弱點資訊管理系統之設計與實作

隨著電腦與電腦網路的普及，電腦安全受到越來越多的注意。在眾多的電腦安全問題中，網路與系統入侵事件發生日漸頻繁而廣泛，所造成的經濟損失日益嚴重。因此入侵偵測在電腦安全防護機制中的重要性與日遽增。所以入侵偵測系統後端弱點資訊管理系統的建置與應用相形重要。入侵行為要能造成對安全的威脅必然要運用網路或系統的弱點，相對地要偵測俱威脅力的入侵行為的發生也是要查核網路流量與系統運作中是否有運用弱點的行為，所以入侵偵測系統需要對弱點資訊有充分的掌握。目前已有許多資訊安全單位在做弱點資訊發現、蒐集及整理的工作，因此能在弱點資訊公開時自動取得弱點資訊的內容，並將此內容納入機構中入侵偵測系統的偵測範圍，就能增進入侵偵測系統運作效能，並在補強程式尚未產生前的空窗期防範入侵行為對系統造成損害。基於這樣的了解，我們設計了一個弱點資訊管理架構，管理弱點資訊從自動化收集、多重資訊的整合、運用於入侵偵測到評估個別弱點週期循環的進程並分析此弱點被運用程度的過程，我們已完成這個管理架構的實做系統，實際地驗證這個管理系統架構是可以有效的改進系統的安全防禦能力，並能對個別弱點產生的安全危害量化，使得更進一步的安全分析成為可能。關鍵字：弱點資料庫、弱點生命週期、弱點資料庫評估。

關鍵字

弱點資訊管理系統

並列摘要

With the prevalence of computer and computer network, computer security has gained more and more attention. Among all the computer security incidents, the occurrences of instruction to computer systems and networks has become highly frequent and extensive, which results in serious damage financially and makes intrusion detection an important sector in the overall computer security protection mechanism. Consequently, the vulnerability information management system supporting the operations an instruction detection system becomes more and more important. As the security of a system or a network is only threatened by instruction activities exploiting its vulnerabilities, the detection of such activities can be achieved by monitoring the system operations or the network traffic to see if any vulnerability is being exploiting. Therefore, an effective misuse-based intrusion detection system needs to have its knowledge to vulnerabilities up to date. With many computer security organization discovering, collecting, and organizing vulnerability information, being able to automatically obtain the vulnerability information once it is publicized and apply it to enhance the detection capability of an intrusion detection system will improve the effectiveness of the intrusion detection system and protect the computer environment from loss before a patch to the vulnerability is available. With this understanding, we proposed a vulnerability information management framework managing operations from automatic information collection, integration and automated application to intrusion detection, to the evaluation of a vulnerability’s progression in its life cycle and the analysis of the extent the vulnerability was exploited. A system adapting this management framework has been implemented. Experiment result shows that the defense capability of a computer environment can be effectively enhanced. In addition, the potential threat of a vulnerability is quantized, which makes further analysis on security possible. Keyword: vulnerability database, vulnerability life cycle, vulnerability evaluate.

並列關鍵字

Vulnerability Information Management System

參考文獻

[2] 陳宗裕，「支援弱點稽核與入侵偵測之整合性後端資料庫設計研究」，中原大學資訊工程研究所，碩士論文，中華名國90年七月。

[13] Renaud Deraison.The Nessus Attack Scripting Language Reference Guide，Version 1.0.0 , pre2 .

[31] World Wide Web Consortium , (28 Dec 2001)

[32] Huang, Hung-Hsuan，Web Navigation Description Language，IIS Sinica，2 Aug 2000。

[40] Victor C. S. Lee John A. Stankovic, and Sang H. Son , “Intrusion Detection in Real-time Database Systems Via Time Signatures“ , Proceedings of the Sixth IEEE Real Time Technology and Applications Symposium (RTAS 2000) , 2000

國際替代計量

弱點資訊管理系統之設計與實作

未授權

主題瀏覽