基於MEWMA管制圖之網路異常偵測系統

隨著網際網路的迅速發展，電子商務已經成為傳統行銷以外的一個新興通路，然而網路安全是最令人頭痛的問題，一旦系統遭受網路駭客入侵，輕則影響網路服務品質，重則造成無法彌補的損失。由於當前駭客攻擊手法伴隨科技發展日新月異，傳統入侵偵測系統比對單一流量特徵資料庫之效能有限，因此本研究考慮基於多變量統計製程管制的原理和建模手法，針對銘傳大學資訊學院2012年5月18日至2012年6月22日合計36天網路正常流量Netflow封包數據，提取網絡流量的兩項特徵：封包數量及封包大小，再根據此兩項特徵資料庫建立監控網路流量變化之多變量指數加權移動平均（MEWMA）管制圖。另一方面，利用網路模擬器NS2模擬產生正常與異常流量資料，並在不同的參數值下，分別計算管制圖之誤報率與漏報率。結果顯示在控制誤報率極小化漏報率的準則下，合理的λ值為0.9、h值介於50至70，其對應誤報率為8％～9％，漏報率為0％～0.63％。最後以PHP撰寫流量分析系統，將銘傳大學桃園校區資訊學院所蒐集得真實網路流量資料存置資料庫，開發「即時網路流量分析系統」，提供網管人員透過網頁以視覺化的方式即時監控流量，所得之管制圖可輔助網管人員監控網路流量是否發生異常的參考依據。

關鍵字

異常偵測； MEWMA管制圖；誤報率；漏報率

並列摘要

The varieties of network applications provide convenient services to users and create many commerce markets. However, lots of network hacking activities have been attacking the services and cause extensive damage and inconvenience. It is very important for network managers to protect the services and improve the QoS and the security. Many network intrusion detection systems are developed to protect the services. Systems only using single signature to detect the abnormal behaviors achieve limited accuracy. In this paper we use multivariate statistical processes control scheme, MSPC, to establish the control chart. The network traffic data were collected from Ming Chuan University. The dataset are stored in Netflow format and dated from 2012/05/15 to 2012/06/22. Two parameters: packet numbers and packet octets are computed to create the MEWMA control chart to monitor the traffic behaviors. We use NS2 simulation to generate normal and abnormal traffic data to determine the parameters h and λ values for the control chart. False positive rate and false negative rate are computed for different combination of parameters. The results show that the false positive rate is less than 10% and the false negative rate is between 0% and 0.63% when minimizing false negative rate and λ=0.9, h=50~70. Finally, we develop an offline-based network analysis system using NetFlow's logs to detect abnormal traffic in network activities.

並列關鍵字

Anomaly detection ； MEWMA control chart ； False positive rate ； False negative rate

參考文獻

王博瑋（2004），「以網路流量為基礎的入侵偵測系統」，大同大學資訊工程研究所碩士論文。

曾芳瑜（2006），「應用類神經網路於異常偵測及誤用偵測之入侵偵測系統」，大同大學資訊工程研究所碩士論文。

Denning DE, Neumann PG.（1985） ‘Requirements and model for IDES –a real-time intrusion detection system,' Computer Science Laboratory, SRI International. Technical Report #83F83-01-00.

Gregg D.M., W.J. Blackert, et al. . （2001）, ‘ Assessing and Quantifying Denial of Service Attacks,' Communications for Network-Centric Operations: Creating the Information Force. IEEE. , 1, p76-80.

Heckerman D.（1995） ‘A tutorial on learning with Bayesian networks. Microsoft Research', Technical Report MSRTR-95-06.

國際替代計量

基於MEWMA管制圖之網路異常偵測系統

全文下載

主題瀏覽