支援弱點稽核與入侵偵測之整合性後端資料庫設計研究

A Study on the Design of Integrated Backend Database for Supporting Vulnerability Auditing and Intrusion Detection

陳宗裕(Tzung-Yu Chen)

指導教授 ： 黃世昆 ； 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2001年)

https://doi.org/10.6840/cycu200100445

摘要

隨著網際網路的發達，網路應用日漸普及，網路安全成為目前十分受到關注的問題。各種軟硬體若因設計上的不良或實作上的疏忽，使其含有安全方面的弱點，則這些弱點會造成系統或網路的安全漏洞，成為系統被入侵的管道。目前防範入侵的方式主要有弱點稽核與入侵偵測兩方面。弱點稽核屬於預防措施，使用者利用工具自行檢查是否使用了含有弱點的軟硬體，以便先行修補弱點或加強安全監控。入侵偵測為系統在使用期間，使用者利用程式監看網路或系統的使用情況，以各種分析方法找出可能為入侵的異常行為，通知使用者以對該異常行為採取進一步的行動。由於有弱點才有被入侵的機會，因此弱點稽核與入侵偵測必須掌握足夠的弱點資料，才能有效提昇安全。
　　弱點資料庫是目前網路上普遍的弱點資料來源，依據功能區分為三類，分別為“入侵事件與弱點通報資料管理”，“安全弱點稽核掃瞄依據之弱點資料”以及“入侵偵測比對使用的攻擊特徵資料”。這些資料庫的共同缺點在於：使用者必須在不同的資料庫間來回尋比對， 才能取得對於同一弱點的完整資訊，同時，使用者還必須具備足夠的相關技能，才能將搜集到的弱點資料應用於弱點稽核系統與入侵偵測系統之上，十分不便且缺乏效率。
　　針對這些缺點，本研究試圖整合弱點稽核與入侵偵測的資料需求，設計弱點資料模型來儲存完整的弱點資料，建立弱點資料庫；應用現有的網路代理人工具，設計資料庫後端的弱點資料擷取機制，使弱點資料庫能自動由網路上取得充足的弱點資料；並設計前端應用支援機制，使弱點資料庫能與應用程式溝通，直接支援弱點稽核系統與入侵偵測系統。在論文中，我們將說明各個機制的功能與設計上的考量及目前雛型系統的發展情況。

關鍵字

入侵偵測 ； 弱點稽核 ； 弱點資料庫

並列摘要

As Internet grows, people employ it in daily lives more and more, thus issues about network security become popular recently. If there was a poor design or negligence occurred at implementation stage of a program (e.g. software, hardware, or firmware) which made the program carry vulnerabilities, it would lead to security leaks of system which are the way the system to be intruded. Nowadays there are mainly two ways to defense against intrusions, which are “vulnerability auditing” and “intrusion detection.” “Vulnerability auditing” is one kind of precautions. Users utilize auditing tools to check if they employed some programs carried vulnerabilities, and then apply patches to those programs or monitor them in advance. “Intrusion detection” is used when a system is under operation. It monitors system and network activities to find malicious ones that could be considered as intrusions by employing some analysis methods, and notices users to take some further actions on them. Because vulnerabilities are the chances of successful intrusions, we must have enough materials for “vulnerability auditing” and “intrusion detection” to improve degree of security.
　　At present vulnerability databases are the general data sources of vulnerabilities on the Internet. According to their capabilities, there are three kinds. They are “data management of intrusion events and vulnerabilities,” “vulnerability data for security auditing,” and “attack patterns for intrusion detection.” There are common problems about these databases: users must traverse several databases on the internet to find out data about the same one vulnerability, and users also must have enough network security related skills to apply these data to their applications, that will greatly defeat the degree of security.
　　To overcome these problems, we tried to integrate the data requirements of “vulnerability auditing” and “intrusion detection” by designing a data model of vulnerability, and used which to set up a vulnerability database. Applying off-the-shelf agent tools, we designed a data retrieval mechanism to let our database have ability to automatically obtain sufficient data about vulnerabilities from Internet. We also designed an application supporting mechanism that directly connects applications and vulnerability database to feed necessary materials to vulnerability auditing systems and intrusion detection systems from our database. In thesis we described each component’s functions, including some issues during the design phase, and the current states of our prototype system.

並列關鍵字

intrusion detection ； vulnerability database ； vulnerability auditing

參考文獻

[1] Extensible Markup Language，http://www.w3.org/XML/

[4] NSA Glossary of Terms Used in Security and Intrusion Detection，SANS Institute，http://www.sans.org/newlook/resources/glossary.htm

[10] Renaud Deraison，The Nessus Attack Scripting Language Reference Guide，Version 1.0.0pre2。

[34] The Internet Engineering Task Force，IETF，http://www.ietf.org

[2] DTD school，W3C school，http://www.w3schools.com/dtd/default.asp