- 學位論文
以環境風險分析為基礎之適應性網路入侵回應系統之使用者風險模型
Risk Model for Adaptive Network Intrusion Response Framework Based on Environment Dependent Risk Analysis
摘要
摘要 在網路的安全偵測及防禦上，我們一般著重在來自於外部網路的攻擊造成的威脅，較少注意來自於內部網路引起的攻擊，這是因為大部份的攻擊主要的源頭是由外部網路入侵到內部網路主機，受到入侵的內部主機再轉向攻擊其他的內部主機，所以較少注重內部網路主機之間的攻擊。因此在這個情況下，若有外部攻擊在第一時間內沒有成功阻止轉化成內部攻擊時，我們會受到巨大的損失；這是因為無法有效判斷攻擊對於各個內網主機的影響為何、可能受到的傷害為何及受到影響最大的主機是哪一台等情形，所以傷害無法被有效的預測，在防禦上就無法做出有效的作為。目前的攻擊大多需要多個步驟才能完成，因此我們提供一個量化的計算模型，藉由內部網路各個主機所偵測到的弱點、攻擊的類型、攻擊時被使用的弱點再參考攻擊發生的次數、各主機的相互影響值及弱點的可能利用方式等參數所形成的攻擊圖，利用攻擊圖上產生的可能攻擊順序、將攻擊的風險依照主機的環境參數作適切的量化，計算攻擊的風險值、主機單位時間內的風險值、主機受攻擊的趨勢、各個攻擊對其他主機的衝擊評估值、單位時間內的衝擊評估值及受衝擊的趨勢來預測連續攻擊中可能被利用的弱點及可能被攻擊的下一台主機。經由這個風險模型我們評估內部網路可能發生的損失及攻擊的趨勢，提供給實施防禦策略及驗證策略是否正確參考。
並列摘要
Abstract In efforts to defend against attacks in a networked computer environment, more attention is spent on the threat caused by attacks coming from the outside network than on threat caused by attacks originated within the inside network because, in most of the cause, the main sources of the attack are from the outside network. By detecting outside attacks and fail them, most of the security threats to a computer environment are eliminated. However, an outside attack may escape the detection of the defense mechanism and successfully compromise an inside host, launch inside attacks, and cause tremendous damages. Therefore, we need a scheme to measure the risk of inside hosts and, after defense action applied, to determine effectiveness of such defense action. Based on the fact that attacks are usually completed in a sequence or a set of steps, we proposed a risk computation model. The information considered in the model includes vulnerability of hosts, attack type and vulnerability exploited by the attacks, the amount of attack, the configuration of the network environment, and possible progression of attacks. We quantify the risk of a host according to its own characteristics as well as the properties of security alerts. The resulted risk index can be utilized to evaluate the impacts of attacks experienced, predict the future progression of attacks and provide a way to validate the effectiveness of an applied defense strategy.