運用異質資訊提升入侵警報正確率

Improving the Efficiency of Intrusion Alarm with Heterogeneous Information Sources

陳鴻吉(Hong-Ji Chen)

指導教授 ： 黃世昆 ； 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2004年)

https://doi.org/10.6840/cycu200400144

摘要

隨著入侵偵測系統日漸受到重視，使用管理上也出現許多問題，如為了提高偵測率，管理者往往必須提高偵測元件的敏感度，但相對的，卻造成警報數量過多的情況。在大量的警報中誤報通常占有相當大的比例，管理者需要仔細檢視才能從中得到有用的資訊，對管理人員而言是相當沉重的負擔，另一方面，攻擊者也可能利用大量的誤報來干擾判斷，以達到欺騙入侵偵測系統的目的。因此，要如何提升入侵警報的正確率是在提升偵測率之後所要面對的一個問題。
通常誤用偵測所定義之攻擊特徵僅限於單一資訊，如網路資訊或主機資訊，而經由單一資訊所產生的警報，由於針對某些攻擊無法精確做出判斷，所以誤報比例相對升高。在本篇論文中，我們針對誤用偵測之網路型入侵偵測系統建立一個警報過濾機制。經由分析，我們找出攻擊成功時所需具備的環境條件或所會呈現的各種不同來源性質的攻擊特徵，入侵偵測系統可據此於發現疑似入侵時，加以即時確認查核。藉由這些異質資訊，可明顯減少誤報的發生，並且不至於將重要的警報給刪除。

關鍵字

異質資訊 ； 誤用偵測 ； 警報過濾 ； 減少誤報 ； 入侵偵測

並列摘要

As the role of intrusion detection systems become more and more important to network security, many managerial problems emerge. One among the most concerned is the alarm flooding problem. In order to achieve high detection rate, system administrators often set the sensitivity level of IDS to high, which inevitably resulted in a huge number of alarms with false alarms occupying sizable proportion. On one hand, administrators need to inspect carefully to discover useful information from them, which is a heavy burden to the administrators. On the other hand, attackers may make use of the large amount of false alarms to obstruct the detection process and deceive intrusion detection systems. Therefore, after achieving high detection rate, how to improve the detection efficiency of intrusion detection systems and effectively reduce the number of false alarms becomes a vital problem to face. In intrusion detection systems adopting misuse detection methods, the attack signatures are mostly characterized with information from single data source: for examples, the packet information from the network or the resource utilization information from the host. Without utilizing other available information, the accuracy of judgment made in generating alarm may not be satisfactory. In this thesis, we propose an alarm filtering scheme to improve the efficiency of misuse-type network intrusion detection system. Through careful analysis, a preliminarily recognized attack threat can be verified against heterogeneous data sources in determining if an attack may really succeed before it is reported. The proposed scheme has been implemented. Experiment result shows that, with the heterogeneous information, the occurrences of false alarm are obviously reduced and none of the real alarms are among those non-reported ones.

並列關鍵字

Intrusion Detection ； Heterogeneous Information ； Alarm Filtering ； False Alarm Reduction ； Misuse Detection

參考文獻

[17] 陳宗裕，支援弱點稽核與入侵偵測之整合性後端資料庫設計研究，中原大學研究所，碩士論文，中華民國九十年七月。

[2] Erwan Lemonnier, ”Guidelines for a Long Term Competitive Intrusion Detection System,”

[4] Tedesco G. and Aickelin U,”Adaptive Alert Throttling For Intrusion Detection Systems,”2003,

[5] G. Woodruff, R. Rogers, and P. Richards, “A congestion control framework for high-speed integrated packetized transport,” IEEE Globecomm 88, 1988,pp. 7.1.11.1.5.

[6] Klaus Julisch, "Dealing with False Positives in Intrusion Detection", extended abstract at RAID 2000, Toulouse, October 2000.