以環境風險分析為基礎之適應性網路入侵回應架構之回應策略

Response strategy for Adaptive Network Intrusion Response Framework Based on Environment Dependent Risk Analysis

李裕祥(yu-shyang lee)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2009年)

https://doi.org/10.6840/CYCU.2009.00906

摘要

隨著網路的普及，透過網路的攻擊事件也不斷的增加。相對於以前，攻 擊多是針對特定服務伺服器，現在則是任何個人或是組織電腦都是可能的攻 擊標的，攻擊行為也變得更加即時且複雜。傳統以特徵比對為核心的入侵偵 測方式因未能考慮到系統的即時狀態已不敷使用，固定的回應機制也不足以 處理多變的攻擊手法，且往往會因反應過度而造成服務被反應機制中斷或是 反應不及無法即時防禦攻擊的發生。除了系統本身的狀態之外，符合系統需 求的環境相關資訊也是十分的重要，例如服務本身的重要性，此資料庫對於 組織的重要性或是檔案的重要性。因此，如何整合偵測方式，系統狀態，環 境資訊，而做出符合系統需求的適當回應方式便是很重要的問題。在本篇論 文中，我們提出運用納入環境資訊與經過警報風險性分析而得的風險評估數 值並佐以攻擊進程資訊於回應方式調整的適應性網路入侵回應架構，以確保 回應策略的有效性與準確性。以警報資訊、環境資訊與系統狀態資訊自動化 制定不同範圍大小的回應策略，再以查核回應方式施行之後風險評估數值的 變動資訊與系統狀態相關資訊持續進行回應方式的動態調整，達到適度防禦 的目的，避免過度防禦造成正常使用遭到阻檔，或是防禦不足無法及時阻擋 攻擊而造成更大的損失。

關鍵字

Intrusion detection ； Automatic response ； Environmental Risk Analysis

並列摘要

With the prevalence of computer network, computer attack increases in its
number as well as in its sophistication. Traditional protection mechanism
consisting of signature-matching based or anomaly based intrusion detection and
preprogrammed intrusion response is incapable of coping with the ever-changing
challenges to the security of computer environment. False detection as well as
inappropriate response could result in disastrous over-reaction or insufficient
reaction such that security of the environment is in jeopardy. Therefore, the
selection of a proper action on a detected incidence should be based on both the
immediate state of the environment and the specific characteristics of the
environment as well. And, in terms, the action should be justified, and adjustment
should be made accordingly. We proposed a method to facilitate automatic
generation of candidate response plans and automatic selection of the response
action based on the risk status index.
In this thesis, we proposed to incorporate environment characteristics
information, risk index and attach progression information into the decision of
intrusion response. we devised a procedure to generate candidate response actions,
determine an initial response action, and adjust the selection of response action
according to the resulted change on the risk index. With the proposed scheme
insufficient or one reaction of intrusion can be avoided, and intrusion response at
the appropriate level can be achieved.

並列關鍵字

Intrusion detection ； Automatic response ； Environmental Risk Analysis

參考文獻

[12] 王盛裕，整合環境資訊與入侵警報之風險評估，中原大學研究所，碩士論

[1] F. Cohen. “Simulating Cyber Attacks, Defenses, and Consequences,”

Sensitive Modelling for Intrusion Detection and Response,” Journal of

Computer Security, Vol. 10, pp.5-22.

[3] T. Toth and C. Kruegel, “Evaluating the Impact of Automated Intrusion