入侵偵測自動回應系統自我穩定型研究

隨著網路頻寬的快速增加，一般入侵偵測系統產生的大量警訊已經成為另外一種管理上的負擔，使得自警訊產生到管理者進行處理該警訊的時間差越來越大，而入侵者有更多的時間從系統的弱點進行入侵以及破壞。因此要保護電腦系統的安全，除了入侵偵測外，我們還需要增加自動回應的機制針對已經產生的入侵警報做出即時的反應。現階段的入侵偵測自動防禦系統主要都是將目標放在如何更準確的從大量的警訊當中過濾出真正的入侵，而其回應機制則完全依賴入侵偵測的結果，然而入侵偵測始終存在錯誤警報的可能，因此提升回應能力是一個值得探討的方向。目前的自動回應機制使用固定的回應策略來針對已知的攻擊做回應，當回應策略的施行不足以阻擋該攻擊或是回應策略的施行過度造成系統負擔，都需要立即進行修正。本論文的目標是將自我穩定的特性加入以防火牆為基礎的回應機制，一方面始使火牆策略的實施俱備彈性，另一方面也可以經由刪除不適宜的防火牆策略降低防火牆的負擔。我們完成所提出的自我穩定型入侵偵測自動回應系統原型的實作並進行實驗，實驗結果顯示我們所設計的系統能夠修正錯誤的防火牆策略，俱備自我穩定的回應能力。

關鍵字

防火牆策略；入侵偵測；自動回應

並列摘要

With the rapid increase of network bandwidth, the amount of alerts generated by intrusion detection system increases everyday. Alert resolution has become a heavy overhead and the time delay between alert generation and alert resolution has grown longer and longer, which resulted in the unwanted fact that computer attackers now have more time to exploit vulnerabilities of computers and to complete attacks before being stopped. Therefore, besides intrusion detection, we need automatic response mechanism in the overall computer security protection framework to provide better protection to computers and the associated networks. Most intrusion detection and automatic response researches emphasize on improving the accuracy of intrusion detection result because automatic response mechanisms rely on the result to respond correctly. However, the possibility of incorrect detection always exists, and improving the capability of response mechanism such that it can recover itself from incorrect responses would be a promising direction to resolve the problem of imperfectness in detection result. In this study, we applied the self-stabilization concept in the firewall-based automatic response mechanism. On one hand, we add flexibility to the application of firewall policy. On the other hand, by eliminate the inappropriate or redundant firewall policies, we can also lower the load of the firewall. We implement a prototype of the self-stabilized intrusion detection and automatic response system with Snort-inline. Experimental results show that our system is able to correct itself from incorrect application of firewall policies and, therefore, is self-stabilizing.

並列關鍵字

Automatic response ； Firewall policy ； Intrusion detection

參考文獻

[3] F. B. Cohen, “Simulating Cyber Attacks, Defenses, and Consequences,” Available at http://all.net/journal/ntb/simulate/simulate.html,May 13, 1999.

[6] 陳瑞宜、林順喜，完全圖上最大權重配對問題隻字我穩定演算法的設計與分析，台灣師範大學資訊教育研究所，師大學報，中華民國89年

[7] Yao-Min Chen, Yanyan Yang, ”Policy Management for Network-based Intrusion Detection and Prevention”, NOMS 2004. IEEE/IFIP Volume 2, 19-23 April 2004 Page(s):219 - 232 Vol.2

[8] Stephen Northcutt SANS Institute, "What is network

[10] P. Innella, O. McMillan,“An Introduction to Intrusion Detection Systems”,

國際替代計量

入侵偵測自動回應系統自我穩定型研究

全文下載

主題瀏覽