- 學位論文
以異常行為偵測為基礎之電子郵件蠕蟲防護架構
An Anomaly Behavior Based Email Worm Protection Framework
摘要
電腦蠕蟲(Worm)是一種透過網路傳播的自主程式，隨著網際網路的普及，這種技術也遭電腦駭客運用為傳播惡意程式的方法，其中，使用電子郵件進行散佈的電子郵件蠕蟲(Email Worm)，已成為目前數量最多的蠕蟲類型，因此，如何防護電子郵件蠕蟲，是資訊系統安全維護非常重要的課題之ㄧ。一般部署在郵件伺服器的特徵比對型偵測系統(Signature-based detection system)無法在系統遭受未知的電子郵件蠕蟲攻擊時提供保護；異常偵測型系統(Anomaly-based detection system)則有錯誤警報(false alarm)多和訓練時間(training time)長的缺點；而沙箱系統需要額外增加系統資源來支援。另外，將偵測系統部署在郵件伺服器尚有無法對使用者從web mail等其它機構外郵件伺服器收到的惡意郵件進行偵測的限制，並且容易受到蠕蟲使用偽裝或隱藏等技術影響。為了克服這些問題，我們設計一個部署在使用者端運用沙箱系統(SandBox)，以異常行為偵測為基礎，使用惡意程式作為蠕蟲特徵之電子郵件蠕蟲防護架構，透過這個架構，未知的電子郵件蠕蟲在機構內部爆發感染之初，資安公司尚未提出精確辨識特徵的空窗期，我們系統即能產生新蠕蟲特徵，阻止蠕蟲繼續在機構內部擴散。
並列摘要
Computer worm is a self-replicating program that propagate itself through network connections. Along with the popularization of the Internet, it is also utilized by computer crackers as a vehicle to propagate malicious programs. Among all kinds of computer worms, email worms, which spread themselves via email, already become one with most occurrences found. Therefore, to protect computers from being compromised in the event of email worm attacks is crucial to the security of information system. The signature-based detection system deployed on mail server, in general, is unable to detect previously unknown email worm, and the anomaly-based detection system has the disadvantages of too many false alarms and too long the training time. Moreover, if users will receive email from outside web mail servers or from any sources other than the official mail servers, the detection systems deployed on mail servers are bypassed and, thus, unable to detect malicious mails. Detection capability of such system is also greatly hindered if email worms are furnished with disguise. In order to resolve these problems, we designed a behavior-based framework to be deployed on user hosts. With this framework, at the early stage of an unknown email worm outbreak, when information security service providers are yet to devise an official solution, a network environment is able to defend itself through automatic generation of the new email worm signature for malicious program scanners to use, and preventing the email worm from infecting other hosts in the organization.