應用類神經網路於異常偵測及誤用偵測之 入侵偵測系統

AN APPLICATION OF NEURAL NETWORKS IN ANOMALY AND MISUSE DETECTION FOR INTRUSION DETECTION SYSTEM

曾芳榆(Fang-Yu Tseng)

指導教授 ： 虞台文

大同大學/電機資訊學院/資訊工程學系所/碩士(2006年)

摘要

目前入侵偵測系統大都是Rule-based，這種偵測方式雖能偵測已知攻擊行為，但卻需要更新Rule才能應付新的攻擊。而且這種Rule-based偵測方式可能無法偵測和Rule只有微小差異之相同攻擊，也有一些較先進之攻擊技術可以躲避系統的偵測。
本研究的入侵偵測系統使用自我組織映射(SOM)類神經網路來學習訓練正常網路行為及網路攻擊行為的特徵‧有別於一般Rule-Based 偵測系統使用封包字串比對的方法，係針對網路封包的TCP Header 擷取特徵向量進行辨識‧對於已知的攻擊型態可以即時加以分類提高偵測速度縮短因應時間，對於未知的不正常網路行為也能夠偵測出來並留做事後分析‧另外本研究實驗分析的攻擊行為不只侷限在某些服務如 HTTP、FTP的攻擊行為，將選取各種常見類型的攻擊進行測試，以期能分析此入侵偵測系統對大多數攻擊類型的偵測率‧

關鍵字

誤用偵測 ； 自我組織映射 ； 入侵偵測系統 ； 異常偵測

並列摘要

Current intrusion detection systems are generally rule-based. Although this method can effectively detect attacks, it is necessary to frequently update their rules to cope with new attacks. Additionally, this detection method may not detect attacks that are slightly different from the ones specified by rules, and there are more advanced attack techniques that can evade the system’s monitoring.
The intrusion detection system of this study uses SOM neural networks to learn the distinguishable features of normal network behaviors and Internet attack, separately. Different from rule-based intrusion detection systems that use the method of packet- string matching, our method extracts feature vector from the TCP header of network packet for attack identification. For the known types of attack, the propose method is able to make classification efficiently. For ones, it is possible to detect them and then use them for later analysis. Additionally, attacks analyzed in this study is not limited to web services, e.g., the attacks of HTTP and FTP. Namely this study selects the common types of attack for testing, Hence, we are able to analyze the detection rates for each attack type in this intrusion detection system.

並列關鍵字

SOM ； IDS ； anomaly detection ； misuse detection

參考文獻

[3] Denning, “An Intrusion-Detection Model”, IEEE transactions on software engineering, Vol. SE-13,NO.2, 222-232, 1987.

[4] Fan W. et al., “Using Artificial Anomalies to Detect Unknown and Known Network Intrusions”, Proceedings of the First IEEE International Conference on Data Mining, San Jose, CA, Nov. 2001.

[5] Ilgun Koral. "USTAT: A Real-time Intrusion Detection System for UNIX", Proceedings of the 1993 Computer Society Symposium on Research in Security and Privacy. Oakland, California, 1993.

[6] IST of MIT Lincoln Laboratory under Defense Advanced Research Projects Agency (DARPA ITO), http://www.ll.mit.edu/IST/ideval/

[7] Jones A.K and Sielken R.S.: Computer system intrusion detection: a survey, 2000.