大規模網路異常檢測技術研究

Anomaly Detection on the Large Scale Network

陳建昇(Chien-Sheng Chen)

指導教授 ： 羅有隆

朝陽科技大學/資訊學院/資訊管理系/碩士(2009年)

摘要

網路應用範圍隨著時間不斷的擴大，而網路的各類攻擊與破壞也與日俱增。其中，DDoS攻擊技術因其隱蔽性、效率高而成為網路攻擊者最青睞的攻擊方式之一，這種方式嚴重地威脅著網頁伺服器的安全。例如DDoS攻擊者曾大規模攻擊許多全球重要的電子商務網站，而令雅虎、亞馬遜、電子港灣與CNN等一度陷入癱瘓，所以網路安全已經成為全球資訊安全的重要組成部分。在研究的過程中，我們針對DDoS攻擊所具有異於正常流量的多維欄位之統計特徵，本文設計實現了一種基於網路處理器的即時檢測及控制系統模組。該系統通過監控網路流量和多元分析其網路位元構成比例，獲得當前流量結構的描述參數，再與預先訓練得到的正常參數比較，根據兩者偏離程度判斷是否出現異常，然後進行相應佇列控制，從而達到檢測和防禦DDoS攻擊、保護後端網路系統的目的。本文所實現的是這個系統，本系統的多元統計子模組，包括統計量的設計和對資料封包進行解析、統計和異常標記。模擬實驗中表明，多元統計模組能為異常檢測與控制模組提供更全面而準確的統計資料，面對常見的各種DDoS攻擊亦能快速檢測並控制，達到一個較為全面的入侵檢測與防禦系統的要求。本系統具有高性能的處理能力，適合於部署在網際網路的關鍵出入口，對網路安全進行有力的維護。

關鍵字

異常檢測 ； DDoS ； 網路處理器

並列摘要

Internet applications continued to expand time over time. And all types of network attacks and destruction are increasing day by day. Which of one, the DDoS attacks have become the most popular one of the attacks because of their covert technology, high efficiency and network attacks? It poses a serious threat to the security of web servers. For example, large-scale DDoS attackers had attacked many of the world''s major e-commerce sites, such as Yahoo!Ò, AmazonÒ, eBayÒ, CNNÒ and so on.. So network security has become an important part of global information security. In the process of research, we had discovered the difference of DDoS attack from the normal flow of the multi-dimensional statistical field characteristics. This paper designed and implemented a network processor-based real-time detection and control system module. The system monitors network traffic through the analysis of their network and multi-bit ratio. It also got the descriptions of the current flow structure parameters, pre-training with the normal parameters to be compared and the according to both determine whether the degree of deviation from the abnormal, and then proceed to the corresponding queue control. That will achieve DDoS attack detection, prevention and the protection of the back-end network or server purposes. This article realized this system’s multivariate statistical sub-modules including the design and statistics for analysis of the data packets, statistics and unusual markings. Simulation and experiments showed that multivariate statistical anomaly detection module and control module could provide a more comprehensive and accurate statistical information. In the face of a variety of common DDoS attacks, it can quickly detect and control to achieve more comprehensive intrusion detection and defense system requirements. The system has high-performance processing capability and suitable to deploy on the Internet key import and export points through a strongly safety maintenance on network.

並列關鍵字

DDoS ； network processor ； anomaly detection

參考文獻

[5] N. Ansari and A. Belenky(2003), “IP traceback with Deterministic Packet Marking”, IEEE. Communications Letters, April 2003, Vol. 7, No. 4, pp. 162-164.

[7] S. M. Bellovin(1996), "Problem Areas for the IP Security Protocols", Proceedings of the Sixth Usenix Unix Security Symposium, San Jose, CA., pp. 1-16.

[9] L. S. Brakmo and L. Peterson(1995), "TCP Vegas: End to End Congestion Avoidance on a Global Internet", IEEE Journal on Selected Areas in Communication, 13(8): 14651480.

[10]M. Bykova, S. Ostermann and B. Tjaden(2001), ”Detecting network intrusions via a statistical analysis of network packet characteristics”, Proceedings of the 33rd Southeastern Symposium on System Theory, pp. 309-314.

[11]J. B. D. Caberera, B. Ravichandran and R. K. Mehra(2000), “Statistical traffic modeling for network intrusion detection”, Proceedings of the 8th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems, 2000, pp. 466-473.