整合環境風險之入侵警報量化評估

Intrusion Alert Ranking Based on Environmental Risk Analysis

吳孟徽(Meng-Hui Wu)

指導教授 ： 田筱榮

中原大學/工學院/資訊工程研究所/碩士(2005年)

https://doi.org/10.6840/cycu200500709

摘要

入侵偵測系統所產生的入侵警報(Intrusion Alert)代表有何種入侵行為已發生或進行中。對於一個複雜環境的管理者而言，在大量入侵警報發生時，必須花費許多時間與精力，找尋高威脅且需優先處理的警報，也會因此失去處理警報的時效性。然而，欲辨別各種入侵行為對環境的威脅程度，我們需要參考相關的環境資訊，來分級警報所代表的攻擊對環境造成的風險，以幫助管理者做出合適的反應決策。
由於相異的網路環境有著不同的特徵，造成某一環境的高威脅警報發生於另一個環境上時，其威脅程度大不相同。為了能合理的分級環境中的警報，我們提出以整合環境資訊來分級警報的方法。經由審慎的分析、研究網路行入侵偵測系統產生的警報所能包含的資訊，我們發現數種分級時所需要考慮的必要因素，並運用風險分析方法OCATVESM，由其結果獲得對於環境中的財產、存在的威脅與其可能造成的傷害的性質描述。接著，我們以糢糊邏輯設計出一套分級方法，用以量化風險分析結果的性質描述為數值型態。因此，當入侵警報發生時，即可對警報做出量化的評估，計算其風險程度指數。此方法，我們於Snort中以附加模組的方式來實作，可以進行即時分級警報。

關鍵字

環境相依的警報風險分級 ； 威脅程度 ； 風險程度指數 ； 整合環境資訊 ； 量化評估 ； 入侵警報

並列摘要

Intrusion alerts produced by intrusion detection systems signal the intrusions occurred or proceeding. When the amount of alerts is huge, a manager watching over a complicated environment may have to spend a lot of time and effort before alerts of high priority and emergency are finally identified. In order to provide timely response to security events, an automatic intrusion alert ranking utility which based on environmental information is important. It would help the manager to take applicable action in time.
Considering that different network sites have different characteristics, alerts of highly concerned in one environment may be irrelevant if it occurs in another environment. In order to rank alerts properly, we propose an alert ranking method based on environmental risk analysis. Through a detailed study of the information carried by alerts generated from an NIDS, we discovered several essential elements a ranking method should considered. By applying the OCTAVE risk analysis process we are able to obtain qualitative descriptions about the assets, threats, and possible damage an arbitrary environment may face. Then, we devise a scheme based on fuzzy logic to transform qualitative descriptions in to quantitative indices. Thus, when an alert is generated, it can be evaluated quantitatively. The method has been implemented as an add-on module to the snort system to perform on-line alert ranking.

並列關鍵字

Environmental Risk Analysis ； Quantitative Index ； Alert Ranking Method ； Environmental Information ； Intrusion Alert

參考文獻

[6] National Institute of Standards and Technology Special Publication 800-30, "Risk Management Guide for Information Technology Systems" (NIST SP 800-30), 2001

[11] US General Accounting Office, "Information Security Risk Assessment: Practices of Leading Organizations", 1999.

[12] E.H. Mamdani and N. Baaklini, "Prescriptive method for deriving control policy in a fuzzy-logic controller", Electronics Letters, Vol. 11, pp. 625, 626. Dec. 1975

[13] T.P. Hong and J.B. Chen, "Finding relevant attributes and membership functions", Fuzz Sets and Systems, volume 103 p.389-404, 1999

[14] R. Ramakrishnan and C.J.M. Rao, "The fuzzy weighted additive rule", Fuzz Sets and Systems, volume 46 p.177-187, 1992