應用模糊推論於無線網路非參數入侵偵測系統研究

由於無線區網IEEE 802.11b/g在訊框(frame)的安全與認證上並不完整，導致攻擊者可透過偽造無線封包中的訊框內容進行攻擊。雖透過以疊積和(cumulative sum, CUSUM)為基礎的非參數序列變化點偵測演算法(non-parametric sequential change point detection, NPSCPD)統計解除認證封包量，可偵測網路環境是否遭受攻擊，但其平均偵測延遲時間(average detection delay, ADD)太長。由於無線區網受攻擊時，無線封包之訊框中的封包序列值(sequence number)會發生不正常的變化量。在本論文中建構媒介存取控制(medium access control, MAC)層的無線封包擷取與訊框內容分析系統(data acquisition and analysis system, DAAS)，並提出以適應性類神經網路(adaptive neuro-fuzzy inference system, ANFIS)為基礎，結合封包序列值變化量與非參數序列演算法進行無線區網入侵偵測，降低平均入侵偵測延遲時間。

關鍵字

無線區網；可適性類神經模糊推論

並列摘要

The intruders may attack the medium access control (MAC) layer of a WiFi network using forged de-authentication frames that cause clients to disconnect from an access point (AP). The non-parametric sequential change point detection (NPSCPD) methodology detects the de-authentication denial-of-service (DoS) attacks and maintains the average false alert rate (FAR) below a prescribed low level. But its average detection delay (ADD) is too long to efficiently provide compensation before the network is disabling. When the wireless local-area networks (WLANs) are attacked, the sequence number value in the packets varies abnormally. In this thesis, the packet collection and frame content analyzing system for the MAC layer of 802.11b/g WLAN is constructed on x86 embedded system. Based on adaptive neuro-fuzzy inference system (ANFIS) rule, the change value of the packet sequence number, de-authentication frames and the NPSCPD algorithm are used to reduce the ADD of the network intrusion detection system. Finally, the simulated observation data are used to test the FAR and ADD performance of the proposed intrusion detection system.

並列關鍵字

ANFIS ； IEEE 802.11

參考文獻

[1] W. A. Arbaugh, N. Shankar, Y. Wan, and K. Zhang, “Your 802.11 wireless network has no clothes,” IEEE Wireless Communications, Vol. 9, pp. 44 – 51, December 2002.

[2] H. Debar, M. Dacier, and A. Wespi, “Toward a taxonomy of intrusion detection systems,” Computer Networks, Vol. 3, pp. 805-822, 1999.

[3] A. Makanju, P. LaRoche, A.N.Zincir-Heywood, “A Comparison Between Signature and GP-Based IDSs for Link Layer Attacks on WiFi Networks,” Proceedings of the 2007 IEEE Symposium on Computational Intelligence in Security and Defense Applications (CISDA 2007), pp. 213 – 219, April 2007

[4] V. Alarcon-Aquino and J.A. Barria,”Anomaly detection in communication networks using wavelets,” IEE Proc. Commun., Vol. 148, pp. 355-362, December 2001.

[5] F. Feather and R. Maxon, “Fault detection in an Ethernet network using anomaly signature matching,” In ACM Sigcomm, Vol. 23, 1993.

國際替代計量

應用模糊推論於無線網路非參數入侵偵測系統研究

全文下載

主題瀏覽