適用於網頁伺服器之應用型入侵偵測系統

An Application-Based Intrusion Detection System for Web Server

王茂吉(Mao-Ji Wang)

指導教授 ： 田筱榮 ； 黃世昆

中原大學/工學院/資訊工程研究所/碩士(2003年)

https://doi.org/10.6840/cycu200300147

摘要

網際網路蓬勃發展的今日，藉由網頁伺服器來傳遞或處理各種資訊，早已成為人們不可或缺之溝通方式，也是目前最常用之網路服務類型，同時也是最常遭受攻擊之服務類型，加上網路攻擊手法日新月異、弱點資訊取得容易、系統管理者未能及時修補漏洞、程式設計者一時疏忽…等各項因素；造成現今諸多攻擊手法可以很容易的被實現；然而多數之入侵偵測系統是以入侵特徵規則作為偵測基礎，僅能對已知之弱點作有效之偵測，除對於新式攻擊無法作立即偵測或預防外，更無法適時偵測出網站內因本身服務程式(ex:cgi、php...)之設計缺失所導致之資料外洩或是竄改等問題。
在本論文中，我們提出一個適用於網頁伺服器之應用型入侵偵測模組，將偵測模組直接嵌入於網頁伺服器中；以『異常行為偵測』為主，並配合使用者點選之行為模式，定義合法請求，過濾異常請求；以『錯誤行為偵測』為輔；確認攻擊類型。藉此，預防新型攻擊行為與偵測已知攻擊事件，同時可於發現入侵的同時，立即中斷回應，以提高系統之安全性，防止重要資料外洩或竄改，最後並針對此系統作一實驗比較。

關鍵字

入侵偵測系統 ； 應用型入侵偵測系統 ； 網頁入侵 ； 異常行為偵測 ； 錯誤行為偵測

並列摘要

Word Wide Web has become the new way of communication today and is the most attack service of network. Besides the known vulnerabilities, more application-level web securities have been exploited recently, such as parameter tampering, application buffer overflow, and forceful browsing etc. They usually refer to vulnerabilities inherent in the code of a web-application themselves. Unfortunately, they can’t be detecting by tradition intrusion detection system effective.

In this paper we take both the anomaly and misuse detection which address the problem of application-level web security. Our system is based on Application-Based intrusion detection system, and the protection module is embedded directly in the web server. In order to define all the valid requests for anomaly detection, we use the techniques which observe the users’ click behaviors and generate their personal policies dynamically. In other hand, we transformed the snort signatures as misuse detection. They can not only pass the valid request but also defend the new attack behavior and detect the old attack event with the method. Finally, we report the results and experience arising from our implementation of these techniques.

並列關鍵字

Intrusion Detection System ； Misuse Detection ； Application-Level web security ； Anomaly Detection ； Web Attack ； Application Based Intrusion Detection System

參考文獻

[ 6. ] Chris Prosise and Saumil Udayan Shah, “Optimizing Web Server Logging”, Web Building Security Issues. November 2000

[ 8. ] David Scott, Richard Sharp, “Abstracting Application-Level Web Security”, WWW 2002, May 7-11, 2002, Honolulu, Hawaii, USA. ACM 1-58113-449-5/02/0005.

[ 9. ] Chen Ding, Chi-Hung Chi, Jing Deng, and Chun-Lei Dong, “Centralized content-based Web filtering and blocking: how far can it go?” IEEE International Conference on , Volume: 2 , 1999

[ 16. ] “The Linux Intrusion Detection System (LIDS) “,http://www.lids.org/

[ 19. ] James Mendelsohn “Successful Deployment of an Intrusion Detection System”, February 28, 2001.