, unknown attacks can be found and prevented without affecting network speed. By effectively using the Flow table feature, we match the headers to defend against attack traffic, rather than blocking all traffic from the attacker. Using Flow Table to defend against attacks in the IoT environment can not only support larger traffic through SDN, but also reduce network congestion caused by traffic-type attacks. The experimental results confirm that Flow table has a better capture rate than IDS in the face of DDoS high traffic and short packet attacks. In blocking attack traffic, the difference between normal traffic and attack traffic can be identified without blocking all traffic of the attacker. We propose to set up Honeypot on the Openflow switch to collect attack traffic. Compared with the existing literature, we can find unknown attacks and complete anomaly detection without delaying the network.
參考文獻
延伸閱讀
- Lin, C. H. (2017). 利用惡意封包流規則對軟體定義網路之攻擊與解決方案 [master's thesis, National Chiao Tung University]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0030-0705201811534810
- Ciou, J. Y. (2016). 基於軟體定義網路於內部網路下之有效反欺騙方法應用於分散式阻斷攻擊防護 [master's thesis, National Taiwan University]. Airiti Library. https://doi.org/10.6342/NTU201602212
- 丘文中（2016）。利用軟體定義網路(SDN)搭配資訊安全監控中心(SOC)自動化阻擋惡意活動〔碩士論文，淡江大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0002-1907201618192900
- 劉泓銘（2006）。利用路徑編碼資訊抵禦分散式阻絕服務攻擊〔碩士論文，淡江大學〕。華藝線上圖書館。https://doi.org/10.6846/TKU.2006.00705
- Liu, Y. H. (2014). A SDN-based Approach for Flow Analysis Attack [master's thesis, National Central University]. Airiti Library. https://www.airitilibrary.com/Article/Detail?DocID=U0031-0412201512021593