適用於小型網路之蠕蟲偵測保護系統

隨著網路的快速發展，經由網路所提供的各種服務日益增加，服務使用的便利性也隨之增加，但相對的當這些服務遭遇由網路而來的攻擊而受到損害時其影響與不便也日益嚴重。電腦蠕蟲是一種具備自我複製與自動傳播功能的軟體型態，由於其傳播過程隱密且影響範圍廣泛，近來運用它進行的網路攻擊的事件接連發生，所造成的損害也持續擴大，要如何在遭遇蠕蟲攻擊時降低個別網路環境中系統受損的情況是現在重要的研究課題。現有的蠕蟲偵測或防禦的系統著眼在即時發現所有的蠕蟲攻擊，然而與網際網路連接為數眾多的小型組織與個人網路大多無法提供其所需要使用的大量資源。在本論文中我們嘗試提供一個可行的方案，使得小環境以及個別使用者能夠運用少量的資源即可進行對蠕蟲攻擊的自我防禦，我們分析探討蠕蟲的特有行為、感染方式與躲避偵測的方法，並探討現有的蠕蟲偵測系統所適用的地方以及其在整體蠕蟲防禦工作上的不足性。據此，我們發展了一套以誘補系統為基礎的輕量化蠕蟲偵測保護系統，透過簡易的客製化的過程，可以針對個別的系統製作特定的保護措施，以減少額外且不需要的資源浪費，並且解決傳統在弱點發佈後至修正程式公佈期間的空窗期間使用者對攻擊無抵抗能力的缺憾。最後我們利用真實網路環境下的流量以及真實的蠕蟲攻擊來驗證我們的系統，並且從中分析我們系統發出警報時的可靠度及產生的特徵與蠕蟲本體的相似度，並分析系統需要改進的地方。

關鍵字

入侵偵測；蠕蟲；蠕蟲偵測；網路安全

並列摘要

As the Internet prevails, the number of services provided through the Internet increases everyday. On one hand, it improves the convenience in utilizing the services. On the other hand, when these services encounter attacks from the Internet and are compromised, the inconvenience and the resulted influence become hard to tolerate. Computer worm is a type of software with the built-in capabilities of self-replication and automatic propagation. It can propagate without being noticed and to a large extend. Recently, network attacks based on computer worms occurred one after another. And, the damages they made grow rocketing high. How to reduce the damage of individual network environment on encountering computer worm attacks has become a very important research issue. Current worm detection or defense system requires heavy resources that the many Internet-connecting network environments owned by small organizations or individuals are unable to offer. In this study, we tried to provide a legitimate solution which allows small organizations on individuals to defend themselves with small amount of resources. By analyzing the behaviors of computer worms, the method they propagate and they way they use to avoid being detected as well as surveying the applicability and insufficiency of current worm detection schemes, we developed a honey-pot based light-weight worm defense system. With an easily accomplishable configuration process, users are able to customize the defense system to their needs. The proposed system has been tested against real Internet traffic and computer worms. The effectiveness of the proposed system has been studied.

並列關鍵字

worm detection ； network security ； intrusion detection ； worm

參考文獻

[7] Cliff C. Zou, D. Towsley, W. Gong, &S. Cai (2005). Routing worm: A fast, selective attack worm based on IP address information. ACM 19th Workshop on Principles of Advanced and Distributed Simulation, 199-206.

[8] B. Madhusudan, &J. Lockwood (2004). Design of a system for real-time worm detection. Hot Interconnects, Stanford, CA , 77–83.

[11] Guofei Gu, M. Sharif, Xinzhou Qin, D. Dagon, W. Lee, &G. Riley (2004). Worm detection, early warning and response based on local victim information. IEEE Computer Security Applications Conference, 2004, 20th Annual, 136-145.

[1] D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, &N. Weaver(2003). Inside the slammer worm. IEEE Security and Privacy, 1(4), 33-39.

Google Scholar

[2] http://www.caida.org/publications/papers/2003/sapphire/sapphire.html

Google Scholar

國際替代計量

適用於小型網路之蠕蟲偵測保護系統

全文下載

主題瀏覽