- 學位論文
以代理人為基礎的網路異常監控機制
An Agent-Based Network Abnormal Monitoring Mechanism
摘要
近年來因網際網路的快速興起，各企業部門間皆可以透過網路進行資料交換，這樣的便利性也引起了駭客的垂涎，而網路入侵手法日新月異，導致網路安全的問題不斷的受到考驗。因此，各企業為了保護自身重要資源，紛紛採購各種防護系統來抵禦外部攻擊；然而，當發生資訊安全事件時，雖可藉由網路設備或防護系統來記錄所有使用者的網路行為，以便加以偵測、監控，但卻無法即時得知該狀況發生，往往等到大量的抱怨進來才發現網路出現問題，才進一步去確認問題的發生及追查問題點在何處。 因此，基於上述需求，本論文將建構一個以代理人為基礎的監控架構，其中有監控閘道與資安交換閘道，並以XML做為資料交換標準；監控中心負責收集及監控各單位之防護系統異常警訊資料，除此之外，設計代理人負責流量控制及命令處置，即時偵測入侵活動，並立即將所有警訊資料顯示至監控畫面上，最後，讓網管人員能即時知道網路異常，進而立即針對威脅做後續處理，有效強化資訊運作之防禦機制，以確保資訊安全。
並列摘要
In these years, rapid development of internet to help the enterprises make the information exchange easier amount their inner departments but also make the abnormal event driven by hacker more frequent. Because the intrusion method is to change with each passing day, we encounter a tough challenge to network security problem. In order to protect their own important enterprise resources and information, enterprises purchase more and more information security system to defense the attack from outside. However, we can detect and control the network environment using network devices and information security systems by logging all users’ behaviors while the information security event was happened but not real-time be aware of the situation. The administrator usually finds the network problem until a great amount of complaint by user and then confirms what the problem is and why the problem happened. Hence, based on above requirement, this paper will construct an agent-based detection and control model, including two kinds of gateways. One is detection and control gateway and another is information security exchange gateway, and using XML format to be data exchange format standard. The Security Operation Center ( SOC ) is responsible for collecting and supervising the abnormal alert messages sent from subsystem constructed at other areas. In addition, we also design an agent that is responsible for network flow control and command process in order to detect intrusion activities in real-time, meanwhile shows all alert messages on the control screen to let the network administrator aware of the abnormal network event and then deals with those kinds of threat. This model will efficiently enhance the protection mechanism in information operation to make sure information security.