網際網路服務之多層入侵防禦系統架構設計

Architecture Design of Multi-layer Intrusion Prevention System for Internet Applications

陳明仁(Ming-Jen Chen)

指導教授 ： 朱元三

國立中正大學/工學院/電機工程學系/博士(2015年)

摘要

隨著手持式裝置的興盛，擴增了網路安全的死角，網路攻擊由內部網路發起的機率相對提高，單以防火牆進行防禦外部攻擊已經不再適用，促使入侵偵測防禦機制越來越受重視。由於網路攻擊的多樣性，以及網路流量日益繁重，入侵防禦系統(Intrusion Prevention System; IPS)需防禦的攻擊類型增加，效能需求也提高。傳統入侵防禦系統是單獨採用下列其中一種防禦方法：(1)Signature-based Detection (SD) (2)Statistical Anomaly-based Detection (SAD) (3) Stateful Protocol Anomaly Detection (SPAD)，三種防禦方法雖然各有其優點，但卻只能防禦單一類型攻擊，而且各有其不足之處。本論文中，提出多層入侵防禦系統架構設計，藉由同時結合SD、SAD、SPAD三種防禦方法來增加攻擊防禦的種類並提升效能。根據多層入侵防禦系統架構，實作4種應用類型的入侵防禦系統來分別驗證整合多種防禦方法的成效。首先VoIP IPS系統，提出Profile Analysis (PA)模組，以PA模組進行SPAD結果分析，即時更新SAD profile的參數設定值，藉以提高SAD分析的正確率。VoIP IPS系統並採用SAD及SPAD階層式架構，由SAD進行第一層的攻擊分析，SPAD進行第二層分析，如此可提高整體處理速度以及分析正確率。當攻擊流量佔整體流量為20%時，階層式架構系統的效能可較單獨使用SPAD架構提升8.89%，當攻擊比佔60%時，系統能提升近50%的效能，整體系統的處理速度可達2.66Gbps。其次，實作Email IPS系統，透過整合SAD及SPAD兩種防禦方法，由SPAD進行封包行為的攻擊分析，而SAD進行封包內容的攻擊分析，增加防禦攻擊類型的完整性，能同時支援Email攻擊及垃圾郵件過濾，提高防禦Email攻擊及垃圾郵件的正確率分別為95.4%及91.1%。並更進一步將Email IPS系統整合病毒偵測引擎，建構多層級式的封包行為攻擊偵測及封包內容過濾的完整防禦機制，整體系統處理速度達4.12Gbps。最後，實作Snort IDS的規則加速器，整合SD及SAD的階層式架構，藉由整合SAD來降低SD負載，加速封包內容過濾的處理速度，系統處理速度達13.9Gbps，可支援目前主要骨幹網路(10Gbps)速度。我們提出的多層入侵防禦系統架構，藉由整合三種防禦方法來，增加攻擊類型的防禦，以因應多樣性攻擊類型，提供完整攻擊防禦，藉由階層式架構設計，分攤效能負載，有效提升運算效能及防禦正確率。

關鍵字

入侵偵測 ； 網路安全 ； 網際網路服務 ； 網路攻擊

並列摘要

The popularity of mobile device makes the management of information security a blind spot and more complexity. Traditional firewall is not applicable against wide variety of cyber attacks. Intrusion Prevention System (IPS) is used to supports both diversity attack detection and high processing performance. There are three major intrusion detection methodologies: Signature-based Detection (SD), Statistical Anomaly-based Detection (SAD) and Stateful Protocol Anomaly Detection (SPAD). Each of methodologies has its own advantages, but it only detects a single type attack. In this thesis, Multi-layer Intrusion Prevention Architecture (MIPA) is proposed to integrate SD, SAD, and SPAD methodologies (modules) for preventing multiple type attack. Four IPS systems are implemented to make up for shortage of traditional SD, SAD and SPAD module base on MIPA architecture. First, VoIP IPS with hierarchical architecture of SAD and SPAD modules is proposed. SAD is used to offload SPAD loading to increase VoIP IPS processing performance. And Profile Analysis (PA) module is proposed to decrease SAD false positive ratio by updating SAD profile threshold based on SPAD results. If the attack traffic rate is 20% of all traffics, the processing speed of VoIP IPS system will increases 8.89% than the system without SAD module. And 60% attack traffic rate will increase about 50% processing speed. VoIP IPS throughput is up to 2.66Gbps. And an Email IPS integrated with SAD and SPAD modules to protect both email attack and spam mail is proposed. The detection accuracy of email attack and spam mail is 95.4% and 91.1% respectively. Then, Email IPS integrated with Virus Detection Engine to support full protection in detecting both behavior-based attack and content-based attack. The throughput of Email IPS is up to 4.12Gbps. Final, a Snort Rule Accelerator (SRA) integrated with SAD and SD is proposed. SAD is used to offload the loading of SD and increases the processing speed of SRA. The throughput of SRS is up to 13.9Gbps and is available to support intrusion prevention in 10Gbps core network. After all, the proposed MIPA architecture is a foundation of Unified Threat Management (UTM) solution. Each module is deployed to support fully multi-layer network protection. The proposed architecture improves the deficiencies of each intrusion detection method and enhances the advantages of each method. It is able to balance the strengths and the weaknesses of each method in MIPA architecture.

並列關鍵字

Intrusion Detection ； IPS ； Intrusion Prevention System ； Network Security

參考文獻

[2] Wikipedia.org. Intrusion prevention system [Online]. Available: https://en.wikipedia.org/wiki/Intrusion_prevention_system

[3] H. Sengary et al.,“VoIP Intrusion Detection Through Interacting Protocol State Machines,” in Int. Conf. on Dependable Systems and Networks, 2006, pp. 393-402.

[4] E. Y. Chen, ”Detecting DoS Attacks on SIP Systems,” in 1st IEEE Workshop on VoIP Management and Security, 2006, pp. 53-58.

[5] S. Niccolini et al., “SIP intrusion detection and prevention: recommendations and prototype implementation,” in 1st IEEE Workshop on VoIP Management and Security, 2006, pp. 47-52.

[6] D. Geneiatakis et al., “A framework for protecting a SIP based infrastructure against malformed message attacks,” Computer Networks: The Int. J. of Computer and Telecommunications Networking, vol. 51, no. 10, pp. 2580-2593, 2006.