以網路流量為基礎的入侵偵測系統

NetFlow Based Intrusion Detection System

王博瑋(Po-Wei Wang)

指導教授 ： 包蒼龍

大同大學/電機資訊學院/資訊工程學系所/碩士(2004年)

摘要

由於網際網路的盛行,人們可以方便地透過網際網路存取遠端的資源,但是大量惡意的網路事件,像是電腦病毒和駭客攻擊,使得網路的管理越來越困難.因此,網路入侵偵系統的需求越來越殷切.
在這篇論文中我們提出了一個以網路流量為基礎的入侵偵測系統.另外,還提出了如何藉由適當調整和設定網路設備將來自於內部的網路攻擊減到最小.當網際網路成了日常活動的平台,網路攻擊的威脅也變得日益嚴重.只靠防火牆是不足以保護透過一般正常服務而來的攻擊.此外大多數目前的入侵偵測是針對網路的入口處而設計,無法阻止來自內部用戶對內部的網路主機和網路本身的攻擊.因此,除了防火牆和入口處之入侵偵測系統,我們需要使用其他種類的入侵偵測系統來保護關鍵的系網和網路本身.我們提出了一個花費不多但卻容易實作的入侵偵測系統,它是由路由器或其他網路探測器輸出的網路流量資訊為基礎而發展出來的異常形態入侵偵測系統.我們的系統能偵測數種來自內部或外部的攻擊,並能即時執行相對的防禦策略.

關鍵字

網路流量 ； 入侵偵測

並列摘要

Due to the popularity of Internet, people can access remote resource on the Internet conveniently. But numerous malicious network events such as computer virus and hacker attack make the network management more difficult. A network intrusion detection system is thus more and more demanding.
In this thesis, a NetFlow based anomaly intrusion detection system is presented. In addition, guidelines to properly configure and setup network device to minimize the possibilities that network attacks come from inside are also proposed. As the Internet becomes the platform of daily activities, the threat of network attack is also become more serious. Firewall along is not capable to protect the system from being attacked through normal service channel. Furthermore, most of the current intrusion detection system focus on the border of organization network which does not provide protection to hosts in the local network and the network itself if the attack is from inside. Therefore, in addition to the firewall and border IDS, we need to use other type of intrusion detection system to protect the critical system as well as the network itself.We propose an inexpensive and easy to implement way to perform the anomaly type intrusion detection based on the NetFlow information exported from the routers or other network probes. Our system can detect several types of network attack from inside or outside and perform counter maneuver accordingly.

並列關鍵字

Intrusion Detection ； NetFlow

參考文獻

[1]Aurobindo Sundaram, “An Introduction to Intrusion Detection”, ACM Crossroads Student Magazine, Jan.2001.

[2]Caberera, J.B.D., Ravichandran, B., and Mehra, R.K. “Statistical Traffic Modeling for Network Intrusion Detection”, Modeling, Analysis and Simulation of Computer and Telecommunication Systems, 2000. Proceedings. 8th International Symposium on, pp. 466-473, Sep. 2000.

[5]E. L. Witzke, T. D. Tarman, S. Ghosh, and G. Woodard, “A Novel Scaleable Architecture for Intrusion Detection and Mitigation in Switched Networks”, MILCOM 2002, Proceedings, Vol 1, pp395-399, Oct. 2002.

[6]“FAQ: Network Intrusion Detection Systems”, Technical Incursion Countermeasures, Mar. 2000.

[8]Hashim, S.J., Jumari, K., and Ismail, M., “Computer Network Intrusion Detection Software Development”, Proc. TENCON 2000. Vol. 3, pp. 117-123Sep. 2000.