入侵偵測系統分析方法效能之定量評估

A Quantitative Performance Evaluation on Intrusion Detection Analysis Methods

李駿偉(Chun-Wei Lee)

指導教授 ： 黃世昆 ； 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2002年)

https://doi.org/10.6840/cycu200200377

摘要

一般入侵偵測(Intrusion Detection)模式可分為兩類，包括異常偵測(Anomaly Detection)與誤用偵測(Misuse Detection)。影響後者偵測效能的因素是必須蒐集足夠多的攻擊樣式（Attack Signature）。影響前者偵測效能的因素有二：一為訂立適當偵測特徵(Feature Selection)，二為分析工具選取(Detection Analysis Method)。
適當特徵選取除了影響偵測效能外也關係整體系統執行效率，一旦選取錯誤或非必要的特徵，將造成系統額外負荷而降低執行效能，也無益於分析法的運用。本論文因此採用資料探勘(Data Mining)之特徵分類技巧，針對不同入侵型態動態選擇最適合特徵。
在選取分析法上，主要為了建立環境行為模式(Environment Behavior Model )以建構異常偵測模組，並針對此行為模式整理出常規性法則藉以判斷入侵。我們分別針對各種分析工具完成系統實作、同時進行實驗探討分析其面對不同入侵之偵測效能優劣，包括類神經網路、模糊理論、有限狀態機、貝氏網路等演算法。
為了具體評估不同分析方法對各種入侵行為之偵測能力，我們研究各種入侵種類及其技術，設計實驗探討分析方法與入侵偵測能力之關係。本論文針對Port-Scan及SYN-Flooder兩種攻擊類型進行實驗分析，透過定性與定量分析探討影響入侵偵測效能之主要特性，藉此找出最適合的分析方法。

關鍵字

類神經網路 ； 貝氏網路 ； 異常偵測 ； 資料探勘 ； 有限狀態機 ； 模糊理論 ； 環境行為模式 ； 入侵偵測系統

並列摘要

We can model intrusion detection behaviors as two different categories, including anomaly detection and misuse detection. Major consideration for a good misuse detection system is to accumulate enough attack signatures; while the performance of anomaly detection is largely influenced by two factors: one is how to set up good section rules for the detection features; another is to design and implement analysis tools to determine the deviation apart from the normal or abnormal behavior.
Choosing good detection features will not only have impact on the detection performance, but also on the overall execution efficiency. Improper selection of features will render extra overhead to the system and can’t benefit to the deployment of analysis tools. We adopt data mining approach to classify features and dynamically adapt to the most suitable one.
On analysis tool selection, we focus on the environment behavior model. Constructing anomaly detector and as a set of normal behaviors for judging intrusions. We have fulfilled a system implementation and conduct experiment for analyzing detection performance of different tools, including neural network, fuzzy logic, finite state machine, and Bayesian network.
In order to evaluate the detection performance of different analysis tools, we study different inclusion types and assess their relationship between analysis methods and intrusion detection performance. We focus on Port-Scan and Syn-Flooder attacks to conduct the evaluation tests. By qualitative and quantitative analysis, we explore their influence on the detection response and find out the most suitable analysis methods.

並列關鍵字

Finite State Machine ； Neural Network ； Fuzzy Logic ； Anomaly Detection ； Bayesian Network ； Intrusion Detection System ； Environment Behavior Model ； Data Mining

參考文獻

[24] 張良豪。「入侵偵測系統快速原型架構」。碩士論文，私立中原大學，民90。

[1] Iguchi, M. and Goto, S., “Network surveillance for detecting intrusions”, Internet Workshop, 1999. IWS 99, Waseda Univ., Tokyo, Japan, pp. 99-106.

[3] Staniford, S., Hoagland, J.A. and McAlerney, J.M., “Practical Automated Detection of Stealthy Portscans”, Silicon Defense, 513 2nd Street Eureka, CA 95501.

[8] Ilgun, K., Kemmerer, R.A. and Porras, P.A., “State Transition Analysis: A Rule-Based Intrusion Detection Approach”, IEEE Transaction on Software Engineering, VOL.21 No.3, March 1995.

[11] Pikoulas, J., Buchanan, W.J., Mannion, M. and Triantafyllopoulos, K., “An agent-based Bayesian forecasting model for enhanced network security”, Proceedings of Eighth Annual IEEE International Conference and Workshop, Engineering of Computer Based Systems, 2001. ECBS 2001, pp. 247-254.